E9-20405. Privacy Act; Notification of a New Privacy Act System of Records, Institution Master File (IMF)

AGENCY:

Office of the Chief Information Officer, HUD.

ACTION:

Notification of a New Privacy Act System of Records.

SUMMARY:

The Department of Housing and Urban Development HUD proposes to amend one of its system of records subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended. The proposed new system of record is the IMF/F51. The IMF System maintains a file of institutions (Title I lenders and Title II mortgagees) which have been approved by the U.S. Department of Housing and Urban Development (HUD) to participate in the Departments Federal Housing Administration (FHA) Mortgage Insurance Programs. The principal objective of the IMF is to consolidate information on the approval status of mortgagees and lenders participating in FHA's insurance programs.

DATES:

Effective Date: This action shall be effective without further notice on September 24, 2009 unless comments are received that would result in a contrary determination.

Comments Due Date: September 24, 2009.

ADDRESSES:

Interested persons are invited to submit comments regarding this notice to the Rules Docket Clerk, Office of General Counsel, Department of Housing and Urban Development, 451 Seventh Street, SW., Room 10276, Washington, DC 20410-0500. Communications should refer to the above docket number and title. A copy of each communication submitted will be available for public inspection and copying between 8 a.m. and 5:00 pm weekdays at the above address.

FOR FURTHER INFORMATION CONTACT:

Donna Robinson-Staton, Departmental Privacy Act Officer, 451 Seventh Street, SW., Room 2256, Washington, DC 20410, Telephone Number [phone]. (This is not a toll-free number.) A telecommunication device for hearing and speech-impaired individuals (TTY) is available at [phone] (Federal Information Relay Service).

SUPPLEMENTARY INFORMATION:

Pursuant to the Privacy Act of 1974 (5 U.S.C. 552a), as amended, notice is given that HUD proposes to establish a new system of records, identified as the Institution Master File (IMF).

Title 5 U.S.C. 552a(e)(4) and (11) provide that the public be afforded a 30-day period in which to comment on the new system of records.

The new system report was submitted to the Office of Management and Budget (OMB), the Senate Committee on Governmental Affairs, and the House Committee on Government Reform pursuant to paragraph 4c of Appendix 1 to OMB Circular No. A-130, “Federal Responsibilities for Maintaining Records About Individuals,” July 25, 1994, (59 FR 37914).

Authority: 5 U.S.C. 552a 88 Stat. 1896; 42 U.S.C. 3535(d).

Dated: August 14, 2009.

Jerry E. Williams,

Chief Information Officer.

HUD/HS/60

System name:

Institution Master File (IMF).

System location:

The system is physically housed in a government-owned building (i.e., the U.S. Department of Housing and Urban Development) in Washington, DC and at HUD's Charleston, West Virginia field office; backup facilities are located in HUD's Pennsylvania office. These buildings are occupied by the Department of HUD's Civil Service employees and contractor personnel (that use picture identification cards to access the buildings) and are not open to the general public. System software is loaded on computers in HUD Headquarters in Washington, DC. Servicing Contractors access HUD systems via Virtual Private Network (VPN).

Categories of individuals covered by the system:

The Institution Master File (IMF) maintains data on Title I lenders and Title II mortgagees who originate, underwrite or service a HUD-insured mortgage.

Categories of records in the system:

IMF includes data such as the lender's first name, last name, Social Security Number (SSN) and title/position (i.e., Chief Executive Officer). The IMF application includes data such as the principal employee's name (i.e., first and last), email address, title, and SSN. The other records include the following data elements: Tax ID, Title I ID, Institution ID, GNMA ID, Institution Name, Institution Type, Insurance Type, Mortgage Type, Doing Business As (aka Fictitious Name), Fiscal Year End, Approval Date, Phone Number, Fax, E-mail, and Geographical Address.

Authority for maintenance of the system:

National Housing Act of 1937 as amended (Pub. L. 75-412).

Purpose:

The IMF maintains the official record of Institutions (Title I lenders and Title II mortgagees) that are approved by HUD/Federal Housing Administration (FHA) to originate, service, or invest in FHA-insured mortgages or loans. The IMF centralizes institution data needed for the operation of FHA's home mortgage, project mortgage and home improvement, mobile homes and manufactured homes. This information is used by more than a dozen other Housing and Ginnie Mae systems for validation of institutional identification/approval, validation of relationships between sponsor and loan correspondents, lender notifications, and claim payments. In addition to being a critical component of insurance application processing and accounting, an extract from the IMF, together with data from the Single Family Housing Enterprise Data Warehouse (SFHEDW), on HUD's Web site, allows the public to locate approved institutions located or doing business in their area. IMF data (e.g., lender's name, address, telephone, fax number, and e-mail address) is extracted and posted on HUD's Web site (http://www.hud.gov/​ll/​code/​llslcrit.cfm) to apprise the public of all FHA-approved lenders within their respective geographic areas. This information is releasable through the Freedom of Information Act (Pub. L. 89-554, 80 Stat., 383; Amended 1996, 2002, 2007). The IMF is used to generate correspondence welcoming newly approved lenders, reminding institutions of their annual certification requirements, warning and subsequently advising institutions of withdrawal of their approval for failure to submit required documentation or pay the required annual recertification fee. The principal objectives of the IMF are to consolidate information on the approval status of mortgagees and lenders participating in FHA's insurance programs. The approval information is fed to FHA processing systems for use in processing and editing individual mortgage/loan insurance applications, servicing transactions, and claims. The IMF is the repository for banking information (encrypted) for wire transferring payments to mortgagees/lenders for claim reimbursements and premium refunds. The personal information collected pertains to the SSNs and Names of the Lenders. The purpose of the information being collected is to ensure that any senior officer (e.g., Chief Executive Officer (CEO), Chief Financial Officer (CFO), partner, director, or principal is in compliance with Section 203(b) of the Helping Families Save Their Homes Act of 2009, which was enacted on May 20, 2009. The Privacy Impact Assessment is currently being re-visited and updated as necessary to incorporate HUD's new Electronic Annual Certification Process for FHA-approved lenders. Under the former certification process, lenders certified manually via the submission of a Title II Yearly Verification Report (i.e., V-Form).

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

All external disclosure of data must be accounted for or information from the system is not released. If unaccounted for, data from the system cannot be disclosed to any entity external to HUD, including contractors. The following are examples of routine uses of data maintained in the system:

1. HUD's Office of Policy Development and Research often use IMF data (i.e., non-personally identifiable information) to conduct studies and statistical reports—directly related to the management of HUD's FHA Lender and Mortgagee Certification Program;

2. HUD's Office of Lender Activities and Program Compliance use IMF data (i.e., non-personally identifiable information) to create correspondence for lenders and mortgagees, reminding them of their annual renewal requirements and notifying them of their non-compliance with Departmental rules and requirements for continued program participation; and

3. Internal HUD Users and HUD's Office of Lender Activities and Program Compliance contractors (required to modify IMF per the terms of their contract) have limited access to “read only” data. As such, HUD staff and contractors do not have access to privacy information.

4. Additional Disclosure for Purposes of Facilitating Responses and Remediation Efforts in the Event of a Data Breach. A record from a system of records maintained by this Department may be disclosed to appropriate agencies, entities, and persons when:

a. The Department suspects or has confirmed that the security or confidentiality of information in a system of records has been compromised;

b. The Department has determined that as a result of the suspected or confirmed compromise there is a risk of harm to economic or property interests, identity theft or fraud, or harm to the security or integrity of systems or programs (whether maintained by the Department or another agency or entity) that rely upon the compromised information; and,

c. The disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:

Data is stored on magnetic discs and tapes. UPS is used to transport the tapes on which data is stored. There is a courier log at the data center. As of August 2009, there will be no magnetic discs or tapes. Furthermore, there are no printouts and hardcopies stored, maintained, or generated from the system. The hard copy V-Form is filed and maintained on microfilm. However, there is no privacy information on the hard copy of the V-form.

Retrieving:

Data is retrieved by the Lenders' first and last name, and Social Security Number. Federal employees and FHA-approved lenders must access IMF by inputting their User IDs and Passwords, issued by the Department of HUD. Again, all users with access to IMF are unable to view personally identifiable data as they have access to “read only” data.

Safeguards:

Records are maintained in a secured computer network behind HUD's protective automated firewall, which ensures limited access to those persons whose official duties require the use of such records. Access to automated records is limited to authorized personnel who must receive a valid User ID and password. All HUD users and developers access the system from work stations connected through the local area network (LAN) routers to the Department's IBM Mainframe platform. Mortgagee/Lender employees view and/or update selected data in the system through HUD's WEB portal, FHA Connection. Functional access is granted on an “as needed” basis only by the IMF Security Administrator or the Security Coordinator for the lending institution, as appropriate.

IMF's software packages provide authentication of a User. User authorizations are controlled at the application level. The IMF system controls all online screen authorizations on the Customer Information Control System (CICS). Also, the FHA Connection security administration's application controls access to the FHA Connection modules of the IMF system. HUD will safeguard the SSN and personal identifying information obtained pursuant to 26 U.S.C. 6103(l) (7) (A) and (B) in accordance with 26 U.S.C. 6103(p)(4), and the IRS's “Tax Information Security Guidelines for Federal, State and Local Agencies,” Publication 1075 (REV 6/2000). Security and private measures are in place for the organization's implementation of the appropriate safeguards to assure confidentiality, integrity and availability of personal information.

Retention and disposal:

Records will be retained and disposed of in accordance with the General Records Schedule included in HUD Handbook 2228.2, appendix 14, item 25; and appendices 15 and 20. HUD handles and retains output data (i.e., stored on magnetic discs and tapes) from the information system in accordance with applicable laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.

Computerized records are maintained in a password-protected environment. If information is needed for evidentiary purposes, documentation will be referred to the HUD Office of Inspector General (OIG) in Washington, DC or other appropriate Federal, State or local agencies charged with the responsibility of investigating or prosecuting violators of Federal law. Documents referred to HUD's OIG will become part of OIG's investigative files.

System manager(s) and address:

Director, Office of Housing/Single Family Housing Office of Lender Activities and Program Compliance (System Owner), Department of Housing and Urban Development, 451 Seventh Street, SW., Room B133/P3214, Washington, DC 20410.

Records access and notification procedure:

For information, assistance, or inquiry about existence of records, contact Donna Robinson-Staton, Departmental Privacy Act Officer, 451 Seventh Street, SW., Room 2256, Washington, DC 20410, telephone [phone] in accordance with the procedures in 24 CFR Part 16. Written request for access to records must include satisfactory proof of identity. The means of proof by certificate of a notary public or equivalent officer empowered to administer oaths must accompany the request. The certificate within or attached to the letter must include full name, current address, city and state of birth, copy of drivers license or equivalent bearing the requester's signature.

Contesting record procedures:

The Department's rules for contesting the contents of records and appealing initial denials, by the individual concerned, appear in 24 CFR Part 16. If additional information or assistance is needed, it may be obtained by contacting:

(i) In relation to contesting contents of records, the Departmental Privacy Act, Department of Housing and Urban Development, 451 Seventh Street SW., Room 2256, Washington, DC 20410.

(ii) In relation to appeals of initial denials, the HUD Departmental Privacy Appeals Officer, Office of General Counsel, Department of Housing and Urban Development, 451 Seventh Street SW., Washington, DC 20410.

Record source categories:

Information in this system of records is supplied directly by the individual, and/or HUD system users.

Exemption from certain provision of the Act:

None.