DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration

Office of Human Resource Management

PRIVACY IMPACT ASSESSMENT

For The

Office of Workers Compensation Program Tracking System (OWCP)

16 July 2010

Overview of the OWCP

The Federal Aviation Act of 1958 gives the Federal Aviation Administration (FAA) the responsibility to carry out safety programs to ensure the safest, most efficient aerospace system in the world. The FAA is responsible for:

Regulating civil aviation to promote safety;
Encouraging and developing civil aeronautics, including new aviation technology;
Developing and operating a system of air traffic control and navigation for both civil and military aircraft;
Developing and carrying out programs to control aircraft noise and other environmental effects of civil aviation; and
Regulating United States (U.S.) commercial space transportation.

One of the programs that helps the FAA fulfill these responsibilities is the Office of Workers Compensation Program Tracking System (OWCP), which was created to maintain a consolidated database of information for purposes of tracking and managing all FAA workers' compensation claims.

This system maintains information surrounding each Worker’s Compensation Claim, including the history of the medical claim and the treatment required to remediate the basis for the claim.

Information, Including Personally Identifiable Information, in OWCP

The Office of Human Resource Management Program and Policies – Workers Compensation Division enters name and medical information related to the compensation case into the OWCP system.

Source of the PII are claims forms, correspondence with Department of Labor, and medical reports.

PII and other data that may be present within the OWCP system can include:

Name
Medical information surrounding the claim, which can include:

Diagnosis
Treatment history
Treating physician
Physician notes
Other medical-related information surrounding the claim

The medical information is stored in a comments/notes field.

The individual’s Social Security Number (SSN) and home mailing address is not included within the system.

Why OWCP Collects PII Information

The system collects PII and other claim-related information for case management purposes. OWCP provides for a means to track and document Worker’s Compensation Claims in a consolidated and secure system across the claim’s entire lifecycle. Having the PII associated with the claim allows the loss associated with the claim to be charged back to the claimant’s associated LOB.

Collecting PII within this system is necessary for the FAA mission to help contain costs, which is a measureable goal of the organizational excellence of the flight plan.

Legal Authority for Information Collection

5 U.S.C. 3301 and 7901, 21 U.S.C. 1101, 42 U.S.C. 4541 and 4561, and 44, U.S.C 3101

How OWCP Uses Information

The internal use for the PII collected by the system is to be able to track compensation cases.

The system creates or makes previously unavailable information available about an individual in that the medical report information is being added to this system.

The system is compatible with the initial collection purpose detailed in the applicable SORN.

How OWCP Shares PII Information

PII contained in OWCP is shared with no other systems or organizations.

Data entered into this system is used strictly by the AHR-100 employees only to track compensation cases.

System does not share the information with other systems, internal or external.

How OWCP Provides Notice and Consent ¹

For an individual’s PII to be included in the OWCP, individual must have a Workers Compensation action filed in the Workers Compensation Information System (WCIS).

The OWCP system does not provide a notice or consent. System is an organizational tracking system only for AHR-100 only.

Individuals are not notified of the scope of the information collected.

How OWCP Ensures Data Accuracy

PII is entered into the system manually.

Validation checks are built into the application software that both prompt the user that an incorrect entry has been entered and must be corrected, and that a user has successfully input data.

PII is not cross-referenced with other systems to verify accuracy.

How OWCP Provides Redress

Under the provisions of the Privacy Act, individuals may request searches of the OWCP file to determine if any records have been added that may pertain to them. This is accomplished by contacting:

AHR-100 OWCP Program Manager
Orville Wright Bldg (FOB10A)
FAA National Headquarters
800 Independence Ave, SW
Washington, DC 20591

Consumers can express grievances about privacy issues to the OWCP Program Manager.

Only AHR-100 OWCP personnel have access and privileges to modify the OWCP information.

How OWCP Secures PII Information

OWCP takes appropriate security measures to safeguard PII and other sensitive data. Security measures in place would include intranet access only and restricted access to the system is limited to AHR-100’s 15 or so employees.

OWCP applies DOT security standards, including but not limited to routine scans and monitoring, back-up activities, and background security checks of technical employees and contractors.

FAA has implemented security controls and technology features that fully incorporate protection of privacy. FAA has complied with Federal Information Security Management Act (FISMA), and mitigated privacy risks through the following methods:

Access to the system is controlled through role-based user accounts.
The system is protected by a series of intrusion detection devices centrally monitored by FAAs Cyber Security Management Center.
The system strictly controls the transmission and storage of information.
All government and contract personnel are required to complete privacy training.

The OWCP system is audited by FAA Security Personnel to ensure FISMA compliance through an annual assessment utilizing standards and guidance provided by the National Institute of Standards and Technology (NIST). The OWCP system has met all requirements and has been certified and accredited to operate by the authority of DOT/FAA.

OWCP takes appropriate security measures to safeguard PII and other sensitive data. The OWCP system is housed in a controlled computer center within a secure facility.

Physical access to the OWCP system is limited to appropriate personnel through photo badges, building key cards, and room-access key pads.

In addition to physical access, electronic access to PII in WCIS is limited according to job function.

How Long OWCP Retains PII

Case records are retained indefinitely.

OWCP System of Records Notice (SORN)

OWCP is a system of records subject to the Privacy Act because it is searched by name.

OWCP contains information that is part of existing System of Records subject to the Privacy Act, because it is searched by an individual Name.

You can find the applicable system of records notice at http://www.dot.gov/privacy/privacyactnotices,

DOT/ALL, 6 Workers’ Compensation Information System.

The DOT is in process to certify and accredit the security of OWCP in accordance with DOT information technology security standard requirements.

1- According to the Privacy Act of 1974, 5 U.S.C. § 552a(b), "No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [subject to 12 exceptions listed under subsection (b)(1–12)]."