1. Office of Health, Safety and Security
HSS
Office of Health, Safety and Security
Overview of Personally Identifiable Information (PII) Protection Requirements May 7, Ray Holmer, Director Office of Information Management Office of Resource Management Office of Health, Safety, and Security U.S. Department of Energy

2. Office of Health, Safety and Security
Agenda
HSS
Office of Health, Safety and Security
Policies and Regulations
Definition of PII
Applicability
Reporting Requirements
Internal Actions / Requirements
Liabilities
Questions

3. Policies and Regulations
HSS
Office of Health, Safety and Security
Privacy Act of 1974
Federal Information Security Management Act (FISMA) of 2002
Health Insurance Portability and Accountability Act (HIPAA)
Office of Management and Budget (OMB) Memorandum (M) 07-16, “Safeguarding Against and Responding to Breaches of Personally Identifiable Information.”
DOE O “Department of Energy Privacy Program”
DOE M “Cyber Security Incident Management Manual”

4. Policies and Regulations
HSS
Office of Health, Safety and Security
All DOE systems (paper based and IT based) and data collections / repositories required to have a:
Privacy Impact Assessment that details the data collection and the measures and controls governing the protection and release of that data
System of Records Notice (SORN) that defines the data collection and details the uses of the data and the purposes and to whom the data can be released. Some examples of SORNs covering PII are:
DOE-43, “Personal Security Clearance Files”
DOE-51, “Employee and Visitor Access Control Records” covers access control records and badge systems (paper and IT)
DOE–63, ‘‘Personal Identity Verification (PIV) Files’’ covers records generated or used in conjunction with HSPD-12

5. Office of Health, Safety and Security
Definition of PII
HSS
Office of Health, Safety and Security
Any information maintained by the Department about an individual, including but not limited to, education, financial transactions, medical history and criminal or employment history, and information that can be used to distinguish or trace an individual’s identity, such as his/her name, social security number, date and place of birth, mother’s maiden name, biometric data, etc., and including any other personal information that is linked or linkable to a specific individual.

6. Office of Health, Safety and Security
Definition of PII
HSS
Office of Health, Safety and Security
Examples of PII When associated with an Individual:
Social Security Number
Date and Place of Birth
Credit Card Numbers
Bank Accounts
Mothers Maiden Name
Biometric Data
Medical History / Work Exposure History
Criminal and Employment History
Social Security Number by itself

7. Office of Health, Safety and Security
Applicability
HSS
Office of Health, Safety and Security
This concerns actions to address data breaches of personally identifiable information (PII) that is collected, processed or maintained by DOE.
Data includes but is not limited to PII that is stored on paper records, stored and/or transmitted through DOE computer systems, and sensitive data owned by DOE that is properly stored on non-DOE computer systems.
Applies to DOE and DOE contractors, to include HSS Cooperative Agreement Organizations

8. Reporting Requirements
HSS
Office of Health, Safety and Security
Types of breaches that must be reported include, but are not limited to the following:
loss of control of employee information consisting of names and social security numbers (including temporary loss of control);
loss of control of Department credit card holder information;
loss of control of PII pertaining to the public;
loss of control of security information (e.g., logons, passwords, etc.);
incorrect delivery of sensitive PII;
theft of PII; and
unauthorized access to PII stored on Department operated web sites.

9. Reporting Requirements
HSS
Office of Health, Safety and Security
PII Breaches must be reported within immediately upon of discovery – Applies to all media including paper, computer and electronic media
Reports of PII breaches will be transmitted via the DOE Cyber Incident Response Capability (DOE-CIRC) in accordance with applicable Deputy Secretary or Under Secretary policies and procedures.
Immediate notifications are required to the HSS Federal Program lead and to the HSS Office of Resource Management / Office of Information Management
Within one hour of receiving the PII breach report, the DOE-CIRC will notify the U.S. Computer Emergency Response Team (US CERT) of the breach, as set forth in OMB Directive and in accordance with current incident reporting processes. Additionally, the DOE-CIRC will notify the Department’s Senior Agency Official for Privacy and other senior officials in accordance with current procedures
Additional Notifications by HSS will include
DOE Senior Management
Office of Management and Budget
House and Senate Committees
Other Government Agencies with an equity

10. Internal Actions Requirements
HSS
Office of Health, Safety and Security
Program Offices are responsible for compiling a report that contains:
a brief description of what happened, including the dates of the data breach and of its discovery, if known;
a description of the personnel information that was involved (e.g., full name, social security number, date of birth, home address, account numbers, etc.);
a brief description of actions taken by the Department to investigate, mitigate losses and protect against any further breach of data;
contact procedures to ask further questions or learn additional information, including a toll-free telephone number, address, web site, and/or postal address;
steps that individuals should take to protect themselves from the risk of identity theft, including steps to obtain fraud alerts, if appropriate, and instructions for obtaining other credit protection services (NOTE: Alerts may include key changes to fraud reports and on-demand personal access to credit reports and scores); and
a statement of whether the information was encrypted or protected by other means, when it is determined such information would be beneficial and would not compromise the security of any Departmental systems.

11. Internal Actions Requirements
HSS
Office of Health, Safety and Security
Risk Analysis / DOE Privacy Impact Response Team (PIRT)
the nature and content of the data (e.g., the data elements involved, such as name, social security number and/or date of birth, etc.);
the ability of an unauthorized party to use the data, either by itself or in conjunction with other data or applications generally available, to commit identity theft or otherwise misuse the data to the disadvantage of the record subjects;
ease of logical data access to the data given the degree of protection for the data (e.g., unencrypted, plain text, etc.);
ease of physical access to the data (e.g., the degree to which the data is readily available to unauthorized access);
evidence indicating that the data may have been the target of unlawful acquisition;
evidence that the same or similar data had been acquired from other sources improperly and used for identity theft;
whether notification to affected individuals through the most expeditious means available is warranted; and
whether further review and identification of systematic vulnerabilities or weaknesses and preventive measures are warranted.

12. Office of Health, Safety and Security
Liabilities
HSS
Office of Health, Safety and Security
The Department or Program Office may be responsible for:
Providing credit monitoring service for 1 year
Legal fees of individuals whose PII was lost / stolen
Civil Law Suits
Criminal Prosecution (negligence)

13. Office of Health, Safety and Security
HIPAA
HSS
Office of Health, Safety and Security
Requirements for the Protection of PHI similar to PII:
Health and Human Services (HHS) drafting additional regulation as a result of recent update to HIPAA
New regulations expands coverage beyond medical community (lawyers, accountants / billers)
Protection of information from unauthorized access or disclosure
Recommend the use of encryption to protect data at rest and data in transit
Look for HIPAA compliant software or FIPS compliant software
Only release data when appropriate for the individual to do their job.

14. Understanding & Safeguarding PII
HSS
Office of Health, Safety and Security
Loss of PII:
Can lead to identity theft (which is costly to the individual and to the Government);
Can result in adverse actions being taken against the employee who loses PII;
Can erode confidence in the Government’s ability to protect personal information.

15. Safeguarding & Handling PII – The Do’s
HSS
Office of Health, Safety and Security
Safeguarding & Handling PII – The Do’s
DO make sure all personal data is marked “FOR OFFICIAL USE ONLY” or “PRIVACY DATA”
DO report any loss or unauthorized disclosure of personal data to your supervisor, program manager, Information System Security Manager, or Privacy Act Officer
Do report any suspected security violation or poor security practices relating to personal data
DO lock up all notes, documents, removable media, laptops and other materials containing personal data when not in use

16. Safeguarding & Handling PII – The Do’s
HSS
Office of Health, Safety and Security
Safeguarding & Handling PII – The Do’s
DO log off, turn off, or lock your computer whenever you leave your desk
DO protect personal data from unauthorized use
DO encrypt personal data sent via
DO destroy personal data via shredder when no longer needed and retention is not required
DO be conscious of your surroundings when discussing personal data—protecting verbal communication with the same heightened awareness as you would paper or electronic data

17. Safeguarding & Handling PII – The Don’ts
HSS
Office of Health, Safety and Security
Safeguarding & Handling PII – The Don’ts
DON’T leave personal data unattended
DON’T take personal data home, in either paper or electronic format, without written permission of your manager or other official, as required
DON’T discuss or entrust personal data to individuals who do not have a need to know
DON’T discuss personal data on wireless or cordless phones (unless absolutely necessary)
DON’T put personal data in the body of an , rather password-protect it as an attachment
DON’T dispose of personal data in recycling bins or regular trash unless it has first been shredded

18. Safeguarding & Handling PII
HSS
Office of Health, Safety and Security
Safeguarding & Handling PII
Review business and programmatic processes within your areas and eliminate all unnecessary collection of PII
If you aren’t going to use it, don’t collect it
Report all mishandling of PII, i.e. unencrypted , unencrypted files
Use software or hardware encryption methods
Look for FIPS compliance and / or HIPAA compliance
There is no conflict between the Privacy Act and HIPAA

19. Office of Health, Safety and Security
Questions
HSS
Office of Health, Safety and Security
Questions ??
Contact Information
Telephone