[Federal Register Volume 74, Number 163 (Tuesday, August 25, 2009)]
[Notices]
[Pages 42910-42912]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E9-20405]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

 [Docket No. FR-5291-N-05]


Privacy Act; Notification of a New Privacy Act System of Records, 
Institution Master File (IMF)

AGENCY: Office of the Chief Information Officer, HUD.

ACTION: Notification of a New Privacy Act System of Records.

-----------------------------------------------------------------------

SUMMARY: The Department of Housing and Urban Development HUD proposes 
to amend one of its system of records subject to the Privacy Act of 
1974 (5 U.S.C. 552a), as amended. The proposed new system of record is 
the IMF/F51. The IMF System maintains a file of institutions (Title I 
lenders and Title II mortgagees) which have been approved by the U.S. 
Department of Housing and Urban Development (HUD) to participate in the 
Departments Federal Housing Administration (FHA) Mortgage Insurance 
Programs. The principal objective of the IMF is to consolidate 
information on the approval status of mortgagees and lenders 
participating in FHA's insurance programs.

DATES: Effective Date: This action shall be effective without further 
notice on September 24, 2009 unless comments are received that would 
result in a contrary determination.
    Comments Due Date: September 24, 2009.

ADDRESSES: Interested persons are invited to submit comments regarding 
this notice to the Rules Docket Clerk, Office of General Counsel, 
Department of Housing and Urban Development, 451 Seventh Street, SW., 
Room 10276, Washington, DC 20410-0500. Communications should refer to 
the above docket number and title. A copy of each communication 
submitted will be available for public inspection and copying between 8 
a.m. and 5:00 pm weekdays at the above address.

FOR FURTHER INFORMATION CONTACT: Donna Robinson-Staton, Departmental 
Privacy Act Officer, 451 Seventh Street, SW., Room 2256, Washington, DC 
20410, Telephone Number (202) 402-8047. (This is not a toll-free 
number.) A telecommunication device for hearing and speech-impaired 
individuals (TTY) is available at (800) 877-8339 (Federal Information 
Relay Service).

SUPPLEMENTARY INFORMATION: Pursuant to the Privacy Act of 1974 (5 
U.S.C. 552a), as amended, notice is given that HUD proposes to 
establish a new system of records, identified as the Institution Master 
File (IMF).
    Title 5 U.S.C. 552a(e)(4) and (11) provide that the public be 
afforded a 30-day period in which to comment on the new system of 
records.
    The new system report was submitted to the Office of Management and 
Budget (OMB), the Senate Committee on Governmental Affairs, and the 
House Committee on Government Reform pursuant to paragraph 4c of 
Appendix 1 to OMB Circular No. A-130, ``Federal Responsibilities for 
Maintaining Records About Individuals,'' July 25, 1994, (59 FR 37914).

    Authority:  5 U.S.C. 552a 88 Stat. 1896; 42 U.S.C. 3535(d).

    Dated: August 14, 2009.
Jerry E. Williams,
Chief Information Officer.
HUD/HS/60

System name:
    Institution Master File (IMF).

System location:
    The system is physically housed in a government-owned building 
(i.e., the U.S. Department of Housing and Urban

[[Page 42911]]

Development) in Washington, DC and at HUD's Charleston, West Virginia 
field office; backup facilities are located in HUD's Pennsylvania 
office. These buildings are occupied by the Department of HUD's Civil 
Service employees and contractor personnel (that use picture 
identification cards to access the buildings) and are not open to the 
general public. System software is loaded on computers in HUD 
Headquarters in Washington, DC. Servicing Contractors access HUD 
systems via Virtual Private Network (VPN).

Categories of individuals covered by the system:
    The Institution Master File (IMF) maintains data on Title I lenders 
and Title II mortgagees who originate, underwrite or service a HUD-
insured mortgage.

Categories of records in the system:
    IMF includes data such as the lender's first name, last name, 
Social Security Number (SSN) and title/position (i.e., Chief Executive 
Officer). The IMF application includes data such as the principal 
employee's name (i.e., first and last), email address, title, and SSN. 
The other records include the following data elements: Tax ID, Title I 
ID, Institution ID, GNMA ID, Institution Name, Institution Type, 
Insurance Type, Mortgage Type, Doing Business As (aka Fictitious Name), 
Fiscal Year End, Approval Date, Phone Number, Fax, E-mail, and 
Geographical Address.

Authority for maintenance of the system:
    National Housing Act of 1937 as amended (Pub. L. 75-412).

Purpose:
    The IMF maintains the official record of Institutions (Title I 
lenders and Title II mortgagees) that are approved by HUD/Federal 
Housing Administration (FHA) to originate, service, or invest in FHA-
insured mortgages or loans. The IMF centralizes institution data needed 
for the operation of FHA's home mortgage, project mortgage and home 
improvement, mobile homes and manufactured homes. This information is 
used by more than a dozen other Housing and Ginnie Mae systems for 
validation of institutional identification/approval, validation of 
relationships between sponsor and loan correspondents, lender 
notifications, and claim payments. In addition to being a critical 
component of insurance application processing and accounting, an 
extract from the IMF, together with data from the Single Family Housing 
Enterprise Data Warehouse (SFHEDW), on HUD's Web site, allows the 
public to locate approved institutions located or doing business in 
their area. IMF data (e.g., lender's name, address, telephone, fax 
number, and e-mail address) is extracted and posted on HUD's Web site 
(http://www.hud.gov/ll/code/llslcrit.cfm) to apprise the public of all 
FHA-approved lenders within their respective geographic areas. This 
information is releasable through the Freedom of Information Act (Pub. 
L. 89-554, 80 Stat., 383; Amended 1996, 2002, 2007). The IMF is used to 
generate correspondence welcoming newly approved lenders, reminding 
institutions of their annual certification requirements, warning and 
subsequently advising institutions of withdrawal of their approval for 
failure to submit required documentation or pay the required annual 
recertification fee. The principal objectives of the IMF are to 
consolidate information on the approval status of mortgagees and 
lenders participating in FHA's insurance programs. The approval 
information is fed to FHA processing systems for use in processing and 
editing individual mortgage/loan insurance applications, servicing 
transactions, and claims. The IMF is the repository for banking 
information (encrypted) for wire transferring payments to mortgagees/
lenders for claim reimbursements and premium refunds. The personal 
information collected pertains to the SSNs and Names of the Lenders. 
The purpose of the information being collected is to ensure that any 
senior officer (e.g., Chief Executive Officer (CEO), Chief Financial 
Officer (CFO), partner, director, or principal is in compliance with 
Section 203(b) of the Helping Families Save Their Homes Act of 2009, 
which was enacted on May 20, 2009. The Privacy Impact Assessment is 
currently being re-visited and updated as necessary to incorporate 
HUD's new Electronic Annual Certification Process for FHA-approved 
lenders. Under the former certification process, lenders certified 
manually via the submission of a Title II Yearly Verification Report 
(i.e., V-Form).

Routine uses of records maintained in the system, including categories 
of users and the purposes of such uses:
    All external disclosure of data must be accounted for or 
information from the system is not released. If unaccounted for, data 
from the system cannot be disclosed to any entity external to HUD, 
including contractors. The following are examples of routine uses of 
data maintained in the system:
    1. HUD's Office of Policy Development and Research often use IMF 
data (i.e., non-personally identifiable information) to conduct studies 
and statistical reports--directly related to the management of HUD's 
FHA Lender and Mortgagee Certification Program;
    2. HUD's Office of Lender Activities and Program Compliance use IMF 
data (i.e., non-personally identifiable information) to create 
correspondence for lenders and mortgagees, reminding them of their 
annual renewal requirements and notifying them of their non-compliance 
with Departmental rules and requirements for continued program 
participation; and
    3. Internal HUD Users and HUD's Office of Lender Activities and 
Program Compliance contractors (required to modify IMF per the terms of 
their contract) have limited access to ``read only'' data. As such, HUD 
staff and contractors do not have access to privacy information.
    4. Additional Disclosure for Purposes of Facilitating Responses and 
Remediation Efforts in the Event of a Data Breach. A record from a 
system of records maintained by this Department may be disclosed to 
appropriate agencies, entities, and persons when:
    a. The Department suspects or has confirmed that the security or 
confidentiality of information in a system of records has been 
compromised;
    b. The Department has determined that as a result of the suspected 
or confirmed compromise there is a risk of harm to economic or property 
interests, identity theft or fraud, or harm to the security or 
integrity of systems or programs (whether maintained by the Department 
or another agency or entity) that rely upon the compromised 
information; and,
    c. The disclosure made to such agencies, entities, and persons is 
reasonably necessary to assist in connection with the Department's 
efforts to respond to the suspected or confirmed compromise and 
prevent, minimize, or remedy such harm.

Policies and practices for storing, retrieving, accessing, retaining, 
and disposing of records in the system:
Storage:
    Data is stored on magnetic discs and tapes. UPS is used to 
transport the tapes on which data is stored. There is a courier log at 
the data center. As of August 2009, there will be no magnetic discs or 
tapes. Furthermore, there are no printouts and hardcopies stored, 
maintained, or generated from the system. The hard copy V-Form is filed 
and maintained on microfilm. However,

[[Page 42912]]

there is no privacy information on the hard copy of the V-form.

Retrieving:
    Data is retrieved by the Lenders' first and last name, and Social 
Security Number. Federal employees and FHA-approved lenders must access 
IMF by inputting their User IDs and Passwords, issued by the Department 
of HUD. Again, all users with access to IMF are unable to view 
personally identifiable data as they have access to ``read only'' data.

Safeguards:
    Records are maintained in a secured computer network behind HUD's 
protective automated firewall, which ensures limited access to those 
persons whose official duties require the use of such records. Access 
to automated records is limited to authorized personnel who must 
receive a valid User ID and password. All HUD users and developers 
access the system from work stations connected through the local area 
network (LAN) routers to the Department's IBM Mainframe platform. 
Mortgagee/Lender employees view and/or update selected data in the 
system through HUD's WEB portal, FHA Connection. Functional access is 
granted on an ``as needed'' basis only by the IMF Security 
Administrator or the Security Coordinator for the lending institution, 
as appropriate.
    IMF's software packages provide authentication of a User. User 
authorizations are controlled at the application level. The IMF system 
controls all online screen authorizations on the Customer Information 
Control System (CICS). Also, the FHA Connection security 
administration's application controls access to the FHA Connection 
modules of the IMF system. HUD will safeguard the SSN and personal 
identifying information obtained pursuant to 26 U.S.C. 6103(l) (7) (A) 
and (B) in accordance with 26 U.S.C. 6103(p)(4), and the IRS's ``Tax 
Information Security Guidelines for Federal, State and Local 
Agencies,'' Publication 1075 (REV 6/2000). Security and private 
measures are in place for the organization's implementation of the 
appropriate safeguards to assure confidentiality, integrity and 
availability of personal information.

Retention and disposal:
    Records will be retained and disposed of in accordance with the 
General Records Schedule included in HUD Handbook 2228.2, appendix 14, 
item 25; and appendices 15 and 20. HUD handles and retains output data 
(i.e., stored on magnetic discs and tapes) from the information system 
in accordance with applicable laws, Executive Orders, directives, 
policies, regulations, standards, and operational requirements.
    Computerized records are maintained in a password-protected 
environment. If information is needed for evidentiary purposes, 
documentation will be referred to the HUD Office of Inspector General 
(OIG) in Washington, DC or other appropriate Federal, State or local 
agencies charged with the responsibility of investigating or 
prosecuting violators of Federal law. Documents referred to HUD's OIG 
will become part of OIG's investigative files.

System manager(s) and address:
    Director, Office of Housing/Single Family Housing Office of Lender 
Activities and Program Compliance (System Owner), Department of Housing 
and Urban Development, 451 Seventh Street, SW., Room B133/P3214, 
Washington, DC 20410.

Records access and notification procedure:
    For information, assistance, or inquiry about existence of records, 
contact Donna Robinson-Staton, Departmental Privacy Act Officer, 451 
Seventh Street, SW., Room 2256, Washington, DC 20410, telephone (202) 
402-8073 in accordance with the procedures in 24 CFR Part 16. Written 
request for access to records must include satisfactory proof of 
identity. The means of proof by certificate of a notary public or 
equivalent officer empowered to administer oaths must accompany the 
request. The certificate within or attached to the letter must include 
full name, current address, city and state of birth, copy of drivers 
license or equivalent bearing the requester's signature.

Contesting record procedures:
    The Department's rules for contesting the contents of records and 
appealing initial denials, by the individual concerned, appear in 24 
CFR Part 16. If additional information or assistance is needed, it may 
be obtained by contacting:
    (i) In relation to contesting contents of records, the Departmental 
Privacy Act, Department of Housing and Urban Development, 451 Seventh 
Street SW., Room 2256, Washington, DC 20410.
    (ii) In relation to appeals of initial denials, the HUD 
Departmental Privacy Appeals Officer, Office of General Counsel, 
Department of Housing and Urban Development, 451 Seventh Street SW., 
Washington, DC 20410.

Record source categories:
    Information in this system of records is supplied directly by the 
individual, and/or HUD system users.

Exemption from certain provision of the Act:
    None.

[FR Doc. E9-20405 Filed 8-24-09; 8:45 am]
BILLING CODE 4210-67-P