Privacy Impact Assessment – Hiring Inventory and Training System (HITS)
HITS System Overview
The Hiring Inventory and Training System (HITS) tracks information regarding internal and external hires. HITS includes three subsystems. One is the HITS Reemployed Annuitants Module. It tracks information regarding the internal and external hires. A second is HITS Training. It tracks information regarding the training being provided to internal and external hires. A very small percentage of the information comes from Treasury Integrated Management Information System (TIMIS) and is updated on a biweekly basis. The third subsystem is HITS Convertee. It tracks selected convertee information.
System of Records Number(s)
* Treasury/IRS 36.003 General Personnel and Payroll Records
* Treasury/IRS 34.037 IRS Audit Trail and Security Records System
* Treasury/IRS 38.001-General Training Records
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A) Taxpayer - None
B) Employee – See Attachment 1
C) Audit Trail –
o Login
o Date Added
o User Added By
o Date Modified
o Modified By
D) Other – none
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A) IRS – See Attachment 1 and 2
B) Taxpayers - None
C) Employee – See Attachment
D) Other Federal Agencies – Treasury Integrated Management Information System (TIMIS)
E) State and Local Agencies - None
F) Other third party sources - None
3. Is each data item required for the business purpose of the system? Explain.
Yes. The data items are needed to accurately track information regarding the internal and external hires.
4. How will each data item be verified for accuracy, timeliness, and completeness?
HITS uses data that is manually input and is verified from rosters, certificates, and resumes. Data is received from TIMIS on a bi-weekly basis for timeliness and accuracy verification. Additionally, there is a limited field size. Certain key fields must be either alpha or numeric characters, and some are linked to other fields. They may also be mandatory and will not allow the record to be saved if not complete. Some insert fields are either “Y” (Yes) or “N” (No). Training instructors check their own work. An “Error Created” message is displayed.
5. Is there another source for the data? Explain how that source is or is not used. No.
6. Generally, how will data be retrieved by the user?
Data is retrieved by Last Name.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Data is retrievable by any field in the application. It is retrievable by name and control number, which are unique identifiers. The programming language used in this program allows data to be retrieved by each data element. The business owner needs the ability to retrieve data by selectee, COOP, hotel, class, instructor, position, and/or hotel reservations. Only selected information is displayed with each query. For example, the class information screen only displays the record number, training class number, title, arrive and depart dates, organization, state and city.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
HITS will be accessed via the Intranet by Personnel Specialists, Hiring Coordinators, and Training Coordinators.
Personnel Specialists can view/add/edit all records. Hiring and Training Coordinators can view all areas, can only add/edit their Area and can add/edit only their elements (i.e., area, pod, employee name, ssn, start date, resident city and state, position hired, source, placement action).
9. How is access to the data by a user determined and by whom?
Access to the data is determined by the manager based on a user’s position and need-to-know. The manager will request a user be added. They must fill out Form 5081, Information System User Registration/Change Request, to request access. A user’s access to the data terminates when it is no longer required. Criteria, procedures, controls, and responsibilities regarding access are documented in the Information Systems Security Rules on Form 5081.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes. HITS provides the control number for the Recruitment Initiative Tracking System (RITS).
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment? Yes.
12. Will other agencies provide, receive, or share data in any form with this system?
Yes, data is received from TIMIS. HITS receives information from the Treasury Integrated Management Information System (TIMIS). The TIMIS data is stored on a CD and manually downloaded into HITS.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
HITS will retain data for a maximum period of 5 years. At the end of the retention period as identified in IRM 1.15.38-1 item 29, the data will be deleted from the system. Media will be overwritten or degaussed before it is submitted for destruction.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
HITS contains no taxpayer data. It is used to accurately track information regarding the internal and external hires. It contains internal and external selectee information and Cooperative convertee selections for the hiring inventory. It contains hotel information, instructor information, manager information, position information, and hotel reservations information for training classes.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
No. HITS does not have the capability to identify, locate, and monitor individuals or groups.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. HITS contains no taxpayer data. Information on employees will be treated equally.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
HITS does not have the capability to make determinations.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
No. HITS is a web-based application. User integrity is maintained through authentication and validation. User Audit Trails are incorporated in the system. HITS does not use persistent cookies.
|
