Privacy Impact Assessments

Titles II and III of the E-Government Act of 2002 require that agencies evaluate systems that collect personally identifiable information (PII) to determine that the privacy of this information is adequately protected. The mechanism by which agencies perform this assessment is a privacy impact assessment (PIA). In accordance with HHS policy, operating divisions (OPDIVs) are responsible for completing and maintaining PIAs on all systems (developmental and operational). Upon completion of each assessment, agencies are required to make PIAs publicly available.

To view the PIAs for each individual OPDIV system, please refer to the links located on the left.

HHS System of Record Notices

The Privacy Act of 1974 requires that agencies create and maintain, as necessary, a system of record notice for systems as defined in the Privacy Act provisions. A system is subject to the Privacy Act if it contains a system of records; any item, collection, or grouping of information about an individual that identifies an individual, and where those records are retrieved by the name of the individual or by some type of unique identifier. In accordance with the Privacy Act of 1974, OPDIVs are responsible for completing and maintaining system or records notices.

The Privacy Act
System of Records Notices (SORNS)