AHRQ Information Security and Privacy Program

This page provides an overview of AHRQ's Information Security and Privacy Program and requirements for protecting against information technology threats and vulnerabilities.

The AHRQ Information Security and Privacy Program fosters an enterprise-wide secure and trusted environment in support of AHRQ's mission. AHRQ's program was established to help protect the Agency against potential information technology (IT) threats and vulnerabilities.  The program ensures compliance with Federal mandates and legislation, including the Federal Information Security Management Act and the President's Management Agenda. It also plays an important role in enabling the Agency's ability to provide mission-critical operations. 

Information Security & Privacy Awareness Training

Information security and privacy awareness training is mandatory for all Federal employees and contract personnel. The Department of Health and Human Services (HHS) mandates that all employees must complete information security training upon initial hiring and annually thereafter. AHRQ ensures that all Agency employees and contractors receive annual information security awareness training and role-based training in compliance with—

To comply with this training requirement, AHRQ developed an online Information Security and Privacy Awareness Training Module that is available on the Agency Intranet to AHRQ staff and contractors.

Additionally, HHS's Cybersecurity Program (http://www.hhs.gov/ocio/securityprivacy/awarenesstraining/awarenesstraining.html) offers courses for Agency staff and contractors on —

HHS's Cybersecurity Program also offers the following role-based training courses:

NIST's Computer Security Awareness, Training, and Education is also a resource for security training.

For more information on AHRQ information security and privacy training, send an Email to the AHRQ Information Security and Privacy Team (SecureAHRQ@ahrq.hhs.gov).

Incident Reporting

AHRQ defines a computer security incident as "a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard computer security practices," in accordance with NIST Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide [PDF File, Plugin Software Help].

If you suspect an information security or privacy related incident has occurred, send an Email immediately to the AHRQ Chief Information Security Officer (eric.colombel@ahrq.hhs.gov) or the AHRQ Information Security and Privacy Team (SecureAHRQ@ahrq.hhs.gov).

Points of Contact

Policy, Guidance, and Legislation

The following are links to information security policies, guidance, and legislation:

Privacy Impact Assessments and Resources

Titles II and III of the E-Government Act of 2002 (http://www.archives.gov/about/laws/egov-act-section-207.html) require Federal agencies to evaluate systems that collect personally identifiable information to determine that the privacy of this information is adequately protected. The links below provide information on privacy impact assessments on HHS systems and on third-party Web sites:

Page last reviewed March 2013
Internet Citation: AHRQ Information Security and Privacy Program. March 2013. Agency for Healthcare Research and Quality, Rockville, MD. http://www.ahrq.gov/policy/electronic/privacy/infosecurity.html