privacy impact assessment future directions tricare management activity health affairs 2009 data...

Privacy Impact Assessment Future Directions

TRICARE Management ActivityHEALTH AFFAIRS

2009 Data Protection Seminar

TMA Privacy Office



Privacy in the News


3


Purpose

The purpose of this presentation is to provide information on the new efforts to improve the Privacy Impact Assessment (PIA) process, to include a synopsis of the new DoD PIA guidance and form


4


Objectives Upon completion of this presentation, you should be able to:

− Identify the key points outlined in the new PIA guidance

− Recognize the new features of the PIA template

− Describe the new efforts established to improve the PIA process


5


Privacy and the Protection of PII DoD takes its responsibility seriously to safeguard personally

identifiable information (PII) in its possession and to prevent its theft, loss, or compromise

DoD is addressing privacy and security challenges through many initiatives including Privacy Impact Assessments (PIAs), Data-at-Rest (DAR), and ensuring that DoD employees are aware of their privacy responsibilities


6


PIA Requirements Federal Agency PIA Requirements

− Section 208 of the E-Government Act of 2002 requires all agencies to conduct PIAs for all new or substantially changed information systems that collect, maintain, or disseminate PII on the public

New DoD PIA Requirements

− DoD Instruction 5400.16 expands the coverage to include Federal personnel, contractors, and foreign nationals employed at U.S. military facilities internationally


7


Highlights of DoDI 5400.16 PIA Guidance Formalizes E-Gov Act PIA requirement in DoD for greater

visibility and clarity

Enhances responsibilities and accountability

− DoD Program Manager (PM) or designee starts the assessment

− Requires coordination with PM, Information Assurance, and Component Privacy

− Expands signature requirements


8


Highlights of DoDI 5400.16 PIA Guidance Better coordination with other processes

− Privacy Act SORNs

− Information Collection

− Certification and Accreditation

− Budget

Establishes review cycle

Structures privacy risk identification and assessment with new DoD PIA Form (DD 2930)


9


Highlights of the New PIA Template DD Form 2930

More comprehensive tool

− Detailed risk analysis questions

− In-depth PII table for selection

− Technical, physical, and administrative control list provided

− Interactive forms with check boxes, radio buttons, and tables

− Digital signatures for the PDF form

− MS Word version also available


10


New PIA Template


11


New PIA Template (continued)


12




13




14




15




16




17




18




19




20




21




22




23




24




25


FY 09 and FY 10 New Efforts DoD IT Portfolio Repository (DITPR) data review and analysis

of privacy reporting elements

− PIA required elements

− Relationship to SSN and PII data elements

− Analysis of Component PIA information reported

Privacy Threshold Analysis Tool

Develop PIA spot audit processPIA

Data


26


PIA Data Quality Analysis Actions Phase one actions

− Identify PIA DITPR element changes

− Modify PIA reporting structures

Phase 2 actions focus on analyzing Component data

− Privacy reporting discrepancies

− Records in non-compliance

− Records needing adequate explanations

− Records requiring PIA based on corresponding PII and SSN answers


27


Privacy Threshold Analysis Develop a PTA tool that would be the initial determination point

for whether privacy documents (SORN and/or PIA) need to be completed

− Incorporate questions related to: PIA

SORN

SSN collection

− Serve as documentation for each new system

Target FY 10 completion and implementation


28


Privacy Spot Audit Process Process for privacy personnel to conduct self-assessments

focusing on:

− Completeness of PIAs

− Measuring general understanding of PIA process in compliance with DoDI 5400.16

Target FY 10 completion and implementation


29


Moving Forward in DoD PIA Process Increase awareness of PII and the need for adequate

protection

Increase policy compliancy

Better reporting to OMB

Identification of areas for enhanced communication and collaboration to enhance privacy throughout DoD


30


Summary You should now be able to:

− Identify the key points outlined in the new PIA guidance

− Recognize the new features of the PIA template

− Describe the new efforts established to improve the PIA process

privacy impact assessment future directions tricare management activity health affairs 2009 data...

Documents

privacy responsibilities

new pia guidance

component privacy

pia process slide

new dod pia guidance

new pia template dd

form slide

new dod pia form dd