On this page:

• I. Data in the System
• II. Access to the Data
• III. Attributes of the Data
• IV. Maintenance of Administrative Controls

I. Data in the System

1. Generally describe what data/information will be collected in the system.

   For grant assistance provided to organizations as well as Fellowship assistance provided to individuals, the Las Vegas Finance Center (LVFC) collects, enters and transmits relevant data provided on forms into various systems and stores hardcopy documents and forms. LVFC's responsibility for Fellowship assistance issued to individuals requires LVFC to collect and maintain hardcopy documents that contain personally identifiable information that requires protection under the Privacy Act.

2. What are the sources and types of the information in the system?

   Data sources and types include:
   
   A. completed SF3881, Vendor ACH Enrollment Form, EPA 190-F-05-001, Fellowship Stipend Payment Enrollment Form, EPA Form 5770-9, Completion of Studies Notice, and SF5510, Authorization Agreement for Preauthorized Payments, are forms that are received from grant and Fellowship recipients as hardcopy documents that are either mailed or faxed to LVFC as well as documents that are printed/re-produced from the systems used by LVFC staff. The SF5510 Form is the data source used to collect enrollment information for a small number of asbestos loan collections received bi-annually from organizations. The SF5510 form contains the name of the organization, mailing address, bank routing transmit number and bank account number, type of bank account and TIN. The SF3881, EPA Form 5770-9, and EPA 190-F-05-001 forms received from individuals for Fellowships contain personally identifiable information (PII). The PII includes: financial institution electronic routing number, bank account number; Taxpayer Identification Number (TIN)/SSN, email address, EPA assistance ID/fellowship number, and the name and address of the individual. All other SF3881 forms received are from organizations that contain the name of the organization, address, contact information, TIN, routing transit number, bank account number, and bank account type.
   
   B. Hardcopy Assistance Agreement/grant and Fellowship documents received from EPA's Grants Management Offices (GMO's), received by fax, and documents reproduced from IGMS, the Integrated Grants Management System. The hardcopy documents stored at LVFC's premises and information accessible in IGMS and IFMS through the LVFC LAN contain information about the recipient of the grant, fellowship, cooperative agreement and interagency agreement, including the name of the entity accepting the award. This is usually an organization, with the exception of fellowships, which are awarded to persons, and interagency agreements which are awarded to other federal agencies. LVFC maintains information on the organization, including the business address, business phone number, mail code, and tax identification number. We also maintain professional contact information on the people in that organization involved in the grant, including mail code, phone number, and email address. In the case of the fellowship recipient, the tax identification number is also the social security number and mailing information may be the mailing information for their home.
   
   Note: Recipients include individuals or organizations that receive financial assistance from EPA or are indebted to EPA. The systems used by LVFC staff for entering data source information and re-producing document information includes: IGMS, IFMS, and the Fellowship Payment System (FPS) which are all EPA owned applications as well as the U.S. Treasury's Pre-Authorized Debit system (PAD).

3. How will the data be used by the Agency?

   The data is used to provide for:
   
   a. electronic funds transfer of payments and collections to both companies and individuals who have received grant/Fellowship assistance from EPA. All electronic payments issued by the U.S. Treasury must contain the financial institution routing transit number, bank account number, TIN, and bank account type. Without this information, funds could not be properly routed electronically. Occasionally, when funds cannot be electronically disbursed, individuals receive check payments at their physical address.
   
   b. payment data transmitted by EPA is used by Treasury's Taxpayer Offset Program, when applicable to offset federal payments to a recipient by other Federal debt owed.
   
   c. recording the obligation transaction for the Assistance/Fellowship Agreement in the agency accounting system, IFMS.
   
   d. information is used to contact recipients and research transaction issues.

4. Why is the information being collected? (Purpose)

   Primarily for compliance with 31 CFR Part 210, Federal Government Participation in the Automated Clearing House (ACH). The ACH network is a nationwide electronic funds transfer (EFT) system that provides for the inter-bank clearing of credit and debit transactions and for the exchange of information among participating financial institutions.
   
   LVFC is required to follow internal agency processes and procedures for entering and accessing data in internal systems as well as follow external requirements issued by OMB, the U.S. Treasury for conducting financial business with recipients of Federal Assistance. IFMS facilitates electronic commerce with grantees and provides accounting and budgetary controls for the entire agency. IFMS increases the availability of grant information for Agency managers, providing them a basis for sound decision-making and oversight and improving the speed with which they can respond to information queries from Congress and the public. For these reasons, it is LVFC's responsibility to ensure that IFMS contains accurate information for grant/fellowship related financial transactions.

Top of Page

II. Access to the Data

1. Who will have access to the data/information in the system (internal and external parties)? If contractors, are the Federal Acquisition Regulations (FAR) clauses included in the contract (24.104 Contract clauses; 52.224-1 Privacy Act Notification; and 52.224-2 Privacy Act)?

   Internal, primarily LVFC staff and the Office of Inspector General Staff. Primarily, only authorized LVFC users have access to the systems accessible through the LVFC LAN and paper documents physically stored at LVFC.
   
   Note: The LVFC LAN and LAN NDS Container General Support System provide the electronic conduit for accessing the agency systems and data attached to the agency Wide Area Network. The Security Plan for the Las Vegas LAN and LAN NDS Container identifies systems utilized by LVFC staff as well as hardcopy documents stored at LVFC.

2. What controls are in place to prevent the misuse of data by those having authorized access?

   a. Assigned LVFC staff enters routing, banking and address information and must have authorized access to the system for which the data is being entered. b. Physical access to LVFC's office requires visitors to be physically escorted at all times. After business hours, the office is locked. Facility security is controlled via electronic card access. c. All LVFC staff are required to sign an annual "OCFO LAN and PC Security Agreement" which states the following:

   • Do not attempt to view, change, or delete data unless you are authorized to do so.
   • Do not use your privileges to obtain data/files or run applications for anyone that is not authorized to do so.
   • Abide by all EPA record management and record retention requirements.
   • Be sure that only authorized personnel are allowed to view confidentially-sensitive data whether the data is on your screen or printed out on paper.
   • When viewing or processing confidentially sensitive data, be sure the PC is in a non-traffic area as that only persons authorized to see the data are in the area.

3. Do other systems share data or have access to data/information in this system? If yes, explain who will be responsible for protecting the privacy rights of the individuals affected by the interface? (i.e., System Administrators, System Developers, System Managers)

   No PII data is interfaced between systems. Because LVFC staff access the systems that contain PII data via the LVFC LAN General Support System, the LVFC LAN system manager and system administrator are responsible for ensuring proper agency security procedures are adhered to for the general support system.

4. Will other agencies, state or local governments share data/information or have access to data in this system? (Includes any entity external to EPA.)

   Yes, but for only payment and collection files transmitted to the U.S. Department of Treasury/Federal Reserve Bank system that are used for payment, collection, and Taxpayer Offset Purposes (TOP). For TOP related transactions, the Department of Justice has access to limited payment related information.

5. Do individuals have the opportunity to decline to provide information or to consent to particular uses of the information? If yes, how is notice given to the individual? (Privacy policies must clearly explain where the collection or sharing of certain information may be optional and provide users a mechanism to assert any preference to withhold information or prohibit secondary use.)

   No Public access

Top of Page

III. Attributes of the Data

1. Explain how the use of the data is both relevant and necessary to the purpose for which the system is being designed.

   All the data is directly relevant to LVFC's mission including: issuing payments, initiating collections, participating in the Taxpayer Offset Program, etc.

2. If data are being consolidated, what controls are in place to protect the data from unauthorized access or use? Explain.

   N/A. LVFC is not consolidating data.

3. If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain.

   N/A - No consolidation planned.

4. How will data be retrieved? Can it be retrieved by personal identifier? If yes, explain. (A personal identifier is a name, Social Security Number, or other identifying symbol assigned to an individual, i.e. any identifier unique to an individual.)

   Data/information is stored and retrieved by the EPA assigned Assistance Agreement Number, Grant or Fellowship number rather than a PII data element. However, for subsequent record search purposes for Fellowship awards and related transactions, some data records can be retrieved by Social Security Number. Data can be retrieved by recipient name, which in the case of the fellowship IGMS module as well as IFMS, and the Fellowship Payment System (FPS), is the name of the individual and by Taxpayer Identification Number, which is the Social Security Number for fellows. It can also be retrieved by assistance id/fellowship number, program code, project officer, grant specialist, by awarding organization, etc. However for IGMS the Fellowship Module has tightly controlled access, including the grants specialists in Headquarters who award the fellowships, and the IGMS system managers and hotline employees who support them, about 35 people in all. Grants specialists only have access to those fellowship documents for which they are the specialist or delegate. For LVFC staff, FPS access is limited to a limited number of staff. Since LVFC is responsible for all agency grant assistance/fellowship payments, most LVFC staff have access to personal identifier information in IFMS as it's needed to do their daily work.

5. What achievements of goals for machine readability have been incorporated into this system? Where is the policy stated? (Machine readable technology enables visitors to easily identify privacy policies and make an informed choice about whether to conduct business with that site.)

   NA - not a web based system so public access not provided

Top of Page

IV. Maintenance of Administrative Controls

1. Has a record control schedule been issued for the records in the system? If so, provide the schedule number. What are the retention periods for records in this system? What are the procedures for eliminating the records at the end of the retention period? (You may check with the record liaison officer (RLO) for your AA-ship, Tammy Boulware (Headquarters Records Officer) or Judy Hutt, Agency Privacy Act Officer, to determine if there is a retention schedule for the subject records.)

   For IFMS related hardcopy documents - Yes, the records control schedule is found under EPA General Records Schedule 129, 24/6b. However, those records applicable to Superfund cost recovery have a record retention of 20 years.

   Due to file space limitations for storage of hardcopy files, all LVFC closed grant files are scanned and available electronically on the LVFC LAN. The system security plan states "However, as part of the normal operation of the system, disposal must occur for media, obsolete hardware, and information. Media that is no longer needed or is past its lifetime may include software distribution, backup tapes, input files from the accounting system or old printouts. All of these may contain sensitive, Privacy Act or copyrighted information. Prior to disposal, all paper media must be shredded (users are made aware of this in the rules of behavior). Magnetic media is erased using OCFO approved methods. CD's or optical media are scratched in at least ten places. Records must be kept of the destruction of media that was known to contain sensitive information, such as backups. A log for this purpose is kept by the LVFC LAN Manager. Obsolete or broken hardware that contains any information (typically on hard drives) must be destroyed. Alternatively, the hard drives may be removed and degaussed using OCFO approved methods. Broken hard drives may not be returned to the vendor to be refurbished without prior degaussing."

   Note: At the time of the IGMS Privacy Impact Assessment filing, for LVFC's hardcopy Fellowship documents - EPA Records Schedule 009 for IGMS was pending approval from the National Archives/Federal Records Center..

2. While the data are retained in the system, what are the requirements for determining if the data are still sufficiently accurate, relevant, timely, and complete to ensure fairness in making determinations?

   Recipient's are responsible for providing updated SF3881, EPA Form 5770-9, or EPA 190-F-05-001 forms to update their financial institution/account information for ensuring future timely receipt of payments. At the discretion of LVFC Certifying Officers they have access to verify the accuracy of electronic banking information prior to approving payments. At the discretion of LVFC Management, Quality Assurance reviews may be conducted periodically.

3. Will this system provide the capability to identify, locate, and monitor individuals? If yes, explain.

   Files attached to workpapers may contain privacy data. However, the system does not allow access to data using privacy data as keys for searches.

4. Does the system use any persistent tracking technologies?

   No.

5. Under which System of Records (SOR) notice does the system operate? Provide the name of the system and its SOR number if applicable. For reference, please view this list of Agency SORs. (A SOR is any collection of records under the control of the Agency in which the data is retrieved by a personal identifier. The Privacy Act Officer will determine if a SOR is necessary for your system.)

   SOR EPA-53: Integrated Grants Management System (IGMS) - Fellowship Module SOR EPA-29: EPA Travel, Other Accounts Payable, and Accounts Receivable Files

Top of Page