Drug Enforcement Administration

Drug Enforcement Administration

Privacy Impact Assessment for the

Prescription Drug Monitoring Program Analytics System (PDMPAS)

Issued by:

David J. Mudd Associate Chief Counsel, DEA Senior Component Official for Privacy

Approved by: Date approved:

Katherine Harman-Stokes Director (Acting) Office of Privacy and Civil Liberties U.S. Department of Justice

August 29, 2022

(May 2019 DOJ PIA Template)

Department of Justice Privacy Impact Assessment Drug Enforcement Administration/ Prescription Drug Monitoring Program Analytics System Page 1

Section 1: Executive Summary

Provide a high-level overview of the information technology (e.g., application, tool, automated process) in non-technical terms that describes the information technology, its purpose, how the information technology operates to achieve that purpose, the general types of information involved, how information may be used and shared, and why a Privacy Impact Assessment was conducted. (Note: this section is an overview; the questions below elicit more detail.)

The Prescription Drug Monitoring Program Analytics System (PDMPAS) is a set of analytic tools, data sources, and processes that are used to support the DEA's Diversion Control Division's (DC) mission by leveraging Prescription Drug Monitoring Program (PDMP) data to support cases and investigations across the country. In practice, PDMP data is provided by the field and includes pharmaceutical transaction data in support of the case work being driven by the field. To support these cases, PDMPAS will analyze the data provided and identify the patterns, metrics, risk factors, and red flags pertinent to the case and provide an overview of the entire dataset to the field.

The PDMPAS environment does collect and maintain some forms of personally identifiable information (PII) and therefore DEA is required to complete a Privacy Impact Assessment (PIA) for its use, pursuant to the E-Government Act of 2002 and the Office of Management and Budget's (OMB) implementing guidance (OMB M-03-22).

Section 2: Purpose and Use of the Information Technology

2.1 Explain in more detail than above the purpose of the information technology, why the information is being collected, maintained, or disseminated, and how the information will help achieve the Component's purpose, for example, for criminal or civil law enforcement purposes, intelligence activities, and administrative matters, to conduct analyses to identify previously unknown areas of concern or patterns.

The purpose of this environment is to provide a protected sandbox environment to research and conduct in-depth and actionable analytical support to DEA's DC for case support, civil litigation, and special projects. The analytical process ingests PDMP data, enhances it with commercially available data (e.g. Thompson-Reuters, Lexus-Nexus), and analyzes the enhanced data in support of special projects and cases. This process is based on over 150 risk factors developed by investigators, attorneys, and subject matter experts that are coded into a data analytics process.

When a request is submitted for a PDMPAS package, the applicable data may come in as Microsoft Excel, text or similar data file through Concorde for analysis. The data analysis requested from the field can be provided in standard form, custom or by commercial inquiries. A variety of analytic tools, namely Structured Query Language and Python, are used to process the data and provide responses to the field for all of their needs and questions. A comprehensive report is also created and provided to the field for them to review and analyze.

Department of Justice Privacy Impact Assessment Drug Enforcement Administration/ Prescription Drug Monitoring Program Analytics System Page 2

PDMP is also used to identify early prescription refills, doctor shopping (i.e. a person obtaining prescriptions from multiple doctors at once), distance traveled, dangerous drug combinations, prescription fraud, patient cells/crews (conspiracies of 3 or more patents), and payment schemes. DEA utilizes the PDMP in two ways: first it provides assistance in determining pharmaceutical drug diversion, and second it establishes production quotas of controlled substances.

The PDMPAS team consists of DEA employees and contractors who will collectively use this environment to support daily operations as users. PDMPAS team members may include the following positions: Section Chiefs, Program Analysts, Investigators, and Contractor analysts and/or Consultants with user approved privileges being assigned individually for each role.

2.2 Indicate the legal authorities, policies, or agreements that authorize collection of the information. (Check all that apply and include citations/references.)

Authority X Statute

Executive Order Federal Regulation Agreement, memorandum of understanding, or other documented arrangement

Other (summarize and provide copy of relevant portion)

Citation/Reference 21 U.S.C. ? 878, Controlled Substances Act

Section 3: Information in the Information Technology

3.1 Indicate below what types of information that may be personally identifiable in Column (1) will foreseeably be collected, handled, disseminated, stored and/or accessed by this information technology, regardless of the source of the information, whether the types of information are specifically requested to be collected, and whether particular fields are provided to organize or facilitate the information collection. Please check all that apply in Column (2), and indicate to whom the information relates in Column (3). Note: This list is provided for convenience; it is not exhaustive. Please add to "other" any other types of information.

Department of Justice Privacy Impact Assessment Drug Enforcement Administration/ Prescription Drug Monitoring Program Analytics System Page 3

(1) General Categories of Information that May Be Personally Identifiable

Example: Personal email address

(2) Information is collected,

processed, disseminated, stored and/or accessed by this information technology (please check each

applicable row)

X

(3) The information relates to: A. DOJ/Component Employees,

Contractors, and Detailees; B. Other Federal Government Personnel; C. Members of the Public - US Citizens or

Lawful Permanent Residents (USPERs); D. Members of the Public - Non-USPERs

B, C and D

Name

X

A, B, C and D

Date of birth or age

X

A, B, C and D

Place of birth

X

A, B, C and D

Gender

X

Race, ethnicity or citizenship

X

A,B,C and D A, B, C and D

(4) Comments

Email addresses of members of the public (US and nonUSPERs)

Names could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Other personal information e.g. date of birth, age etc. could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Other personal information e.g. date of birth, age etc. could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Gender information could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Race, ethnicity and/ or citizenship could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Department of Justice Privacy Impact Assessment Drug Enforcement Administration/ Prescription Drug Monitoring Program Analytics System Page 4

(1) General Categories of Information that May Be Personally Identifiable

Religion

(2) Information is collected,

processed, disseminated, stored and/or accessed by this information technology (please check each

applicable row)

X

(3) The information relates to: A. DOJ/Component Employees,

Contractors, and Detailees; B. Other Federal Government Personnel; C. Members of the Public - US Citizens or

Lawful Permanent Residents (USPERs); D. Members of the Public - Non-USPERs

A,B,C and D

Social Security Number (full, last 4

X

digits or otherwise truncated)

A,B,C and D

Tax Identification Number (TIN)

X

A,B,C and D

Driver's license

X

A,B,C and D

Alien registration number

X

A,B,C and D

(4) Comments

Religion could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Social Security Number (SSN) could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Government assigned identifiers etc. could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Government assigned identifiers etc. could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Government assigned identifiers etc. could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Department of Justice Privacy Impact Assessment Drug Enforcement Administration/ Prescription Drug Monitoring Program Analytics System Page 5

(1) General Categories of Information that May Be Personally Identifiable

Passport number

(2) Information is collected,

processed, disseminated, stored and/or accessed by this information technology (please check each

applicable row)

X

(3) The information relates to: A. DOJ/Component Employees,

Contractors, and Detailees; B. Other Federal Government Personnel; C. Members of the Public - US Citizens or

Lawful Permanent Residents (USPERs); D. Members of the Public - Non-USPERs

A,B,C and D

Mother's maiden name

Vehicle identifiers

X

A,B,C and D

Personal mailing address

X

A,B,C and D

Personal e-mail address

X

A,B,C and D

(4) Comments

Government assigned identifiers etc. could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Vehicle Identification Numbers could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Email addresses, phone numbers etc. could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs) to include for prescribers, pharmacies, and/or patients.

Email addresses, etc. could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs) to include for prescribers, pharmacies, and/or patients.

Department of Justice Privacy Impact Assessment Drug Enforcement Administration/ Prescription Drug Monitoring Program Analytics System Page 6

(1) General Categories of Information that May Be Personally Identifiable

Personal phone number

(2) Information is collected,

processed, disseminated, stored and/or accessed by this information technology (please check each

applicable row)

X

(3) The information relates to: A. DOJ/Component Employees,

Contractors, and Detailees; B. Other Federal Government Personnel; C. Members of the Public - US Citizens or

Lawful Permanent Residents (USPERs); D. Members of the Public - Non-USPERs

A,B,C and D

Medical records number

X

Medical notes or other medical or

X

health information

Financial account information

X

Applicant information Education records Military status or other information Employment status, history, or similar information Employment performance ratings or other performance information, e.g., performance improvement plan Certificates Legal documents Device identifiers, e.g., mobile devices Web uniform resource locator(s) Foreign activities

A,B,C and D A,B,C and D A,B,C and D

(4) Comments

Phone numbers etc. could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs) to include for prescribers, pharmacies, and/or patients.

Health information could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs)

Health information could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs)

Financial information could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Department of Justice Privacy Impact Assessment Drug Enforcement Administration/ Prescription Drug Monitoring Program Analytics System Page 7

(1) General Categories of Information that May Be Personally Identifiable

Criminal records information, e.g., criminal history, arrests, criminal charges

(2) Information is collected,

processed, disseminated, stored and/or accessed by this information technology (please check each

applicable row)

X

(3) The information relates to: A. DOJ/Component Employees,

Contractors, and Detailees; B. Other Federal Government Personnel; C. Members of the Public - US Citizens or

Lawful Permanent Residents (USPERs); D. Members of the Public - Non-USPERs

A,B,C and D

Juvenile criminal records information

Civil law enforcement information,

X

e.g., allegations of civil law violations

A,B,C and D

Whistleblower, e.g., tip, complaint or referral

Grand jury information

X

A,B,C and D

Information concerning witnesses to criminal matters, e.g., witness statements, witness contact information

Procurement/contracting records

Proprietary or business information Location information, including continuous or intermittent location tracking capabilities

Biometric data: - Photographs or photographic

identifiers - Video containing biometric data - Fingerprints - Palm prints - Iris image - Dental profile - Voice recording/signatures

(4) Comments

Criminal history could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Civil law violation information could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

Information related to grand jury, criminal prosecution, or civil litigation could be collected of employees, contractors, other federal government personnel, members of the public (US or non-USPERs).

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download