HHS Machine-Readable Privacy Policy Guide - Substance Abuse ...

Machine-Readable Privacy Policy Guide
US Department of Health and Human Services
2.2.5 OMB Memorandum M-03-22
OMB has provided federal agencies with M-03-22, Guidance for Implementing the
Privacy Provisions of the E-Government Act of 2002, September 2003. This guidance
directs agencies to conduct reviews of how they use technology to collect new
information and when they buy or develop new IT systems to handle collecting IIF as
well as website privacy policy content.
M-03-22 indicates that PIAs should be conducted if any of the following nine
circumstances occur:
Conversions. When converting paper-based methods to electronic systems.
Anonymous to Non-Anonymous. When the system’s function, as applied to
an existing information collection, changes anonymous information into IIF.
Significant System Management Changes. When new uses of an existing
IT system, including application of new technologies, significantly change how
information in identifiable form is managed in the system.
Significant Merging. When agencies adopt or alter business processes so
that government databases holding IIF are merged, centralized, matched with
other databases, or otherwise significantly manipulated.
New Public Access. When user-authenticating technology (e.g., password,
digital certificate, biometric) is newly applied to an electronic information
system that members of the public can access.
Commercial Sources. When agencies systematically incorporate into
existing information systems databases of IIF purchased or obtained from
commercial or public sources.
New Interagency Uses. When agencies work together on shared functions
involving significant new uses or exchanges of IIF.
Internal Flow or Collection. When alteration of a business process results
in significant new uses or disclosures of information or incorporation into the
system of additional IIF.
Alteration in Character of Data. When new IIF added to a collection raises
the risks to personal privacy, such as the addition of health or privacy
information.
In addition to the PIA requirements, M-03-22 outlines new and previously
established requirements for privacy policies on agency websites. New content
requirements outlined in M-03-22 include ensuring website privacy policies inform
website visitors of their rights under the Privacy Act or other applicable privacy laws
and implementing machine-readable privacy policies on all public websites.
2.2.6 OMB Memorandum 01-05
OMB M-01-05 provides guidance on implementing the Computer Matching and
Privacy Protection Act of 1988. M-01-05 states that agencies must “prior to any data
sharing...review and meet the Privacy Act requirements for computer matching,
including developing a computer matching agreement and publishing notice of the
Page 13