|Acting DPSAC director Richie Taffet stands outside the badging office in Bldg. 31.
When the first emails went out to the administrative officer community several months ago notifying them that they must begin the process to receive their new high-tech HHS ID badges, it marked the beginning of the final stage in a 5-year effort by NIH to comply with the August 2004 federal mandate “to establish a common identification standard for federal employees and contractors.”
This mandate, known as Homeland Security Presidential Directive-12 (HSPD-12), requires all federal agencies to use a “reliable, commonly accepted form of government identification that will enhance security, increase government efficiency, reduce identity fraud and protect personal privacy.”
For NIH, that reliable government identification is the new HHS ID badge (also called PIV card or smart card). What makes this new badge reliable is the requirement that its holder—whether an NIH employee, contractor or affiliate—must undergo a strict identity-proofing process called personal identity verification (PIV). PIV establishes that the person is who s/he says s/he is. Affiliates are fellows, guest researchers and special volunteers.
The HHS ID badge itself must meet strict technical and physical specifications and be strongly resistant to identity fraud, tampering, counterfeiting and terrorist exploitation; rapidly authenticated electronically; and issued only by reliable providers.
To oversee this multi-year, multi-million dollar project, NIH tapped the ORS Division of Personnel Security and Access Control (DPSAC) and its policy arm, the HSPD-12 Program Office.
Adding to the challenges of this project has been the integration of the NIH Enterprise Directory (NED), the NIH Background Investigation Tracking System (BITS) and the HHS Identity Management System into the PIV enrollment and badge issuance process. NED is the authoritative source for identity management at NIH and provides a framework for supporting new business processes at the agency. The Center for Information Technology and the Office of the Chief Information Officer have worked side by side with DPSAC and the HSPD-12 office, providing their technical expertise throughout the 5 years of this project.
According to Richie Taffet, acting director of DPSAC, “The successful completion of this project would not be possible without the dedicated service of many individuals from all of the ICs. Specialists in IT, administration, policy, personnel security, access control, immigration services, budget, finance, planning, privacy, law, communications and more have contributed to this project. The NIH administrative community deserves special thanks for their willingness to serve as our focus group, advisors and beta testers to make sure that all of the systems worked properly together. These individuals also committed considerable time to special training programs to ensure that when the system went live they would be able to serve the remainder of the NIH community effectively.”
HHS ID Badge Deployment at NIH
With testing of the PIV process and the new smart HHS ID badge now complete, NIH is ready to deploy the new badge to the general NIH population. Beginning in August and continuing through June 2010, all new and existing employees, contractors and affiliates will be issued the new badge. If you currently hold a legacy NIH badge and fall within one of these three categories, you will be notified sometime over the next few months to start the process leading to the issuance of the HHS ID badge.
HHS has given NIH a June 2010 deadline to issue new badges to all 34,000 NIH employees, contractors and affiliates in Maryland and around the country.
Accelerating the Badge Renewal Process
|A mockup of the new HHS ID badge
Although your current badge may show an expiration date that occurs well into the future (sometimes years into the future), during the changeover to the new HHS ID badge the NED team will “force” an early renewal of your ID badge regardless of its expiration date.
Throughout the badging process, individuals will receive detailed instructions on how to proceed. These instructions, which will be sent as email alerts by NED, will highlight next steps and how to get help.
DPSAC has determined that first responders (police, fire, et al.) along with other badge holders requiring elevated background investigations will be the first groups to complete the process and receive the new badge. DPSAC is in the process of determining the order of rollout for the rest of the NIH workforce, including remote locations in Montana and North Carolina.
How Badge Renewal Works
There are three steps in the ID badge renewal process: pre-enrollment, enrollment and badge issuance.
Prior to each of these steps employees, contractors and affiliates will receive an email alert containing instructions to obtain the new badge.
The first step is pre-enrollment, which begins when DPSAC alerts the NED team to “force” the individual’s badge for renewal. Following completion of renewal by IC administrative staff, the individual must be “sponsored” for an HHS ID badge in NED. Note that most NED records do not contain all personal information required by the PIV process. You will be asked to provide any missing information, which in most cases is your place of birth and citizenship. (While you’re updating your information in NED, you may want to sign up for Alert NIH, a new service for employees and contractors who wish to receive emergency information 24/7 on personal, as well as NIH-issued, communication devices.)
Once your AO sponsors you, DPSAC will check your fingerprint and background investigation status with the Office of Personnel Management. Everyone applying for a new HHS ID badge will be checked against the OPM database and placed into one of two categories. Each category has specific requirements that the individual will need to complete before s/he can obtain a new badge:
- Individuals without the appropriate background investigation on file (usually new federal employees, but also a sizeable percentage of current employees) will have all 10 fingerprints captured during their 20-minute enrollment appointment and will be required to fill out an e-QIP questionnaire.
- Individuals with a background investigation on file will have two fingerprints taken for the new badge. They will not be required to complete additional forms.
With the OPM database check complete, DPSAC staff will direct you via an email alert to make a 20-minute appointment at an Enrollment Work Station (EWS). You should not try to make an appointment until directed to do so. These stations are conveniently located on the Bethesda campus and in off-campus suburban Maryland federal buildings including Executive Plaza North, Fishers Lane and Rockledge II. Other EWS locations include the Gerontology Research Center in Baltimore, Ft. Detrick in Frederick, NIEHS in Research Triangle Park, N.C., and Rocky Mountain Laboratories in Hamilton, Mont.
In step two of the badge renewal process—enrollment—the individual is fingerprinted and photographed at an EWS. As noted above, those with an appropriate investigation on file will only need to have their two index fingerprints captured. Individuals who require an investigation will have all 10 fingerprints captured. Individuals who have the appropriate background investigation on file will be immediately authorized for the new HHS ID badge. For all others, once fingerprint results come back from OPM, typically within 3-5 business days, and there are no issues, DPSAC will authorize the individual to make an appointment to receive the new badge.
For individuals who do not have the appropriate background investigation for their current position on file, DPSAC will send him/her instructions to complete a series of federally mandated questionnaires. These include the electronic Questionnaires for Investigations Processing (e-QIP) as well as forms OF-306 (Declaration for Federal Employment) and OF-612 (Optional Application for Federal Employment).
“Individuals receiving these instructions, even employees who have been with NIH for many years, must complete the forms,” according to Taffet. “This is a requirement set forth by the Office of Personnel Management. Unfortunately, OPM will return the application if all of the requisite forms are not completed and submitted in a timely manner. Only after they are in receipt of all completed forms will they complete the background checks.” He added, “It is imperative that anyone receiving e-QIP instructions respond as quickly as possible since those who fail to complete these questionnaires run the risk of having to return to an EWS to be re-fingerprinted, and incurring an additional cost to their IC,” he concluded.
Individuals who will be completing an e-QIP questionnaire can save time if they know in advance what information or documents they’ll need before filling out the form. Fact sheets summarizing the requirements for each form can be found on the ID badge web site at idbadge.nih.gov/badge/4steps.asp.
The third and final step in the renewal process is badge issuance. Once the individual completes the enrollment process, s/he will be notified via an email alert to schedule a 20-minute appointment to pick up the new HHS ID badge at a nearby Issuance Work Station (IWS). There the individual will be required to read and concur with a badge subscriber agreement and provide a 6-8 digit PIN that can be remembered easily. When the individual has picked up his/her HHS ID badge, the process is complete. DPSAC will later notify the individual when the background investigation is completed or if further information is needed.
The new badge will admit the holder to all areas that s/he had previous access to with the NIH ID badge. In the future, this “smart card” will be required to access NIH computer(s) as well.
“It’s important to emphasize that anyone who plans to enroll or pick up their ID badge needs to make an appointment in advance and needs to keep their appointment,” said Taffet. DPSAC reserves 20-minute blocks of time exclusively for each individual to complete the enrollment and badge issuance processes. DPSAC is depending on everyone to keep their appointments or notify DPSAC early to reschedule.
According to Taffet, “only by maintaining a very tight schedule will we be able to meet the June 2010 deadline for issuing HHS ID badges to all 34,000 employees, contractors and affiliates who are currently holding NIH badges. Every missed appointment really impedes our progress since DPSAC will not be able to fill the missed appointment with someone else. DPSAC is adding customer service staff to answer the phones and assist people with their questions. This should help to keep the process moving forward.”
The New Look of the HHS ID Badge
The new badge will share a common appearance and topography with all other federal agencies and will contain identifying information about the individual and his or her agency. It will carry the individual’s photograph, full legal name (no nicknames), operating division (NIH), badge expiration date, badge serial number, federal agency smart credential number (which uniquely identifies an individual and his/her OPDIV), an authentication key and two fingerprints encoded onto the badge using a mathematical representation or algorithm. The HHS ID badge will not carry the individual’s Social Security number, home address or phone number.
For NIH only, the new HHS ID badge will identify the holder either as an employee (white background with no stripe) or a contractor/affiliate (horizontal green stripe over a white background). Badges of individuals who are also federal emergency responders will display a horizontal red stripe across the lower part of the badge with the words “federal emergency responder” across the stripe. As an added security step, DPSAC has purchased scanners that can distinguish between authentic and fake proofs of identification.
NIH ID badges will continue to be issued to extended visitors, service providers and vendors by the NIH Police. For a complete description of the new HHS ID badge and the PIV process, visit http://idbadge.nih.gov.