Webinar: Third Party Websites & Applications

Date: June 22, 2011
Speaker: Kris O'Neil (HHS Cybersecurity Team)
Presentation and discussion on privacy requirements and best practices in light of steps taken for the implementation of of OMB 10-23.0.
Download Slides (PDF)
Please review our exit disclaimer
If you have questions regarding this webinar or the HHS Center for New Media Webinar series, email newmedia@hhs.gov.
Transcript

All right, everyone, welcome to our HHS new media brown bag webinar series. My name is Katherine Hamilton, I will be facilitating the webinar today. Our regular meeting facilitator is out today, and today we have Chris presenting from the HHS cyber security team and I am going to go ahead and pass it over to Chris. 

 Everyone is on -- the speakers are muted, so if you do have a question, enter your questions into the question box ask in the webinar window and then we will be answering questions periodically throughout the presentation. 

 Okay. Thanks, Katherine. Thanks, everyone, for joining. We have a large attendance for our webinars that we typically do for privacy so I don't know if it is typical for new media but thanks, everyone, for joining. Hopefully you have heard a little about the requirements but this is a good introduction and a little overview and we have other trainings coming up which I will talk about at the end if you want more detail or need more did he detail, so this is just going to be a little overview. As Katherine mentioned, I think you all are on mute but feel free to ask questions through the webinar. I will try to talk and answer questions at the same time and if not I will get to your question at the end. Please ask anything you think might be relevant. I am happy to take hard questions. 

 We're here to talk about third party websites and applications. Before I begin, I thought it might be worth -- first we'll talk about privacy and then we'll talk about what is sigh third party website and application and then talk about what you may need to do depending on your role and we'll take any questions from the audience. 

 Probably everyone know what is private is is generally. I think you know it when you see it although everyone has a little bit different definition or different standard for themselves and of course context matters a lot as well, what you consider -- privacy for your doctor may be different than what you expect on Facebook or somewhere else. What we have here on slide 3 is the fair information principles, FCC kind of put these out and so most privacy laws including the privacy act identify these five privacy principles and the requirements of any privacy really are some balancing of these requirements and some ways to kind of get these out so the first one is notice and awareness. 

 Individuals should be given notice when you are collecting their information or how their information is going to be used that most of are you familiar with that with the privacy policy at the bottom of most web pages and there is choice and consent. Depending on the situation, individuals may have some opportunity to choose or condition tent to what information is provided to them. For example, for opted and opt out are usually the examples given so you can choose to provide certain information or you may choose not to and I think most of us have that experience where there is a Social Security number being asked by your cable company or something and you are like why do you need that and different information that I can provide you. 

 You want to be clear whether there is options for choosing what information to provide or if the individual needs the consent. Another privacy principle is access and participation. Since some instances there is not an opportunity to choose or content but regardless if you are collecting personal information you should be providing individual access to the information are you collecting about them. 

 It is particularly important when you are making benefits, of course, so you are applying for credit, and you are refused by the bank, and you should have an opportunity to review what information they had access to so you can see what information was incorrect or inaccurate and of course that's often the case. 

 You want to be able to access the information about you and be able to participate and correct where there is opportunities, where information is incorrect. Of course integrity and security, so if you are collecting personal information that needs to be secured and it needs to be maintained accurately so that numbers don't get trance posed and that sort of thing so that benefits aren't declined where they shouldn't be. 

 Of course finally enforcement and redress. A little about the redress is being able to amend and correct information that's wrong, but in general this should be a mechanism in place to make sure that any privacy policy, security measures and patient procedures are in force and are maintained correctly and then again if there is any violations or any mistakes that are made that the individual has an opportunity to address those and that there are ways to make a mends. 

 That is one-way to think about privacy. There really is one of my frustrations sometimes with the privacy committee is we all have different definitions of privacy and everyone wants to slice and Dice things in different ways but really good way of thinking about privacy and some ways all of these things need to be in place and if there isn't an opportunity for choice or consent, for example, then notice and awareness needs to be even more prominent. 

 Vice versa. If are you collect ago lot of personal information, access and participation and consent probably needs to be a higher priority than if you are not collecting very important information, so again your doctor, collects information that is just part of doing -- providing you healthcare, but you should have an opportunity to access the records that you are sure that when you are getting care that they're using the right information. 

 So I also didn't get into a lot of laws. I thought that might be a little too much information or not very helpful, but of course in the federal government we do have several privacy laws, biggest ones the privacy act and the E-government act of 2002 had privacy provisions for those of you ( indiscernible ) assessment required for systems and those tend to be the two big privacy laws. Of course depending on where you work in the federal government, other privacy laws may apply, HIPAA is another big one of course and has privacy requirements associated with it, and in addition to those two laws, really where a lot of privacy requirements come from are the office of management and budget and there aren't a lot of privacy laws that apply to federal government but what really where the requirements come from are O&B guidance where they explain and articulate how to supply and implement those privacy laws and more importantly they have a lot of additional requirements passed along. 

 I think we have a question.

 My last name is Chris O'Neill, O Nea L. I should have introduced myself more formally. I am with the cyber security program and support Mark Brown and Michael Carlton, our senior agency official tore privacy, so he has the broader responsibility to the entire department for private sigh and Mark Brown within the cyber security program has lead on a lot of the department privacy initiatives going on.

 We're here to talk about third party websites and applications and some of the privacy requirements for those and third party websites and applications are defined by O&B as a Web-based technology not exclusively operator controlled by a government entity or base technology that involves significant participation of nongovernment entity. Often they're located on a a Dot comwebsite and ( indiscernible ) incorporate on an agency's official website. 

 This is kind of the social media. It is really social media, kind of what they're talking about here but I believe O&B was intentionally using the term third party websites and applications because it is not just social media they want the privacy requirements apply to, and something that comes to mind is survey monkey has been brought up a few times and that initially probably wouldn't have crossed my mind and would be the big five you see on the right so slide 40 with Facebook, Twitter, You Tube, flicker and the blogs and they tend to be the social media when you hear those are what you think about and I may not have thought about survey monkey but it probably would fall in the application definition. 

 The definition came in OMB M1023. It followed on the social media memorandum I am sure most of you are familiar with and if are you not I think it came out in April of 2010 and encouraged the use of social media and certain things need to be in place and so the privacy requirements came out and in this third party website and application guidance. 

 A couple things to note, the purpose of the memorandum is ensure the agency uses TPWAs to protect privacy and consistent with law and there should be transparency of privacy policies, notification to individuals, should be provided notice, and there should be careful analysis of the privacy implications, whatever federal agencies choose to use the PPWA's. 

 So what you need to do is the guidance laid out several requirements. One is kind of obvious probably to inventory current and proposed uses. The cybersecurity has already conducted a data call with all senior officials for privacy if you are not familiar with that term within each octave there is a senior official privacy and in a lot it is someone responsible for the privacy act. However, it is not true in all instances for those of you here at the department and within the Office of the secretary Mark Brown is actually serving as the OS senior official for privacy, and I don't want to forget anyone or I would rattle them off but I know we have a lot of Opdivs on the phone and we conducted a data call with all of them. 

 We did the data call a few months ago so for have come online. I know there are different procedures in different OPDIVs to notify and get registered as a third party website or social media site and it is important for to us have the current inventory so that we can ensure the privacy requirements are being complied with. 

 The next thing is review and assess the website. Obviously there are already in place that predated this guidance, so we do have the ability everyone to review the policy and make sure you're comfortable with what Facebook and You Tube and all of the sites are doing with information and how you are going to be using the site and you will need to update your own privacy practices so make sure you can comply with 1023. Some examples are updating the policy and machine readable policy to describe the use of TPWA and make sure your website has privacy notice and both that's both on the federal website as well as on the third party website and those things should be in line and I know a lot of times there is a lot of reuse of privacy policies and everyone point to the privacy policy and really there should be unique privacy policy that is describe the practices your website. 

 Usually the main policy says we don't collect any personal information and then will you go to a site that has a web forum that's collecting personal information and it doesn't collect it, so we want to make sure those things are in place and if you are going to be linking to a third party website, from your page, you probably should be referencing the general policy regarding the third party websites. I will get into more of this with examples in a minute. 

 Another requirement is that you should ( indiscernible ) notifying the public redirected to a nongovernmental website. I know there are different perspectives on the alerts or statements on how they should read and be displayed with the OMB guidance does want to make sure people are aware they're leaving a government site and going to an external site. We did provide sample language at the end of the presentation. There is a long list of guidance we developed around third party websites. 

 We did release an implementation memo back in December, I believe, and that has some sample language you can use for privacy notices and then these alert statements. In addition to the alerts you need to make sure there is appropriate branding to distinguish activities on third party websites and so of course it should be an official website that should have official seals and third party websites and people know that even though you are an external site, it is being managed officially by the government. 

 Then, finally, you will need to conduct a privacy impact assessment on each use of the third party websites, and and we'll go into more detail about that later although we have a whole training on the third party websites and the PIA's, and and it is pretty simple and basically wants to make sure the requirements we already talked about have been implemented and that you have kind of thought about these requirements and that you have appropriately complied with the memo. It is really kind of a quick checklist to make sure that you followed these things you need to do. 

 A couple -- another question? The slide deck will be shared. I think they plan to send it out afterwards and it will also be a link to some other training that we have and several other documents that are both in here and then you will be able to get after the session. 

 So here is a couple of examples. This is we have only gotten one PIA I think from all of the third party website applications uses in the department, and that was from the office of inspector general and the -- actually a really fantastic PIA describing what they do as well as being able to demonstrate some of the -- how they definitely comply with the rierms in the 1023, so there is appropriate branding. 

 There is the official OIG seal. We have a privacy notice. Of course Twitter is a little fin I funny about privacy notice so it is a link to the privacy policy at OIG and it is prominently displayed and then there is a pop-up alert when you go to the actual OIG home page so I think this is hard to read, I know, but it says OIG HHS.gov in the bottom right-hand corner, and if you were to link on scroll over the OIG at HHS on Twitter, you would see that it says external link to read policy or read notice and click on that. 

 It has this external link. It has the notice. It has the privacy policy that's been updated to describe the use in the branding as well. A couple other quick examples, so on Facebook here is how help here. I know a lot of Facebook pages have sort of a comment moderation policy. Healthcare got dove has the privacy notice and common policy so privacy notice is prominent. I think a lot of Facebook pages and others are embedding the privacy policy for that comment policy and of course those two are really closely related because that's where a lot of the personal and privacy locations are relevant with that comment policy, but it is really great to be seeing privacy on the front page there when you go to it. 

 Here is You Tube. Within the video information you can provide a link back to the official government site and the official privacy policy as well as any other privacy notice that you need to put here. So each website, we know each one is a little different and has different capabilities just as far as posting and providing links to privacy policies and definitely feel free to be creative and we're hoping there will be lots of -- I know everyone is probably working together on these things and so definitely want to make sure that best practices get prom you will gated and each one will take a little different consideration. 

 I mentioned PIA questionnaire. That's sort of probably almost the starting point in a way because a lot of these other requirements, the questions take you through the requirements of 1023 so you don't have to read it and can figure it out and you can go sequentially through the third party website, PIA template that we have and make sure you have all of the requirements appropriately completed. It does require some additional analysis. I don't want to go into too much detail because we do have a separate training and we will have the opportunity if you want to go into detail or do need to complete the PIA to get training on that, but basically the process will be that you complete the questionnaire and you work with your senior official for privacy to get approval, and then that will be submitted to the department for the department's approval and then you would just need to make sure that you periodically review that PIA to ensure anything you described in there is accurate and of course nothing ink whiched too much with your use for Facebook or You Tube or others and nothing changed too much that will impact the PIA. 

 Getting started, the first thing is to really coordinate with your OPDIV senior official for privacy. They're aware of the requirements. They have been reviewing T they helped us develop the data call. They helped respond to data call and hopefully they have been reaching out to you or you have been reaching out to them to kind of start getting compliance with these things. If not, definitely please reach out to them and let them know if you are managing one of these websites that needs to complete a PIA and manage compliance in 1023. 

 Then I went over these at a high level and there is a lot of resources we developed. We have standard operating procedures in the privacy impact assessment so it really walks through each question and discusses and provides additional guidance and explains what OMB is asking for and because our PI's really ties closely to the OMB guidance and there is training offered and most operating decisions have now received special specific training on these third party websites and applications and I think there are a couple others we have coming up in July and we are going to be offering training probably once a month at least but probably twice a month here for the next couple of weeks or couple of months, and biweekly there is a webinar we host for security and privacy online reporting tool sport, the acronym, and it is we have the PIA built into and so we do training biweekly the privacy team does a training and usually that's on the system PIA and for the near term we're going to be TPWA, PIA training and hopefully that will provide -- if you missed any OPDIV training or OPDIV is coming up, feel free to join us on Friday and you can get on the listserv and find out when the upcoming ones will be coming up. Usually on Fridays they're usually at one and so you can probably just forecast out every two weeks from this Friday. There will be TPWA training. 

 Also on the website we have frequently asked questions, and you are with being to go through those and see if they help. We have gotten a lot of -- we have gotten a couple of pilots, a couple PIAs come in and we worked closely with the center for new media and so hopefully we have gotten a lot of question that is you may be asking probably answered in that FAQ, but if not, we're always happy to take additional questions at the Spectracef Help Desk -- cybersecurity Help Desk. You can see the email and it is staffed from 8 to 6 every day and you will get a fast response if you send the questions there. 

 That's how you can get to me. If I am out, the Help Desk knows exabtly who is in and who can get ahold of and to get an answer to your question. If you go to the internet site you will find a whole wealth of privacy documents and security documentation as well, and so that's the presentation and I want to go ore it relatively quickly but I was hope field goal we have lots of questions we can get into details based on the interest of group. 

 I see someone has their hand raised. If you have a question, you can type it into the question spot.

 While we're waiting for that, to clarify, who needs to allow PIA's and like for which accounts? 
 So the policy is that all third party websites and am a indications have a PIA and so that means each use, so if there are -- if you for each Facebook page the department has there should be a PIA, and the training we'll be talking about -- although there are differences and we're learning this quite a bit especially only a dumb have come in and the one that is have we heard it does sound like quite a bit of difference in the practices, so we do expect that each PIA should be reflective of what's going on on that particular website and how comments are being handled and what kind of PIA is being made available and that sort of thing, and each Facebook page needs to have it. Ideally the account holder I don't know a lot about exactly how each page is managed. Sounds like there are a lot of people who have multiple accounts and, yeah, each Facebook page, each You Tube page, each flicker page, each needs to have its own separate PIA and it is easier to work for the colleaguing manying the sites to work together if you know you are having more practices to document answers similarly. 

 Got it. And I know that there has been discussion as to like should the risk be couple, you know, big PIAs apply to everybody, and then you all end up going the route everybody needs to have their own. Can you discuss a little about the rationale behind? 


 Sure. OMB did provide -- say that it was possible to group a few PIA's together, and the challenge we found when we did the pilots as well as now that they're coming in, that there are differences in how sites are being managed and how people want to manage sites so we did feel the need for accountability perspective for as well as inventory reasons and all of thesis other things that the ideal, that what we really needed to have was a single PIA for each use. We do know that's a little bit of work and creates a little more work and we also know that will really be important for conveying to the public that you have kind of reviewed privacy and that you are not kind of infringing on their privacy rights or anything like that. 

 We know in most of the case that is we have seen I don't think there is a huge risk with using these sites. Of course as you guys know because you are managing them, you don't have a lot of access to information. You don't get a lot of information from these sites, and I am not sure the public is really that clear on that. I know I am a Facebook user and probably most of you all are, and we're all a little creeped out about I that. 

 We see the value but the privacy policies change occasionally, and we don't really know what it means or sounds like they changed but they really haven't and the facial recognition was the thing that came up last week, I think, and so there is always something going on with these sites and generally that's not really going to impact probably how the government is managing these pages and doesn't impact the information you are getting, and people have kind of chosen by being part of these but that's really the point of the PIA is convey that we don't have the information, the only thing we have are comments and moderating them more to protect you than because we're tracking you. We want to make sure you don't share PIA, so really I feel like a lot of the PIAs will be, no, we're not collecting information and here is why you should feel comfortable. 

 I know it is a little work but hopefully spending an hour or two kind of articulating your privacy practices will be useful for just thinking about privacy for a little while and I know like I said I think that privacy is something we're becoming more and more familiar with, have been doing privacy for about ten years now and ten years ago there wasn't a lot of people talking about it and then now it is really on the front page of the news every day, and so I think people are becoming more and more familiar and aware of choice and consent and the kind of options they have and that they can change the settings of Facebook and I still think it is important to take a little bit of time to step back and think about privacy if we are going to implement one of these third party websites. 

 Looks like we have had a few questions come in and I think we can open up that window.

 I will go in order here. With you want to join the PIA training, feel free to send a note to that cybersecurity email address. If you send a note to that saying you want to join, we'll make sure you get the invite and you can get added to the reminders. 

 The next question is would you speak a little bit about iPhone aps, how they fit into all of this. That's one of the hard questions I was mentioning earlier. I believe that applications, iPhone appes would likely fall under -- probably need to do the system PIA, not the third party website and application PIA. I believe that iTunes may be a third party website but probably not because we kind of are seeing that that's where people just go to get the application and if you are creating an application that people can download, you probably should be completing the system PIA and then you may need to complete the third party website application, too, and I actually think it is more likely to be the system PIA. They will definitely need to make sure privacy notices are in there, addressing privacy, any personal information being collected and that one is actually one of the hard ones that you probably would want to work with the senior official for privacy to determine for sure which of those you want to complete but I believe you want to start probably with the system PIA. 

 Do PIAs need to be filled out for existing Facebook and Twitter accounts if it follows the same policies as the website and -- yes, I think we answered that, probably came in after Reed's question, and so, yes, all existing Facebook and Twitter accounts new he had to have an individual PIA. 

 As well as You Tube and user voice and any of those other ones? 

 Yeah. I didn't get into the whole decision tree again because I wanted to keep a high level, but you saw the definition earlier and we do need to figure out whether or not you are a third party application and if you go to the PIA training at the cybersecurity internet or if you attend the training on Friday, we do kind of go through that decision process about what is a third party website and do you need to do a PIA, and it is very specific. It is about whether or not you are interacting with the public for open government and so if you are -- if you are using survey monkey to survey the public, you probably -- you don't have to comply with M -- if you are using survey monkey to the public, then you do need to -- it is a third party website that needs to comply with M-1023. M-1023 does only apply to interactions with the public. If you are using survey monk toy survey your employees, you would not need to do a PIA and wobt need to comply with M-1023. It is about interacting with the public and not employees. 

 The next question is if the Facebook page follows the same policies as the website, no. So yes and no I should say. So the privacy policies at your website so the healthcare.gov privacy policy or the OIG privacy policy, for example, was updated to describe its use of third party websites and applications, so it is we use twit to her interact with the public and we don't collect personal information by using Twitter and so it thates that information and does specifically call out third party websites and applications and their use, and so absolutely the privacy policies need to be updated to talk about that. 

 It hasn't come out get and GIO hasn't wanted us to prom gate it so much but thru's an audit going on around third party websites and applications and it is clear from that they expect agency websites are updated to describe the use of third party websites and applications. The challenge of course is if are you using 10 or 15 different tools and getting them all in one policy is difficult or describing differences or you may not be made available on nine out of the ten of those and on the tenth one you do get more information so describing all of that can be a bit of a challenge but the privacy policy needs to be updated to describe the third party use even if the third party use say we don't collect PII and your current privacy policy says you don't collect, you need to make it clear that you are not collecting it in both cases. 

 Chris, correct me if I'm wrong, but the privacy policy on the website basically this is the information we collect or don't collect on the website. The privacy notices on many of the third party accounts basically say this is not a government site. We are putting information from the government on the site but the privacy settings of the third party site are not subject to this being a requirement. There is a difference in the type of policies or notices that you put about privacy on Facebook versus on the Dot gov website. 

 That's right. I didn't want to go into too much information because I feel like that would save it all for the Friday training and future trainings and this is more the hopefully raise awareness about this and then help you seek other sources if you do need more information, but OMB did make this 1023 and did introduce this concept of making PII available, so they do -- you do need to identify PII being made available to third party websites because being made available means commenting liking all of those things why you use a third party website, and is making PII available, so we know you're not collecting PII generally speaking using the sites, you are not collecting Facebook, and you are not using it to collect PII, it is not the purpose, not why you are doing it, not what you are doing. However, people are liking and they are commenting and stheer doing all of those things and by virtue PII is being made available to HHS.

 Has anyone delineated policy on enforcement and redress? So there are -- there are privacy policy that is are out there generally speaking that talk about privacy act, for example, you have to write a system of records notice and in that it talks about how people can make complaints and do that sort of thing so there should be specific policies on enforcement and redress depending on the circumstances and what you have. I can't imagine with Facebook if it is really just being made available and we don't control that, there is not really a lot of enforcement or redress around that. Where there is sort of enforcement on our side it would be trying to track and make sure that everyone identified on the inventory or maintaining a official third party website application complied with M-1023 and we try to make sure PIAs are done and that sort of thing and I wouldn't imagine this context of third party websites or social media there would be a strong issue with enforcement of redress but that's where the SOP would -- the senior official privacy would come into play and would make sure that you're not doing anything you shouldn't be doing. 

 ( indiscernible ) training to the IT system to TPWs as well. So, yes, and no. There are specific requirements that we have for the PIAs and they do mirror our MO322 requirements for PIAs. We do expect these PIAs will be kept current, that they be reviewed at least annually, and because they're new we're not quite sure how much things will change with systems and generally things don't change that much because it is sort of very expensive to make major system changes, so from going from anonymous to not anonymous would be a big deal, and so you usually once a year is plenty to update those PIA's. I don't think these PIAs will change that much even with Facebook facial recognition, for example. We're not getting that information and not really using it at all so I don't think it would change a PIA that much. Yeah, we all will have to work together to make sure that if there are changes to Facebook or other sites that might impact PIA's or how practices are articulated here, and we would have to all work together to update those. 

 Generally once do you the PI A annual review would probably be sufficient. 

 For those of us notten grande in the privacy stuff can you tell us what MO322 provisions are. 
 Thanks for keeping me honest here. MO322 is the O B guidance that came out in 2003 to implement the privacy provisions of the E-government act. The E-government act required PIAs on all IT systems and so that's generally people have been doing PIAs the last eight or nine years and it has been on the IT systems and so there is a whole -- the senior official for privacy, for example, and even a lot of program officials are pretty familiar with the system PIA's, and so there are -- there is a whole separate guide on conducting a PIA for that and operating procedures for that and based on 322. 

 I thought ( indiscernible ) was covered. I am not sure. I don't know specificses of idea scale. In general every agency needs to do their own PIAs. GSA I do know has done some certifying accrediting of these things and have their own app so when you do your -- when we have our decision tree for whether we need to do a PIA on a third party application, we say it is another government agency you don't need to do it so no GSA has several app they put out and blogging software, for example, and that would be considered a government website because it would still be GSA and you wouldn't need to do it. If you are using a Dot come, you need to do a PI A. 

 I might be making this up, so this is a little fuzzy but I believe GSA conducts a PIA for the idea scale centered around opening government plans and because most of the agencies and departments really sort of open government plans utilized, idea scale, and I believe that the PAA put in place was a one-time thing, so from -- 

 Although in light of the OMB 1023, we'll have to go back and double check on that for all of you folks on the line. They may have done like a review of the privacy impact assessment for overall use but each agency still may need to file their own PIA to have on file. The PIA process should not be too arduous as long as you can explain what are you doing with the site. 

 Yeah. I agree. We know that it is a little bit of work, and especially the first time do you it, it will be hard, but if you do manage several accounts, I think that once you have done one, the other two will fall into place pretty quickly. 

 We'll follow occupy that GSAPIA question. 

 Thanks, Cheryl. 

 Specifically -- I don't know if that was a follow-on but specifically so they would not have to fill one out. I think that went with idea scale so we'll get back to you on that and double check. 

 How long will it take to review a PIA and how will that affect existing accounts? So the review of a PIA from the department perspective is all I can really speak to. Generally we try to -- once we are informed there is one to review we try to get them turned around in about ten business days. Really just depends on the timing and when we get them. It doesn't really take very long to review. Of course we're all learning this. We're learning about the social media sites and how this he work and of course I think privacy is new to a pot of people in this community well, so the first few coming in are taking a little longer than might be the case in I a couple of -- in a month or so. 

 Generally this shouldn't impact the use. I know there is already a lot up and running and and there is no plan to pull any sites down that don't have a PIA. Of course we do -- the CIO, might be he will Carlton, the senior agency official is also a title he wears, and has required that everybody be complying with these by the end of the fiscal year, so once that -- and fiscal year comes and I am not sure what will happen then but we do really encourage everyone to be diligent about complying with this and hopefully shouldn't take more than a few hours, probably less than that, to get the PIA done. It does have to go through a couple levels of review.

 When review them what are you looking for. 

 Generally those familiar with the PIA, the OPDIV senior official for privacy reviews for accuracy and completeness, so, for example, if you were to say that you're using Facebook to do behavioral advertising or marketing or something like that, hopefully they're the ones that catch that and say, no, don't do that, et cetera really just open government and that's how we should be, what our practice should state and that's what we should be doing and the department would really review for completeness, to make sure all the questions are completed and that they make sense when you read it, sometimes things do slip through where there is a little inconsistency and it is easier because we don't have a lot of examples for the third party websites and for systems if you are familiar with systems, they will say they don't collect personal information but then provide you a privacy act system of record number. Those two things don't quite make sense, so it is where they get through the senior official privacy and sometimes that happens and so we review for that sort of consistency and with the first few that have come in the third party websites we're taking a little closer look to mark sure that the policies have been updated, theres a clear link to the privacy policies, that the branding is there, those things because we're trying to learn how these things are being implemented and also because it is a little easier to check with a system it is pretty hard to go in and find out what information is being collect and handled, so for these initial ones we do do a little that and generally a senior official for privacy will review for accuracy and appropriatness of the practices and we'll just review to make sure that everything looks good and of course things are going to get posted on the public website and just like the system PIAs do and we want to make sure there is nothing in there that might create cause for concern for the public. 

 Do we need to fill out a PIA or update our online use. 

 There are multiple requirements in M-1023. Update your online privacy, at the website, and on the government website it is updating the privacy notice on the third party website and it is making sure there is external branding, a whole list of requirements identified at the beginning. One of them is also to complete a PIA. The PIA itself will walk you through the 1023 requirements to make sure you have complied with those things and if you have, then it is a pretty easy saying yes, yes, yes, in all of the questions, but slide 6 kind of walks through a lot of what these requirements are, so all of them need to be completed to be fully come Palestine r pliant -- come compliant. If agency used survey monk toy find ut what kind of contact the agency wants it needs to post a privacy policy. Yes. If you are using survey monkey make sure there is a notice and then you will want to identify survey monkey probably in your OPDIV and online privacy policy to say that you used third party websites. I think this is the part going to create a little bit of creativity and it is complicated to describe all of your practices on the online privacy policy on the government privacy policy, but generally should say probably provide a general principle about what you are doing with these third party websites and generally whether PIIas, personal identifiable information is being collected or not and then if it is generally you're not, just PI being made available and if are you using survey monkey and PII is being made available then you will want to probably call it out more explicitly, but that's what you -- that's the reason why you have to kind of do the PIA to assess does the privacy policy align cover what you are doing or updated? If it doesn't mention them at all it definitely needs to. 

 To clarify on the question the actual information that the agency is collecting on any sort of survey needs to go through the office of information collection and that's a different information collection, surveys essentially and polls, and the the privacy information we're talking about is what happens when we're not on a Dot gov site. If you are using survey monk.com to collect the survey information, you have to indicate that are you using a Dot com website and they're not subject to the same privacy requirement and the agency is not collecting any personally identifiable information so it does get a little confusing there, but there is a difference between the privacy implications of using a Dot com site versus the information collection implications of using a survey.

 I think this is -- so then there is a follow-up. Since others are unable to go online, they say yes, they did, the GSA scale is online and along with 508 thatless and we'll have to double check because there is a PIA out there for DHS done a PIA on some of these sites as well, but that doesn't niecely apply to HHS's use of those sites so we'll have to make sure GSA, we'll have to review the PIA and look at their language and if they have created process by which you can use the idea scale through GSA and I think you are covered. For example, I know they approved Google docs as an appropriate tool that you can use -- there is a Google EDCs -- Google docs for government but you have to go through GSA to get access to that. There are certain processes and proceduring and sort of certain scopes for those things. We will have to follow up. It sounds like maybe an ideal scale case there might be ( indiscernible ). 

 GSA certainly did a PIA for their own useage and I am not sure that G String ofSA has the authority to accept ( indiscernible ) on exafl of other agencies or rather if the HHS privacy CIO office has to accept it. That's what we need to clarify. We'll take that back and get an answer for you guys. 

 The webinar is being recorded. If we embed a You Tube video on the site, is that PIA or only if we set up a page on that site? In general OMB says third party website is on a Dot com, and there are instances where you can embed, so we'll have to look at that and I think in general you probably will have to do a PIA and I think you will have to do a PIA. 

 Should that be a separate one? 

 If you have a channel and then those same -- 

 Videos are being posted and embedded on HHS site, I think you would be covered then. 

 You should know embedding You Tube or any other video there may be privacy imlixzs of embedding a video under your site and certain privacy settings that you can enable or not enable when embedding on a website and -- 

 Some of that is delineated. For You Tube in particular some of it delineated within the You Tube guidance. You can check that out. 

 The You Tube guidance is on the new media website. 

 My last name is O 'Neal and the first name is Kris, and the cybersecurity Help Desk is probably the best way to reach me or anyone else. First name is Kristofor and feel free to contact me by pulling up my name. How extensive should review be done of the TPA W A in terms of service agreement? One should be familiar with the privacy policy and the service agreement if you are going to be using these sites and probably will inform your PIA to some extent although I know that tons of service are negotiated at a high level and I don't think they say a lot about privacy. They tend to be my understanding is they tend to be more focused on -- what's -- 

 The indemnification liability. 

 That's the word, indemnification, so certainly you should be familiar with it but I don't know that we will have a huge impact on your specific PIA. 

 I agree. Right now the current policy is for GSA to or one of the agencies to begin the negotiation on in terms of service amendment and then signed by GSA and at the agency level. If there is already one signed at the agency level, the individual operating divisions do not need to sign them although for this purpose it is important just to be familiar with what it says even if it is all in legalease. Just read it. 

 To further clarify what Katherine is saying, if we signed the department level, then everybody across HHS is covered in terms of service agreements, and a list of the ones that we have signed also are found on the new media HHS.gov website as well as linked directly to those agreements if you want to review them. 

 There is just one last question here. It says more of a comment, we sometimes have ( indiscernible ) not from our channel example a grantee, and so I guess that is actually one example, so if you have -- if you are just linking to a video, and it is not through a channel or not -- if you link to a CBS news article, the external links apply, and the same thing I think with embedding might be the case as well and not to your video and not to
your channel and just linking, then probably don't have to follow 1023. If you do maintain a You Tube channel and you are embedding a series of your own videos -- 

 The point where it would apply is based on what I know is that on your DOT gov privacy policy you indicate we do occasionally embed videos from third party sites and this is meant to be a benefit for information for the public, and just on your agency privacy policy to indicate that we do do that. If you are embedding videos you should be privacy settings that you can tweak that Reed mentioned when the You Tube guidance and I don't think that all of the video sharing platforms are the same in that regard, but with You Tube specifically you can set it so that it does not drop a cookie on the user machine until they hit play so they have the choice to hit play or not, and that's just one example without getting too much into the details. 

 Certainly you can contact the HHS center for new media as well as the cybersecurity team if you want to get more detail on very specific questions like that. 

 I think there is a lot of -- I think everyone everything is really case by case. Some dhingz are clear Facebook pages, for example, and flicker accounts, those sorts of things and we keep getting examples, survey monk sigh one again that I didn't even occur to me until we started going through this and people asked questions. Really feel free to -- first work through your senior official for privacy and then if together you guys provide reasoning and then we can take a look here at the department as well and probably aren't going to be special cases. 

 The cookie thing as an example why PIA can be useful or something you need to think about because there is separate guidance and we're not going to talk about today around M-1022 about third party -- cookies, and whether they're tier 1, tier 2, tier 3, and of course the government has to go through a huge process to go to use tier 3 cookies for PI's being collected and the private sector cookies are rampant and just at an online privacy conference last week and a little scared to surf the web now, but so if you have You Tube dropping a cookie from an HHS doc, when you think you are on a.gov site, and your privacy policy says you don't drop cookies that have PII and You Tube is collecting that, then the public could be really confused. That's where the PIA comes into place and clear notice the privacy policy is important and really just being transparent which is another key private sigh term, just being transparent with what's happening happening and what's going on with the sites and where we have to control or where we don't have control and where people ( indiscernible ) own agreements and making sure all of that is articulated in the privacy policies and notices. 

 Looks like we have one more question. 

 Is Google analytics require PIA? Whether PII is being collected or not, so there is this term being made available. Google analytics I don't think it going to apply to this because mostly that's being done on a DOT gov site. However, that's where the cookie policy comes into play and generally we have been seeing the Google analytics as a tier 2 and doesn't have to go through the higher level approval process and whether you are using Google analytics, you need to make sure the privacy policy, articulates whether you are tier 1, tier 2, tier 2, and Google analytics is generally being used on a Dot gov site.

 I think we're running up on the end of our hour. We have a few more questions about these embedding videos. So we'll probably have to take those off line and do additional research on how that works and what is happening there with those to figure out exactly how we can apply those. If you need more information, we go into a lot more detail about that decision making process, the decision tree of yes or no, do I new he had to do a PIA on the PIA training Friday and of course the senior officials for privacy really great resource for determining how these things apply. Of course we're all kind of learning this and I think it is new. OMB uses the new terms like make PIA available and third party websites and applications, so we're all just kind of trying to figure out exactly what these mean. 

 I think the big goal would be to knock out the Facebook accounts, You Tubes, those that are really clear, the Twitter accounts that we know are definitely third party websites and then we can kind of clean up the harder ones to determine later. 

 Question about how to sign up for the training. You can email the HHS cybersecurity team. 

 Flip over to that email address, Kris. 

 Sure.

 I know the presentation will be coming out afterwards. There is the email address, HHScybersecurity@HHS.gov. You can use that for anything to get access and sign up and if you have additional questions around this and if you have any questions about privacy and security, feel free to send us that email address and it will get directed to the right person. 

 All right. I think we are about out of time. Definitely either email the cybersecurity team or email the center for new media which is newmedia@HHS.gov and we can answer any additional questions that are a little more detailed and that we didn't have time to answer here. All right. That's it for today. Thank you, guys, everyone, for coming. 

 Thank you. 

 Thanks, Kris. 

 Thanks, Kris. [ event concluded ].
	Follow @HHSNewMedia on Twitter
	Read our blog
	Get in the Loop
	Join the ListServe (HHS only)
	Subscribe to e-mail updates
Directories of HHS Accounts
	Facebook
	Twitter
	YouTube
	Blogs
	Flickr
	Podcasts
Webinar: Third Party Websites & Applications

Transcript

HHS New Media Webinar Series

Stay Connected

Whooo is on?
