Privacy Act of 1974, System of Records; Notice: Comprehensive Servicing and Management System, 7208-7212 [2018-03393]

Agencies

• DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Federal Register Volume 83, Number 34 (Tuesday, February 20, 2018)]
[Notices]
[Pages 7208-7212]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-03393]


-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Docket No. FR-7009-N-01]


Privacy Act of 1974, System of Records; Notice: Comprehensive 
Servicing and Management System

AGENCY: Office of Asset Management and Portfolio Oversight (OAMPO), 
HUD.

ACTION: Notice of a new system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, the Department of 
Housing and Urban Development (HUD), Office of Asset Management and 
Portfolio Oversight (OAMPO) provides public notice that it proposes to 
establish a new system, Department of Housing and Urban Development 
System of Records Titled, ``Comprehensive Servicing and Monitoring 
System (CSMS) P085''.

DATES: March 22, 2018.
    Comments Due Date: March 22, 2018.

ADDRESSES: You may submit comments, identified by docket number and 
title, by one of the following methods:
    Federal e-Rulemaking Portal: https://www.regulations.gov. Follow the 
instructions provided on that site to submit comments electronically.
    Fax: 202-619-8365.
    Email: [email protected].
    Mail: Attention: Housing and Urban Development, Privacy Office; 
John Bravacos, The Executive Secretariat; 451 Seventh Street SW, Room 
10139; Washington, DC 20410.

FOR FURTHER INFORMATION CONTACT: For general questions please contact: 
John Bravacos, SAOP, Department of Housing and Urban Development, 451 
Seventh Street SW, Washington, DC 20410; telephone number 202-708-1515 
for privacy issues please contact: Senior Agency Official, John 
Bravacos.

SUPPLEMENTARY INFORMATION: This system of records titled P085--
Comprehensive Servicing and Monitoring System (CSMS), Department of 
Housing and Urban Development (HUD), Office of Asset Management and 
Portfolio Oversight (OAMPO). P-085-CSMS is operated by HUD's OAMPO, and 
includes personally identifiable information (PII) provided on or about 
families receiving rental housing assistance, multifamily property 
owners, multifamily vendors, and HUD employees who have system access, 
which information is retrieved by a name or unique identifier. CSMS, 
identified in HUD's Inventory of Systems as P085, supports the 
accounting and asset management functions for the Federal Housing 
Administration (FHA) an agency of the US Department of Housing and 
Urban Development. The system supports asset servicing and accounting 
for HUD held and HUD-owned multifamily assets and is a subsidiary 
ledger to the FHA general ledger. CSMS supports several management and 
accounting functions for these loans and properties, including 
financial recordkeeping, performance analysis, and status reporting for 
HUD's financial and business managers. CSMS is a proprietary system 
that maintains both Business Identifiable Information (BII) and PII.
    This system of records incorporates Federal privacy requirements 
and HUD policy requirements. The Privacy Act provides certain 
safeguards for an individual against an invasion of personal privacy by 
requiring Federal agencies to protect records in an agency system of 
records from unauthorized disclosure, ensure that information is 
current for its intended use, and that adequate safeguards are provided 
to prevent misuse of such information. The notice reflects the 
Department's focus on industry best practices in protecting the 
personal privacy of the individuals covered by each system 
notification. This notice states the name and location of the record 
system, the authority for and manner of its operations, the categories 
of individuals it covers, the records it contains, the sources of the 
information for those records, the routine uses made of the records, 
and the system of records exemption types. In addition, the notice 
includes the business address of the HUD officials who will inform 
interested persons of the procedures whereby they may gain access to 
and/or request amendments to records pertaining to them. The routine 
uses that apply to this publication are reiterated based on past 
publication to clearly communicate the ways in which HUD continues to 
conduct some of its business practices. In accordance with 5 U.S.C. 
552a(e)(4) and (11), HUD has provided a report of this new system to 
the Office of Management and Budget (OMB), the Senate Committee on 
Homeland Security and Governmental Affairs, and the House Committee on 
Oversight and Government Reform as instructed by OMB Circular No. A-
108, ``Federal Agencies Responsibilities for Review, Reporting, and 
Publication under the Privacy Act.''
SYSTEM NAME AND NUMBER
    P085--COMPREHENSIVE SERVICING AND MONITORING SYSTEM (CSMS)

Security Classification:
    UNCLASSIFIED, BUT SENSITIVE

[[Page 7209]]

System Location:
    Department of Housing and Urban Development, 451 Seventh Street SW, 
Washington, DC 20410 or at the locations of the Business Service 
Provider/Contractor under contract with HUD.

System Manager(s):
    Robert Iber, Department of Housing and Urban Development, Office of 
Asset Management and Portfolio Oversight, 451 Seventh Street SW, 
Washington, DC 20410, (202) 708-3055.

Authority for Maintenance of the System:
    HUD/FHA collects social security numbers during the FHA loan 
endorsement process and by request via IRS Form W-9 to update its 
records. Tenant information is collected by HUD contractors under the 
National Housing Act (12 U.S.C 1701 et seq.). CSMS provides servicing 
for loans acquired through the payment of an insurance claims under 
Housing Act Sections 202, 207, 223(f), 236, 221(d)(3), 221 (d)(4), 232, 
and 242. In addition, CSMS includes Mark to Market loans including 
Demonstration preservation programs from the Multifamily Assisted 
Housing Reform and Affordability Act of 1997 (MAHRA) (42 U.S.C. 1437f) 
and Demonstration preservation programs of the Office of 
Recapitalization (RECAP). CSMS collects and shares SSNs and PII 
externally with credit reporting agencies (pursuant to 5 U.S. Code 
552a), banks (pursuant to Section 6109 of the Internal Revenue Code), 
and with the IRS (pursuant to Section 6109 of the Internal Revenue 
Code).

Purpose(s) of the System:
    CSMS is a loan servicing, property management, and accounting 
system. The purpose of the system is to bill and collect funds owed to 
HUD/FHA, to provide program information about loan repayment and 
status, to manage investment of reserve for replace funds, to process 
and reimburse property managers or vendors for expenses incurred in 
managing multifamily properties owned by the Department, to track lease 
information for tenants living in HUD-owned properties, and to account 
for all transactions on this portfolio.
    CSMS is a subsidiary ledger to the FHA's general ledger. CSMS 
provides servicing and accounting for multifamily loans acquired 
through the payment of an insurance claims under various Sections of 
the National Housing Act (12 U.S.C 1701 et seq.), including Sections 
221(d)(3) and 221 (d)(4), 202, 207, 223(f), 232 and 242, 236, and loans 
from the Mark2Market and Demonstration preservation programs of the 
Office of Recapitalization (RECAP). CSMS also provides property 
management servicing and accounting for HUD-owned properties or 
mortgagees-in-possession for use by HUD and its property management 
contractor.

Categories of Individuals Covered by the System:
    (e.g., all participants of certain HUD Rental Housing Assistance 
Programs, and/or HUD staff). CSMS collects, processes, and retains 
information from the following individuals:
     Families receiving Housing assistance from HUD-
administered Multifamily programs administered by the Multifamily 
Property Disposition Division in Fort Worth, TX.
     Multifamily Property Owners established at the time that 
the FHA loan is executed.
     Vendors to ensure, preserve and protect the property, 
including but not limited to electricians, plumbers, landscape 
contractors, security services, advertisers, painters and foreclosure 
commissioners.
     HUD employees who have CSMS access for entering and 
tracking information.

Categories of Records in the System:
     Loan Servicing/Claims: Mortgagors/Borrowers and authorized 
contacts' names and addresses, Borrower's TIN/Social Security Numbers, 
phone numbers; email addresses; banking information (institutional 
information, routing, account numbers and account type); loan amounts 
(assigned balance, unpaid principal balance, face amount), interest 
rates, loan terms, and loan statuses; claim data (amount, expenses, 
interest paid by HUD, certificate of claim liability); payment and 
other financial account data such as loan balances, loan history, 
interest accrued, fees incurred, real estate property information, 
property taxes and insurance amounts, reserve for replacement escrow 
accounts and related invested escrows; accounting data including debits 
and credits to HUD accounts based on transaction events.
     Vendor Information: Service fees, late fees, and other 
billing data; collection history; expenses incurred for foreclosure and 
acquisition, protection and preservation, attorney fees, special 
assessments; disbursements for taxes, insurance, and any other 
miscellaneous disbursements; Mortgagee-in-Possession activity, 
appraisals, closing costs; asset sales, other loan termination data; 
UCC and filings by jurisdiction with due dates, filing costs, 
continuation data.
     HUD-Owned Property: Property names, addresses, authorized 
contacts names and addresses, phone numbers, email addresses; property 
financial account data such as income and expense; acquisition data; 
sale data, potential bidders, bid packages, closing activities; vendor/
business partner (banking information, TIN/SSN number, routing, account 
numbers, small business identifier, and other socioeconomic data); 
accounting data including debits and credits to HUD accounts based on 
transaction events.
     HUD-Owned Property Tenant: Tenants' names, addresses, 
social security number, marital status, gender, family members; lease 
information, including rent, subsidies, fees, collections, history, and 
eviction status.
     Uniform Commercial Code (UCC)/202: Property names, 
addresses, authorized contacts' names and addresses, phone numbers, 
email addresses; loan maturity date; status; UCC filing by jurisdiction 
due dates, filing costs, continuation data.

Record Source Categories:
    Records in the system are obtained through a variety of HUD/FHA 
loan documents, completed W-9 forms, investment account enrollment 
forms, and tenant lease records. Information is entered into the system 
by HUD/FHA staff or its contractors. This information is not received 
electronically from another system. The information is released by HUD 
for entry into CSMS.
    Routine uses of records maintained in the system, including 
categories of users and the purposes of such uses. In addition to those 
disclosures generally permitted under 5 U.S.C. Section 552A(B) of the 
Privacy Act, all or a portion of the records or information contained 
in this system may be disclosed to authorized entities, as is 
determined to be relevant and necessary, outside the Department of 
Housing and Urban Development as a routine use pursuant to 5 U.S.C. 
552A(B)(3), as follows:
    1. To appropriate agencies, entities, and persons for disclosures 
which are compatible with the purpose for which the records in this 
system were collected, as set forth by Appendix I--HUD's Routine Use 
Inventory Notice published in the Federal Register (80 FR 81837-81840), 
as follows:
    a. To the National Archives and Records Administration or to the 
General Services Administration for records having enough historical or 
other value to warrant continued preservation by the United States 
Government, or for inspection under Title 44 U.S.C. 2904 and 2906. Loan

[[Page 7210]]

Servicing and HUD-Owned Property hard-copy documentation is provided.
    b. To a congressional office from the record of an individual, in 
response to an inquiry from that congressional office made at the 
request of that individual. Loan Servicing/Claims, Vendor, HUD-Owned 
Property, HUD-Owned Property tenant, and UCC/202 information is 
provided as requested.
    c. To contractors performing or working under a contract with HUD, 
when necessary to accomplish an agency function related to this system 
of records. Disclosure requirements are limited to only those data 
elements considered relevant to accomplishing an agency function. 
Individuals provided information under these routine use conditions are 
subject to Privacy Act requirements and disclosure limitations imposed 
on the Department. Loan Servicing/Claims, Vendor Information, HUD-Owned 
Property Information, HUD-Owned Property tenant, and UCC/202 is 
provided as requested.
    d. To appropriate Federal, State, and local governments, or 
persons, pursuant to a showing of compelling circumstances affecting 
the health or safety or vital interest of an individual or data 
subject, including assisting such agencies or organizations in 
preventing the exposure to or transmission of a communicable or 
quarantinable disease, or to combat other significant public health 
threats, if upon such disclosure appropriate notice was transmitted to 
the last known address of such individual to identify the health threat 
or risk. To a consumer reporting agency, when trying to collect a claim 
owed on behalf of the Government, in accordance with 31 U.S.C. 3711(e). 
To Federal, State, and local agencies, their employees, and agents for 
the purpose of conducting computer matching programs as regulated by 
the Privacy Act of 1974, as amended (5 U.S.C. 552a).
    e. To Federal agencies, non-Federal entities, their employees, and 
agents (including contractors, their agents or employees; employees or 
contractors of the agents or designated agents); or contractors, their 
employees or agents with whom HUD has a contract, service agreement, 
grant, cooperative agreement, or computer matching agreement for the 
purpose of: (1) Detection, prevention, and recovery of improper 
payments; (2) detection and prevention of fraud, waste, and abuse in 
major Federal programs administered by a Federal agency or non-Federal 
entity; (3) detection of fraud, waste, and abuse by individuals in 
their operations and programs, but only to the extent that the 
information shared is necessary and relevant to verify pre-award and 
prepayment requirements prior to the release of Federal funds, prevent 
and recover improper payments for services rendered under programs of 
HUD or of those Federal agencies and non-Federal entities to which HUD 
provides information under this routine use.
    f. To contractors, grantees, experts, consultants, Federal 
agencies, and non-Federal entities, including, but not limited to, 
State and local governments and other research institutions or their 
parties, and entities and their agents with whom HUD has a contract, 
service agreement, grant, or cooperative agreement, when necessary to 
accomplish an agency function, related to a system of records, for the 
purposes of statistical analysis and research in support of program 
operations, management, performance monitoring, evaluation, risk 
management, and policy development, or to otherwise support the 
Department's mission. Records under this routine use may not be used in 
whole or in part to make decisions that affect the rights, benefits, or 
privileges of specific individuals. The results of the matched 
information may not be disclosed in identifiable form.
    g. To a recipient who has provided the agency with advance, 
adequate written assurance that the record provided from the system of 
records will be used solely for statistical research or reporting 
purposes. Records under this condition will be disclosed or transferred 
in a form that does not identify an individual.
    h. To contractors, grantees, experts, consultants and their agents, 
or others performing or working under a contract, service, grant, or 
cooperative agreement with HUD, when necessary to accomplish an agency 
function related to a system of records. Disclosure requirements are 
limited to only those data elements considered relevant to 
accomplishing an agency function. Individuals provided information 
under these routine use conditions are subject to Privacy Act 
requirements and disclosure limitations imposed on the Department.
    i. To contractors, experts and consultants with whom HUD has a 
contract, service agreement, or other assignment of the Department, 
when necessary to utilize relevant data for the purpose of testing new 
technology and systems designed to enhance program operations and 
performance.
    j. To appropriate Federal, State, local, tribal, or governmental 
agencies or multilateral governmental organizations responsible for 
investigating or prosecuting the violations of, or for enforcing or 
implementing, a statute, rule, regulation, order, or license, where HUD 
determines that the information would assist in the enforcement of 
civil or criminal laws. To third parties during the course of a law 
enforcement investigation, to the extent necessary to obtain 
information pertinent to the investigation, provided the disclosure of 
such information is appropriate to the proper performance of the 
official duties of the officer making the disclosure.
    k. To a court, magistrate, administrative tribunal, or arbitrator 
in the course of presenting evidence, including disclosures to opposing 
counsel or witnesses in the course of civil discovery, litigation, 
mediation, or settlement negotiations; or in connection with criminal 
law proceedings; or in response to a subpoena or to a prosecution 
request when such records to be released are specifically approved by a 
court provided order. To appropriate Federal, State, local, tribal, or 
governmental agencies or multilateral governmental organizations 
responsible for investigating or prosecuting the violations of, or for 
enforcing or implementing, a statute, rule, regulation, order, or 
license, where HUD determines that the information would assist in the 
enforcement of civil or criminal laws. To third parties during the 
course of a law enforcement investigation to the extent necessary to 
obtain information pertinent to the investigation, provided disclosure 
is appropriate to the proper performance of the official duties of the 
officer making the disclosure.
    To another agency or to an instrumentality of any governmental 
jurisdiction within or under the control of the United States for a 
civil or criminal law enforcement activity if the activity is 
authorized by law, and if the head of the agency or instrumentality has 
made a written request to the agency that maintains the record, 
specifying the particular portion desired and the law enforcement 
activity for which the record is sought.
    l. To the Department of Justice (DOJ) when seeking legal advice for 
a HUD initiative or in response to DOJ's request for the information, 
after either HUD or DOJ determine that such information is relevant to 
DOJ's representatives of the United States or any other components in 
legal proceedings before a court or adjudicative body, provided that, 
in each case, the agency also determines prior to disclosure that 
disclosure of the records to DOJ is a use of the information contained 
in the records that is compatible with the purpose for which HUD 
collected the records. HUD on its own may disclose records in this 
system of records in legal proceedings

[[Page 7211]]

before a court or administrative body after determining that the 
disclosure of the records to the court or administrative body is a use 
of the information contained in the records that is compatible with the 
purpose for which HUD collected the records.
    To the IRS for reporting of payments, forgiveness of debt, and 
property sales under section 6109 of the Internal Revenue Code. A 
subset of Loan Servicing/Claims and Vendor Information is provided. To 
banks holding escrow monies for the purpose of establishing interest 
bearing accounts and reporting of interest payments to the IRS under 
section 6109 of the Internal Revenue Code. A subset of Loan Servicing/
Claims data is provided. To credit reporting agencies for the purposed 
of reporting delinquencies under 5 U.S. Code 552a. A subset of Loan 
Servicing/Claims data is provided. To UCC filing organization for the 
purpose of filing UCC Article 9 secured party interest on behalf of HUD 
under the Uniform Commercial Code Article 9. A subset of Uniform 
Commercial Code (UCC)/202 data is provided.
    To appropriate agencies, entities, and persons as necessary when:
    1. HUD suspects or has confirmed that there has been a breach of 
the system of records;
    2. HUD has determined that as a result of the suspected or 
confirmed breach there is a risk of harm to individuals, HUD (including 
its information systems, programs, and operations), the Federal 
Government, or national security; and
    3. The disclosure made to such agencies, entities, and persons is 
reasonably necessary to assist in connection with HUD efforts to 
respond to the suspected or confirmed breach or to prevent, minimize, 
or remedy such harm.
    4. To another Federal agency or Federal entity, when HUD determines 
that information from this system of records is reasonably necessary to 
assist the recipient agency or entity in:
    5. Responding to a suspected or confirmed breach or,
    6. Preventing, minimizing, or remedying the risk of harm to 
individuals, the recipient agency or entity (including its information 
systems, programs, and operations), the Federal Government, or national 
security, resulting from a suspected or confirmed breach.

Policies and Practices for Storage of Records:
    Records in CSMS are stored electronically in a secure data center 
at the primary site in Silver Spring, MD and at a secure data center at 
the Disaster Recovery Site in Columbus, OH. Encrypted backup tapes are 
stored in a secure vault at an alternate storage site in Rockville, MD. 
Paper records are stored in locked file cabinets in limited access 
areas of a secure facility with 24 hour monitoring and other physical 
protection measures. Paper records are stored in a secure location and 
retrieved by staff according to their level of authorization.

Policies and Practices for Retrieval of Records:
    Electronic records are retrieved via a variety of CSMS reports and 
data screens by authorized users of CSMS according to their level of 
authorization. The primary method of retrieval is Integrated Real 
Estate Management System (IREMS) id or FHA loan number.

Policies and Practices for Retention and Disposal of Records:
    Record retention use and disposal practices are governed by 44 
U.S.C. Chapter 33. On-line data is kept for the life of the system/
contract, based on the contractual requirement to provide full loan 
histories. Backup and Recovery digital media are destroyed or otherwise 
rendered irrecoverable per NIST SP 800-88 Rev 1 ``Guidelines for Media 
Sanitization.'' Hard copy documents held by the contractor are retired 
per the Performance Work Statement and HUD Handbook 2225.6, Records 
Disposition Schedules and HUD Handbook 2228.2, General Records 
Schedules. The system contractor will purge the information at contract 
termination per the Transition-Out Plan.

Administrative, Technical, and Physical Safeguards:
    Electronic records are maintained in secured areas within the 
system. Access is limited to authorized personnel with a need-to-know 
based on unique user credentials and confidential passwords. Physical 
entry by unauthorized person is restricted though the use of locks, 
guards, passwords, and/or other security measures. Policy and standard 
operating procedures are implemented and disseminated to system users 
to ensure records are safeguarded, including rules of behavior 
implementation.

Record Access Procedures:
    For information, assistance, or inquiry about the existence of 
records, contact Marcus Smallwood, Acting, Chief Privacy Officer 451 
Seventh Street SW, Room 10139, Washington, DC 20410, telephone number 
(202) 708-3055. When seeking records about yourself from this system of 
records or any other Housing and Urban Development (HUD) system of 
records, your request must conform with the Privacy Act regulations set 
forth in 24 CFR part 16. You must first verify your identity, meaning 
that you must provide your full name, address, and date and place of 
birth. You must sign your request, and your signature must either be 
notarized or submitted under 28 U.S.C.1746, a law that permits 
statements to be made under penalty of perjury as a substitute for 
notarization. In addition, your request should:
    a. Explain why you believe HUD would have information on you.
    b. Identify which Office of HUD you believe has the records about 
you.
    c. Specify when you believe the records would have been created.
    d. Provide any other information that will help the Freedom of 
Information Act (FOIA), staff determine which HUD office may have 
responsive records.
    If your request is seeking records pertaining to another living 
individual, you must include a statement from that individual 
certifying their agreement for you to access their records. Without the 
above information, the HUD FOIA Office may not conduct an effective 
search, and your request may be denied due to lack of specificity or 
lack of compliance with regulations.

Contesting Record Procedures:
    The Department's rules for contesting contents of records and 
appealing initial denials appear in 24 CFR part 16, Procedures for 
Inquiries. Additional assistance may be obtained by contacting John 
Bravacos, Senior Agency Official for Privacy, 451 Seventh Street SW, 
Room 10139, Washington, DC 20410, or the HUD Departmental Privacy 
Appeals Officers, Office of General Counsel, Department of Housing and 
Urban Development, 451 Seventh Street SW, Washington, DC 20410.

Notification Procedures:
    Individuals seeking notification of and access to any record 
contained in this system of records, or seeking to contest its content, 
may submit a request in writing to the Privacy Office at the address 
provided above or to the component's FOIA Officer, whose contact 
information can be found at https://www.hud.gov/foia under ``contact.'' 
If an individual believes more than one component maintains Privacy Act 
records concerning him or her the individual may submit the request to 
the Chief Privacy Officer, HUD, 451 Seventh Street SW, Room 10139, 
Washington, DC 20410.

[[Page 7212]]

Exemptions Promoulgated for the System:
    None.

History:
    None.

    Dated: February 8, 2018.
John Bravacos,
Senior Agency Official for Privacy.
[FR Doc. 2018-03393 Filed 2-16-18; 8:45 am]
 BILLING CODE 4210-67-P