Privacy Impact Assessment – HQEO
HQEO System Overview
HQEO is used to control the case inventory of tax law specialists in the HQEO Technical Divisions. These applications monitor the case inventory by group and specialist, track the time spent on each case, generate timesheets, process user fees, and create inventory and accomplishment reports.
Data is received by HQEO from the Employee Plans Exempt Organization Determination System (EDS) and is manually keyed into the system. EDS is a district system run on a mini computer. Exempt Organizations and Employee Plans submit applications to TE/GE to determine if they meet the law requirements of the Internal Revenue Code. If an application is found incomplete, a letter is sent to the applicant requesting the missing data. If an application is found complete, the data entered is added to the inventory control tables.
Systems of Records Number(s)
Treasury/IRS 50.222--Tax Exempt/Government Entities (TE/GE) Case Management Records
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A.
* Point of contact data:
o Organization Taxpayer name
o Plan Sponsor
o Organization Phone Number
o Organization Address
o Contact person’s name (or Power of Attorney)
B.
* Tax Law Specialist (TLS) name
C. None
D.
* Lookup information:
o Project work codes
o Control number / Case Number
o User fee information:
* Check amount
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. & B. & C. The data elements defined in sections 1A, 1B, and 1D are obtained from organization taxpayer correspondence or from Tax Law Specialists and is used to update case status.
D. No.
E. No.
F. No.
3. Is each data item required for the business purpose of the system? Explain.
Yes. All data items are used to support case inventory control, inventory monitoring (ie: by group and specialist), specialist time management and timesheet generation, and processing user fees, as well as reporting functions.
4. How will each data item be verified for accuracy, timeliness, and completeness?
Timeliness: A manual check is made by a senior tax law specialist when cases are screened for assignment, as to the data items, by checking the taxpayer's paper submission and the date stamped on the submission by the user fee clerk.
Accuracy: A manual check is made by a senior tax law specialist when cases are screened for assignment as to the accuracy of the data items by checking the taxpayer's paper submission.
Completeness: The HQEO system verifies an address through an automated completion check.
5. Is there another source for the data? Explain how that source is or is not used.
No. The data is received from physical documents received from organization taxpayers.
6. Generally, how will data be retrieved by the user?
Data will be retrieved by users through the IRS LAN (FYI, field users cannot access the application) via intranet access.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Data can be retrieved by any field within the database; specifically, EIN, organization name, and case number.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
User groups define the appropriate level of system access based on job duties. Groups are maintained for the following roles:
* TE/GE staff
* Developers
* System Administrators
* DBA
* Users who can only view cases assigned to their group (eg: Examiners) specifically on a “need to know” basis in support of their job duties.
* User fee specialists
9. How is access to the data by a user determined and by whom?
Data access is granted on a “need to know” basis. The OL5081 (Online 5081) is used to document access requests, modifications, and terminations for all types of users, including System Administrators. When a new user needs access to IRS systems or applications, the user’s manager or designated official, completes an OL5081 requesting access for the new user. OL5081 is an online form, which includes information, such as the name of the system or application, type of access, and the manager’s signature approving authorization of access. The completed OL5081 is submitted to the System Administrator, who assigns a user ID and an initial password. Before access is granted, the user is required to digitally sign OL5081 acknowledging his/her security responsibilities when using the system. Users are prevented from exceeding their assigned access privileges.
Before users can have access to HQEO they must also have their profile entered into the Control Table. This table determines which “menu” they are allowed access to. Menu system limits access to certain screens. Further Informix permissions must be set if they are allowed to add new records, update current ones or be able to delete any records. These permissions are set by creating GRANT scripts and are implemented by a Database Administrator.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes. Data from the Employee Plans Exempt Organization Determination System (EDS) is manually keyed in by HQEO application users:
* EDS Reports are used to input information in HQEO manually; that is, hardcopies are printed and keyed in by HQEO users.
* Employee Plans-Exempt Organizations Determination System (EDS) is a district system run on a mini computer. Exempt Organizations and Employee Plans submit applications to TEGE to determine if they meet the law requirements of the Internal Revenue Code.
* Application data is keyed in manually to determine if all the required information was submitted. If an application is found incomplete, a letter is sent to the applicant requesting the missing data.
* If an application is found complete, the manually entered data is added to the inventory control tables.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
EDS:
* PIA – Current.
* C&A – Certification expired August 11, 2005.
12. Will other agencies provide, receive, or share data in any form with this system?
No. HQEO does not receive or send information to any systems outside of the IRS.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
Application specific data retention and elimination procedures are not codified. Records persist in database tables as “closed” cases, but are not eliminated.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15.
No. HQEO does not use technology in a new way.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
No. Entities are identified by EIN. A user may also retrieve the organization name and organization address, but this information is only used for the business purpose of the system (ie: to support case inventory control, inventory monitoring (ie: by group and specialist), specialist time management and timesheet generation, and processing user fees, as well as reporting functions).
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
No. HQEO’s monitoring functions extend to case inventory information only (by group and specialist). The application does not have the capability to monitor individuals or groups.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. Taxpayers and employees/specialists are not treated differently by the use or reports generated from HQEO.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
Taxpayers are provided the Specialist’s contact information to discuss negative determinations or to update incorrect case information.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
No. HQEO does not use persistent cookies or other tracking devices to identify web visitors.
|
