Policy Letter 17-02
Date: August 2, 2017
A critical responsibility of states and grantees is safeguarding personal information of refugees and other populations served by ORR. This Policy Letter provides guidance on sharing data about individuals receiving ORR refugee resettlement benefits or services.
Personally identifiable Information
The term “personally identifiable information” or PII refers to information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Common examples of PII include name, Social Security Number, driver’s license number, alien registration number, and date of birth.
The term PII is broad because there are many different types of information that can be used to distinguish or trace an individual's identity. Determining whether information is PII requires a case-by-case assessment of the specific risk that an individual can be identified. Information that is not PII can become PII whenever additional information becomes available in any medium or from any source that would make it possible to identify an individual.1 For example, citizenship or immigration status is not PII, but when combined with other identifiers, such as address or date of birth, it can become PII. Similarly, language and ethnic or religious affiliation can become PII when paired with other identifiers.
Restrictions on Sharing PII
The regulations at 45 CFR 400.27 direct states to ensure that no information about, or obtained from, an individual receiving ORR refugee resettlement benefits or services is disclosed in a form that can distinguish or trace the individual’s identity without the individual’s consent or the consent of their parent or guardian, if the individual is a minor. This extends to all information about the individual in the possession of a state agency providing ORR refugee resettlement benefits or services. As a result, states cannot release PII about individuals receiving ORR refugee resettlement benefits or services, except for purposes directly connected with, and necessary to, the administration of the program. Research and evaluation activities are not directly related to the administration of the refugee resettlement program.
HHS regulations at 45 CFR 75.365 permit public access to grantee records pertinent to a federal award, with the exception of PII. Therefore, grantees directly funded by ORR cannot release PII about individuals receiving benefits or services through an ORR grant.
One way to share information for activities not directly related to the administration of the resettlement program, such as research and evaluation, is to de-identify the data. Data is “de-identified” when individual identifiers that alone or in combination with other information could identify an individual have been removed.
If you have questions about the information in this Policy Letter, please contact Jennifer Schmalz at (202) 260-5186 or Jennifer.Schmalz@acf.hhs.gov.
E. Scott Lloyd
Director
Footnote
1. See OMB Memorandum M-17-12 “Preparing for and Responding to a Breach of Personally Identifiable Information” for more information about PII.