2019-14409. Privacy Act of 1974; System of Records

AGENCY:

Office of Single-Family Asset Management, HUD.

ACTION:

Notice of amended privacy act system of records.

SUMMARY:

In accordance with the Privacy Act of 1974, the Office of Single Family Asset Management, Department of Housing and Urban Development (HUD) is giving notice that it intends to amend one of its systems of records published in the Federal Register on August 19, 2016, Asset Disposition and Management System (ADAMS). As a result of the annual review of ADAMS, HUD is updating ADAMS to include automation of the Name Address Identification Number application process (e-NAID). This notice includes updates to the former notice's routine uses, categories of records, and purpose of system statements. This notice also incorporates administrative and format changes to convey already published information in a more synchronized format.

DATES:

August 5, 2019.

Comments Due Date: August 5, 2019.

ADDRESSES:

You may submit comments, identified by docket number and title, by one of the following methods:

Federal e-Rulemaking Portal: http://www.regulation.gov. Follow the instructions provided on that site to submit comments electronically. All comments received will be posted without change to http://www.regulation.gov,, including any personal information provided.

Mail: Attention: Housing and Urban and Development, Privacy Office; John Bravacos, The Executive Secretariat, 451 Seventh Street SW, Room 10139; Washington, DC 20410.

Email: [e-mail].

Fax: [phone].

Docket: For access to the docket to read background documents or comments received go to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

The Privacy Office, 451 Seventh Street SW, Room 10139, Washington, DC 20410, telephone number 202-708-3054 (this is not a toll-free number). Individuals who are hearing- and speech-impaired may access this telephone number via TTY by calling the Federal Relay Service at 800-877-8339 (this is a toll-free number).

SUPPLEMENTARY INFORMATION:

The Federal Housing Administration (FHA) insures approved lenders against the risk of loss on loans they finance for the purchase, and in some instances, rehabilitation of single family homes. In the event of a default on an FHA-insured loan, the lender generally acquires title to the property by foreclosure, a deed-in-lieu of foreclosure, or other acquisition method; files a claim for insurance benefits; and conveys the property to HUD. Properties conveyed to the Secretary of HUD make up the Single Family Real Estate Owned (REO) inventory managed by the Office of Single Family Asset Management. HUD administers its REO disposition program through four Homeownership Centers (HOCs) located in Philadelphia, Pennsylvania; Atlanta, Georgia; Denver, Colorado; and Santa Ana, California. HUD currently has 55 Management and Marketing (M&M) contracts; 23 Asset Managers (AMs); 31 Field Service Managers (FSMs); and 1 Mortgage Compliance Manager (MCM) who provide M&M services throughout the United States. The ADAMS application is provided under a Software as a Service (SaaS) contract for HUD/FHA to track the acquisition, maintenance, and sale of HUD's Single-Family Real Estate Owned (REO) inventory under HUD's Property Disposition Sales Program (24 CFR part 291). The Office of Single-Family Asset Management (OSFAM) has automated the approval process for real estate brokers (selling and principal brokers), governmental entities (State and local governments, public agencies) and private nonprofit organizations that participate in HUD's Property Disposition Sales Program (24 CFR 291). Eligible participants must have an approved, active Name Address Identifier (NAID) and be registered as a Bidder on the HUD Home store website. The e-NAID process leverages existing ADAMS technology to verify program eligibility and approval requirements and consolidates the prior paper-based NAID application process with processing and approval of the NAID in ADAMS. The e-NAID enhancement eliminates manual data entry and supports the Department's mission to mitigate financial risk to the FHA Mutual Mortgage Insurance Fund (MMIF) by reducing the NAID processing timeframe and the required IRS 1099 payment to brokers and service contractors. As a result of the annual review of ADAMS, records have been updated to include automation of the Name Address Identification Number application process (e-NAID). This notice includes updates to the former notice's routine uses, categories of records, and purpose of system statements. This notice also incorporates administrative and format changes to convey already published information in a more synchronized format.

Specifically, this ADAMS notice amendment identifies automation of the Name Address Identification Number (NAID) application process (e-NAID). E-NAID:

• Allows participants to complete forms SAMS 1111, “Payee Name and Address,” and SAMS 1111-A, “Selling Broker Certification” through HUDhomestore.com
• Leverages e-Signature's Application Programming Interface (API) to allow the NAID application to be signed and approved electronically
• Provides near-real time approval and tracking/generation of NAID
• Eliminates the “Check current NAID Status” lookup option
• Eliminates manual data entry
• Reduces NAID processing time

SYSTEM NAME AND NUMBER

Asset Disposition and Management System (ADAMS—P260).

SECURITY CLASSIFICATION:

Not classified.

SYSTEM LOCATION:

ADAMS is accessible at workstations located at the following locations: Department of Housing and Urban Development Headquarters, 451 Seventh Street SW, Washington, DC 20410; HUD Atlanta Homeownership Center, Five Points Plaza, 40 Marietta Street, Atlanta, GA 30303-2806; HUD Philadelphia Homeownership Center, The Wanamaker Building, 100 Penn Square East, Philadelphia, PA 19107-3389; HUD Denver Homeownership Center Processing & Underwriting—20th FL, 1670 Broadway Denver, CO 80202; Santa Ana Homeownership Center, Santa Ana Federal Building, 34 Civic Center Plaza, Room 7015, Santa Ana, CA 92701-4003. The system is externally hosted by Yardi Systems, Inc., 430 S Fairview, Goleta, CA 93117; SunGard, 1001 E Campbell Road, Richardson, TX 75081; and CenturyLink, 200 N Nash Street, El Segundo, CA 90245. The Santa Barbara datacenter hosts the design and development instances. Testing, production and disaster recovery instances are located in the Dallas, TX and Los Angeles, CA datacenters.

SYSTEM MANAGER(S):

Ivery W. Himes, Director, Office of Single-Family Asset Management, Room 9178, 450 Seventh Street SW, Washington, DC 20410.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

The specific authorizations are:

• The National Housing Act, Public Law 479, 48 Stat. 1246, 12 U.S.C. 1715z-11a
• The Housing and Community Development Act of 1987, Public Law 100-242, Title I, 165, Feb. 5, 1988, 101 Stat. 1864, 42 U.S.C. 3543
• Section 904 of the Stewart B. McKinney Homeless Assistance Amendments Act of 1988, Public Law 100-628, 42 U.S.C. 3544
• Title 24 Code of Federal Regulations, Part 291, Disposition of HUD-Acquired and -Owned Single Family Property

PURPOSE(S) OF THE SYSTEM:

ADAMS is a case management system for HUD-owned and HUD-managed single-family properties in support of HUD Property Disposition Sales Program (24 CFR part 291). ADAMS supports HUD Headquarters and Homeownership Center (HOC) staff and HUD's Management and Marketing (M&M) contractors to track single-family properties from their acquisition by HUD through the steps necessary to resell the properties. ADAMS captures pertinent data relating to the properties, including acquisition, maintenance and sales cost, property description and value, bids and sales proceeds, and special program designations. ADAMS also tracks and monitors certain events after sales under the Good Neighbor Next Door, non-profit, and Asset Control Area (ACA) sales programs. Additional Nonprofit/Government entity web-based program management tools improve the application, recertification, and reporting process for organizations that participate in the Office of Single Family Housing (OSFH) activities and to assist HUD staff with the daily administration of FHA's Nonprofit Program activities. HUD maintains a roster of nonprofit organizations that are qualified to participate in certain specified FHA activities. ADAMS is used to:

• Approve and/or recertify participant's Name Address Identification (e-NAID) required to submit bids and purchaser information (SAMS 1111, SAMS 1111-A) for HUD REO property sales (HUDhomestore.com).
• Obtain, store, and display case-level information about properties acquired by or in custody of HUD.
• Track events and information describing the status of real property from the date of conveyance to the Department through several stages of management, marketing, and disposition, to final reconciliation of sale proceeds.
• Retain data relative to contracts, contractors, and vendors that support the property disposition program.
• Calculate property management, marketing, and incentive fees earned by management and marketing (M&M) contractors, closing agents, and special property inspection (SPI) contractors, and generate disbursement transmittals.
• Calculate M&M contractor payment incentives and disincentives.
• Generate disbursement transmittals for payment of other property-related expenses such as pass-through expenses and property taxes.
• Exchange data with HUD and non-HUD systems and internet sites for both input and retrieval of data using the data exchange.
• Provide data security with multiple levels of access for users including HUD employees and designated contractors.
• Provide standard and ad hoc reporting capability.
• Facilitate summary, trend, and comparative analysis of portfolio performance.
• Provide ease of navigation and use for users at all skill levels.
• Ensure the security and privacy of the information collected and stored in the SSAE-18 compliant data center and provide disaster recovery from the disaster recovery data center.
• Provide Web-based access to subcontractors, appraisers, and inspectors to enable them to upload property data and related documents.
• Provide Pre-Conveyance functionality including request for conveyance extension, request for approval of occupied conveyance, over-allowable requests, and surchargeable damage request.
• Special reporting designed for ease of use by M&M contractors. Reports based on latest daily and weekly data and provides for online reports, national summary reports, and historical reports that are uploaded by administrative users.
• Web-based Disposition Program Compliance System (DPCS) module provides features to support the performance of Good Neighbor Next Door Sales Programs (GNND) compliance control tasks. DPCS features are organized according to three main steps in the sales process: Pre-sales/pre-registration, sales/pre-closing, and post-closing.

Extensive workflow rules are incorporated into ADAMS to ensure compliance with HUD regulations, policies, and procedures. OSFAM ensures the protection of program participant PII and mortgagee business sensitive information by ensuring ADAMS' compliance with HUD and Federal Information Security Management Act (FISMA) security and privacy controls. Data exchanges are done via secure file transfer protocol (SFTP); and the servers and mainframes used employ Federal Information Processing Standards (FIPS) 199 moderate security categorization controls. The ADAMS Information System Security Officer (ISSO) and Co-CORs work closely with system security administrators, network and project security personnel to ensure the integrity of data exchanges. The ADAMS service provider has annual independent Service Organization Control (SOC I) attestation audits conducted in accordance with the American Institute of Certified Public Accountants' (AICPA) Statement on Standards for Attestation Engagements No. 18 (SSAE 18) and under Federal Information System Controls Audit Manual (FISCAM) standards. Access to REO data and ADAMS screens is restricted to those individuals with a need-to-know and a valid business justification. Approved changes undergo rigorous service provider acceptance, smoke, and regression testing before User Acceptance Testing (UAT) by HUD Subject Matter Experts (SMEs) and implementation is authorized.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Individuals covered by this system include:

• Homebuyers
• Successful Bidders (purchasers)
• Nonprofits and Government (state and local) agencies
• Management and Marketing (M&M) contractors

CATEGORIES OF RECORDS IN THE SYSTEM:

Homebuyers

• Name, address, SSN, race/ethnicity

Successful Bidders (Purchasers)

• Business name, address, and telephone number
• Social Security Number (SSN), Employee Identification Number (EIN), or Tax Identification Number (TIN)
• Mortgagee ID Number
• SAMS name and address identification number (NAID)
• FHA case number and property address
• Date purchaser(s) signed sales contract (Form HUD-9548)
• Date sales contract accepted by HUD
• Purchase price
• Purchaser type
• Appraisal information
• Tax payments
• Sales offer information
• HUD-1
• Contract information
• Vendor information
• Financial transactions

Nonprofit and Government (state and local) (Note: In addition to the successful bidders/purchasers)

• Internal Revenue Service (IRS) letters for determination of nonprofit status
• Articles of Organization
• Mortgage notes
• W-9
• SAMS-1111
• Property report documentation (Median Income certification)

Management and Marketing (M&M) Contractors

• Business name, address, and telephone number
• EIN, TIN, or SSN
• SAMS NAID
• FHA case number and property address
• Date purchaser(s) signed sales contract (Form HUD-9548)
• Date sales contract accepted by HUD
• Purchase price
• Purchaser type
• Mortgage notes
• W-9
• SAMS-1111
• Property report documentation (Median Income certification)
• Limited information about the homebuyers: Name, address, SSN, and race/ethnicity characteristics
• Payment Information Form ACH Vendor Payment System (SF 3881) new

ADAMS contains files on property appraisals, tax payments, purchase sales offer information, HUD-1, purchase contract information, vendor information, and property preservation and protection invoice information, FHA property listings, and property agent contact information.

RECORD SOURCE CATEGORIES:

Purchasers, Brokers, appraisers, M&M contractors, Nonprofits, State and Local Government entities, and HUD employees.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, all or a portion of the records or information in this system may be disclosed to authorized entities, as determined to be relevant and necessary, outside the Department of Housing and Urban Development (HUD) as a routine use pursuant to 5 U.S.C. 552a(b)(3):

1. To the Government Accountability Office (GAO) for audit purposes.

2. To the Office of the Inspector General (OIG) for audit purposes.

3. To Management and Marketing contractors for processing the sale of HUD Homes.

4. To the Federal Bureau of Investigation (FBI) to investigate possible fraud revealed in the course of property disposition efforts to allow HUD to protect the interest of the Secretary.

5. To the National Archives and Records Administration (NARA) for records having sufficient historical or other value to warrant continued preservation by the United States Government, or for inspection under authority of Title 44, Chapter 29, of the United States Code.

6. To a congressional office from the record of an individual, in response to an inquiry from the congressional office made at the request of that individual.

7. To contractors, grantees, experts, consultants, Federal agencies, and non-Federal entities, including, but not limited to, State and local governments and other research institutions or their parties, and entities and their agents with whom HUD has a contract, service agreement, grant, or cooperative agreement, when necessary to accomplish an agency function related to a system of records, for the purpose of statistical analysis and research in support of program operations, management, performance monitoring, evaluation, risk management, and policy development, or to otherwise support the Department's mission. Records under this routine use may not be used in whole or in part to make decisions that affect the rights, benefits, or privileges of specific individuals. The results of the matched information may not be disclosed in identifiable form.

1. To contractors, grantees, experts, consultants and their agents, or others performing or working under a contract, service, grant or cooperative agreement with HUD, when necessary to accomplish an agency function related to a system of records. Disclosure requirements are limited to only those data elements considered relevant to accomplishing an agency function. Individuals provided information under these routine use conditions are subject to Privacy Act requirements and disclosure limitations imposed on the Department.

2. To appropriate agencies, entities, and persons when:

i. HUD suspects or has confirmed that the security or confidentiality of information in a system of records has been compromised;

ii. HUD has determined that as a result of the suspected or confirmed compromise there is a risk of harm to economic or property interests, identity thief, or fraud, or hard to the security or integrity of systems or programs (whether maintained by HUD or another agency or entity) that rely upon the compromised information; and individuals, HUD (including its information systems, programs, and operations), the Federal Government, or national security; and

iii. the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HUD's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm for purposes of facilitating responses and remediation efforts in the event of a data breach.

8. To the Department of Justice (DOJ) when seeking legal advice for a HUD initiative or in response to DOJ's request for the information, after either HUD or DOJ determine that such information is relevant to DOJ's representatives of the United States or any other components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that disclosure of the records to DOJ is a use of the information contained in the records that is compatible with the purpose for which HUD collected the records. HUD on its own may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which HUD collected the records.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

ADAMS records are stored electronically in secure facilities. Electronic files are stored in case files on secure servers. Electronic files are replicated at a disaster recovery offsite location in case of loss of computing capability or other emergency at the primary facility. ADAMS primary host facility is located at SunGard, 1001 E Campbell Road, Richardson, TX 75081. The ADAMS disaster recovery facility is at CenturyLink, 200 N Nash Street, El Segundo, CA 90245.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records can be viewed using computer search by the FHA case number, property address (including other geographical characteristics such as contract area, property state/city/county/zip code, Homeownership Center), or contractor ID or name, or non-profit/government agency name.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

ADAMS records comply with the National Archives and Records Administration's July 2017 General Records Schedule 1.1, Financial Management and Reporting Records, Items 010 and 011, to maintain for six years, or when business use ceases. Backup and Recovery digital media will be destroyed or otherwise rendered irrecoverable per NIST SP 800-88 “Guidelines for Media Sanitization” (December 2014).

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

FHA ensures the protection of program participants' PII and mortgagee business sensitive information by ensuring ADAMS' compliance with HUD and Federal Information Security Management Act (FISMA) security and privacy controls.

Administrative

1. OSFAM conducts a full security assessment of ADAMS to ensure compliance with NIST SP 800-53, Recommended Security Controls for Federal Information Systems, as amended, and NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, as amended, and HUD's authorization to operate methodology.

2. ADAMS undergoes an annual independent attestation assessment.

3. A documented security impact analysis is conducted whenever changes are proposed to ADAMS or its interfacing information systems, networks, or to their physical environment, interfaces, or user-community makeup.

4. The ADAMS hosting environment tests and documents the incident response capability for ADAMS on a yearly basis. This training allows for determination of the effectiveness the incident response plan and incorporation into the procedure for contingency planning testing plan.

Technical

1. Access to program participants data and ADAMS screens is restricted to those individuals with a need-to-know and a valid business justification.

2. ADAMS access requires two levels of logins to access the system. The first login uses HUD Siteminder system to verify that the user has active HUD authorization. The second login uses ADAMS internal security system to set permissions for data access and system functionality.

3. Data exchanges are done via secure file transfer protocol (SFTP); and the servers and mainframes used employ Federal Information Processing Standards (FIPS) 199 moderate security categorization controls. OSFAM personnel work closely with system security administrators, network and project security personnel to ensure the integrity of data exchanges.

Physical

1. Access to data centers are controlled using an electromagnetic badge and/or biometric access system which maintains information such as employee names, ID numbers, access badge numbers, issue date of the access badge, as well as what areas the employee is authorized to access.

2. Each system logs the date, time, and location of each entry into the data center. Physical access is further restricted only to authorized personnel and other approved individuals according to their job functions. The systems are used to generate access badges used at each data center entrance where a badge reader is installed. Each badge reader stores an access list in memory. If a connection between a badge reader and the master server supporting the card key system is severed, the badge readers will still limit access using the access list stored in memory.

3. A Facilities Manager performs a monthly review of entry logs at each data center to ensure access is appropriate. Any unusual activities are investigated and resolved.

RECORD ACCESS PROCEDURES:

For Information, assistance, or inquiries about records, contact John Bravacos, Senior Agency Official for Privacy, 451 Seventh Street SW, Room 10139, Washington, DC 20410, telephone number [phone]. When seeking records about yourself from this system of records or any other HUD system of records, your request must conform with the Privacy Act regulations set forth in 24 CFR part 16. You must first verify your identity, by providing your full name, address, and date and place of birth. You must sign your request, and your signature must either be notarized or submitted under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization.

If your request is seeking records pertaining to another living individual, you must include a statement from that individual certifying their agreement for you to access their records. Without the above information, the HUD FOIA Office may not conduct an effective search, and your request may be denied due to lack of specificity or lack of compliance with regulations.

CONTESTING RECORD PROCEDURES:

The Department's rules for contesting contents of records and appealing initial denials appear in 24 CFR part 16, Implementation of the Privacy Act of 1974. Additional assistance may be obtained by contacting John Bravacos, Senior Agency Official for Privacy, 451 Seventh Street SW, Room 10139, Washington, DC 20410, or the HUD Departmental Privacy Appeals Officers, Office of General Counsel, Department of Housing and Urban Development, 451 Seventh Street SW, Room 10110, Washington, DC 20410.

NOTIFICATION PROCEDURES:

Individuals seeking notification of and access to any record contained in this system of records, or seeking to contest its content, may submit a request in writing to the Privacy Office at the address provided above or to the component's FOIA Officer, whose contact information can be found at http://www.hud.gov/​foia under “contact.” If an individual believes more than one component maintains Privacy Act records concerning him or her, the individual may submit the request to the Senior Agency Official for Privacy, HUD, 451 Seventh Street SW, Room 10139, Washington, DC 20410.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

Amendment—Asset Disposition and Management System HSNG.SF/HUF.01, 81 FR 55477; Published in the Federal Register—August 19, 2016.

Amendment—Asset Disposition and Management System HSNG.SF/HUF.01, 79 FR 10825; Published in the Federal Register—February 26, 2014 (note: Changed coding structure).

Amendment—Asset Disposition and Management System HUD/HS-58, 77 FR 41993; Published in the Federal Register—July 17, 2012.

Initial—Asset Disposition and Management System HUD/HS-58, 73 FR 62520; Published in the Federal Register—October 21, 2008.

Dated: June 28, 2019.

John Bravacos,

Senior Agency for Privacy.