HHS Machine-Readable Privacy Policy Guide - Substance Abuse ...

Machine-Readable Privacy Policy Guide
US Department of Health and Human Services
Usage—for what business purpose collected data is used and disclosed
Sharing—with whom data is shared and why and whether sharing is optional
Expiration—how long information is retained.
1.3 Scope
All HHS websites should have a machine-readable privacy policy on all public
websites to ensure compliance with the E-Government Act of 2002. Machinereadable
privacy policies are not required on HHS Intranet websites. This guide
applies to all HHS personnel, which includes the Operating Divisions (OPDIV) and
contractors responsible for managing and operating public websites on behalf of HHS
or OPDIVs.
This guide will familiarize HHS personnel with machine-readable privacy
requirements set forth in the E-Government Act of 2002 and machine-readable
privacy specification, Platform for Privacy Preferences (P3P), developed by the World
Wide Web Consortium (W3C).
1.4 Document Organization
The remainder of the document is structured as follows:
Section 1 describes federal privacy requirements.
Section 2 provides roles and responsibilities during the implementation
process.
Section 3 describes the process of implementing a machine-readable privacy
policy.
Section 4 provides step by step guidance on how to develop and implement a
machine-readable privacy policy.
Section 5 provides a conclusion summarizing the points of this guide.
This guide also contains the following appendices:
Appendix A provides a feedback form for use in submitting comments on this
document to HHS.
Appendix B lists the acronyms used in this document.
Appendix C defines terms most frequently used in this document.
Appendix D lists references for this document.
Appendix E provides the Machine-Readable Data Analysis Worksheet.
Appendix F provides a list of all documents associated with the HHS
Information Security Program.
Page 7