Who is responsible for the PIA process?
• The PIA process is a collaborative one, and involves multiple stakeholders; • Those with the most knowledge and insight into a system, its characteristics, and the privacy and security controls in place should complete the PIA. This can include a System Owner/Manager or program official. PIA authors can also consult with the IC Privacy Coordinator and Information System Security Officer (ISSO); • Once the PIA is completed by the PIA author, it is sent to the PIA Reviewer for their review and comments. The PIA Reviewer role should be assigned to the IC Privacy Coordinator or a designee. If no revisions are required, the PIA Reviewer can promote the PIA to the NIH OSOP; and • The OSOP reviews completed PIAs and promotes them to the HHS SAOP, if complete and accurate, or returns the PIA to the IC Privacy Coordinator if it is incomplete or requires changes.
