NIH Login Service Privacy Policy

The NIH Login Service (NIH Login) facilitates access by National Institutes of Health (NIH) staff and registered external collaborators to NIH operated websites, applications, and services that require a log in. Protecting your privacy is very important to us. NIH never collects information for commercial marketing or any purpose unrelated to the NIH’s mission and goals. Therefore, NIH Login will never sell your information to anyone, and we will only use it to provide secure access to the NIH websites and systems you log in to. Remember that once you leave the NIH Login screen, you will be subject to the privacy policies for the site(s) you are visiting.

NIH Login automatically collects and retains a limited set of information about you when you use the service. We collect different information for badged NIH staff and non-NIH external collaborators:

         
• NIH Staff: first name, last name, email address, and HHS identification number (HHSID); and
• Non-NIH External Collaborators: first name, last name, email address, and persistent identifier from the external identity provider (the owner of the account you used to log in).

The NIH Login Service only allows you to provide the information indicated above. You cannot provide information we do not automatically request from the identity provider (the owner of the account you used to log in).

After you log in, NIH Login asks the identity provider (the owner of the account you used to log in) to send the information listed in the Types of Information Collected section.

When you visit any website, its server may generate a piece of text known as a "cookie" to place on your computer. The cookie allows the server to "remember" specific information about your visit while you are connected. The cookie makes it easier for you to use the dynamic features of webpages.

There are two types of cookies, single session (temporary), and multi-session (persistent). Session cookies last only as long as your web browser is open. Once you close your browser, the session cookie disappears. Persistent cookies are stored on your computer for longer periods.

The Office of Management and Budget M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies allows Federal agencies to use both session and persistent cookies. The NIH Login Service uses session cookies to facilitate your secure access to NIH applications and websites. These session cookies contain only information about your browser’s visit to the site; they do not contain any personal information about you. NIH Login does not use persistent cookies.

If you do not wish to allow the NIH Login Service to place session cookies on your computer, you can disable in your web browser. You can find instructions to disable cookies in the most popular browsers at https://www.usa.gov/optout-instructions.

Notes:

• If you choose to disable cookies, you will experience issues accessing information and resources at sites and applications that rely on the NIH Login service.
• Configuring your browser to disable cookies will disable cookies for all websites, not just NIH sites that rely on NIH Login services.

Your right to request corrections to errors in your personal information used by the NIH Login Service is specified in the published NIH System of Records Notice (SORN) 09-25-0216.

For NIH staff, the NIH Login Service uses information from the NIH Enterprise Directory (NED). You may update your personal information in NED via the NED self-service portal. You may also contact the NIH IT Service Desk if you need help.

NIH does not have a process in place for non-NIH individuals to correct your personal information used by NIH Login because the information is sent directly to the NIH Login Service by the identity provider (the owner of the account you used to log in) when you log in. To correct your personal information, you will need to contact the owner of the account you used to log in. For example, if you work at a research institution and use your institution’s credentials to log in via NIH Login, you must contact your research institution’s information technology (IT) department.

NIH Login has implemented administrative, technical, and physical controls to protect your personal information that we collect.

NIH Login assigns specific roles on a case-by-case basis to qualified, vetted, and authorized NIH staff. Through those role assignments, authorized NIH staff get the system permissions they need to perform various job functions. NIH Login regularly reviews role assignments, and revokes role assignments when they are no longer required or appropriate.

NIH Login segregates IT hardware and software from the internet to prevent unauthorized or malicious access. NIH Login maintains and monitors access control lists and event logs to detect unauthorized, suspicious, or malicious activity. Only authorized NIH IT technical staff have access to these logs and access lists, and they must use multi-factor authentication to access the information. In addition, NIH Login uses an array of tools to monitor and audit file and system integrity.

NIH Login limits physical access to NIH Login servers that are all located in a secured facility or cloud environment. Security personnel are stationed at the main entrance of the complex, 24 hours a day, seven days a week. Anyone entering the facility must be pre-authorized and must display a valid government identification (ID) showing a current identification photo. All entrance doors to the data centers are controlled by card-activated locks that restrict access 24 hours a day, seven days a week.

The session cookies used by NIH Login are considered web measurement and customization technologies. These technologies comply with existing Federal and NIH policies with respect to privacy and data safeguarding standards.

NIH conducts and publishes a Privacy Impact Assessment (PIA) for each use of an IT system or third-party website application (TPWA) because each application or site may have different functionality or practices. PIAs are stored with the NIH Privacy Office and TPWAs are posted for public view on DHHS’ Third Party Websites and Applications web site.

Because NIH Login relies on groups of records that are designed to be retrieved by an individual’s name or other personal identifier linked to the individual, NIH Login is covered by the Privacy Act of 1974, as amended (5 U.S.C. Section 552a). NIH System of Records Notices are published in the Federal Register and posted on the HHS System of Records Notices Website.

NIH Login retains records for NIH users until business use ceases, or for six (6) years after their password is altered or user account is terminated, but longer retention is authorized if required for business use. Records are destroyed six years after cutoff, unless continuation is requested by the NIH, in accordance with the National Archives and Records Administration (NARA) approved disposition schedule #s DAA-GRS-2013-0006-0003 and DAA-GRS-2013-0006-0004. NIH Login retains a limited set of information for non-NIH individuals only for the short duration of time when they are using the service.

NIH Login employs the principles of least privilege and need to know, allowing only authorized accesses for NIH staff where access is required to perform primary job responsibilities in accordance with organizational missions and business functions. Information collected by the NIH Login Service is available only to NIH Login System Administrators, and other designated NIH staff who require this information to perform their duties.

For further information about NIH privacy policy, please contact the NIH Senior Official for Privacy at privacy@mail.nih.gov ; call 301-496-4606 or visit the NIH Privacy Program web page.

Link to NIH Privacy Policy