[Federal Register Volume 84, Number 129 (Friday, July 5, 2019)]
[Notices]
[Pages 32205-32209]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-14409]
-----------------------------------------------------------------------
DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT
[Docket No. FR-6146-N-07]
Privacy Act of 1974; System of Records
AGENCY: Office of Single-Family Asset Management, HUD.
ACTION: Notice of amended privacy act system of records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, the Office of
Single Family Asset Management, Department of Housing and Urban
Development (HUD) is giving notice that it intends to amend one of its
systems of records published in the Federal Register on August 19,
2016, Asset Disposition and Management System (ADAMS). As a result of
the annual review of ADAMS, HUD is updating ADAMS to include automation
of the Name Address Identification Number application process (e-NAID).
This notice includes updates to the former notice's routine uses,
categories of records, and purpose of system statements. This notice
also incorporates administrative and format changes to convey already
published information in a more synchronized format.
DATES: August 5, 2019.
Comments Due Date: August 5, 2019.
ADDRESSES: You may submit comments, identified by docket number and
title, by one of the following methods:
Federal e-Rulemaking Portal: http://www.regulation.gov. Follow the
instructions provided on that site to submit comments electronically.
All comments received will be posted without change to http://www.regulation.gov, including any personal information provided.
Mail: Attention: Housing and Urban and Development, Privacy Office;
John Bravacos, The Executive Secretariat, 451 Seventh Street SW, Room
10139; Washington, DC 20410.
Email: [email protected].
Fax: 202-619-8365.
Docket: For access to the docket to read background documents or
[[Page 32206]]
comments received go to http://www.regulations.gov.
FOR FURTHER INFORMATION CONTACT: The Privacy Office, 451 Seventh Street
SW, Room 10139, Washington, DC 20410, telephone number 202-708-3054
(this is not a toll-free number). Individuals who are hearing- and
speech-impaired may access this telephone number via TTY by calling the
Federal Relay Service at 800-877-8339 (this is a toll-free number).
SUPPLEMENTARY INFORMATION: The Federal Housing Administration (FHA)
insures approved lenders against the risk of loss on loans they finance
for the purchase, and in some instances, rehabilitation of single
family homes. In the event of a default on an FHA-insured loan, the
lender generally acquires title to the property by foreclosure, a deed-
in-lieu of foreclosure, or other acquisition method; files a claim for
insurance benefits; and conveys the property to HUD. Properties
conveyed to the Secretary of HUD make up the Single Family Real Estate
Owned (REO) inventory managed by the Office of Single Family Asset
Management. HUD administers its REO disposition program through four
Homeownership Centers (HOCs) located in Philadelphia, Pennsylvania;
Atlanta, Georgia; Denver, Colorado; and Santa Ana, California. HUD
currently has 55 Management and Marketing (M&M) contracts; 23 Asset
Managers (AMs); 31 Field Service Managers (FSMs); and 1 Mortgage
Compliance Manager (MCM) who provide M&M services throughout the United
States. The ADAMS application is provided under a Software as a Service
(SaaS) contract for HUD/FHA to track the acquisition, maintenance, and
sale of HUD's Single-Family Real Estate Owned (REO) inventory under
HUD's Property Disposition Sales Program (24 CFR part 291). The Office
of Single-Family Asset Management (OSFAM) has automated the approval
process for real estate brokers (selling and principal brokers),
governmental entities (State and local governments, public agencies)
and private nonprofit organizations that participate in HUD's Property
Disposition Sales Program (24 CFR 291). Eligible participants must have
an approved, active Name Address Identifier (NAID) and be registered as
a Bidder on the HUD Home store website. The e-NAID process leverages
existing ADAMS technology to verify program eligibility and approval
requirements and consolidates the prior paper-based NAID application
process with processing and approval of the NAID in ADAMS. The e-NAID
enhancement eliminates manual data entry and supports the Department's
mission to mitigate financial risk to the FHA Mutual Mortgage Insurance
Fund (MMIF) by reducing the NAID processing timeframe and the required
IRS 1099 payment to brokers and service contractors. As a result of the
annual review of ADAMS, records have been updated to include automation
of the Name Address Identification Number application process (e-NAID).
This notice includes updates to the former notice's routine uses,
categories of records, and purpose of system statements. This notice
also incorporates administrative and format changes to convey already
published information in a more synchronized format.
Specifically, this ADAMS notice amendment identifies automation of
the Name Address Identification Number (NAID) application process (e-
NAID). E-NAID:
Allows participants to complete forms SAMS 1111, ``Payee Name
and Address,'' and SAMS 1111-A, ``Selling Broker Certification''
through HUDhomestore.com
Leverages e-Signature's Application Programming Interface
(API) to allow the NAID application to be signed and approved
electronically
Provides near-real time approval and tracking/generation of
NAID
Eliminates the ``Check current NAID Status'' lookup option
Eliminates manual data entry
Reduces NAID processing time
SYSTEM NAME AND NUMBER
Asset Disposition and Management System (ADAMS--P260).
SECURITY CLASSIFICATION:
Not classified.
SYSTEM LOCATION:
ADAMS is accessible at workstations located at the following
locations: Department of Housing and Urban Development Headquarters,
451 Seventh Street SW, Washington, DC 20410; HUD Atlanta Homeownership
Center, Five Points Plaza, 40 Marietta Street, Atlanta, GA 30303-2806;
HUD Philadelphia Homeownership Center, The Wanamaker Building, 100 Penn
Square East, Philadelphia, PA 19107-3389; HUD Denver Homeownership
Center Processing & Underwriting--20th FL, 1670 Broadway Denver, CO
80202; Santa Ana Homeownership Center, Santa Ana Federal Building, 34
Civic Center Plaza, Room 7015, Santa Ana, CA 92701-4003. The system is
externally hosted by Yardi Systems, Inc., 430 S Fairview, Goleta, CA
93117; SunGard, 1001 E Campbell Road, Richardson, TX 75081; and
CenturyLink, 200 N Nash Street, El Segundo, CA 90245. The Santa Barbara
datacenter hosts the design and development instances. Testing,
production and disaster recovery instances are located in the Dallas,
TX and Los Angeles, CA datacenters.
SYSTEM MANAGER(S):
Ivery W. Himes, Director, Office of Single-Family Asset Management,
Room 9178, 450 Seventh Street SW, Washington, DC 20410.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
The specific authorizations are:
The National Housing Act, Public Law 479, 48 Stat. 1246,
12 U.S.C. 1715z-11a
The Housing and Community Development Act of 1987, Public
Law 100-242, Title I, 165, Feb. 5, 1988, 101 Stat. 1864, 42 U.S.C. 3543
Section 904 of the Stewart B. McKinney Homeless Assistance
Amendments Act of 1988, Public Law 100-628, 42 U.S.C. 3544
Title 24 Code of Federal Regulations, Part 291,
Disposition of HUD-Acquired and -Owned Single Family Property
PURPOSE(S) OF THE SYSTEM:
ADAMS is a case management system for HUD-owned and HUD-managed
single-family properties in support of HUD Property Disposition Sales
Program (24 CFR part 291). ADAMS supports HUD Headquarters and
Homeownership Center (HOC) staff and HUD's Management and Marketing
(M&M) contractors to track single-family properties from their
acquisition by HUD through the steps necessary to resell the
properties. ADAMS captures pertinent data relating to the properties,
including acquisition, maintenance and sales cost, property description
and value, bids and sales proceeds, and special program designations.
ADAMS also tracks and monitors certain events after sales under the
Good Neighbor Next Door, non-profit, and Asset Control Area (ACA) sales
programs. Additional Nonprofit/Government entity web-based program
management tools improve the application, recertification, and
reporting process for organizations that participate in the Office of
Single Family Housing (OSFH) activities and to assist HUD staff with
the daily administration of FHA's Nonprofit Program activities. HUD
maintains a roster of nonprofit organizations that are qualified to
participate in certain specified FHA activities. ADAMS is used to:
[[Page 32207]]
Approve and/or recertify participant's Name Address
Identification (e-NAID) required to submit bids and purchaser
information (SAMS 1111, SAMS 1111-A) for HUD REO property sales
(HUDhomestore.com).
Obtain, store, and display case-level information about
properties acquired by or in custody of HUD.
Track events and information describing the status of real
property from the date of conveyance to the Department through several
stages of management, marketing, and disposition, to final
reconciliation of sale proceeds.
Retain data relative to contracts, contractors, and
vendors that support the property disposition program.
Calculate property management, marketing, and incentive
fees earned by management and marketing (M&M) contractors, closing
agents, and special property inspection (SPI) contractors, and generate
disbursement transmittals.
Calculate M&M contractor payment incentives and
disincentives.
Generate disbursement transmittals for payment of other
property-related expenses such as pass-through expenses and property
taxes.
Exchange data with HUD and non-HUD systems and internet
sites for both input and retrieval of data using the data exchange.
Provide data security with multiple levels of access for
users including HUD employees and designated contractors.
Provide standard and ad hoc reporting capability.
Facilitate summary, trend, and comparative analysis of
portfolio performance.
Provide ease of navigation and use for users at all skill
levels.
Ensure the security and privacy of the information
collected and stored in the SSAE-18 compliant data center and provide
disaster recovery from the disaster recovery data center.
Provide Web-based access to subcontractors, appraisers,
and inspectors to enable them to upload property data and related
documents.
Provide Pre-Conveyance functionality including request for
conveyance extension, request for approval of occupied conveyance,
over-allowable requests, and surchargeable damage request.
Special reporting designed for ease of use by M&M
contractors. Reports based on latest daily and weekly data and provides
for online reports, national summary reports, and historical reports
that are uploaded by administrative users.
Web-based Disposition Program Compliance System (DPCS)
module provides features to support the performance of Good Neighbor
Next Door Sales Programs (GNND) compliance control tasks. DPCS features
are organized according to three main steps in the sales process: Pre-
sales/pre-registration, sales/pre-closing, and post-closing.
Extensive workflow rules are incorporated into ADAMS to ensure
compliance with HUD regulations, policies, and procedures. OSFAM
ensures the protection of program participant PII and mortgagee
business sensitive information by ensuring ADAMS' compliance with HUD
and Federal Information Security Management Act (FISMA) security and
privacy controls. Data exchanges are done via secure file transfer
protocol (SFTP); and the servers and mainframes used employ Federal
Information Processing Standards (FIPS) 199 moderate security
categorization controls. The ADAMS Information System Security Officer
(ISSO) and Co-CORs work closely with system security administrators,
network and project security personnel to ensure the integrity of data
exchanges. The ADAMS service provider has annual independent Service
Organization Control (SOC I) attestation audits conducted in accordance
with the American Institute of Certified Public Accountants' (AICPA)
Statement on Standards for Attestation Engagements No. 18 (SSAE 18) and
under Federal Information System Controls Audit Manual (FISCAM)
standards. Access to REO data and ADAMS screens is restricted to those
individuals with a need-to-know and a valid business justification.
Approved changes undergo rigorous service provider acceptance, smoke,
and regression testing before User Acceptance Testing (UAT) by HUD
Subject Matter Experts (SMEs) and implementation is authorized.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Individuals covered by this system include:
Homebuyers
Successful Bidders (purchasers)
Nonprofits and Government (state and local) agencies
Management and Marketing (M&M) contractors
CATEGORIES OF RECORDS IN THE SYSTEM:
Homebuyers
Name, address, SSN, race/ethnicity
Successful Bidders (Purchasers)
Business name, address, and telephone number
Social Security Number (SSN), Employee Identification
Number (EIN), or Tax Identification Number (TIN)
Mortgagee ID Number
SAMS name and address identification number (NAID)
FHA case number and property address
Date purchaser(s) signed sales contract (Form HUD-9548)
Date sales contract accepted by HUD
Purchase price
Purchaser type
Appraisal information
Tax payments
Sales offer information
HUD-1
Contract information
Vendor information
Financial transactions
Nonprofit and Government (state and local) (Note: In addition to
the successful bidders/purchasers)
Internal Revenue Service (IRS) letters for determination
of nonprofit status
Articles of Organization
Mortgage notes
W-9
SAMS-1111
Property report documentation (Median Income
certification)
Management and Marketing (M&M) Contractors
Business name, address, and telephone number
EIN, TIN, or SSN
SAMS NAID
FHA case number and property address
Date purchaser(s) signed sales contract (Form HUD-9548)
Date sales contract accepted by HUD
Purchase price
Purchaser type
Mortgage notes
W-9
SAMS-1111
Property report documentation (Median Income
certification)
Limited information about the homebuyers: Name, address,
SSN, and race/ethnicity characteristics
Payment Information Form ACH Vendor Payment System (SF
3881) new
ADAMS contains files on property appraisals, tax payments, purchase
sales offer information, HUD-1, purchase contract information, vendor
information, and property preservation and protection invoice
information, FHA property listings, and property agent contact
information.
RECORD SOURCE CATEGORIES:
Purchasers, Brokers, appraisers, M&M contractors, Nonprofits, State
and Local Government entities, and HUD employees.
[[Page 32208]]
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b) of the Privacy Act, all or a portion of the records or
information in this system may be disclosed to authorized entities, as
determined to be relevant and necessary, outside the Department of
Housing and Urban Development (HUD) as a routine use pursuant to 5
U.S.C. 552a(b)(3):
1. To the Government Accountability Office (GAO) for audit
purposes.
2. To the Office of the Inspector General (OIG) for audit purposes.
3. To Management and Marketing contractors for processing the sale
of HUD Homes.
4. To the Federal Bureau of Investigation (FBI) to investigate
possible fraud revealed in the course of property disposition efforts
to allow HUD to protect the interest of the Secretary.
5. To the National Archives and Records Administration (NARA) for
records having sufficient historical or other value to warrant
continued preservation by the United States Government, or for
inspection under authority of Title 44, Chapter 29, of the United
States Code.
6. To a congressional office from the record of an individual, in
response to an inquiry from the congressional office made at the
request of that individual.
7. To contractors, grantees, experts, consultants, Federal
agencies, and non-Federal entities, including, but not limited to,
State and local governments and other research institutions or their
parties, and entities and their agents with whom HUD has a contract,
service agreement, grant, or cooperative agreement, when necessary to
accomplish an agency function related to a system of records, for the
purpose of statistical analysis and research in support of program
operations, management, performance monitoring, evaluation, risk
management, and policy development, or to otherwise support the
Department's mission. Records under this routine use may not be used in
whole or in part to make decisions that affect the rights, benefits, or
privileges of specific individuals. The results of the matched
information may not be disclosed in identifiable form.
1. To contractors, grantees, experts, consultants and their agents,
or others performing or working under a contract, service, grant or
cooperative agreement with HUD, when necessary to accomplish an agency
function related to a system of records. Disclosure requirements are
limited to only those data elements considered relevant to
accomplishing an agency function. Individuals provided information
under these routine use conditions are subject to Privacy Act
requirements and disclosure limitations imposed on the Department.
2. To appropriate agencies, entities, and persons when:
i. HUD suspects or has confirmed that the security or
confidentiality of information in a system of records has been
compromised;
ii. HUD has determined that as a result of the suspected or
confirmed compromise there is a risk of harm to economic or property
interests, identity thief, or fraud, or hard to the security or
integrity of systems or programs (whether maintained by HUD or another
agency or entity) that rely upon the compromised information; and
individuals, HUD (including its information systems, programs, and
operations), the Federal Government, or national security; and
iii. the disclosure made to such agencies, entities, and persons is
reasonably necessary to assist in connection with HUD's efforts to
respond to the suspected or confirmed compromise and prevent, minimize,
or remedy such harm for purposes of facilitating responses and
remediation efforts in the event of a data breach.
8. To the Department of Justice (DOJ) when seeking legal advice for
a HUD initiative or in response to DOJ's request for the information,
after either HUD or DOJ determine that such information is relevant to
DOJ's representatives of the United States or any other components in
legal proceedings before a court or adjudicative body, provided that,
in each case, the agency also determines prior to disclosure that
disclosure of the records to DOJ is a use of the information contained
in the records that is compatible with the purpose for which HUD
collected the records. HUD on its own may disclose records in this
system of records in legal proceedings before a court or administrative
body after determining that the disclosure of the records to the court
or administrative body is a use of the information contained in the
records that is compatible with the purpose for which HUD collected the
records.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
ADAMS records are stored electronically in secure facilities.
Electronic files are stored in case files on secure servers. Electronic
files are replicated at a disaster recovery offsite location in case of
loss of computing capability or other emergency at the primary
facility. ADAMS primary host facility is located at SunGard, 1001 E
Campbell Road, Richardson, TX 75081. The ADAMS disaster recovery
facility is at CenturyLink, 200 N Nash Street, El Segundo, CA 90245.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records can be viewed using computer search by the FHA case number,
property address (including other geographical characteristics such as
contract area, property state/city/county/zip code, Homeownership
Center), or contractor ID or name, or non-profit/government agency
name.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
ADAMS records comply with the National Archives and Records
Administration's July 2017 General Records Schedule 1.1, Financial
Management and Reporting Records, Items 010 and 011, to maintain for
six years, or when business use ceases. Backup and Recovery digital
media will be destroyed or otherwise rendered irrecoverable per NIST SP
800-88 ``Guidelines for Media Sanitization'' (December 2014).
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
FHA ensures the protection of program participants' PII and
mortgagee business sensitive information by ensuring ADAMS' compliance
with HUD and Federal Information Security Management Act (FISMA)
security and privacy controls.
Administrative
1. OSFAM conducts a full security assessment of ADAMS to ensure
compliance with NIST SP 800-53, Recommended Security Controls for
Federal Information Systems, as amended, and NIST SP 800-37, Guide for
Applying the Risk Management Framework to Federal Information Systems,
as amended, and HUD's authorization to operate methodology.
2. ADAMS undergoes an annual independent attestation assessment.
3. A documented security impact analysis is conducted whenever
changes are proposed to ADAMS or its interfacing information systems,
networks, or to their physical environment, interfaces, or user-
community makeup.
4. The ADAMS hosting environment tests and documents the incident
response capability for ADAMS on a yearly basis. This training allows
for determination of the effectiveness the incident response plan and
incorporation into the procedure for contingency planning testing plan.
[[Page 32209]]
Technical
1. Access to program participants data and ADAMS screens is
restricted to those individuals with a need-to-know and a valid
business justification.
2. ADAMS access requires two levels of logins to access the system.
The first login uses HUD Siteminder system to verify that the user has
active HUD authorization. The second login uses ADAMS internal security
system to set permissions for data access and system functionality.
3. Data exchanges are done via secure file transfer protocol
(SFTP); and the servers and mainframes used employ Federal Information
Processing Standards (FIPS) 199 moderate security categorization
controls. OSFAM personnel work closely with system security
administrators, network and project security personnel to ensure the
integrity of data exchanges.
Physical
1. Access to data centers are controlled using an electromagnetic
badge and/or biometric access system which maintains information such
as employee names, ID numbers, access badge numbers, issue date of the
access badge, as well as what areas the employee is authorized to
access.
2. Each system logs the date, time, and location of each entry into
the data center. Physical access is further restricted only to
authorized personnel and other approved individuals according to their
job functions. The systems are used to generate access badges used at
each data center entrance where a badge reader is installed. Each badge
reader stores an access list in memory. If a connection between a badge
reader and the master server supporting the card key system is severed,
the badge readers will still limit access using the access list stored
in memory.
3. A Facilities Manager performs a monthly review of entry logs at
each data center to ensure access is appropriate. Any unusual
activities are investigated and resolved.
RECORD ACCESS PROCEDURES:
For Information, assistance, or inquiries about records, contact
John Bravacos, Senior Agency Official for Privacy, 451 Seventh Street
SW, Room 10139, Washington, DC 20410, telephone number (202) 708-3054.
When seeking records about yourself from this system of records or any
other HUD system of records, your request must conform with the Privacy
Act regulations set forth in 24 CFR part 16. You must first verify your
identity, by providing your full name, address, and date and place of
birth. You must sign your request, and your signature must either be
notarized or submitted under 28 U.S.C. 1746, a law that permits
statements to be made under penalty of perjury as a substitute for
notarization.
If your request is seeking records pertaining to another living
individual, you must include a statement from that individual
certifying their agreement for you to access their records. Without the
above information, the HUD FOIA Office may not conduct an effective
search, and your request may be denied due to lack of specificity or
lack of compliance with regulations.
CONTESTING RECORD PROCEDURES:
The Department's rules for contesting contents of records and
appealing initial denials appear in 24 CFR part 16, Implementation of
the Privacy Act of 1974. Additional assistance may be obtained by
contacting John Bravacos, Senior Agency Official for Privacy, 451
Seventh Street SW, Room 10139, Washington, DC 20410, or the HUD
Departmental Privacy Appeals Officers, Office of General Counsel,
Department of Housing and Urban Development, 451 Seventh Street SW,
Room 10110, Washington, DC 20410.
NOTIFICATION PROCEDURES:
Individuals seeking notification of and access to any record
contained in this system of records, or seeking to contest its content,
may submit a request in writing to the Privacy Office at the address
provided above or to the component's FOIA Officer, whose contact
information can be found at http://www.hud.gov/foia under ``contact.''
If an individual believes more than one component maintains Privacy Act
records concerning him or her, the individual may submit the request to
the Senior Agency Official for Privacy, HUD, 451 Seventh Street SW,
Room 10139, Washington, DC 20410.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
Amendment--Asset Disposition and Management System HSNG.SF/HUF.01,
81 FR 55477; Published in the Federal Register--August 19, 2016.
Amendment--Asset Disposition and Management System HSNG.SF/HUF.01,
79 FR 10825; Published in the Federal Register--February 26, 2014
(note: Changed coding structure).
Amendment--Asset Disposition and Management System HUD/HS-58, 77 FR
41993; Published in the Federal Register--July 17, 2012.
Initial--Asset Disposition and Management System HUD/HS-58, 73 FR
62520; Published in the Federal Register--October 21, 2008.
Dated: June 28, 2019.
John Bravacos,
Senior Agency for Privacy.
[FR Doc. 2019-14409 Filed 7-3-19; 8:45 am]
BILLING CODE 4210-67-P