Privacy Act of 1974; System of Records, 32205-32209 [2019-14409]

Agencies

• DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Federal Register Volume 84, Number 129 (Friday, July 5, 2019)]
[Notices]
[Pages 32205-32209]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-14409]


-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Docket No. FR-6146-N-07]


Privacy Act of 1974; System of Records

AGENCY: Office of Single-Family Asset Management, HUD.

ACTION: Notice of amended privacy act system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, the Office of 
Single Family Asset Management, Department of Housing and Urban 
Development (HUD) is giving notice that it intends to amend one of its 
systems of records published in the Federal Register on August 19, 
2016, Asset Disposition and Management System (ADAMS). As a result of 
the annual review of ADAMS, HUD is updating ADAMS to include automation 
of the Name Address Identification Number application process (e-NAID). 
This notice includes updates to the former notice's routine uses, 
categories of records, and purpose of system statements. This notice 
also incorporates administrative and format changes to convey already 
published information in a more synchronized format.

DATES: August 5, 2019.
    Comments Due Date: August 5, 2019.

ADDRESSES: You may submit comments, identified by docket number and 
title, by one of the following methods:
    Federal e-Rulemaking Portal: https://www.regulation.gov. Follow the 
instructions provided on that site to submit comments electronically. 
All comments received will be posted without change to https://www.regulation.gov, including any personal information provided.
    Mail: Attention: Housing and Urban and Development, Privacy Office; 
John Bravacos, The Executive Secretariat, 451 Seventh Street SW, Room 
10139; Washington, DC 20410.
    Email: [email protected].
    Fax: 202-619-8365.
    Docket: For access to the docket to read background documents or

[[Page 32206]]

comments received go to https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: The Privacy Office, 451 Seventh Street 
SW, Room 10139, Washington, DC 20410, telephone number 202-708-3054 
(this is not a toll-free number). Individuals who are hearing- and 
speech-impaired may access this telephone number via TTY by calling the 
Federal Relay Service at 800-877-8339 (this is a toll-free number).

SUPPLEMENTARY INFORMATION:  The Federal Housing Administration (FHA) 
insures approved lenders against the risk of loss on loans they finance 
for the purchase, and in some instances, rehabilitation of single 
family homes. In the event of a default on an FHA-insured loan, the 
lender generally acquires title to the property by foreclosure, a deed-
in-lieu of foreclosure, or other acquisition method; files a claim for 
insurance benefits; and conveys the property to HUD. Properties 
conveyed to the Secretary of HUD make up the Single Family Real Estate 
Owned (REO) inventory managed by the Office of Single Family Asset 
Management. HUD administers its REO disposition program through four 
Homeownership Centers (HOCs) located in Philadelphia, Pennsylvania; 
Atlanta, Georgia; Denver, Colorado; and Santa Ana, California. HUD 
currently has 55 Management and Marketing (M&M) contracts; 23 Asset 
Managers (AMs); 31 Field Service Managers (FSMs); and 1 Mortgage 
Compliance Manager (MCM) who provide M&M services throughout the United 
States. The ADAMS application is provided under a Software as a Service 
(SaaS) contract for HUD/FHA to track the acquisition, maintenance, and 
sale of HUD's Single-Family Real Estate Owned (REO) inventory under 
HUD's Property Disposition Sales Program (24 CFR part 291). The Office 
of Single-Family Asset Management (OSFAM) has automated the approval 
process for real estate brokers (selling and principal brokers), 
governmental entities (State and local governments, public agencies) 
and private nonprofit organizations that participate in HUD's Property 
Disposition Sales Program (24 CFR 291). Eligible participants must have 
an approved, active Name Address Identifier (NAID) and be registered as 
a Bidder on the HUD Home store website. The e-NAID process leverages 
existing ADAMS technology to verify program eligibility and approval 
requirements and consolidates the prior paper-based NAID application 
process with processing and approval of the NAID in ADAMS. The e-NAID 
enhancement eliminates manual data entry and supports the Department's 
mission to mitigate financial risk to the FHA Mutual Mortgage Insurance 
Fund (MMIF) by reducing the NAID processing timeframe and the required 
IRS 1099 payment to brokers and service contractors. As a result of the 
annual review of ADAMS, records have been updated to include automation 
of the Name Address Identification Number application process (e-NAID). 
This notice includes updates to the former notice's routine uses, 
categories of records, and purpose of system statements. This notice 
also incorporates administrative and format changes to convey already 
published information in a more synchronized format.
    Specifically, this ADAMS notice amendment identifies automation of 
the Name Address Identification Number (NAID) application process (e-
NAID). E-NAID:

 Allows participants to complete forms SAMS 1111, ``Payee Name 
and Address,'' and SAMS 1111-A, ``Selling Broker Certification'' 
through HUDhomestore.com
 Leverages e-Signature's Application Programming Interface 
(API) to allow the NAID application to be signed and approved 
electronically
 Provides near-real time approval and tracking/generation of 
NAID
 Eliminates the ``Check current NAID Status'' lookup option
 Eliminates manual data entry
 Reduces NAID processing time
SYSTEM NAME AND NUMBER
    Asset Disposition and Management System (ADAMS--P260).

SECURITY CLASSIFICATION:
    Not classified.

SYSTEM LOCATION:
    ADAMS is accessible at workstations located at the following 
locations: Department of Housing and Urban Development Headquarters, 
451 Seventh Street SW, Washington, DC 20410; HUD Atlanta Homeownership 
Center, Five Points Plaza, 40 Marietta Street, Atlanta, GA 30303-2806; 
HUD Philadelphia Homeownership Center, The Wanamaker Building, 100 Penn 
Square East, Philadelphia, PA 19107-3389; HUD Denver Homeownership 
Center Processing & Underwriting--20th FL, 1670 Broadway Denver, CO 
80202; Santa Ana Homeownership Center, Santa Ana Federal Building, 34 
Civic Center Plaza, Room 7015, Santa Ana, CA 92701-4003. The system is 
externally hosted by Yardi Systems, Inc., 430 S Fairview, Goleta, CA 
93117; SunGard, 1001 E Campbell Road, Richardson, TX 75081; and 
CenturyLink, 200 N Nash Street, El Segundo, CA 90245. The Santa Barbara 
datacenter hosts the design and development instances. Testing, 
production and disaster recovery instances are located in the Dallas, 
TX and Los Angeles, CA datacenters.

SYSTEM MANAGER(S):
    Ivery W. Himes, Director, Office of Single-Family Asset Management, 
Room 9178, 450 Seventh Street SW, Washington, DC 20410.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    The specific authorizations are:
     The National Housing Act, Public Law 479, 48 Stat. 1246, 
12 U.S.C. 1715z-11a
     The Housing and Community Development Act of 1987, Public 
Law 100-242, Title I, 165, Feb. 5, 1988, 101 Stat. 1864, 42 U.S.C. 3543
     Section 904 of the Stewart B. McKinney Homeless Assistance 
Amendments Act of 1988, Public Law 100-628, 42 U.S.C. 3544
     Title 24 Code of Federal Regulations, Part 291, 
Disposition of HUD-Acquired and -Owned Single Family Property

PURPOSE(S) OF THE SYSTEM:
    ADAMS is a case management system for HUD-owned and HUD-managed 
single-family properties in support of HUD Property Disposition Sales 
Program (24 CFR part 291). ADAMS supports HUD Headquarters and 
Homeownership Center (HOC) staff and HUD's Management and Marketing 
(M&M) contractors to track single-family properties from their 
acquisition by HUD through the steps necessary to resell the 
properties. ADAMS captures pertinent data relating to the properties, 
including acquisition, maintenance and sales cost, property description 
and value, bids and sales proceeds, and special program designations. 
ADAMS also tracks and monitors certain events after sales under the 
Good Neighbor Next Door, non-profit, and Asset Control Area (ACA) sales 
programs. Additional Nonprofit/Government entity web-based program 
management tools improve the application, recertification, and 
reporting process for organizations that participate in the Office of 
Single Family Housing (OSFH) activities and to assist HUD staff with 
the daily administration of FHA's Nonprofit Program activities. HUD 
maintains a roster of nonprofit organizations that are qualified to 
participate in certain specified FHA activities. ADAMS is used to:

[[Page 32207]]

     Approve and/or recertify participant's Name Address 
Identification (e-NAID) required to submit bids and purchaser 
information (SAMS 1111, SAMS 1111-A) for HUD REO property sales 
(HUDhomestore.com).
     Obtain, store, and display case-level information about 
properties acquired by or in custody of HUD.
     Track events and information describing the status of real 
property from the date of conveyance to the Department through several 
stages of management, marketing, and disposition, to final 
reconciliation of sale proceeds.
     Retain data relative to contracts, contractors, and 
vendors that support the property disposition program.
     Calculate property management, marketing, and incentive 
fees earned by management and marketing (M&M) contractors, closing 
agents, and special property inspection (SPI) contractors, and generate 
disbursement transmittals.
     Calculate M&M contractor payment incentives and 
disincentives.
     Generate disbursement transmittals for payment of other 
property-related expenses such as pass-through expenses and property 
taxes.
     Exchange data with HUD and non-HUD systems and internet 
sites for both input and retrieval of data using the data exchange.
     Provide data security with multiple levels of access for 
users including HUD employees and designated contractors.
     Provide standard and ad hoc reporting capability.
     Facilitate summary, trend, and comparative analysis of 
portfolio performance.
     Provide ease of navigation and use for users at all skill 
levels.
     Ensure the security and privacy of the information 
collected and stored in the SSAE-18 compliant data center and provide 
disaster recovery from the disaster recovery data center.
     Provide Web-based access to subcontractors, appraisers, 
and inspectors to enable them to upload property data and related 
documents.
     Provide Pre-Conveyance functionality including request for 
conveyance extension, request for approval of occupied conveyance, 
over-allowable requests, and surchargeable damage request.
     Special reporting designed for ease of use by M&M 
contractors. Reports based on latest daily and weekly data and provides 
for online reports, national summary reports, and historical reports 
that are uploaded by administrative users.
     Web-based Disposition Program Compliance System (DPCS) 
module provides features to support the performance of Good Neighbor 
Next Door Sales Programs (GNND) compliance control tasks. DPCS features 
are organized according to three main steps in the sales process: Pre-
sales/pre-registration, sales/pre-closing, and post-closing.
    Extensive workflow rules are incorporated into ADAMS to ensure 
compliance with HUD regulations, policies, and procedures. OSFAM 
ensures the protection of program participant PII and mortgagee 
business sensitive information by ensuring ADAMS' compliance with HUD 
and Federal Information Security Management Act (FISMA) security and 
privacy controls. Data exchanges are done via secure file transfer 
protocol (SFTP); and the servers and mainframes used employ Federal 
Information Processing Standards (FIPS) 199 moderate security 
categorization controls. The ADAMS Information System Security Officer 
(ISSO) and Co-CORs work closely with system security administrators, 
network and project security personnel to ensure the integrity of data 
exchanges. The ADAMS service provider has annual independent Service 
Organization Control (SOC I) attestation audits conducted in accordance 
with the American Institute of Certified Public Accountants' (AICPA) 
Statement on Standards for Attestation Engagements No. 18 (SSAE 18) and 
under Federal Information System Controls Audit Manual (FISCAM) 
standards. Access to REO data and ADAMS screens is restricted to those 
individuals with a need-to-know and a valid business justification. 
Approved changes undergo rigorous service provider acceptance, smoke, 
and regression testing before User Acceptance Testing (UAT) by HUD 
Subject Matter Experts (SMEs) and implementation is authorized.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Individuals covered by this system include:
     Homebuyers
     Successful Bidders (purchasers)
     Nonprofits and Government (state and local) agencies
     Management and Marketing (M&M) contractors

CATEGORIES OF RECORDS IN THE SYSTEM:
    Homebuyers
     Name, address, SSN, race/ethnicity
    Successful Bidders (Purchasers)
     Business name, address, and telephone number
     Social Security Number (SSN), Employee Identification 
Number (EIN), or Tax Identification Number (TIN)
     Mortgagee ID Number
     SAMS name and address identification number (NAID)
     FHA case number and property address
     Date purchaser(s) signed sales contract (Form HUD-9548)
     Date sales contract accepted by HUD
     Purchase price
     Purchaser type
     Appraisal information
     Tax payments
     Sales offer information
     HUD-1
     Contract information
     Vendor information
     Financial transactions
    Nonprofit and Government (state and local) (Note: In addition to 
the successful bidders/purchasers)
     Internal Revenue Service (IRS) letters for determination 
of nonprofit status
     Articles of Organization
     Mortgage notes
     W-9
     SAMS-1111
     Property report documentation (Median Income 
certification)
    Management and Marketing (M&M) Contractors
     Business name, address, and telephone number
     EIN, TIN, or SSN
     SAMS NAID
     FHA case number and property address
     Date purchaser(s) signed sales contract (Form HUD-9548)
     Date sales contract accepted by HUD
     Purchase price
     Purchaser type
     Mortgage notes
     W-9
     SAMS-1111
     Property report documentation (Median Income 
certification)
     Limited information about the homebuyers: Name, address, 
SSN, and race/ethnicity characteristics
     Payment Information Form ACH Vendor Payment System (SF 
3881) new
    ADAMS contains files on property appraisals, tax payments, purchase 
sales offer information, HUD-1, purchase contract information, vendor 
information, and property preservation and protection invoice 
information, FHA property listings, and property agent contact 
information.

RECORD SOURCE CATEGORIES:
    Purchasers, Brokers, appraisers, M&M contractors, Nonprofits, State 
and Local Government entities, and HUD employees.

[[Page 32208]]

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    In addition to those disclosures generally permitted under 5 U.S.C. 
552a(b) of the Privacy Act, all or a portion of the records or 
information in this system may be disclosed to authorized entities, as 
determined to be relevant and necessary, outside the Department of 
Housing and Urban Development (HUD) as a routine use pursuant to 5 
U.S.C. 552a(b)(3):
    1. To the Government Accountability Office (GAO) for audit 
purposes.
    2. To the Office of the Inspector General (OIG) for audit purposes.
    3. To Management and Marketing contractors for processing the sale 
of HUD Homes.
    4. To the Federal Bureau of Investigation (FBI) to investigate 
possible fraud revealed in the course of property disposition efforts 
to allow HUD to protect the interest of the Secretary.
    5. To the National Archives and Records Administration (NARA) for 
records having sufficient historical or other value to warrant 
continued preservation by the United States Government, or for 
inspection under authority of Title 44, Chapter 29, of the United 
States Code.
    6. To a congressional office from the record of an individual, in 
response to an inquiry from the congressional office made at the 
request of that individual.
    7. To contractors, grantees, experts, consultants, Federal 
agencies, and non-Federal entities, including, but not limited to, 
State and local governments and other research institutions or their 
parties, and entities and their agents with whom HUD has a contract, 
service agreement, grant, or cooperative agreement, when necessary to 
accomplish an agency function related to a system of records, for the 
purpose of statistical analysis and research in support of program 
operations, management, performance monitoring, evaluation, risk 
management, and policy development, or to otherwise support the 
Department's mission. Records under this routine use may not be used in 
whole or in part to make decisions that affect the rights, benefits, or 
privileges of specific individuals. The results of the matched 
information may not be disclosed in identifiable form.
    1. To contractors, grantees, experts, consultants and their agents, 
or others performing or working under a contract, service, grant or 
cooperative agreement with HUD, when necessary to accomplish an agency 
function related to a system of records. Disclosure requirements are 
limited to only those data elements considered relevant to 
accomplishing an agency function. Individuals provided information 
under these routine use conditions are subject to Privacy Act 
requirements and disclosure limitations imposed on the Department.
    2. To appropriate agencies, entities, and persons when:
    i. HUD suspects or has confirmed that the security or 
confidentiality of information in a system of records has been 
compromised;
    ii. HUD has determined that as a result of the suspected or 
confirmed compromise there is a risk of harm to economic or property 
interests, identity thief, or fraud, or hard to the security or 
integrity of systems or programs (whether maintained by HUD or another 
agency or entity) that rely upon the compromised information; and 
individuals, HUD (including its information systems, programs, and 
operations), the Federal Government, or national security; and
    iii. the disclosure made to such agencies, entities, and persons is 
reasonably necessary to assist in connection with HUD's efforts to 
respond to the suspected or confirmed compromise and prevent, minimize, 
or remedy such harm for purposes of facilitating responses and 
remediation efforts in the event of a data breach.
    8. To the Department of Justice (DOJ) when seeking legal advice for 
a HUD initiative or in response to DOJ's request for the information, 
after either HUD or DOJ determine that such information is relevant to 
DOJ's representatives of the United States or any other components in 
legal proceedings before a court or adjudicative body, provided that, 
in each case, the agency also determines prior to disclosure that 
disclosure of the records to DOJ is a use of the information contained 
in the records that is compatible with the purpose for which HUD 
collected the records. HUD on its own may disclose records in this 
system of records in legal proceedings before a court or administrative 
body after determining that the disclosure of the records to the court 
or administrative body is a use of the information contained in the 
records that is compatible with the purpose for which HUD collected the 
records.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    ADAMS records are stored electronically in secure facilities. 
Electronic files are stored in case files on secure servers. Electronic 
files are replicated at a disaster recovery offsite location in case of 
loss of computing capability or other emergency at the primary 
facility. ADAMS primary host facility is located at SunGard, 1001 E 
Campbell Road, Richardson, TX 75081. The ADAMS disaster recovery 
facility is at CenturyLink, 200 N Nash Street, El Segundo, CA 90245.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records can be viewed using computer search by the FHA case number, 
property address (including other geographical characteristics such as 
contract area, property state/city/county/zip code, Homeownership 
Center), or contractor ID or name, or non-profit/government agency 
name.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    ADAMS records comply with the National Archives and Records 
Administration's July 2017 General Records Schedule 1.1, Financial 
Management and Reporting Records, Items 010 and 011, to maintain for 
six years, or when business use ceases. Backup and Recovery digital 
media will be destroyed or otherwise rendered irrecoverable per NIST SP 
800-88 ``Guidelines for Media Sanitization'' (December 2014).

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    FHA ensures the protection of program participants' PII and 
mortgagee business sensitive information by ensuring ADAMS' compliance 
with HUD and Federal Information Security Management Act (FISMA) 
security and privacy controls.
    Administrative
    1. OSFAM conducts a full security assessment of ADAMS to ensure 
compliance with NIST SP 800-53, Recommended Security Controls for 
Federal Information Systems, as amended, and NIST SP 800-37, Guide for 
Applying the Risk Management Framework to Federal Information Systems, 
as amended, and HUD's authorization to operate methodology.
    2. ADAMS undergoes an annual independent attestation assessment.
    3. A documented security impact analysis is conducted whenever 
changes are proposed to ADAMS or its interfacing information systems, 
networks, or to their physical environment, interfaces, or user-
community makeup.
    4. The ADAMS hosting environment tests and documents the incident 
response capability for ADAMS on a yearly basis. This training allows 
for determination of the effectiveness the incident response plan and 
incorporation into the procedure for contingency planning testing plan.

[[Page 32209]]

    Technical
    1. Access to program participants data and ADAMS screens is 
restricted to those individuals with a need-to-know and a valid 
business justification.
    2. ADAMS access requires two levels of logins to access the system. 
The first login uses HUD Siteminder system to verify that the user has 
active HUD authorization. The second login uses ADAMS internal security 
system to set permissions for data access and system functionality.
    3. Data exchanges are done via secure file transfer protocol 
(SFTP); and the servers and mainframes used employ Federal Information 
Processing Standards (FIPS) 199 moderate security categorization 
controls. OSFAM personnel work closely with system security 
administrators, network and project security personnel to ensure the 
integrity of data exchanges.
    Physical
    1. Access to data centers are controlled using an electromagnetic 
badge and/or biometric access system which maintains information such 
as employee names, ID numbers, access badge numbers, issue date of the 
access badge, as well as what areas the employee is authorized to 
access.
    2. Each system logs the date, time, and location of each entry into 
the data center. Physical access is further restricted only to 
authorized personnel and other approved individuals according to their 
job functions. The systems are used to generate access badges used at 
each data center entrance where a badge reader is installed. Each badge 
reader stores an access list in memory. If a connection between a badge 
reader and the master server supporting the card key system is severed, 
the badge readers will still limit access using the access list stored 
in memory.
    3. A Facilities Manager performs a monthly review of entry logs at 
each data center to ensure access is appropriate. Any unusual 
activities are investigated and resolved.

RECORD ACCESS PROCEDURES:
    For Information, assistance, or inquiries about records, contact 
John Bravacos, Senior Agency Official for Privacy, 451 Seventh Street 
SW, Room 10139, Washington, DC 20410, telephone number (202) 708-3054. 
When seeking records about yourself from this system of records or any 
other HUD system of records, your request must conform with the Privacy 
Act regulations set forth in 24 CFR part 16. You must first verify your 
identity, by providing your full name, address, and date and place of 
birth. You must sign your request, and your signature must either be 
notarized or submitted under 28 U.S.C. 1746, a law that permits 
statements to be made under penalty of perjury as a substitute for 
notarization.
    If your request is seeking records pertaining to another living 
individual, you must include a statement from that individual 
certifying their agreement for you to access their records. Without the 
above information, the HUD FOIA Office may not conduct an effective 
search, and your request may be denied due to lack of specificity or 
lack of compliance with regulations.

CONTESTING RECORD PROCEDURES:
    The Department's rules for contesting contents of records and 
appealing initial denials appear in 24 CFR part 16, Implementation of 
the Privacy Act of 1974. Additional assistance may be obtained by 
contacting John Bravacos, Senior Agency Official for Privacy, 451 
Seventh Street SW, Room 10139, Washington, DC 20410, or the HUD 
Departmental Privacy Appeals Officers, Office of General Counsel, 
Department of Housing and Urban Development, 451 Seventh Street SW, 
Room 10110, Washington, DC 20410.

NOTIFICATION PROCEDURES:
    Individuals seeking notification of and access to any record 
contained in this system of records, or seeking to contest its content, 
may submit a request in writing to the Privacy Office at the address 
provided above or to the component's FOIA Officer, whose contact 
information can be found at https://www.hud.gov/foia under ``contact.'' 
If an individual believes more than one component maintains Privacy Act 
records concerning him or her, the individual may submit the request to 
the Senior Agency Official for Privacy, HUD, 451 Seventh Street SW, 
Room 10139, Washington, DC 20410.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    Amendment--Asset Disposition and Management System HSNG.SF/HUF.01, 
81 FR 55477; Published in the Federal Register--August 19, 2016.
    Amendment--Asset Disposition and Management System HSNG.SF/HUF.01, 
79 FR 10825; Published in the Federal Register--February 26, 2014 
(note: Changed coding structure).
    Amendment--Asset Disposition and Management System HUD/HS-58, 77 FR 
41993; Published in the Federal Register--July 17, 2012.
    Initial--Asset Disposition and Management System HUD/HS-58, 73 FR 
62520; Published in the Federal Register--October 21, 2008.

    Dated: June 28, 2019.
John Bravacos,
Senior Agency for Privacy.
[FR Doc. 2019-14409 Filed 7-3-19; 8:45 am]
BILLING CODE 4210-67-P