The Privacy Act of 1974 requires U.S. Government agencies to:

• limit the collection of personal information about U.S. citizens and legal residents to information that is necessary to carry out an agency function and to collect Social Security numbers only when legally authorized;
• inform individuals of the purpose and use of information collected in a HHS Privacy Policy Notice and
• publish a Systems of Records Notice in the Federal Register for each agency system that collects more than one record that contains information about an individual and is designed to be retrieved by name or other personal identifier.