Loading...
HomeMy WebLinkAboutRES 20-211RESOLUTION NO. 20-211 BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF BEAUMONT: THAT the City Manager be and he is hereby authorized to execute an Information Sharing Access Agreement, (ISAA) with the Department of Homeland Security/Federal Emergency Management Agency (DHS/FEMA) Federal Insurance and Mitigation Administration (FIMA) to enable FEMA to share personally identifiable information that is protected by the Privacy Act of 1974 with the City relating to daily flood management. The Information Sharing Access Agreement is substantially in the form attached hereto as Exhibit "A" and made a part hereof for all purposes. The meeting at which this resolution was approved was in all things conducted in strict compliance with the Texas Open Meetings Act, Texas Government Code, Chapter 551. PASSED BY THE CITY COUNCIL of the City of Beaumont this the 6th day of October, 2020. - M or Becky Ames - DHS/FEMA ISAA Page 1 of 13 INFORMATION SHARING ACCESS AGREEMENT (ISAA) BETWEEN THE DEPARTMENT OF HOMELAND SECURITY/ FEDERAL EMERGENCY MANAGEMENT AGENCY (DHS/FEMA) FEDERAL INSURANCE AND MITIGATION ADMINISTRATION (FIMA) AND The City of Beaumont, Jefferson County, Texas 1. INTRODUCTION AND PURPOSE. The U.S. Department of Homeland Security/Federal Emergency Management Agency, Federal Insurance and Mitigation Administration (DHS/FEMA/FIMA) and The City of Beaumont, Jefferson County, Texas (Beaumont, Texas) voluntarily enter into this Information Sharing Access Agreement (ISAA). The purpose of the ISAA is to enable FEMA to share personally identifiable information (PII) that is protected by the Privacy Act of 1974 (Privacy Act), as amended, 5 U.S.C. § 552a, with the Beaumont, Texas to review National Flood Insurance Program (NFIP) policy and/or claims information will used for daily floodplain management, CRS and HM activities NFIP Data will be used in providing unmet needs by NFIP claims payouts within Beaumont, Texas and service areas, making substantial damage determinations as well as identifying properties for buy- out or elevation.. 2. AUTHORITIES. This ISAA is authorized by: a. Robert T. Stafford Disaster Relief and Emergency Assistance Act, Pub. L. No. 93-288 (1974) (42 U.S.C. 5121 et seq.) (Stafford Act) for declared disasters only; b. Homeland Security Act of 2002, Pub. L. No. 107-296 (2002) (6 U.S.C. 101 et seq.) for declared disasters only; c. National Flood Insurance Act of 1968, Pub. L. No. 90-448, Title XIII (1968) (42 U.S.C. 4001 et seq.) (NFIA); d. Privacy Act of 1974 (5 U.S.C. 552a) (Privacy Act); e. Authority notification - DHS/FEMA 003 NFIP Files System of Records, 79 FR 28747 (May 19, 2014) (NFIP Files SORN). Updated August 07, 2019 EXHIBIT "A" DHS/FEMA ISAA Page 2 of 13 3. BACKGROUND a. FEMA collects, maintains, uses, and disseminates, personally identifiable information (PIl) from NFIP policyholders. NFIP policyholder PII is protected by the Privacy Act and shared pursuant to the NFIP Files SORN. b. As authorized by the routine use provision of the Privacy Act, 5 U.S.C. § 552a(b)(3), FEMA may disclose policyholder PII to federal, state, local, and tribal government agencies to enable them to receive only the NFIP policy and claims information necessary to satisfy a specific routine use as valid and eligible under the NFIP Files SORN. c. This ISAA encompasses NFIP Files SORN Routine Uses (I), (L), (M), (N), (0), (R), and (T) only. d. This ISAA encompasses NFIP Files SORN Routine Use (G) for floodplain management enforcement only. Any other routine use (G) that involves investigating or prosecuting a violation or enforcing or implementing a law, rule, regulation, or order requires a separate ISAA that must be reviewed and cleared by the FEMA Privacy Office. e. The Beaumont, Texas certifies that it will review NFIP policy and claims information for properties within its jurisdiction as part of its responsibility as a NFIP Community under the following routine uses. Routine Use I To federal, state, local, and tribal government agencies, insurance companies, and established voluntary organizations in order to determine eligibility for benefits, verify non -duplication of benefits following a flooding event or another disaster, and provide needs unmet by NFIP claims payouts within their jurisdictions and service areas. Routine Use O To the Army Corps of Engineers and federal, state, local, and tribal government agencies to review NFIP policy and claims information for properties within its jurisdiction in order to assist in hazard mitigation and floodplain management activities, and in monitoring compliance with the floodplain management measures adopted by the community. Routine Use R To federal, state, local, and tribal government agencies to conduct research, analysis, and feasibility studies of policies and claims within its jurisdiction. Routine Use T To community officials and representatives to provide repetitive loss records of properties within that community. Updated August 07, 2019 DHS/FEMA ISAA Page 3 of 13 4. DEFINITIONS. As used in this Agreement, the following terms will have the following meanings: a. COMPUTER MATCHING: Any computerized comparison of two or more automated systems of records, or a system of records with non-federal records, for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in -kind assistance or payments under federal benefit programs. See 5 U.S.C. § 552a(a)(8). Pursuant to 5 U.S.C. § 552a(o), any record contained in a system of records may only be disclosed to a recipient agency or non-federal agency for use in a computer matching program pursuant to a Computer Matching Agreement (CMA) between the source agency and the recipient agency or non- federal agency. b. NIST. CYBERSECURITY FRAMEWORK: National Institutes of Standards and Technology (NIST) "Framework for Improving Critical Infrastructure Cybersecurity," which sets out a repeatable process of, "Identify, Protect, Detect, Respond and Recover," to guide organizational cybersecurity activities and consideration of cybersecurity risk in organizational risk management processes. c. PERSONALLY IDENTIFIABLE INFORMATION (PII): Any information that permits the identity of an individual to be directly or indirectly inferred, including other information that is linked or linkable to an individual. For example, when linked or linkable to an individual, such information includes an address, name, social security number, date and place of birth, mother's maiden name, account number, license number, vehicle identifier number, license plate number, device identifier or serial number, internet protocol address, biometric identifier (e.g., photograph, fingerprint, iris scan, voice print), educational information, financial information, medical information, criminal or employment information, and information created specifically to identify or authenticate an individual (e.g., a random generated number). PII constitutes "Controlled Unclassified Information." d. PRIVACY INCIDENT. The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than the authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an unauthorized purpose. The term encompasses both suspected and confirmed incidents involving PII, whether intentional or inadvertent, which raises a reasonable risk of harm. e. SYSTEM SECURITY PLAN. Formal document that provides an overview of the security requirements for the information system and describes the security controls in place or planned for meeting those requirements. For instance, technical controls typically include Access Control (IA), Audit and Accountability (AU), Identification and Authentication (IA), and System and Communications (SC). Updated August 07, 2019 DHS/FEMA ISAA Page 4 of 13 5. RESPONSIBILITIES. a. FEMA's responsibilities under this ISAA are as follows: i. Share with the Beaumont, Texas the NFIP policyholder data found in Appendix A of this agreement. ii. Share with the Beaumont, Texas NFIP policyholder data and its associated information, as found in Appendix A of this agreement. iii. Transmit the NFIP policyholder data and related information listed in Appendix A to the Beaumont, Texas in password protected format via encrypted email. iv. Ensure that NFIP policyholder data is accurate, complete, and up-to-date as reasonably necessary. V. FEMA shall not take any adverse action or limit any of its Federal benefits as a result of this sharing of information. b. The Beaumont, Texas's responsibilities under this ISAA are as follows: i. Use and maintain the NFIP policyholder PII under this ISAA only to review NFIP policy and claims information for properties within its jurisdiction under the following routine uses: Routine Use I To federal, state, local, and tribal government agencies, insurance companies, and established voluntary organizations in order to determine eligibility for benefits, verify non -duplication of benefits following a flooding event or another disaster, and provide needs unmet by NFIP claims payouts within their jurisdictions and service areas. Routine Use O To the Army Corps of Engineers and federal, state, local, and tribal government agencies to review NFIP policy and claims information for properties within its jurisdiction in order to assist in hazard mitigation and floodplain management activities, and in monitoring compliance with the floodplain management measures adopted by the community. Routine Use R To federal, state, local, and tribal government agencies to conduct research, analysis, and feasibility studies of policies and claims within its jurisdiction. Routine Use T To community officials and representatives to provide repetitive loss records of properties within that community. Updated August 07, 2019 DHS/FEMA ISAA Page 5of13 The NFIP policyholder PII provided by FEMA under this ISAA may not be used for any other purpose. ii. Instruct all individuals with access to NFIP policyholder PH regarding the confidential nature of the information, the safeguard requirements of this Agreement, and the criminal penalties and civil remedies specified in federal and state laws against unauthorized disclosure of NFIP policyholder PII covered by this Agreement. iii. Employ appropriate administrative, technical, and/or physical safeguards to secure any and all NFIP policyholder PII shared under the provisions of this ISAA, whether in physical or electronic form, and store PH only in places and in a manner, that are safe from access by unauthorized persons or for unauthorized use. iv. Limit access to NFIP policyholder PII provided by FEMA under this ISAA only to the authorized Beaumont, Texas personnel to review NFIP policy and claims information for properties within its jurisdiction under the following routine uses: Routine Use I To federal, state, local, and tribal government agencies, insurance companies, and established voluntary organizations in order to determine eligibility for benefits, verify non -duplication of benefits following a flooding event or another disaster, and provide needs unmet by NFIP claims payouts within their jurisdictions and service areas. Routine Use O To the Army Corps of Engineers and federal, state, local, and tribal government agencies to review NFIP policy and claims information for properties within its jurisdiction in order to assist in hazard mitigation and floodplain management activities, and in monitoring compliance with the floodplain management measures adopted by the community. Routine Use R To federal, state, local, and tribal government agencies to conduct research, analysis, and feasibility studies of policies and claims within its jurisdiction. Routine Use T To community officials and representatives to provide repetitive loss records of properties within that community. on behalf of Beaumont, Texas. This includes all entities and individuals listed in paragraphs 6 and 7. V. The Beaumont, Texas will not further disclose NFIP policyholder PII provided by FEMA to outside third parties without the express consent of FEMA or the NFIP policyholder(s) to whom the PII pertains including, as Updated August 07, 2019 DHS/FEMA ISAA Page 6 of 13 applicable, requests by third parties under state open access and freedom of information laws. vi. The Beaumont, Texas shall ensure no computer matching will occur for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in -kind assistance or payments under federal benefit programs unless a separate CMA is in place. vii. The Beaumont, Texas will, in a timely manner, take appropriate action with regard to any request made by DHS for access, additions, changes, deletions, or corrections of PII. In addition, the Beaumont, Texas will, in a timely manner, notify DHS of any data errors that it discovers. viii. The Beaumont, Texas will destroy information provided by FEMA when no longer needed by Beaumont, Texas to meet unmet needs, acquiring property, preventing duplication of benefits, or other business need as identified within this agreement. ix. Pursuant to Routine Use N, provide FEMA with names, addresses of policyholders within their jurisdictions, and a brief general description of their plan for acquiring and relocating their flood prone properties for the purpose of ensuring that communities engage in floodplain management, improved real property acquisitions, and relocation projects that are consistent with the NFIP. 6. CONSENT TO THIRD PARTY ACCESS TO NFIP POLICYHOLDER PII: At this time, Beaumont, Texas has not indicated an intent to share NFIP policyholder PII with third party contractors. 7. POINTS OF CONTACT. a. The FEMA points of contact are as follows: Monique Crewes Acting Chief,, Insurance Analytics and Policy, FIMA, FEMA 202-655-8573 Monique. Crewes Afema. dhs. gov Scott McAfee GIS Analyst 202-236-3255 S cott.Mcafeenfema. dhs. gov Updated August 07, 2019 DHS/FEMA ISAA Page 7 of 13 . John Bowman Floodplain Management and Insurance Specialist 940-898-5556 JohnE.Bowman a,fema.dhs.gov b. The Beaumont, Texas points of contact are as follows: (No more than five POCs) Adina Josey Senior Planner/Floodplain Administrator 409-880-3764 adina. j osey(a,beaumonttexas. goy Chris Boone Director of Planning and Community Development 409-880-3764 chris.boone(a�beaumonttexas. og_v Katrina Purcell Planner I 409-880-3764 katrina.purcell(a,beaunionttexas. goy 8. SEVERABILITY. Nothing in this ISAA is intended to conflict with current law, regulation, or FEMA directives. If a term of this ISAA is inconsistent with such authority, then that term shall be invalid, but the remaining terms and conditions of this ISAA shall remain in full force and effect. 9. NO PRIVATE RIGHT. This ISAA is an internal agreement between FEMA and the Beaumont, Texas. It does not create nor confer any right or benefit that is substantive or procedural, enforceable by any third party against the Parties, the United States, or other officers, employees, agents, or associated personnel thereof. Nothing in this ISAA is intended to restrict the authority of either party to act as provided by law, statute, or regulation, or to restrict any party from administering or enforcing any laws within its authority or jurisdiction. Accordingly, the terms of this Agreement do not constitute or imply the grant, by the United States of America, of any other consent, accord, satisfaction, advice, or waiver of its rights, power or authority. 10. FUNDING. This ISAA is not an obligation or commitment of funds, nor a basis for transfer of funds. Each party shall bear its own costs in relation to this ISAA. Expenditures by each party will be subject to its budgetary processes and to availability of funds pursuant to applicable laws, regulations, and policies. The parties expressly acknowledge that this in no way implies that Congress will appropriate funds for such expenditures. Updated August 07, 2019 DHS/FEMA ISAA Page 8 of 13 11. ISSUE RESOLUTION. FEMA and the Beaumont, Texas understand that during the course of this ISAA, they may have to resolve issues such as: scope, interpretation of provisions, unanticipated technical matters, and other proposed modifications. Both parties agree to appoint their respective points of contact to work in good faith towards resolution of such issues. 12. USE OF CONTRACTOR WITH ACCESS TO NFIP POLICYHOLDER PII. When the Beaumont, Texas utilizes a contractor in connection with its performance of its obligations under the ISAA and the Beaumont, Texas provides such contractor with access to NFIP policyholder PII, the Beaumont, Texas shall provide FEMA with prompt notice of the identity of such contractor and the extent of the role that such contractor will play in connection with the purpose of this ISAA. Moreover, all such contractors given access to any NFIP policyholder PII must agree to: (a) abide by the conditions set forth herein, including, without limitation, its provisions relating to compliance with minimum standards for the protection of NFIP policyholder PII and Notice of Security and/or Privacy Incident; (b) restrict use of NFIP policyholder PII only to the performance of services to Beaumont, Texas in connection with Beaumont, Texas performance of its obligations under the ISAA, and (c) certify in writing, upon completion of the performance of services by a contractor, that the contractor has immediately un-installed, removed, and/or destroyed all copies of NFIP policyholder PII within 30 days of the contractor's performance of services to the Beaumont, Texas. 13. RETURN OR DESTRUCTION OF NFIP POLICYHOLDER PII. If at any time during the term of the ISAA any part of NFIP policyholder PII, in any form, that the Beaumont, Texas obtains from FEMA ceases to be required by the Beaumont, Texas for the performance of the purpose under the ISAA, or upon termination of the ISAA, whichever occurs first, Beaumont, Texas shall,. within fourteen (14) days thereafter, promptly notify FEMA and securely return the NFIP policyholder PII to FEMA, or, at FEMA's written request destroy, un-install and/or remove all copies of such NFIP policyholder PII in the Beaumont, Texas's possession or control, and certify to FEMA that such tasks have been completed. 14. ENTIRE AGREEMENT. This ISAA constitutes the entire agreement between the parties with regard to information sharing. 15. MODIFICATION. This ISAA may be modified upon the mutual written consent of the parties. 16. COUNTERPARTS. This ISAA, when executed in any number of counterparts and by different parties on separate counterparts, each of which counterparts when so executed and delivered shall be deemed to be an original, and all of which counterparts taken together shall constitute but one and the same Agreement. 17. EFFECTIVE DATE, DURATION AND TERMINATION. This ISAA will become effective upon the signature of both parties and will remain in effect for three Updated August 07, 2019 DHS/FEMA ISAA Page 9 of 13 years. However, FEMA will only provide the information identified in Appendix A for the disaster period of assistance. Either party may terminate this agreement upon written notice to the other party: 18. NOTICE OF PRIVACY INCIDENT. If the Beaumont, Texas, or its contractors, suspect, discover or are notified of a suspected or confirmed privacy incident relating to NFIP policyholder PII, the Beaumont, Texas shall immediately, but in no event later than twenty-four (24) hours from suspicion, discovery or notification of the suspected or confirmed privacy incident, notify the FEMA Privacy Officer at (202) 212-5100 or FEMA-Privacy@fema.dlls.gov. 19. PRIVACY INCIDENT HANDLING. In the event of a privacy incident emanating from this ISAA, FEMA will investigate the incident pursuant to DHS standard procedures and will consult Beaumont, Texas to diagnose, mitigate and manage the privacy incident. The Beaumont, Texas will be responsible for carrying out all necessary measures to remedy the effects of the privacy incident. 20. REPORTING. This ISAA covers several routine uses outlined in Paragraph 3 (d) and (e). Each time a record is requested under this ISAA, Beaumont, Texas will indicate the specific purpose and use of the record and the specific routine use under which the record is being requested. FEMA will keep a record of the date, nature, and purpose of each disclosure of a record under this ISAA. The Parties will coordinate to prepare a report/audit summarizing compliance with the privacy, redress, and security requirements set forth in this Agreement. 21. INDEMNIFICATION. The Beaumont, Texas shall bear all costs, losses and damages to the extent resulting from Beaumont, Texas breach of the ISAA. Beaumont, Texas agrees to release, defend, indemnify, and hold harmless FEMA for claims, losses, penalties and damages and reasonable attorneys' fees and costs to the extent arising out of Beaumont, Texas's, or its contractor's, negligence, unauthorized use or disclosure of NFIP policyholder PII and/or Beaumont, Texas's, or its contractor's, breach of its obligations under the ISAA. Beaumont, Texas shall inform all of its principals, officers, employees, agents and contractors assigned to handling NFIP policyholder PII under the ISAA of the obligations contained in the ISAA. 22. PENALTIES. The Beaumont, Texas understands that if it or one of its employee/agents willfully discloses any such PII to a third party not authorized to receive it, FEMA will revoke the Beaumont, Texas's access to NFIP policyholder PH. Updated August 07, 2019 DHS/FEMA ISAA Page 10 of 13 APPROVED BY: FEDERAL EMERGENCY MANAGEMENT AGENCY Paul Huang. Date Federal Insurance Directorate Assistant Administrator DHS/FEMA/FIMA The'City of Beaumont, Jefferson County, Texas Kyle Hayes Date City Manager The City of Beaumont, Jefferson County, Texas Updated August 07, 2019 DHS/FEMA ISAA Page 11 of 13 Appendix A — NFIP Data Description The following lists the NFIP policyholder PII data elements that may be shared by FEMA with the Beaumont, Texas. The Beaumont, Texas will only receive the PII data, or data when combined with other data could lead to PII, necessary to meet the routine use: ■ Policyholder Name (Routine Uses I and N only) ■ Property Address ■ Date of Loss ■ Building Characteristics ■ Coverages (building, contents) ■ Premium and fees ■ Claims amount paid (building, contents, ICC) ■ Non-PII data elements as necessary, requested, and available NFIP System of Records Notices (SORNs) Roittine Uses A To the Department of Justice (DOJ), including Offices of the U.S. Attorneys, or other federal agency conducting litigation or in proceedings before any court, adjudicative, or administrative body, when it is relevant or necessary to the litigation and one of the following is a party to the litigation or has an interest in such litigation: 1. DHS or any component thereof; 2. Any employee or former employee of DHS in his/her official capacity; 3. Any employee or former employee of DHS in his/her individual capacity when DOJ or DHS has agreed to represent the employee; or 4. The U.S. or any agency thereof. B To a congressional office from the record of an individual in response to an inquiry from that congressional office made at the request of the individual to whom the record pertains. C To the National Archives and Records Administration (NARA) or General Services Administration pursuant to records management inspections being conducted under the authority of 44 U.S.C. 2904 and 2906. D To an agency or organization for the purpose of performing audit or oversight operations as authorized by law, but only such information as is necessary and relevant to such audit or oversight function. E To appropriate agencies, entities, and persons when: 1. DHS suspects or has confirmed that the security or confidentiality of information in the system of records has been compromised; Updated August 07, 2019 DHS/FEMA ISAA Page 12 of 13 2. DHS has determined that as a result of the suspected or confirmed compromise, there is a risk of identity theft or fraud, harm to economic or property interests, harm to an individual, or harm to the security or integrity of this system or other systems or programs (whether maintained by DHS or another agency or entity) that rely upon the compromised information; and 3. The disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with DHS's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. F To contractors and their agents, grantees, experts, consultants, and others performing or working on a contract, service, grant, cooperative agreement, or assignment for DHS, when necessary to accomplish an agency function related to this system of records. Any individuals provided information under this routine use are subject to the same Privacy Act requirements and limitations on disclosure as are applicable to DHS officers and employees G To an appropriate federal, state, tribal, local, international, or foreign law enforcement agency or other appropriate authority charged with investigating or prosecuting a violation or enforcing or implementing a law, rule, regulation, or order, when a record, either on its face or in conjunction with other information, indicates a violation or potential violation of law, which includes criminal, civil, or regulatory violations and such disclosure is proper and consistent with the official duties of the person making the disclosure. H , To Write Your Own insurance companies as authorized under 44 CFR 62.23 to administer flood insurance in partnership with FEMA. I To federal, state, local, and tribal government agencies, insurance companies, and established voluntary organizations in order to determine eligibility for benefits, verify non -duplication of benefits following a flooding event or another disaster, and provide needs unmet by NFIP claims payouts within their jurisdictions and service areas. J To state government agencies in order to provide GFIP certificates for carrying out the purposes of the NFIP within its jurisdiction. K To property loss reporting bureaus, state insurance departments, and insurance companies to investigate fraud or potential fraud in connection with claims, subject to the approval of the DHS Office of the Inspector General. L To state, local, and tribal government agencies to ascertain the degree of financial burdens they expect to assume in the event of a flooding disaster within its jurisdiction. M To state, local, and tribal government agencies to further NFIP outreach and education activities within their jurisdiction. N To state, local, and tribal government agencies that provide names, addresses of policyholders within their jurisdictions, and a brief general description of their plan for acquiring and relocating their flood prone properties for the purpose of ensuring that communities engage in floodplain management, improved real property acquisitions, and relocation projects that are consistent with the NFIP. This is contingent upon the Federal Insurance Mitigation Administration Updated August 07, 2019 DHS/FEMA ISAA Page 13 of 13 determining that the use furthers the flood plain management and hazard mitigation goals of the agency. O To the Army Corps of Engineers and federal, state, local, and tribal government agencies to review NFIP policy and claims information for properties within its jurisdiction in order to assist in hazard mitigation and floodplain management activities, and in monitoring compliance with the floodplain management measures adopted by the community. P To lending institutions and mortgage servicing companies for purposes of assistingwith lender compliance. Q To current owners of properties for the purpose of providing the dates and dollar amounts of past loss payments made to the said property. R To federal, state, local, and tribal government agencies to conduct research, analysis, and feasibility studies of policies and claims within its jurisdiction. S To financial institutions for purposes of providing referral or cooperative reimbursement payments to insurance agents to share marketing and advertising costs between NFIP and entities participating in the NFIP. T To community officials and representatives to provide repetitive loss records of properties within that community. U To OMB in for purposes related to the review of private relief legislation in accordance with OMB Circular No. A-19. V ': To private reinsurers, private capital firms, and financial institutions for the purposes of preparing NFIP assumption of risk proposals. W . To the news media and the public, with the approval of the Chief Privacy Officer in consultation with counsel, when there exists a legitimate public interest in the disclosure of the information, when disclosure is necessary to demonstrate the accountability of DHS's officers, employees, or individuals covered by the system, except to the extent the Chief Privacy Officer determines that release of the specific information in the context of a particular case would constitute an unwarranted invasion of personal privacy. httys://www. gpo. gov/fdsys/Ukg/FR-2014-05-19/html/2014-11386. htm Updated August 07, 2019