DHS/FEMA/PIA-049 Individual Assistance (IA) Program

11m ago
73 Views
1 Downloads
923.54 KB
77 Pages
Last View : 3d ago
Last Download : 1m ago
Upload by : Kairi Hasson
Transcription

Privacy Impact Assessmentfor theIndividual Assistance (IA) ProgramDHS/FEMA/PIA-049 January 11, 2018 Contact PointChristopher B. SmithOffice of Response and RecoveryFederal Emergency Management Agency(202) 646-3642Reviewing OfficialPhilip S. KaplanChief Privacy OfficerDepartment of Homeland Security(202) 343-1717

Privacy Impact AssessmentDHS/FEMA/PIA-049 Individual Assistance ProgramPage 1AbstractThe U.S. Department of Homeland Security (DHS), Federal Emergency ManagementAgency (FEMA), Office of Response and Recovery (ORR), Individual Assistance Divisionmanages the Individual Assistance (IA) programs. These programs provide disaster recoveryassistance to individuals and support FEMA’s recovery mission under the Robert T. StaffordDisaster Relief and Emergency Assistance Act, as amended (Stafford Act), through the collectionand processing of disaster survivor information obtained through electronic or paper-based means.FEMA is publishing this Privacy Impact Assessment (PIA) to broadly cover the collection, use,maintenance, retrieval, and dissemination of personally identifiable information (PII) of applicantsfor the purpose of implementing the FEMA IA programs.OverviewIndividual Assistance (IA)1 is authorized when a Governor or Tribal Chief Executiverequests federal assistance and the President of the United States declares a major disaster oremergency.2 The Governor’s or Tribal Chief Executive’s request for assistance may include anyof the following: IA, Public Assistance (PA), or Hazard Mitigation Assistance (HMA). FEMAmay begin the initial collection of individual applicants’ information once a Presidentialdeclaration has occurred or may be imminent for a major disaster or emergency.The IA Division’s mission is to ensure that disaster survivors have timely access to a fullrange of programs and services to maximize their recovery. To support this mission, the IADivision operates the IA programs, which include the Individual and Households Program (IHP)and the Transitional Sheltering Assistance (TSA) program. The IHP3 provides financial assistanceand direct services to those who have necessary expenses and serious needs as a direct result of adisaster and are unable to meet those needs through other means. The TSA program providessurvivors with lodging in hotels or motels that are paid directly by FEMA. The provision of IHPand TSA requires FEMA to collect, use, maintain, and share PII and sensitive PII (SPII)4 fromapplicants, and this is accomplished through various information technology (IT) systems,applications, and forms. FEMA is publishing this PIA to discuss the IHP and TSA from aprogrammatic standpoint, to include the IHP and TSA’s initial collection of information, its1Individual Assistance refers to money or direct assistance to eligible individuals and households whose propertyhas been damaged or destroyed as a direct result of a major disaster or emergency and whose losses are not coveredby insurance or other means.242 U.S.C. §§ 5121-5207.342 U.S.C. § 5174(a)(1).4SPII refers to the use of the Social Security number, bank account information, and limited medical information.For the purposes of this document, “PII” will be used to refer to both regular PII and SPII.

Privacy Impact AssessmentDHS/FEMA/PIA-049 Individual Assistance ProgramPage 2eventual use and storage, and the associated technologies and tools used to support the program.With the publication of this PIA, the following PIAs have been retired: DHS/FEMA/PIA-001 Emergency Preparedness and Response (EP&R) IndividualAssistance (September 21, 2004). DHS/FEMA/PIA-012a Disaster Assistance Improvement Program (DAIP) (November16, 2012). DHS/FEMA/PIA-027 National Emergency Management Information System-IndividualAssistance (NEMIS-IA) (June 29, 2012). DHS/FEMA/PIA-038(a) Virginia Systems Repository (VSR): Data Repositories (May12, 2014).Individuals and Households ProgramThe most prominent IA program is the IHP, which requires the collection of certain PII inorder to properly administer the program. IHP provides financial assistance and direct assistancein the form of temporary housing assistance to those who have necessary expenses and seriousneeds as a direct result of a disaster and are unable to meet those needs through other means.5 IHPconsists of Housing Assistance (HA) and Other Needs Assistance (ONA), which comprise the coreservices that FEMA provides directly to eligible individuals and households.HA provides financial or direct assistance to individuals or households whose property hasbeen damaged or destroyed by a major disaster or emergency and whose losses are not covered byinsurance. HA may consist of Lodging Expense Reimbursement, Rental Assistance, DirectTemporary Housing Assistance, Repair Assistance, Replacement Assistance, or Permanent orSemi-Permanent Housing Construction. ONA provides financial assistance for disaster-relatednecessary expenses and serious needs that are not covered by insurance. To determine theassistance needs of an applicant, National Processing Service Center (NPSC)6 representatives mayask medically-related questions to determine what types of durable medical equipment may havebeen lost or damaged due to the disaster, or what modifications to FEMA-provided housing maybe necessary to make a dwelling safe for an applicant or household member with access andfunctional needs. State, territorial, or tribal governments may elect to administer ONA themselvesor jointly with FEMA. If ONA is being administered jointly, state, territorial, or tribal government5See Individuals and Households Program Unified Guidance, FP 104-009-03 (September 2016), available 808281201b6eebf9fbbd7c8a070fddb308971/FEMAIHPUG CoverEdit December2016.pdf.6NPSCs are call centers where survivors can call FEMA’s toll-free phone number to apply for assistance or checkthe status of an existing application. FEMA operates three NPSCs located in Denton, TX, Hyattsville, MD, andStephenson, VA, and these sites are staffed year-round and have the capability to expand with additional staff withinfive hours of a Presidential disaster declaration.

Privacy Impact AssessmentDHS/FEMA/PIA-049 Individual Assistance ProgramPage 3users will have access to the State Web Module in National Emergency Management InformationSystem-Individual Assistance (NEMIS-IA), FEMA’s master database that supports theadministration of various available disaster assistance programs.Transitional Sheltering Assistance (TSA)FEMA may provide TSA to applicants who are unable to return to their pre-disasterprimary residence because their home is uninhabitable or inaccessible due to a Presidentiallydeclared disaster. TSA is intended to reduce the number of disaster survivors congregating inshelters by quickly transitioning survivors into short-term accommodations through directpayments to lodging providers.In order to move individuals out of temporary shelters and into transitionalaccommodations, such as hotels and motels, FEMA will survey survivors in temporary shelters,sometimes prior to their formal registration for assistance. These surveys will include contactinformation, FEMA registration status, and TSA eligibility or rental assistance eligibility. If theindividual is not registered for FEMA assistance, FEMA will also deploy a strike team7 to registerthe individual for IA. Once they are registered, the data that was collected in the temporary shelterswill be correlated against the formal registration data. If found eligible for TSA assistance,applicants’ PII may be shared with lodging providers in order to transition the applicant into shortterm accommodations. This determination is made automatically when an applicant first appliesfor assistance, and his or her PII is only shared if found eligible.Disaster Assistance Improvement Program (DAIP)Under Executive Order (EO) 13411, FEMA was required to simplify the process ofidentifying, applying for, and checking the status of disaster assistance. 8 As a result, FEMAimplemented the Disaster Assistance Improvement Program (DAIP), which provides a single pointof collection for disaster survivor information, regardless of whether a survivor applies forassistance online9 or via phone. DAIP initiates the collection of information relevant to all disasterassistance programs. Through established criteria and programs, DAIP then disseminates theinformation to other federal agencies and to NEMIS-IA. During this time, DAIP also performsverification of records and checks for duplication of benefits.EO 13411 also required FEMA to “strengthen controls designed to prevent improperpayments and other forms of fraud, waste, and abuse.” The DAIP IT system automatically flagspotentially duplicate records, which alerts FEMA personnel that the record should be manually7A strike team is a group of FEMA personnel deployed to a disaster-affected area to assist survivors in applying forIA.8Executive Order 13411, “Improving Assistance for Disaster Victims.” 71 FR 52729 (September 6, 2006).Available at .gov.

Privacy Impact AssessmentDHS/FEMA/PIA-049 Individual Assistance ProgramPage 4reviewed, and prevents the applicant from receiving any assistance until the potential duplicate isresolved. FEMA further prevents survivors from receiving duplicate benefits by sharing survivorinformation with participating federal agencies, enabling them to adjust or offset disbursements tosurvivors as required under 44 CFR § 206.191. In furtherance of this requirement, FEMA hasestablished Computer Matching Agreements (CMA) with the U.S. Department of Housing andUrban Development (HUD) and the Small Business Administration (SBA) as a measure to preventapplicants from receiving duplicate benefits. FEMA’s CMAs are discussed further in section 6.2.IT SystemsFEMA operates and uses the following IT systems to support the administration of the IAprogram and processes. These IT systems facilitate various functions to help FEMA assess andmeet the needs of survivors. While they are separate IT systems, they all use the same PII dataelements, and receive PII from the same, original data sources—the survivor applicantsthemselves. The data is collected once during the survivor’s initial contact with FEMA and it flowsinto the IT systems outlined below:10 DAIP10 is the initial collection point for applicant PII, and is the IT system that NPSCstaff enter survivor information into in order to initiate a survivor’s application for FEMAassistance. The DAIP IT system then disseminates applicant information to NEMIS-IAand to other federal agencies to support the administration of available disaster assistanceprograms. NEMIS-IA11 is the IT system that houses survivor case files and is the master databasethat FEMA uses to administer its assistance programs and make disaster assistancedecisions. VSR12 is a platform that supports Temporary Sheltering Assistance (TSA) and housesnumerous applications that provide support to various IA functions, including ContinuedRental Assistance, communications with staff at an NPSC, and communications toapplicants. Disaster Management and Support Environment (DMSE) Cloud Environment (CE)13 isultimately where the information collected by Disaster Survivor Assistance (DSA) mobileapplication is stored.See Appendix A, p. 54.See Appendix A, p. 49.12See Appendix A, p. 58.13See Appendix A, p. 62.11

Privacy Impact AssessmentDHS/FEMA/PIA-049 Individual Assistance ProgramPage 5 Automated Construction Estimating (ACE)14 is the tool that field inspectors use to collectand store inspection data of properties damaged during a disaster. ACE receives survivorPII from NEMIS-IA in order to schedule and conduct housing inspections. FEMA IHP Program Management Section Customer Resource Management portal15supports the IHP Helpdesk that FEMA uses internally to track issues with applicants’ files.Through the use of the IT systems and tools, FEMA is able to administer its assistanceprograms and fulfill the needs of IA applicants. They also help FEMA provide and improvecustomer service by making the relevant information more easily accessible to FEMA personnelwho provide IA services and by reducing the wait times for applicants requesting IA services. Inorder to accomplish their intended purposes, these systems may use a variety of disaster survivorPII, up to and including the full dataset collected from the survivor’s initial application.16Having an interconnected network of systems allows survivor information to be collectedonce, minimizing the data files necessary to complete the registration process, and enables theinformation to be disseminated to the authorized agencies that are part of the disaster assistanceprocess. Ultimately, data in NEMIS-IA is replicated into the Enterprise DataWarehouse/Operational Data Store,17 in order to allow FEMA to conduct reporting and analysisto inform leadership and to improve customer service in the future.The PII stored in each IT system is only that which is necessary to allow the IT system andFEMA personnel to perform their job functions, and access is only granted to specific IT systemsbased on mission need and an individual’s need to know.Disaster Assistance Application ProcessSurvivors’ first interaction with FEMA is typically through the websitewww.disasterassistance.gov, or through the FEMA Helpline, where they can speak with a NPSCrepresentative. However, in some circumstances, FEMA may pre-register survivors who are notalready registered for disaster assistance by surveying them for their contact information andregistration status in order to rapidly provide access to TSA and move them out of temporary masscare shelters. Survivors requesting disaster assistance online use the pre-screening questionnaire18service hosted on www.disasterassistance.gov to identify types of assistance for which they maybe eligible, and then they may choose to register directly for assistance. The pre-screening14See Appendix A, p. 70.See Appendix A, p. 72.16See OMB 1660-002: FEMA Form 009-0-001.17See DHS/FEMA/PIA-026 Operational Data Store (ODS) and Enterprise Data Warehouse (EDW) (June 29, 2012),available at ns/privacy pia fema 026 2012.pdf.18The website www.disasterassistance.gov and the pre-screening questionnaire is hosted by the U.S. Department ofLabor (DOL), but all of the information collected from applicants is not shared with DOL; rather, all applicant PII isentered directly into the DAIP IT system.15

Privacy Impact AssessmentDHS/FEMA/PIA-049 Individual Assistance ProgramPage 6questionnaire provides a list of the types of assistance and the option to print the assistancedescriptions at a later time or to email assistance descriptions as a reference for later.To apply for disaster assistance, survivors have four options: visit the websitewww.disasterassistance.gov (mobile or full desktop site), call the FEMA Disaster AssistanceHelpline and speak to an NPSC representative, register directly with a member of the DSA cadre,19or apply using paper forms at a Disaster Recovery Center (DRC).20 Survivors may also check thestatus of their registration by creating or accessing an online account onwww.disasterassistance.gov. If a survivor decides to apply online, he or she uses FEMA’s onlineDisaster Assistance Center (DAC) to complete the registration process. If a survivor chooses toregister in person with a DSA cadre member, the DSA cadre member collects the survivor’s PIIusing a FEMA-issued mobile device and enters it directly into DAIP. If a survivor calls the DisasterAssistance Helpline, an NPSC representative will read a Privacy Notice, collect the survivor’s PII,and enter it into DAIP.Regardless of the method of registration, FEMA collects the survivor and co-applicant’s21PII to determine whether the survivor is eligible for FEMA assistance. The survivor either entersthe information into the online form or provides the information directly to the DSA or NPSCrepresentative. This information includes name, date of birth, and Social Security number (SSN)of the applicant and co-applicant, as well as address, household bank account information, contactinformation, the names and ages of all occupants, information about the damaged dwelling,ownership or renter status, insurance information, disaster-related expenses (medical, dental, childcare), disaster-related vehicle damage, emergency needs, business damage, and incomeinformation.Regardless of the method of registration, the information collected from survivors isinitially entered into DAIP. DAIP then disseminates the information to NEMIS-IA and the otherIA IT systems that require the information to accomplish their purposes in facilitating the IAprocess. DAIP disseminates information based on eligibility determination, and NEMIS-IAdetermines the following: FEMA Disaster Registration Number, which is a unique identifier forthe applicant’s file; Application Status (“In-Process,” “Submitted” “Approved,” or “Denied”);19The mission of the DSA program is to build and sustain an expeditionary workforce that can establish a timelypresence primarily focused on addressing the needs of disproportionately impacted populations and disastersurvivors. DSA cadre members register survivors for disaster assistance, provide guidance on the registrationprocess, and provide an overview of the assistance available through FEMA.20See Individuals and Households Program Unified Guidance, FP 104-009-03 (September 2016), p. 31, available 808281201b6eebf9fbbd7c8a070fddb308971/FEMAIHPUG CoverEdit December2016.pdf.21A co-applicant is often included to allow an individual other than the main applicant to be able to check the statusof the application. Under most circumstances, the co-applicant and the applicant are spouses or domestic partners. Ifthe co-applicant is not listed as such, FEMA personnel cannot discuss the application status or reveal any details ofthe application to that individual. Without a co-applicant, FEMA can only discuss the application status with theoriginal applicant.

Privacy Impact AssessmentDHS/FEMA/PIA-049 Individual Assistance ProgramPage 7Housing Inspection Required (Y/N); Priority of Assistance; Type of Assistance being considered;and time stamps.Once an application is completed, FEMA sends out a hard-copy version to the applicant,so that he or she has a chance to review it for accuracy. An important part of the mail-out packageis the Eligibility Determination Letter, which explains to the survivor the types of benefits forwhich FEMA has found them to be eligible.22 This mail-out package also includes instructions onthe appeal process, as well as a redress notice. This mail-out package is sent automatically, unlessan applicant opts out of receiving it and chooses instead to receive all correspondenceelectronically.After completing the initial registration, survivors are required to submit proof of thefollowing items, as appropriate: identity, such as a driver’s license or passport; home ownership;residential rental leases; insurance; medical bills, in the event of a disaster-related medicalcondition; and tax forms. Other substantiating documentation may also be submitted (e.g.,photographs of damage) dependent upon the circumstance. Survivors can submit thisdocumentation through www.disasterassistance.gov, by faxing it, or by mailing directly to FEMA.After receipt, the documents are stored in FEMA’s enterprise document management system,Document Management and Records Tracking System (DMARTS).23In order to monitor their application status or update their information, survivors mayestablish a User ID, password, and personal identification number (PIN) to create an onlineaccount at www.disasterassistance.gov. Only survivors who wish to gain access

DHS/FEMA/PIA-027 National Emergency Management Information System-Individual Assistance (NEMIS-IA) (June 29, 2012). DHS/FEMA/PIA-038(a) Virginia Systems Repository (VSR): Data Repositories (May 12, 2014). Individuals and Households Program The most prominent IA program is