<?xml version="1.0" encoding="UTF-8"?>


<pai>
    <agency toc="yes">
        <name>Department of Health and Human Services</name>
        <abbrev>HHS</abbrev>

        <previouslyPublished>
            <url>https://www.gpo.gov/fdsys/pkg/FR-2016-02-18/pdf/2016-03241.pdf</url>
            <title>09-70-0502, Enrollment Data Base (EDB)</title>
            <date year="2016" month="2" day="18"/>
        </previouslyPublished>      
        
        <previouslyPublished>
<url>https://www.gpo.gov/fdsys/pkg/FR-2016-03-29/pdf/2016-07060.pdf</url>
<title>09-90-0058, Tracking Records and Case Files for FOIA and Privacy Act Requests and Appeals</title>
<date year="2016" month="3" day="29"/>
</previouslyPublished>

        <previouslyPublished>
            <url>https://www.gpo.gov/fdsys/pkg/FR-2016-05-03/pdf/2016-10253.pdf</url>
            <title>09-70-0511, Risk Adjustment Data Validation System (RAD-V), HHS/CMS/CCIIO</title>
            <date year="2016" month="5" day="05"/>
        </previouslyPublished>

        <previouslyPublished>
            <url>https://www.gpo.gov/fdsys/pkg/FR-2016-07-18/pdf/2016-16812.pdf</url>
            <title>09-80-0321 ORR Division of Children’s Services Records; 09-80-0325 ORR Internet Refugee Arrivals Data System (iRADS); 09-80-0327 ORR Repatriation Program Records; 09-80-0329 ORR Unaccompanied Refugee Minors Records; and 09-80-0388 ORR Refugee Suicide Database.   09-60-0217 ORR Cuban Refugee Data System (deleted)</title>
            <date year="2016" month="7" day="18"/>
        </previouslyPublished>

        <previouslyPublished>
            <url>https://www.gpo.gov/fdsys/pkg/FR-2016-10-28/pdf/2016-26116.pdf</url>
            <title>Deletion of 18 Records</title>
            <date year="2016" month="10" day="28"/>
        </previouslyPublished>

        <previouslyPublished>
            <url>https://www.gpo.gov/fdsys/pkg/FR-2016-11-21/pdf/2016-27959.pdf</url>
            <title>09-90-1601 Outside Experts Recruited for Non-FACA Activities added; 09-20-0168, 09-30-0049, 09-37-0022, and 09-90-0080 Deleted</title>
            <date year="2016" month="11" day="21"/>
        </previouslyPublished>
        
       
        
        
        <section id="09-35-0001" toc="yes">
                <systemNumber>09-35-0001</systemNumber>
                    <subsection type="systemName">
                        <xhtmlContent>
                            <p>

                                Agency Management Information System/Grants (AMIS/GRANTS and CONTRACTS), HHA/AHRQ/OPART.
                            </p>

                            <blockquote>
                                The "Agency Management Information System/Grants and Contracts (AMIS/GRANTS and CONTRACTS), HHS/AHRQ/OM" was previously named the "Agency for Healthcare Research and Quality, Grants Information and Tracking System with Contracts Component (GIAnT)]

                            </blockquote>
                        </xhtmlContent>
                        
                        </subsection>
                            <subsection type="securityClassification">
                                <xhtmlContent>
                                    <p>
                                        None.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="systemLocation">
                                <xhtmlContent>
                                    <p>
                                        Agency for Healthcare Research and Quality, Office of Performance, Accountability, Resources and Technology, 540 Gaither Road, Rockville, Maryland 20850
                                    </p>
                                    <p>
                                        Program Support Center, Office of Management, Division of Acquisition Management, Parklawn Building, Room 5C-10, 5600 Fishers Lane, Rockville, Maryland 20857.
                                    </p>
                                    <p>
                                        For a list of contractors, please write to the system manager at the address listed below.
                                    </p>
                                    <p>
                                        Inactive records will be stored at: Washington National Records Center, 4205 Suitland Road, Suitland, Maryland 20746-8001.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="categoriesOfIndividuals">
                                <xhtmlContent>
                                    <p>
                                        This system contains the names of research training and career development grant applicants and principal investigators, research training grant program directors, and research fellowship recipients; peer and other special reviewers; grant and contract project directors and other key personnel.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="categoriesOfRecords">
                                <xhtmlContent>
                                    <p>
                                        Research grant, research training grant, research career development, research fellowship, and contract files, including applications, proposals, award notices, and summary comments of peer reviewers.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="authorityForMaintenance">
                                <xhtmlContent>
                                    <p>
                                        AHRQ grants and contract administration authorities in Title IX of the Public Health Service (PHS) Act (42 U.S.C. 299-299c -6); Sec. 1142 of the Social Security Act (42 U.S.C. 1320b-12) and Sec. 487 PHS Act (42 U.S.C. 288) (National Research Service Awards).
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="purpose">
                                <xhtmlContent>
                                    <p>
                                        The information in this system is used to facilitate day-to-day grants and contracts management operations and for purposes of review, analysis, planning and policy formulation by AHRQ staff members and by other components of DHHS which conduct research. AHRQ also may refer these records to the appropriate office in the Department for the purpose of monitoring payback; if necessary, debt collection; and investigation of alleged scientific misconduct.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="routineUsesOfRecords">
                                <xhtmlContent>
                                    <p>
                                        1. Disclosure may be made to a congressional office from the records of an individual in response to an inquiry from the congressional office made at the request of the individual.
                                    </p>
                                    <p>
                                        2. The Department may disclose information from this system of records to the Department of Justice, to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, 5 where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose of which the records were collected.
                                    </p>
                                    <p>
                                        3. AHRQ may disclose information about an individual grant or contract application or fellowship applicant to credit reporting agencies to obtain a credit report in order to determine his/her credit worthiness.
                                    </p>
                                    <p>
                                        4. Limited disclosures, pursuant to 5 U.S.C. 552a(b)(12), may be made from this system to "consumer reporting agencies" as defined in the Fair Credit Reporting Act (15 U.S.C. 1681ff.) or the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a)(3)) after the procedural prerequisites of 31 U.S.C. 3711 have been followed. The purpose of such disclosures is to aid in the collection of outstanding debts owed to the Federal Government, i.e., providing an incentive for delinquent debtors to pay the Government.
                                    </p>
                                    <p>
                                        5. Disclosure may be made to the National Technical Information Service (NTIS), U.S. Department of Commerce, to contribute to the Smithsonian Science Information Exchange, for dissemination of scientific and fiscal information on funded awards (abstracts and relevant administrative and financial data.)
                                    </p>
                                    <p>
                                        6. Disclosure may be made to qualified experts, not within the definition of Department employees, for opinions, as a part of the grant application or contract proposal review process.
                                    </p>
                                    <p>
                                        7. Disclosure may be made to an AHRQ grantee or contractor for the purposes of (a) carrying out research, or (b) providing services relating to grant review, or for carrying out quality assessment, program evaluation, and/or management reviews. They will be required by written agreement to maintain Privacy Act safeguards with respect to such records.
                                    </p>
                                    <p>
                                        8. Disclosure may be made to a Federal Agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit of the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
                                    </p>
                                    <p>
                                        9. Where Federal agencies having power to subpoena other Federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
                                    </p>
                                    <p>
                                        10. Disclosure may be made to the cognizant Audit Agency for auditing.
                                    </p>
                                    <p>
                                        11. In the event that a system of records maintained by the Department indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by statute or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred for purposes of litigation, as a routine use, to the appropriate agency, whether Federal (e.g., the Department of Justice), or State (e.g., the State's Attorney General's Office) charged with the responsibility of investigating or processing such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.
                                    </p>
                                    <p>
                                        12. Disclosure may be made to the grant/contractor institution in connection with performance or administration under the terms and condition of the award, or in connection with problems that might arise in performance or administration if an award is made on a grant/contract proposal.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="policiesAndPractices">
                                <xhtmlContent>
                                    <p>
                                        Storage:
                                    </p>
                                    <p>
                                        Records are stored on hard disks with magnetic tape backup as well as in manual files (file folders).
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="retrievability">
                                <xhtmlContent>
                                    <p>
                                        Electronic records are retrievable by key data fields such as investigator name, application, grant or contract number. Paper records are retrievable by name of principal investigator and/or grant/contract number.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="safeguards">
                                <xhtmlContent>
                                    <p>
                                        1. Authorized users: All AHRQ staff working with grants or contracts have access to the system. Level of access is determined by individual need-to-know and electronic records are controlled by password access. Levels of access will be determined and granted by the System Manager. Only staff members of the Grants Management and Contracts Management have regular access to their Division's paper grant and contract files. Limited access to official grant and contract files is granted to other AHRQ and DHHS staff with need-to-know about AHRQ research projects, only with authorization of the responsible System Manager.
                                    </p>
                                    <p>
                                        2. Physical safeguards: File servers and database servers are maintained in areas secured by combination lock. Data is backed up from hard drive to magnetic tape daily. Paper records are secured in locked file cabinets. All file cabinets and computer equipment are maintained under general Agency and building security.
                                    </p>
                                    <p>
                                        3. Procedural safeguards: Access to electronic records by non-AHRQ personnel is through the Systems Manager only. DHHS staff may inspect AHRQ grant and contract records on a need-to-know basis only, with the approval of the responsible System Manager. Visitors are not left unattended in the office containing the files. Grant and contract records are either transmitted in sealed envelopes are hand-carried.
                                    </p>
                                    <p>
                                        4. Technical safeguards: Initial electronic access is through the AHRQ local area network which is controlled by password. Subsequent levels of security exist for access to the Agency Management Information System/Grants and Contracts (AMIS/GRANTS and CONTRACTS) system itself and, within the system, individual users are granted appropriate levels of access (read only, read/write) depending upon individual need. Levels of access are granted by the System Manager.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="retentionAndDisposal">
                                <xhtmlContent>
                                    <p>
                                        The complete paper applications and proposals of unfunded grants and contracts will be retired to the Federal Records Retention Center approximately one year after grant or contract closeout date and subsequently disposed of in accordance with the records retention schedule. Paper records of funded grant applications and contracts and their respective files are retained at AHRQ for one year beyond the termination date of the grant or until after the final report is received, whichever is sooner. They are then retired to the Federal Records Center and disposed of twelve years after final payment in accordance with the National Archives and Records Administration General Records Schedule. The pertinent records retention control schedule may be obtained by writing a System Manager at the following address:
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="systemManager">
                                <xhtmlContent>
                                    <p>
                                        For administrative information: AMIS/GRANTS and CONTRACTS Policy-Coordinating Official/Administrator, 301-427-1439-- (Information Technology Help Desk).
                                    </p>
                                    <p>
                                        For grants information: Grants Management Officer, 301-427-1447.
                                    </p>
                                    <p>
                                        For contracts information: Contracts Management Officer, 301-427-1780.
                                    </p>
                                    <p>
                                        All System Managers are located at the following address: Office of Performance, Accountability, Resources and Technology, 540 Gaither Road, Rockville, Maryland 20850.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="notificationProcedure">
                                <xhtmlContent>
                                    <p>
                                        To determine if a record exists, write to the System Manager at the above address. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be. The requester should specify name or number of grant/contract. The requester must also sign a statement indicating an understanding that the knowing and willful request for acquisition of information from a protected record pertaining to an individual under false pretenses is a criminal offense under the Act, punishable by a five thousand dollar fine.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="recordAccessProcedures">
                                <xhtmlContent>
                                    <p>
                                        Same as notification procedures. Requester should also reasonably specify the record contents being sought. Positive identification of the requester as above is required. Subject individuals may also request an accounting of disclosures that have been made of their record, if any.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="contestingRecordProcedures">
                                <xhtmlContent>
                                    <p>
                                        Contact the official at the address specified under the System Manager subheading above and reasonably identify the record, specify the information being contested, and state the corrective action sought and reason(s) for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="recordSourceCategories">
                                <xhtmlContent>
                                    <p>
                                        Grant applications, contractor project directors, reports and correspondence from the research community, and statements from grant review committees; consumer reporting agencies; DHHS System of Records 09-25-0036, Extramural Awards: IMPAC (Grant/Contract/Cooperative Agreement Information), HHS/NIH/DRG.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="exemptionsClaimed">
                                <xhtmlContent>
                                    <p>
                                        No.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                        </section>
                            <section id="09-35-0002" toc="yes">
                                <systemNumber>09-35-0002</systemNumber>
                                <subsection type="systemName">Medical Expenditure Panel Survey (MEPS) and National Medical Expenditure Survey 2 (NMES 2), HHS/AHRQ/CFACT.</subsection>
                                <subsection type="securityClassification">
                                    <xhtmlContent>
                                        <p>
                                            None.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemLocation">
                                    <xhtmlContent>
                                        <p>
                                            Center for Financing, Access, and Cost Trends, AHRQ, 540 Gaither Road, Rockville, MD 20850.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfIndividuals">
                                    <xhtmlContent>
                                        <p>
                                            (1) Individuals and members of households selected by probability sampling techniques to be representative of the civilian non- institutionalized population of the United States; health care providers, staff responding on behalf of health insurers and the employers of members of sampled households; (2) residents and next-of-kin of such residents of nursing and personal care homes, selected by probability sampling techniques to be representative of residents of such homes, and facilities and the staff responding on behalf of such facilities.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            Records containing information on: (1) The incidence of illness and accidental injuries, prevalence of diseases and impairments, the extent of disability, the use, expenditures and sources of payment for health care services, and other characteristics of individuals obtained in household interviews (demographic and socioeconomic characteristics such as age, marital status, education, occupation and family income) and the names, telephone numbers and addresses of the responding staffs of health care providers, health insurers, and employers; (2) the utilization of long-term care, nursing home care, care in personal care homes through data on residents (demographic and social characteristics, health status and charges and sources of payment for care); through data facility characteristics (general characteristics, certification, services offered and corresponding expenses), and through data on next-of-kin or representative of residents (demographic and social characteristics, health status, and expenditures for health care of residents); and (3) Medicare claims records of members of sampled households and of sampled residents of nursing and personal care homes.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="authorityForMaintenance">
                                    <xhtmlContent>
                                        <p>
                                            Section 913 and 306 of the Public Health Service (PHS) Act (42 U.S.C. 299b-2 and 242k(b)). Sections 924(c) and 308(d) of the PHS Act (42 U.S.C. 299c-3(c) and 242m(d)) provide authority for protecting restrictions on identifiable information about individuals.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="purpose">
                                    <xhtmlContent>
                                        <p>
                                            The data are used in aggregated form for statistical and health services research purposes respecting analysis and evaluation of health care costs, and the accessibility, planning, organization, distribution, technology, utilization quality, and financing of health services and systems.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="routineUsesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            The Department has contracted with private firms for the purpose of collecting, analyzing, aggregating, or otherwise refining records in this system. Relevant records are collected by and/or disclosed to such contractors. The contractors are required to maintain Privacy Act safeguards with respect to such records.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="policiesAndPractices">
                                    <xhtmlContent>
                                        <p>
                                            Storage:
                                        </p>
                                        <p>
                                            File folders, magnetic tapes, CD ROM and secure network servers.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retrievability">
                                    <xhtmlContent>
                                        <p>
                                            Information can be retrieved by respondent name and address. However, this information is not stored in routinely used analytic files.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="safeguards">
                                    <xhtmlContent>
                                        <p>
                                            AHRQ and its contractors implement personnel, physical, and procedural safeguards as follows:
                                        </p>
                                        <p>
                                            1. Authorized Users: Access is limited to persons authorized and needing to use the records, including project directors, contract officers, interviewers, health care researchers and analysts, statisticians, statistical clerks and data entry staff on the staffs of AHRQ and the MEPS contractors.
                                        </p>
                                        <p>
                                            2. Physical safeguards: The hard-copy records are stored in locked safes, locked files, and locked offices when not in use. Computer terminals used to process identifiable data are located in secured areas and are accessible only to authorized users. Automated back-up files are stored in locked, fire proof safes.
                                        </p>
                                        <p>
                                            3. Procedural safeguards: All employees of AHRQ and contractor personnel with access to AHRQ records are required, as a condition of employment, to sign an affidavit, acknowledging AHRQ's confidentiality statute and penalty provision and binding themselves to nondisclosure of individually identifiable information. Periodic training sessions are conducted to reinforce the statutorily-based confidentiality restrictions. Actual identifiers are maintained in separate files linked only if there is  specific need as authorized by the System Manager. Data stored in computers both at AHRQ and the contractor sites are accessed through the use of passwords/keywords unique to each user and changed at least every 45 days. An automated audit trail will be maintained. Contractors who maintain records in this system are instructed to make no further disclosure of the records other than those requested by AHRQ/CFACT. Privacy Act requirements and the restrictions of 42 U.S.C 242m(d) are specifically included in contracts for survey, research and data processing activities related to this system. The DHHS project directors, contract officers and project officers oversee compliance with these confidentially and security requirements.
                                        </p>
                                        <p>
                                            4. These safeguards are in accordance with chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary chapter PHS hf. 45-13; Part 6, "ADP Systems Security," of the HHS ADP Systems Manual, and the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31).
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retentionAndDisposal">
                                    <xhtmlContent>
                                        <p>
                                            Hard-copy records will be burned or shredded following verification that such data were correctly entered into a machine readable format.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemManager">
                                    <xhtmlContent>
                                        <p>
                                            Director, Division of Survey Operations, CFACT/AHRQ, 540 Gaither Road, Rockville, MD. 20850
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="notificationProcedure">
                                    <xhtmlContent>
                                        <p>
                                            To determine if a record exists, write to the System Manager, giving your full name and address.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordAccessProcedures">
                                    <xhtmlContent>
                                        <p>
                                            The system is exempt from the requirements of the Privacy Act; however, a subject individual may be granted access to his/her records at the System's Manager's discretion. Positive identification is required from anyone seeking such access.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="contestingRecordProcedures">
                                    <xhtmlContent>
                                        <p>
                                            If access has been granted and some information is being contested, contact the System Manager and reasonably identify the record, specify the contested information, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordSourceCategories">
                                    <xhtmlContent>
                                        <p>
                                            Respondents in the survey samples including: members of households, physicians, hospitals, health insurers, employers, staff of nursing and personal care homes, the next-of-kin of residents of such homes and facilities, and Systems 09-70-0005, Medicare Bill File (Statistics), HHS/HCFA/BDMS.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemsExempted">
                                    <xhtmlContent>
                                        <p>
                                            With respect to this system of records, exemption has been granted from the requirements contained in subsections 552a(c)(3), (d)(1) through (4) and (e)(4)(G) and (H), in accordance with the provisions of subsection 552a(k)(4) of the Privacy Act of 1974. This system has been exempted because it contains only records which are required by statute to be maintained and used solely as statistical records.
                                        </p></xhtmlContent>
                            </subsection>
                            </section>
                            <section id="09-19-0001" toc="yes">
                                <systemNumber>09-19-0001</systemNumber>
                                <subsection type="systemName">Records of Persons Exposed or Potentially Exposed to Toxic or Hazardous Substances, HHS/ATSDR.</subsection>
                                <subsection type="securityClassification">
                                    <xhtmlContent>
                                        <p>
                                            None.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemLocation">
                                    <xhtmlContent>
                                        <p>
                                            Division of Health Studies, Agency for Toxic Substances and Disease Registry (ATSDR), Coordinating Center for Environmental Health and Injury Prevention (CCEHIP), 4770 Buford Highway, Building 106, Atlanta, GA 30341,
                                        </p>
                                        <p>
                                            Division of Health Assessment and Consultation, ATSDR, CCEHIP, 4770 Buford Highway, Building 106, Atlanta, GA 30341,
                                        </p>
                                        <p>
                                            Division of Regional Operations, ATSDR, CCEHIP, 4770 Buford Highway, Building 106, Atlanta, GA 30341,
                                        </p>
                                        <p>
                                            Division of Toxicology and Environmental Medicine, ATSDR, CCEHIP, 4770 Buford Highway, Building 106, Atlanta, GA 30341-3724; and
                                        </p>
                                        <p>
                                            Federal Records Center, 4712 Southpark Blvd., Ellenwood, GA 30294. Data are also located at contractor sites. A list of contractor sites where individually identified data are currently located is available upon request to the system manager.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfIndividuals">
                                    <xhtmlContent>
                                        <p>
                                            Individuals exposed or potentially exposed to toxic or hazardous substances may include the following: (1) Selected persons living or having lived near a hazardous waste site, including facilities owned or operated by the United States; (2) persons exposed or potentially exposed to environmental hazards resulting from exposure to contaminated water, soil, air, or biota; (3) participants in health outcome studies (including exposure studies, symptom and disease prevalence studies, cluster investigations), and epidemiologic studies to determine the public health threat of exposure to hazardous or toxic substances; (4) registry participants with exposures associated with specific chemicals; (5) participants from sites of emergency activities, and other sites that are the subject of a citizen's petition; (6) persons working or having worked in response actions at hazardous waste sites or other occupational settings where exposure to hazardous substances occurred. The first five categories of persons above may include children as well as adults.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            Name, address, (including length of time at current address), telephone number, date of birth, Social Security number, sex, current and past occupations, dates, pathways and routes of toxic or hazardous substance exposure or potential exposure, environmental sampling data, smoking history, results of medical and laboratory tests, records on biological specimens (<i>e.g.</i> blood, urine, <i>etc.</i>), and related documents such as questionnaire responses. The specific type of records collected and maintained is determined by the needs of the individual registry or study.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="authorityForMaintenance">
                                    <xhtmlContent>
                                        <p>
                                            "Comprehensive Environmental Response, Compensation, and Liability Act of 1980" as amended by "Superfund Amendments and Reauthorization Act of 1986" (42 U.S.C. 9601, 9604); and the "Resource Conservation and Recovery Act of 1976" as amended in 1984 (42 U.S.C. 6901).
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="purpose">
                                    <xhtmlContent>
                                        <p>
                                            Records in this system are used to carry out the legislated environmental public health mandates of the Agency for Toxic Substances and Disease Registry (ATSDR). Specifically this information is used to: (1) Identify the public health threat caused by exposure to toxic and hazardous substances utilizing health outcome studies, epidemiologic studies, exposure investigations, and other health effects studies; and (2) establish and maintain national registries of persons exposed to toxic substances and persons with serious diseases and illnesses associated or potentially associated with exposure to toxic substances. Registries will have the additional purposes of tracking exposed individuals, keeping them informed of health effects of exposure, preventive measures and possible breakthroughs in treatment, along with serving as a centralized location for research data on these exposed individuals.
                                        </p>
                                        <p>
                                            Records may be disclosed to the National Center for Environmental Health, CCEHIP, and Centers for Disease Control and Prevention (CDC), for laboratory analysis of samples and for collaborative efforts (<i>i.e.,</i> providing staff, performing statistical analysis, <i>etc.</i>) in coordinating investigations.
                                        </p>
                                        <p>
                                            Records (<i>i.e.,</i> name, Social Security number, date of birth) may be disclosed to the National Center for Health Statistics, CDC to obtain a determination of vital status. Death certificates with the cause of death will then be obtained from Federal, State, or local agencies to enable ATSDR to: (1) Determine whether excess mortality is occurring among individuals exposed to toxic or hazardous substances; and (2) notify similarly exposed persons.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="routineUsesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            Records may be disclosed to Department of Health and Human Services contractors to locate individuals exposed or potentially exposed to toxic or hazardous substances (<i>e.g.,</i> in the establishment of the National Exposure Registry), conduct interviews, perform medical examinations, collect and analyze biological specimens, evaluate and interpret data, and perform follow up health investigations so that the research purposes for which the records are collected may be accomplished. The contractor must comply with the requirements of the Privacy Act with respect to such records.
                                        </p>
                                        <p>
                                            Records may be disclosed to Federal agencies such as the Environmental Protection Agency (EPA), State and local health departments, and other public health or cooperating medical authorities in connection with program activities and related collaborative efforts to deal more effectively with exposures to hazardous or toxic substances, and to satisfy mandatory reporting requirements when applicable.
                                        </p>
                                        <p>
                                            Records (i.e., name, Social Security number) may be disclosed to other Federal agencies and to missing person location agencies to obtain information to aid in locating individuals involved in these studies.
                                        </p>
                                        <p>
                                            Records may be disclosed for a research purpose, when the Department:
                                        </p>
                                        <p>(A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (B) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identified form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (C) has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law; and (D) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.</p>
                                        <p>
                                            Disclosures may be made to a congressional office from the records of an individual, in response to a verified inquiry from the congressional office made at the written request of that individual.
                                        </p>
                                        <p>
                                            In the event of litigation initiated by EPA in collaboration with ATSDR, ATSDR may disclose such records as it deems desirable or necessary to the Department of Justice to enable the Department to effectively represent ATSDR. The types of litigative proceedings that ATSDR may request include the recovery of expenses incurred in cleanup operations at Superfund or Resource Conservation and Recovery Act sites, including program and staff costs.
                                        </p>
                                        <p>
                                            In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claims, if successful, are likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                        </p>
                                        <p>
                                            Records may be provided to the Social Security Administration by ATSDR, for the purpose of locating or tracking individuals, to accomplish the research or program purpose for which the records were collected.
                                        </p>
                                        <p>
                                            Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="policiesAndPractices">
                                    <xhtmlContent>
                                        <p>
                                            Storage:
                                        </p>
                                        <p>
                                            File folders, computer tapes and disks (hard and floppy), CD-ROMs.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retrievability">
                                    <xhtmlContent>
                                        <p>
                                            By name or Social Security number.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="safeguards">
                                    <xhtmlContent>
                                        <p>
                                            The following special safeguards are provided to protect the records from inadvertent disclosure:
                                        </p>
                                        <p><i>Authorized Users:</i> A database security package is implemented on CDC's mainframe computer to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Access to records is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of ATSDR or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected. A list of authorized users will be maintained by the system manager.
                                        </p>
                                        <p><i>Physical Safeguards:</i> Questionnaires, log books, and other source data are maintained in locked cabinets in locked rooms, and security guard service in buildings provide personnel screening of visitors. Access to the CDC Clifton Road facility where the mainframe computer is located (ATSDR utilizes the CDC mainframe computer) is controlled by a cardkey system. Access to the computer room is controlled by a cardkey and security code (numeric keypad) system. The local fire department is located directly next door to the Clifton Road facility. The computer room is protected by an automatic sprinkler system, numerous automatic sensors (<i>e.g.,</i> water, heat, smoke, <i>etc.</i>) are installed, and a proper mix of portable fire extinguishers is located throughout the computer room. The system is backed up on a nightly basis with copies of the files stored off site in a secure fireproof safe. Computer workstations, lockable personal computers, and automated records are located in secured areas.
                                        </p>
                                        <p><i>Procedural Safeguards:</i> Protection for computerized records both on the mainframe and the ATSDR Local Area Network (LAN) includes programmed verification of valid user identification code and password prior to logging on to the system, mandatory password changes, limited log-ins, virus protection, and user rights/file attribute restrictions. Password protection imposes user name and password log-in requirements to prevent unauthorized access. Each user name is assigned limited access rights to files and directories at varying levels to control file sharing. There are routine daily backup procedures and secure off-site storage is available for backup files.
                                        </p>
                                        <p>
                                            Knowledge of individual tape passwords is required to access tapes, and access to systems is limited to users obtaining prior supervisory approval. When Privacy Act tapes are scratched, a special "an additional procedure" process is performed in which tapes are completely written over to avoid inadvertent data disclosure. When possible, a backup copy of data is stored at an offsite location and a log kept of all changes to each file and all persons reviewing the file. Selected safeguards will be applicable to specific elements of the system, as appropriate. Additional safeguards may also be built into the program by the system analyst as warranted by the sensitivity of the specific data set.
                                        </p>
                                        <p>
                                            ATSDR and contractor employees who maintain records are instructed in specific procedures to protect the security of records, and are to check with the system manager prior to making disclosure of data. When individually identified data are being used in a room, admittance at either ATSDR or contractor sites is restricted to specifically authorized personnel.
                                        </p>
                                        <p>
                                            Appropriate Privacy Act provisions are included in contracts, and the ATSDR Project Director, contract officers, and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to ATSDR or destroyed, as specified by the contract.
                                        </p>
                                        <p><i>Implementation Guidelines:</i> The safeguards outlined above are in accordance with the HHS Information Security Program Policy and FIPS Pub 200, "Minimum Security Requirements for Federal Information and Information Systems." Data maintained on CDC's Mainframe and the ATSDR LAN are in compliance with OMB Circular A-130, Appendix III. Security is provided for information collection, processing, transmission, storage, and dissemination in general support systems and major applications.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retentionAndDisposal">
                                    <xhtmlContent>
                                        <p>
                                            Records are retained and disposed of in accordance with the ATSDR Comprehensive Records Control Schedule (B-371). Current procedures allow the system manager to keep the records for 20 years unless needed for further study. Registry records will be actively maintained as long as funding is provided for by legislation. Retention periods vary depending on the type of record. Source documents for computer tapes or disks are disposed of when no longer needed in the study as determined by the system manager, and as provided in the signed consent form, as appropriate.
                                        </p>
                                        <p>
                                            Records may be transferred to a Federal Records Center for storage when no longer needed for evaluation or analysis. Disposal methods include the paper recycling process, burning or shredding hard copy records, and erasing computer tapes and disks.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemManager">
                                    <xhtmlContent>
                                        <p>
                                            Director, Division of Health Studies, Chamblee Bldg 106, Rm 3007, MS F57, ATSDR, CCEHIP, 4770 Buford Highway, Atlanta, GA 30341.
                                        </p>
                                        <p>
                                            Director, Division of Health Assessment and Consultation, Chamblee Bldg 106, Rm 5007, MS F59, ATSDR, CCEHIP, 4770 Buford Highway, Atlanta, GA 30341.
                                        </p>
                                        <p>
                                            Director, Division of Regional Operations, Chamblee Bldg 106, Rm 4112, MS F58, ATSDR, CCEHIP, 4770 Buford Highway, Atlanta, GA 30341.
                                        </p>
                                        <p>
                                            Director, Division of Toxicology and Environmental Medicine, Chamblee Bldg. 101, Rm. 3118, MS F29, ATSDR, CCEHIP, 4770 Buford Highway, Atlanta, GA 30341-3724.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="notificationProcedure">
                                    <xhtmlContent>
                                        <p>
                                            An individual may learn if a record exists about himself or herself by contacting the appropriate system manager at the above address. Persons who knowingly and willfully request or acquire a record pertaining to an individual under false pretenses are subject to criminal prosecution. Requesters in person must provide photo identification (such as driver's license) or other positive identification that would authenticate the identity of the individual making the request. Individuals who do not appear in person must submit a request which has been notarized to verify their identity. A parent or guardian who requests notification of, or access to, a minor's medical record must provide a birth certificate (or notarized copy), court order, or other competent evidence of guardianship. An individual who requests notification of or access to, a medical record shall at the time the request is made, designate in writing a responsible representative (who may be a physician, other health professional, or other responsible individual) who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                        </p>
                                        <p>
                                            In addition, the following information should be provided when requesting notification: (1) Full name and Social Security number; and (2) nature of the study, or probable exposure or disease subregistry which might include the requester.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordAccessProcedures">
                                    <xhtmlContent>
                                        <p>
                                            Same as the notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="contestingRecordProcedures">
                                    <xhtmlContent>
                                        <p>
                                            Contact the system manager at the address specified above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordSourceCategories">
                                    <xhtmlContent>
                                        <p>
                                            Subject individuals, families of deceased individuals, concerned citizens associated with a particular site, State and local health departments, physicians' records, hospital records, Social Security Administration, Environmental Protection Agency and other agencies responsible for environmental public health.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemsExempted">
                                    <xhtmlContent>
                                        <p>None.</p>
                                    </xhtmlContent>
                                </subsection>
                            </section>
                            <section id="09-20-0001" toc="yes">
                                <systemNumber>09-20-0001</systemNumber>
                                <subsection type="systemName">Certified Interpreting Physician File, HHS/CDC/NIOSH.</subsection>
                                <subsection type="securityClassification">
                                    <xhtmlContent>
                                        <p>
                                            None.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemLocation">
                                    <xhtmlContent>
                                        <p>
                                            Division of Respiratory Disease Studie , National Institute for Occupational Safety and Health (NIOSH), 1095 Willowdale Road, MS 217, Morgantown, WV 26505-2845.
                                        </p>
                                        <p>
                                            Data are also located at contractor sites as studies are developed, data collected, and reports written.  A list of contractor sites where individually identified data are currently located is available upon request to the system manager.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfIndividuals">
                                    <xhtmlContent>
                                        <p>
                                            Physicians who have been taken the test to be certified to interpret X-rays under the Federal Mine Health and Safety Act of 1977. Records are also maintained on physicians who have attempted to obtain certification, but did not qualify.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            Certification qualifications of physicians.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="authorityForMaintenance">
                                    <xhtmlContent>
                                        <p>
                                            Federal Mine Health and Safety Act of 1977, Section 501, "Research" (30 U.S.C. 951).
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="purpose">
                                    <xhtmlContent>
                                        <p>
                                            The main purpose is to certify physicians as qualify to interpret X-rays using the ILO system of classification for pneumoconiosis.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="routineUsesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            1. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                        </p>
                                        <p>
                                            2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                        </p>
                                        <p>
                                            3. Records subject to the Privacy Act are disclosed to private firms for data entry, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                        </p>
                                        <p>
                                            4. In the event of litigation initiated at the request of NIOSH, the Institute may disclose such records as it deems desirable or necessary to the Department of Justice and to the Department of Labor, Office of the Solicitor, where appropriate, to enable the Departments to effectively represent the Institute, provided such disclosure is compatible with the purpose for which the records were collected. The only types of litigative proceedings that NIOSH is authorized to request are: (1) Enforcement of a subpoena issued to an employer to provide relevant information; or (2) contempt citation against an employer for failure to comply with a warrant obtained by the Institute.
                                        </p>
                                        <p>
                                            5. Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="policiesAndPractices">
                                    <xhtmlContent>
                                        <p>
                                            Storage:
                                        </p>
                                        <p>
                                            File folders, microcomputer files, Computer tapes/disks and printouts, microfilm.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retrievability">
                                    <xhtmlContent>
                                        <p>
                                            Name and/or social security number, supplied on a voluntary basis are the indices used to retrieve records.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="safeguards">
                                    <xhtmlContent>
                                        <p>
                                            1. Authorized Users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC) or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                        </p>
                                        <p>
                                            2. Physical safeguards: Locked cabinets in locked rooms, 24-hour guard service in buildings, personnel screening and escorting of visitors, a limited access, secured computer room with fire extinguishers and overhead sprinkler system, computer terminals and automated records located in secured areas.
                                        </p>
                                        <p>
                                            3. Procedural safeguards: Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, and frequently changed passwords. Knowledge of individual tape passwords is required to access tapes, and access to systems is limited to users obtaining prior supervisory approval. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                        </p>
                                        <p>
                                            CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                        </p>
                                        <p>
                                            4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31).
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retentionAndDisposal">
                                    <xhtmlContent>
                                        <p>
                                            Records are retained indefinitely. Disposal methods include erasing computer tapes, burning or shredding printouts or transferring records to the Federal Records Center.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemManager">
                                    <xhtmlContent>
                                        <p>
                                            Administrative Officer, Division of Respiratory Disease Studies (DRDS), National Institute for Occupational Safety and Health (NIOSH), 1095 Willowdale Road, MS 217, Morgantown, WV 26505-2845.
                                        </p>
                                        <p>
                                            Chief, Examinations Processing Branch, DRDS, NIOSH, Receiving Center, Post Office Box 4258, MS 122, Morgantown, WV 26504-4258.
                                        </p>
                                        <p>
                                            Policy coordination is provided by: Director, Division of Respiratory Disease Studies, National Institute for Occupational Safety and Health, 1095, Willowdale Road, MS 220, Morgantown, WV 26505-2845,
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="notificationProcedure">
                                    <xhtmlContent>
                                        <p>
                                            An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordAccessProcedures">
                                    <xhtmlContent>
                                        <p>
                                            Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="contestingRecordProcedures">
                                    <xhtmlContent>
                                        <p>
                                            Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordSourceCategories">
                                    <xhtmlContent>
                                        <p>
                                            Information is obtained directly from the individual or his/her designee.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemsExempted">
                                    <xhtmlContent>
                                        <p>
                                            None.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                            </section>
                            <section id="09-20-0055" toc="yes">
                                <systemNumber>09-20-0055</systemNumber>
                                <subsection type="systemName">Administrative Files for Research/Demonstration and Training Grants, and Cooperative Agreements Applications, HHS/CDC/PGO.</subsection>
                                <subsection type="securityClassification">
                                    <xhtmlContent>
                                        <p>
                                            None.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemLocation">
                                    <xhtmlContent>
                                        <p>
                                            Division of Research Grants, National Institutes of Health, Westbard Bldg., Westbard Avenue, Bethesda, MD 20014.
                                        </p>
                                        <p>
                                            Grants Management Office, Procurement and Grants Office, Rm. 300, Buckhead Bldg., Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                        </p>
                                        <p>
                                            Office of Extramural Coordination and Special Projects, National Institute for Occupational Safety and Health (NIOSH), Bldg. 1, Rm. 3053, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                        </p>
                                        <p>
                                            Division of Training and Manpower Development, Division of Biomedical and Behavioral Science, Division of Physical Sciences and Engineering, and Division of Surveillance, Hazard Evaluations, and Field Studies, NIOSH, 4676 Columbia Parkway, Cincinnati, OH 45226.
                                        </p>
                                        <p>
                                            Division of Respiratory Disease Studies and Division of Safety Research, NIOSH, 1095 Willowdale Road, Morgantown, WV 26505-2845.
                                        </p>
                                        <p>
                                            Federal Records Center, 4205 Suitland Road, Suitland, MD 20409, and 1557 St. Joseph Avenue, East Point, GA 30344.
                                        </p>
                                        <p>
                                            A list of contractor sites where individually identified data are currently located is available upon request to the system manager.
                                        </p>
                                        <p>
                                            Data are also occasionally located at grantee sites as studies are developed, data collected, and reports written. A list of grantee sites where individually identified data are currently located is available upon request to the system manager.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfIndividuals">
                                    <xhtmlContent>
                                        <p>
                                            Applicants for occupational safety and health research and demonstration grants, and training grants.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            Draft and final grant application and review history, awards, financial records and progress reports and related correspondence.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="authorityForMaintenance">
                                    <xhtmlContent>
                                        <p>
                                            Occupational Safety and Health Act, Section 20, "Research and Related Activities" and Section 21, `Training and Employee Education" (29 U.S.C. 669, 670).
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="purpose">
                                    <xhtmlContent>
                                        <p>
                                            The purpose of this system is to review grant applications for research and training and to administer funded grants. This information is provided to the National Institutes of Health and to components of the Centers for Disease Control (CDC) including NIOSH for review.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="routineUsesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            1. Referrals may be made of assignments of research investigators and project monitors on specific research projects to the National Technical Information Service (NTIS), Depart of Commerce, to contribute to the Smithsonian Science Information Exchange.
                                        </p>
                                        <p>
                                            2. To the cognizant audit agency for auditing.
                                        </p>
                                        <p>
                                            3. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                        </p>
                                        <p>
                                            4. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                        </p>
                                        <p>
                                            5. To qualified experts not within the definition of Department employees as prescribed in Department regulations for opinions as a part of the application review process.
                                        </p>
                                        <p>
                                            6. To a Federal agency, in response to its request, in connection with the letting of a contract, or the issuance of a license, grant, cooperative agreement, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
                                        </p>
                                        <p>
                                            7. To individuals and organizations deemed qualified by PHS to carry out specific research related to the review and award processes of PHS.
                                        </p>
                                        <p>
                                            8. To the grantee institution relative to performance or administration under the terms and conditions of the award.
                                        </p>
                                        <p>
                                            9. Records subject to the Privacy Act are disclosed to private firms for data entry, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                        </p>
                                        <p>
                                            10. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="policiesAndPractices">
                                    <xhtmlContent>
                                        <p>
                                            Storage:
                                        </p>
                                        <p>
                                            5x8 cards, computer tapes/discs and printouts, notebooks, and file folders.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retrievability">
                                    <xhtmlContent>
                                        <p>
                                            Name is the index used to retrieve information.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="safeguards">
                                    <xhtmlContent>
                                        <p>
                                            1. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                        </p>
                                        <p>
                                            2. Physical safeguards: Records are kept in locked cabinets in locked rooms. Guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in operation at the Federal Records Center.
                                        </p>
                                        <p>
                                            3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with system manager prior to making disclosures of data.
                                        </p>
                                        <p>
                                            4. Implementation guidelines: HHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Mangement Regulations, subchapter B--Archives and Records.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retentionAndDisposal">
                                    <xhtmlContent>
                                        <p>
                                            Approved and funded applications are kept for one year beyond closeout, and then sent to the Federal Records Center (FRC) for 10 years, after which time they are destroyed. Unsuccessful applications are retained for up to 2 years at the agency, and then sent to the FRC for 10 years. Draft applications are kept for one year or until an official application is received (at which time the draft is destroyed). Disposal methods include the paper recycling process, burning or shredding paper materials, and erasing computer tapes.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemManager">
                                    <xhtmlContent>
                                        <p>
                                            Grants Management Officer, Procurement and Grants Office, Buckhead Bldg., Rm. 300, MS E09, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                        </p>
                                        <p>
                                            Associate Director for Extramural Programs, NIOSH, Bldg. 1, Rm. 3053, MS D30, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                        </p>
                                        <p>
                                            Policy coordination is provided by: Associate Director for Management and Operations, Bldg. 1, Rm. 2011, MS D15, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="notificationProcedure">
                                    <xhtmlContent>
                                        <p>
                                            An individual may learn if a record exists about himself or herself by contacting the appropriate system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identify or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordAccessProcedures">
                                    <xhtmlContent>
                                        <p>
                                            Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="contestingRecordProcedures">
                                    <xhtmlContent>
                                        <p>
                                            Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordSourceCategories">
                                    <xhtmlContent>
                                        <p>
                                            Information is obtained directly from the individual.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemsExempted">
                                    <xhtmlContent>
                                        <p>
                                            None.
                                        </p>
                                    </xhtmlContent>
                                </subsection></section>
                                <section id="09-20-0059" toc="yes">
                                    <systemNumber>09-20-0059</systemNumber>
                                    <subsection type="systemName">Division of Training Mailing List, HHS/CDC/NIOSH.</subsection>
                                    <subsection type="securityClassification">
                                        <xhtmlContent>
                                            <p>
                                                None.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="systemLocation">
                                        <xhtmlContent>
                                            <p>
                                                Division of Training and Manpower Development (DTMD), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226.
                                            </p>
                                            <p>
                                                Data are also occasionally located at contractor sites as studies are developed, data collected, and reports written. A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="categoriesOfIndividuals">
                                        <xhtmlContent>
                                            <p>
                                                Persons who have taken a NIOSH training course or who ask to be placed on the list.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="categoriesOfRecords">
                                        <xhtmlContent>
                                            <p>
                                                Names and addresses.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="authorityForMaintenance">
                                        <xhtmlContent>
                                            <p>
                                                Occupational Safety and Health Act, Section 21, "Training and Employee Education" (29 U.S.C. 670).
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="purpose">
                                        <xhtmlContent>
                                            <p>
                                                The purpose of this system is to advise prospective students of upcoming NIOSH training courses.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="routineUsesOfRecords">
                                        <xhtmlContent>
                                            <p>
                                                Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                            </p>
                                            <p>
                                                The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                            </p>
                                            <p>
                                                Records subject to the Privacy Act are disclosed to private firms for data entry, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="policiesAndPractices">
                                        <xhtmlContent>
                                            <p>
                                                Storage:
                                            </p>
                                            <p>
                                                Computer tapes/disks and printouts, addressograph plates.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="retrievability">
                                        <xhtmlContent>
                                            <p>
                                                Name and student number are the indices used to retrieve records from this system.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="safeguards">
                                        <xhtmlContent>
                                            <p>
                                                l. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC) or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                            </p>
                                            <p>
                                                2. Physical safeguards: Locked cabinets in locked rooms, 24-hour guard service in buildings, personnel screening of visitors, a limited access, secured computer room with fire extinguishers and overhead sprinkler system, computer terminals and automated records located in secured areas.
                                            </p>
                                            <p>
                                                3. Procedural safeguards: Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, and frequently changed passwords. Knowledge of individual tape passwords is required to access tapes, and access to systems is limited to users obtaining prior supervisory approval. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                            </p>
                                            <p>
                                                CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                            </p>
                                            <p>
                                                4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31).
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="retentionAndDisposal">
                                        <xhtmlContent>
                                            <p>
                                                Record copy maintained from three to ten years in accordance with retention schedules. Source documents for computer disposed of when no longer needed in the study, as determined by the system manager. Disposal methods include erasing computer tapes and burning or shredding paper materials.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="systemManager">
                                        <xhtmlContent>
                                            <p>
                                                Audio Visual Production Officer, Division of Training and Manpower Development (DTMD), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="notificationProcedure">
                                        <xhtmlContent>
                                            <p>
                                                An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identify or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="recordAccessProcedures">
                                        <xhtmlContent>
                                            <p>
                                                Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="contestingRecordProcedures">
                                        <xhtmlContent>
                                            <p>
                                                Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="recordSourceCategories">
                                        <xhtmlContent>
                                            <p>
                                                Information is obtained directly from the individual.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="systemsExempted">
                                        <xhtmlContent>
                                            <p>
                                                None.
                                            </p>
                                        </xhtmlContent>
                                    </subsection></section>
                                    <section id="09-20-0089" toc="yes">
                                        <systemNumber>09-20-0089</systemNumber>
                                        <subsection type="systemName"> Studies of Treatment of Tuberculosis and other Mycobacterioses, HHS/CDC/NCPS.</subsection>
                                        <subsection type="securityClassification">
                                            <xhtmlContent>
                                                <p>
                                                    None.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="systemLocation">
                                            <xhtmlContent>
                                                <p>
                                                    Division of Tuberculosis Elimination, National Center for Prevention Services, Corporate Square, Bldg. 10, Room 2208, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333 and Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                </p>
                                                <p>
                                                    A list of contractor sites where individually identified data are currently located is available upon request to the system manager.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="categoriesOfIndividuals">
                                            <xhtmlContent>
                                                <p>
                                                    Adults and children with tuberculosis or other mycobacterial diseases having been or currently being treated or observed by a limited number of participating local or county health departments, clinics, and hospitals (from 1959 until the present time), including those individuals in selected areas receiving isoniazid therapy or BCG vaccinations, and patients for whom routine tuberculosis treatment is ineffective. Also included are contacts to tuberculosis patients, adults with inactive tuberculosis, and controls.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="categoriesOfRecords">
                                            <xhtmlContent>
                                                <p>
                                                    Abstracts of medical data pertaining to clinical trials, including medical history, skin tests, physical examinations, laboratory test results, X-ray results, medications prescribed, smoking habits, etc.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="authorityForMaintenance">
                                            <xhtmlContent>
                                                <p>
                                                    Public Health Service Act, Section 301, "Research and Investigation" (42 U.S.C. 241).
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="purpose">
                                            <xhtmlContent>
                                                <p>
                                                    To determine the effectiveness and safety of a variety of treatments and preventive measures for tuberculosis and other mycobacterial diseases, to determine the best measures against drug resistant tuberculosis, and to monitor incidence of complications among individuals who have received preventive therapy, including isoniazid.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="routineUsesOfRecords">
                                            <xhtmlContent>
                                                <p>
                                                    Records may be disclosed to health departments and other public health or cooperating medical authorities in connection with program activities and related collaborative efforts to deal more effectively with diseases and conditions of public health significance.
                                                </p>
                                                <p>
                                                    Records may be disclosed to health departments and other public health or cooperating medical authorities in connection with program activities and related collaborative efforts to deal more effectively with diseases and conditions of public health significance.
                                                </p>
                                                <p>
                                                    A record may be disclosed for a research purpose, when the Department:
                                                </p>
                                                <p>
                                                    (A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;
                                                </p>
                                                <p>
                                                    (B) Has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring;
                                                </p>
                                                <p>
                                                    (C) Has required the recipient to: (1) Establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law;
                                                </p>
                                                <p>
                                                    (D) Has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
                                                </p>
                                                <p>
                                                    The Department is under contract with private firms for the purpose of collating, analyzing, aggregating or otherwise refining records in this system. Relevant records are maintained by the contractors. The contractors are required to maintain Privacy Act safeguards with respect to such records. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                </p>
                                                <p>
                                                    Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="policiesAndPractices">
                                            <xhtmlContent>
                                                <p>
                                                    Storage:
                                                </p>
                                                <p>
                                                    Cards, file folders, computer tapes/disks and printouts.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="retrievability">
                                            <xhtmlContent>
                                                <p>
                                                    Records are retrieved by the participant's name and/or study I.D. number.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="safeguards">
                                            <xhtmlContent>
                                                <p>
                                                    1. Authorized users: A database security package is implemented on CDC's mainframe computer to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                </p>
                                                <p>
                                                    2. Physical safeguards: Access to the CDC Clifton Road facility where the mainframe computer is located is controlled by a card key system. Access to the computer room is controlled by a card key and security code (numeric keypad) system. Access to the data entry area is also controlled by a card key system. The hard copy records are kept in locked cabinets in locked rooms. The local fire department is located directly across the street from the Clifton Road buildings. The computer room is protected by an automatic sprinkler system, automatic sensors (e.g., water, heat, smoke, etc.) are installed, and portable fire extinguishers are located throughout the computer room. The system is backed up on a nightly basis with copies of the files stored off site in a secure fire proof safe. The 24-hour guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in effect at the Federal Records Center.
                                                </p>
                                                <p>
                                                    3. Procedural safeguards: System security includes automatic suspension of accounts, forced password changes, and control of systems and data set access. Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, frequently changed passwords, and Vault Management System. When Privacy Act tapes are erased, a special "certified" process is performed in which tapes are completely written over to avoid inadvertent data disclosure. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                </p>
                                                <p>
                                                    CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                </p>
                                                <p>
                                                    4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31). FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="retentionAndDisposal">
                                            <xhtmlContent>
                                                <p>
                                                    Records are maintained in agency for five years. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="systemManager">
                                            <xhtmlContent>
                                                <p>
                                                    Director, Division of Tuberculosis Elimination, National Center for Prevention Services, Corporate Square, Bldg. 10, Rm. 10, MS E10, Centers for Disease Control and Prevention, l600 Clifton Road, NE, Atlanta, GA 30333.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="notificationProcedure">
                                            <xhtmlContent>
                                                <p>
                                                    An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                </p>
                                                <p>
                                                    An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                </p>
                                                <p>
                                                    A parent or guardian who requests notification of, or access to, a child's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                </p>
                                                <p>
                                                    The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="recordAccessProcedures">
                                            <xhtmlContent>
                                                <p>
                                                    Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="contestingRecordProcedures">
                                            <xhtmlContent>
                                                <p>
                                                    Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="recordSourceCategories">
                                            <xhtmlContent>
                                                <p>
                                                    Individuals, state and local health departments, hospitals, laboratories, clinics, and family members of study participants.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="systemsExempted">
                                            <xhtmlContent>
                                                <p>
                                                    None.

                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                    </section>
                                    <section id="09-20-0090" toc="yes">
                                        <systemNumber> 09-20-0090</systemNumber>
                                        <subsection type="systemName"> Studies of Testing for Tuberculosis and other Mycobacterioses, HHS/CDC/NCPS.</subsection>
                                        <subsection type="securityClassification">
                                            <xhtmlContent>
                                                <p>
                                                    None.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="systemLocation">
                                            <xhtmlContent>
                                                <p>
                                                    Division of Tuberculosis Elimination, National Center for Prevention Services, Corporate Square, ldg. 10, Rm. 2208, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333 and
                                                </p>
                                                <p>
                                                    Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="categoriesOfIndividuals">
                                            <xhtmlContent>
                                                <p>
                                                    Study participants include patients, clientele, and employees of local and county health departments, hospitals, and other institutions currently observing and/or treating cases of tuberculosis and other mycobacterial diseases. Participants include adults and children.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="categoriesOfRecords">
                                            <xhtmlContent>
                                                <p>
                                                    Medical records.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="authorityForMaintenance">
                                            <xhtmlContent>
                                                <p>
                                                    Public Health Service Act, Section 301, "Research and Investigation" (42 U.S.C. 241).
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="purpose">
                                            <xhtmlContent>
                                                <p>
                                                    To study the diagnostic value of tests used to identify persons infected with M. tuberculosis or sensitized by other mycobacteria. These records may also be used by the Food and Drug Administration in conducting research related to Investigational New Drugs (IND).
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="routineUsesOfRecords">
                                            <xhtmlContent>
                                                <p>
                                                    Test results will be returned to the collaborating physician or responsible hospital official.
                                                </p>
                                                <p>
                                                    Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                </p>
                                                <p>
                                                    In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                </p>
                                                <p>
                                                    Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.
                                                </p>
                                                <p>
                                                    Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="policiesAndPractices">
                                            <xhtmlContent>
                                                <p>
                                                    Storage:
                                                </p>
                                                <p>
                                                    Cards, file folders, computer tapes/disks and printouts.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="retrievability">
                                            <xhtmlContent>
                                                <p>
                                                    Records are retrieved by name and I.D. number.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="safeguards">
                                            <xhtmlContent>
                                                <p>
                                                    1. Authorized users: A database security package is implemented on CDC's mainframe computer to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                </p>
                                                <p>
                                                    2. Physical safeguards: Access to the CDC Clifton Road facility where the mainframe computer is located is controlled by a card key system. Access to the computer room is controlled by a card key and security code (numeric keypad) system. Access to the data entry area is also controlled by a card key system. The hard copy records are kept in locked cabinets in locked rooms. The local fire department is located directly across the street from the Clifton Road buildings. The computer room is protected by an automatic sprinkler system, automatic sensors (e.g., water, heat, smoke, etc.) are installed, and portable fire extinguishers are located throughout the computer room. The system is backed up on a nightly basis with copies of the files stored off site in a secure fire proof safe. The 24-hour guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in effect at the Federal Records Center.
                                                </p>
                                                <p>
                                                    3. Procedural safeguards: System security includes automatic suspension of accounts, forced password changes, and control of systems and data set access. Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, frequently changed passwords, and Vault Management System. When Privacy Act tapes are erased, a special "certified" process is performed in which tapes are completely written over to avoid inadvertent data disclosure. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                </p>
                                                <p>
                                                    CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                </p>
                                                <p>
                                                    4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31). FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="retentionAndDisposal">
                                            <xhtmlContent>
                                                <p>
                                                    Records are maintained in agency for five years. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="systemManager">
                                            <xhtmlContent>
                                                <p>
                                                    Director, Division of Tuberculosis Elimination, National Center for Prevention Services, Corporate Square, Bldg. 10, Rm. 2208, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333 and Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="notificationProcedure">
                                            <xhtmlContent>
                                                <p>
                                                    An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                </p>
                                                <p>
                                                    An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                </p>
                                                <p>
                                                    A parent or guardian who requests notification of, or access to, a child's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                </p>
                                                <p>
                                                    The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="recordAccessProcedures">
                                            <xhtmlContent>
                                                <p>
                                                    Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="contestingRecordProcedures">
                                            <xhtmlContent>
                                                <p>
                                                    Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="recordSourceCategories">
                                            <xhtmlContent>
                                                <p>
                                                    Individuals and hospitals.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="systemsExempted">
                                            <xhtmlContent>
                                                <p>
                                                    None.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                    </section>
                                    <section id="09-20-0096" toc="yes">
                                                                                    <systemNumber> 09-20-0096</systemNumber>
                                            <subsection type="systemName"> Records of Tuskegee Study Health Benefit Recipients, HHS/CDC/NCPS.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        National Center for Prevention Services, Corporate Square, Bldg. 11, Rms. 2117, 2118, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333 and Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Adult participants in the study, their spouses, and their direct offspring.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Records relating to medical treatment of Tuskegee Study Health Benefit Program beneficiaries.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Public Health Service Act, Section 301, "Research and Investigation" (42 U.S.C. 241).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        To determine eligibility and provide medical benefits for participants and qualified family members.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        A record may be disclosed for a research purpose, when the Department:
                                                    </p>
                                                    <p>
                                                        (A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;
                                                    </p>
                                                    <p>
                                                        (B) Has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring;
                                                    </p>
                                                    <p>
                                                        (C) Has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the records, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law;
                                                    </p>
                                                    <p>
                                                        (D) Has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to health departments and other public health or cooperating medical authorities in connection with program activities and related collaborative efforts to deal more effectively with diseases and conditions of public health significance.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        File folders.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are retrieved alphabetically by name.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        l. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Locked cabinets in locked rooms, electronic anti-intrusion devices in operation at the Federal Records Center, 24- hour guard service in buildings, personnel screening of visitors.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with the system manager prior to making disclosures of data.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in agency for five years. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records are to be maintained permanently.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, National Center for Prevention Services, Corporate Square, Bldg. 11, Rm. 2106, MS E07,  Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                    </p>
                                                    <p>
                                                        A parent or guardian who requests notification of, or access to, a child's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Participants and family members of participants entitled to medical care; Social Security Administration for Medicare information; and State welfare departments for information on Medicaid.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0102" toc="yes">
                                            <systemNumber>09-20-0102</systemNumber>
                                            <subsection type="systemName"> Alien Mental Waiver Program, HHS/CDC/NCPS.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        Medical Screening Section, Division of Quarantine, National Center for Prevention Services, Corporate Square, Bldg. 10, Rm. 1105, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333 andFederal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Immigrant aliens with waivers of excludability who have or have had a physical or mental disorder with associated behavior that may pose, or has posed, a threat to the property, safety, or welfare of the alien or others.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Medical history files.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Public Health Service Act, Section 325, "Examination of Aliens" (42 U.S.C. 252); Immigration and Nationality Act, Section 212(g), "Application for Waiver of Grounds of Excludability" (8 U.S.C. ll82(g)).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        To comply with the requirements of section 212(g) of the Immigration and Nationality Act, the Centers for Disease Control (CDC) must receive and maintain medical records on aliens who apply for waivers of excludability due to a physical or mental disorder with associated harmful behavior. CDC is furnished with a copy of the alien's medical examination report and psychiatric/psychological evaluation and uses the information to process the initial applications for such waivers and for periodic medical surveillance and evaluation of individual cases.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Department of State (DOS) or Immigration and Naturalization Service (INS) obtains initial medical examinations and submits to the Division of Quarantine, CDC. Final diagnosis returned to submitter. Alien or sponsor furnishes copy of medical file to local health care facility in the United States.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed for a research purpose, when CDC is authorized to share information on aliens with the Social Security Administration to determine eligibility for benefits, pursuant to Section 1631(e) of the Social Security Act as amended by Public Law 103 -296, or as otherwise provided for in the Social Security Act.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        Individual file folders.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are retrieved by name.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: Access is granted to only a limited number of personnel, i.e., program manager and immediate staff members, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Locked cabinets in locked rooms, 24-hour guard service in buildings, personnel screening of visitors, electronic anti-intrusion devices in operation at the Federal Records Center.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with the system manager prior to making disclosures of data.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in agency for five years. Disposal methods include burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process when 10 years old, unless needed for further study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, Division of Quarantine, National Center for Prevention Services, Corporate Square, Bldg. 10, Room 1207, MS E03,  Centers for Disease Control and Prevention,  1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                    </p>
                                                    <p>
                                                        A parent or guardian who requests notification of, or access to, a child's or mentally incompetent person's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child or mentally incompetent person by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Prior to alien's arrival in the U.S., medical information supporting the diagnosis of a physical or mental mental disorder with associated harmful behavior is submitted by Department of State and/or Justice Department (INS); after arrival, mental status evaluations submitted by medical specialists, schools, or institutions.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0103" toc="yes">
                                            <systemNumber>09-20-0103</systemNumber>
                                            <subsection type="systemName"> Alien Tuberculosis Followup Program, HHS/CDC/NCPS.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        Office of the Director, Division of Quarantine, Center for Prevention Services, 1644 Freeway Office Park, Room 1327, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Immigrant aliens with tuberculosis.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Medical history.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Public Health Service Act, Section 325, "Examination of Aliens" (42 U.S.C 252); Immigration and Nationality Act, Section 212(g), "Application for Waiver of Grounds of Excludability" (8 U.S.C. 1182(g)).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        To provide a record system for the surveillance and periodic medical evaluation of immigrant aliens with tuberculosis.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Disclosure may be made to State health departments; city health departments or the courts, private physicians or other health care facilities that will provide medical care for the immigrant alien.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.
                                                    </p>
                                                    <p>
                                                        CDC is authorized to share information on aliens with the Social Security Administration to determine eligibility for benefits, pursuant to Section 1631 (e) of the Social Security Act as amended by Public Law 103-296, or as otherwise provided for in the Social Security Act.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        Card files, computer tapes/disks and printouts.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are retrieved by name, Alien Registration Number, and by year of birth.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: A database security package is implemented on CDC's mainframe computer to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Access to the CDC Clifton Road facility where the mainframe computer is located is controlled by a card key system. Access to the computer room is controlled by a card key and security code (numeric keypad) system. Access to the data entry area is also controlled by a card key system. The hard copy records are kept in locked cabinets in locked rooms. The local fire department is located directly across the street from the Clifton Road buildings. The computer room is protected by an automatic sprinkler system, automatic sensors (e.g., water, heat, smoke, etc.) are installed, and portable fire extinguishers are located throughout the computer room. The system is backed up on a nightly basis with copies of the files stored off site in a secure fire proof safe. The 24-hour guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in effect at the Federal Records Center.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: System security includes automatic suspension of accounts, forced password changes, and control of systems and data set access. Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, frequently changed passwords, and Vault Management System. When Privacy Act tapes are erased, a special "certified" process is performed in which tapes are completely written over to avoid inadvertent data disclosure. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                    </p>
                                                    <p>
                                                        CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31). FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Card files are maintained in agency for two years. Destroyed by paper recycling process after 2 years. Computer file maintained 4 years at CDC. Records destroyed by erasing tape after 4 years.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, Division of Quarantine, National Center for Prevention Services, 1644 Freeway Office Park, Rm.1328, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                    </p>
                                                    <p>
                                                        A parent or guardian who requests notification of, or access to, a child's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Information obtained from alien's visa medical documents at port of entry by Quarantine Inspectors.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0106" toc="yes">
                                            <systemNumber>09-20-0106</systemNumber>
                                            <subsection type="systemName"> Specimen Handling for Testing and Related Data, HHS/CDC/NCID.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        Material, Data and Specimen Handling Section, Scientific Resources Program, National Center for Infectious Diseases, Bldg. 4, Rm. B35, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        San Juan Laboratories, Center for Infectious Diseases, Centers for Disease Control, San Juan, Puerto Rico 00936.
                                                    </p>
                                                    <p>
                                                        Division of Vector-Borne Infectious Diseases, National Center for Infectious Diseases, Centers for Disease Control and Prevention, Foot Hills Campus, Fort Collins, CO 80522 and Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                    </p>
                                                    <p>
                                                        A list of contractor sites where individually identifiable data are currently located is available upon request to the appropriate system manager.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Adults and children whose specimens have been submitted to the Centers for Disease Control (CDC) for testing.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Results of diagnostic tests involving microbiology, clinical chemistry, hematology, immunology, genetics and pathology.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Public Health Service Act, section 301, "Research and Investigation," (42 U.S.C. 241); sections 304, 306 and 308(d) which discuss authority to grant assurances of confidentiality for health research and related activities (42 U.S.C. 242 b, k, and m(d)).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        For documentation of test results which are returned to submitter. Used between specialty units for research purposes; and for epidemiological investigations, for epidemic causes, prevention, family groupings of diseases, and geographical location of specific diseases; also, used by epidemiologists and researchers in determining drug resistance of specific organisms.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        The following routine uses apply to all records in this system except those maintained under an assurance of confidentiality provided by Section 308(d) of the Public Health Service Act (unless expressly authorized in the consent form or stipulated in the Assurance Statement):
                                                    </p>
                                                    <p>
                                                        CDC is under contract with private firms for the purposes of collating, analyzing, aggregating, or otherwise refining records in this system. Relevant records are disclosed to such contractors. The contractors are required to maintain Privacy Act safeguards with respect to such records.
                                                    </p>
                                                    <p>
                                                        A record may be disclosed for a research purpose, when the Department: (A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (B) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (C) has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law; (D) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
                                                    </p>
                                                    <p>
                                                        To individuals and organizations deemed qualified by the Secretary to carry out quality assessment, medical audits, or utilization review.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to health departments and other public health or cooperating medical authorities in connection with program activities and related collaborative efforts to deal more effectively with diseases and conditions of public health significance.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        Original Form - file folders; microfilm copies, computer tapes/disks and printouts.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Retrieved by name or designated number furnished by the submitter, CDC identifying number, and/or microfilm number.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: A database security package is implemented on CDC's mainframe computer to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Access to the CDC Clifton Road facility where the mainframe computer is located is controlled by a card key system. Access to the computer room is controlled by a card key and security code (numeric keypad) system. Access to the data entry area is also controlled by a card key system. The hard copy records are kept in locked cabinets in locked rooms. The local fire department is located directly across the street from the Clifton Road buildings. The computer room is protected by an automatic sprinkler system, automatic sensors (e.g., water, heat, smoke, etc.) are installed, and portable fire extinguishers are located throughout the computer room. The system is backed up on a nightly basis with copies of the files stored off site in a secure fire proof safe. The 24-hour guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in effect at the Federal Records Center.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: System security includes automatic suspension of accounts, forced password changes, and control of systems and data set access. Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, frequently changed passwords, and Vault Management System. When Privacy Act tapes are erased, a special "certified" process is performed in which tapes are completely written over to avoid inadvertent data disclosure. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                    </p>
                                                    <p>
                                                        CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31). FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in agency for five years. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process when 10 years old, unless needed for further study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, National Center for Infectious Diseases, Bldg. 1, Rm. 6013, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Director, Epidemiology Program Office, Bldg. 1, Rm. 5009, MS C08, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Director, National Center for Prevention Services, Corporate Square, Bldg. 11, Rm. 2106, MS E07, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333-3724.
                                                    </p>
                                                    <p>
                                                        Director, National Center for Environmental Health, Chamblee Bldg. 101, Rm. 3116, MS F29, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        Director, National Center for Injury Prevention and Control, Koger Davidson Bldg., Rm. 1078, MS F36, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        Director, National Immunization Program, Corporate Square, bldg. 12, Rm. 5113, MS E05, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Policy coordination is provided by: Associate Director for Management and Operations, Bldg. 1, Rm. 2011, MS D15, Centers for Disease Control and Prevention, 1600 Clifton Road NE, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the appropriate system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                    </p>
                                                    <p>
                                                        A parent or guardian who requests notification of, or access to, a child's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Approved public health laboratories, Federal medical facilities, private physicians.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0112" toc="yes">
                                            <systemNumber>09-20-0112</systemNumber>
                                            <subsection type="systemName"> Fellowship Program and Guest Researcher Records, HHS/CDC/PMO.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        Recruitment Branch, Human Resources Management Office, Bldg. 1, Rm. B237, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        National Personnel Records Center (Civilian Personnel Records), 111 Winnebago Street, St. Louis, MO 63118.
                                                    </p>
                                                    <p>
                                                        National Personnel Records Center (Civilian Personnel Records), 111 Winnebago Street, St. Louis, MO 63118.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Visiting Fellows, Visiting Associates, Visiting Scientists, Staff Fellows, and Guest Researchers within CDC and ATSDR.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Applications, requests for appointment, curriculum vitae, letters of reference.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Public Health Service Act, Section 207(g),(h), "Appointment of Personnel," Section 208, "Pay and Allowances," and Section 301, "Research and Investigation" (42 U.S.C. 209(g),(h), 210 and 241).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        This system is utilized by the Centers for Disease Control (CDC) officials for the purpose of review of applications and supporting documents in order to award fellowships; and for determinations regarding salary or stipend increases.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        File folders, computer tapes/disks and printouts.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        The system is accessed by name of the individual, fellow, or guest researcher.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Records are kept in locked cabinets in locked rooms. Guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in operation at the Federal Records Center.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with system manager prior to making disclosures of data.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: HHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Mangement Regulations, subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in agency for two years. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the National Personnel Records Center where records are retained in accordance with retention schedules.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Chief, Recruitment Branch, Human Resources Management Office, Bldg. 1, Rm. 1043. Centers for Disease Control and Prevention, l600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Secured from applicant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0113" toc="yes">
                                            <systemNumber>09-20-0113</systemNumber>
                                            <subsection type="systemName"> Epidemic Investigation Case Records, HHS/CDC/NCID.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        National Center for Infectious Diseases, Bldg. 1, Rm. 6013, Centers for Disease Control, l600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Epidemiology Program Office, Bldg. 1, Rm. 5009, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        National Center for Prevention Services, 1600 Freeway Park, Rm. 313, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        National Center for Environmental Health, Chamblee Bldg. 101, Centers for Disease Control, 4770 Buford Highway NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        National Center for Injury Prevention and Control, Koger Davidson Building, Rm. 2037, Centers for Disease Control, 4770 Buford Highway NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Adults and children with disease and other health conditions of public health significance, their contacts, others with possible exposure and appropriate controls.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Medical histories, case reports.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Public Health Service Act, Section 301, "Research and Investigation," (42 U.S.C. 241); sections 304, 306, and 308(d), which discuss authority to grant assurances of confidentiality for health research and related activities (42 U.S.C. 242 b, k, and m(d)); and section 361, "Quarantine and Inspection, Control of Communicable Diseases,` (42 U.S.C. 264).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        The record system is used by professional staff at the Centers for Disease Control (CDC) for more complete knowledge of the disease/condition in the following ways: (1) An examination of existing files enables investigators to determine areas that have been adequately investigated and to specify those that might be pursued; or (2) Records may later be examined in the light of future discoveries and proven associations so that relevant data collected at the time of the outbreak may be analyzed and reassessed. CDC may or may not request duplicate copies of these State and/or local health department records for further analysis following completion of the field investigation.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        The following routine uses apply to all records in this system except those maintained under an assurance of confidentiality provided by Section 308(d) of the Public Health Service Act (unless expressly authorized in the consent form or stipulated in the Assurance Statement):
                                                    </p>
                                                    <p>
                                                        These records may be disclosed, i.e., returned to the State and/or local health departments in order for them to take measures to control, prevent, or treat disease and to conduct follow-up activities with patients and others contacted during the investigations. Private physicians may also be supplied pertinent medical information on their patients from these records.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        File folders, cards, computer tapes/disks and printouts.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Retrieved alphabetically by name.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: A database security package is implemented on CDC's mainframe computer to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Access to the CDC Clifton Road facility where the mainframe computer is located is controlled by a card key system. Access to the computer room is controlled by a card key and security code (numeric keypad) system. Access to the data entry area is also controlled by a card key system. The hard copy records are kept in locked cabinets in locked rooms. The local fire department is located directly across the street from the Clifton Road buildings. The computer room is protected by an automatic sprinkler system, automatic sensors (e.g., water, heat, smoke, etc.) are installed, and portable fire extinguishers are located throughout the computer room. The system is backed up on a nightly basis with copies of the files stored off site in a secure fire proof safe. The 24-hour guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in effect at the Federal Records Center.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: System security includes automatic suspension of accounts, forced password changes, and control of systems and data set access. Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, frequently changed passwords, and Vault Management System. When Privacy Act tapes are erased, a special "certified" process is performed in which tapes are completely written over to avoid inadvertent data disclosure. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                    </p>
                                                    <p>
                                                        CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31). FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in agency for four years. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, National Center for Infectious Diseases, Bldg. 1, Rm. 6013, MS C12, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333
                                                    </p>
                                                    <p>
                                                        Director, Epidemiology Program Office, Bldg. 1, Rm. 5009, MS C08, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333
                                                    </p>
                                                    <p>
                                                        Director, National Center for Environmental Health, Chamblee Bldg. 101, Rm. 2115, MS F29, Centers for Disease Control, 4770 Buford Highway NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        Director, National Center for Injury Prevention and Control, Koger Davidson Bldg., Rm. 2037, MS F36, Centers for Disease Control, 4770 Buford Highway NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        Policy coordination is provided by: Director, Office of Program Support, Bldg. 1, Rm. 2011, MS D15, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the appropriate system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                    </p>
                                                    <p>
                                                        A parent or guardian who requests notification of, or access to, a child's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Individuals, State and local health departments, and private physicians.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0117" toc="yes">
                                            <systemNumber>09-20-0117</systemNumber>
                                            <subsection type="systemName"> Medical and Test Record Results of Individuals Involved in NIOSH Laboratory Studies, HHS/CDC/NIOSH.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        Division of Biomedical and Behavioral Science (DBBS), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226
                                                    </p>
                                                    <p>
                                                        Division of Standards Development and Technology Transfer (DSDTT), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226 and
                                                    </p>
                                                    <p>
                                                        Federal Records Center, 3150 Bertwynn Drive, Dayton, Ohio 45439.
                                                    </p>
                                                    <p>
                                                        A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.
                                                    </p>
                                                    <p>
                                                        Also, occasionally data may be located at the facilities of collaborating researchers where analyses are performed, data collected and reports written. A list of these facilities is available upon request to the system manager.
                                                    </p>
                                                    <p>
                                                        Data may be located only at those facilities that have an adequate data security program and the collaborating researcher must return the data to NIOSH or destroy individual identifiers at the conclusion of the project.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Volunteer subjects from the general population.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Occupational history, medical history, results of medical tests including biopsy specimens, demographic data, results of psychological and psychometric tests, and data necessary to interpret the medical results.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Occupational Safety and Health Act, Section 20, "Research and Related Activities" (29 U.S.C. 669).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        This system is to develop composite data summaries to support the development of criteria for occupational safety and health standards, and to provide other recommendations for improving worker safety and health.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records subject to the Privacy Act are disclosed to private firms for data entry, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                                    </p>
                                                    <p>
                                                        In the event of litigation initiated at the request of NIOSH, the Institute may disclose such records as it deems desirable or necessary to the Department of Justice and to the Department of Labor, Office of the Solicitor, where appropriate, to enable the Departments to effectively represent the Institute, provided such disclosure is compatible with the purpose for which the records were collected. The only types of litigative proceedings that NIOSH is authorized to request are: (1) enforcement of a subpoena issued to an employer to provide relevant information; or (2) contempt citation against an employer for failure to comply with a warrant obtained by the Institute.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to NIOSH collaborating researchers (NIOSH contractors, grantees, cooperative agreement holders, or other Federal or State scientists) in order to accomplish the research purpose for which the records are collected. The collaborating researchers must agree in writing to comply with the confidentiality provisions of the Privacy Act and NIOSH must have determined that the researchers' data security procedures will protect confidentiality.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        Manual files, computer cards, computer tapes/disks, computer listings, microfilm.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Name and case number are the indexes used to retrieve records from this system.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Records are kept in locked cabinets in locked rooms. Guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in operation at the Federal Records Center.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with system manager prior to making disclosures of data.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: HHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Mangement Regulations, subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in agency for three years. Personal identifiers are destroyed as soon as they are no longer necessary for the protection of the individuals involved. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, Division of Biomedical and Behavioral Science (DBBS), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226 and
                                                    </p>
                                                    <p>
                                                        Medical Officer, Division of Standards Development and Technology Transfer (DSDTT), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226.
                                                    </p>
                                                    <p>
                                                        Policy coordination is provided by: Director, Office of Program Support, Bldg. 1, Rm. 2011, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the appropriate system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Information is obtained directly from the individual.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0118" toc="yes">
                                            <systemNumber>09-20-0118</systemNumber>
                                            <subsection type="systemName"> Study at Work Sites where Agents Suspected of Being Occupational Hazards Exist, HHS/CDC/NIOSH.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        Division of Biomedical and Behavioral Science, (DBBS), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226 and
                                                    </p>
                                                    <p>
                                                        Federal Records Center, 3150 Bertwynn Drive, Dayton, Ohio 45439.
                                                    </p>
                                                    <p>
                                                        A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.
                                                    </p>
                                                    <p>
                                                        Also, occasionally data may be located at the facilities of collaborating researchers where analyses are performed, data collected and reports written. A list of these facilities is available upon request to the system manager. Data may be located only at those facilities that have an adequate data security program and the collaborating researcher must return the data to NIOSH or destroy individual identifiers at the conclusion of the project.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Subjects employed at specific sites under study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Occupational history, medical history, results of medical tests including results of hearing tests, demographic data, employee records, psychological and psychometric tests, and data necessary to interpret the medical results.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Occupational Safety and Health Act, Section 20, "Research and Related Activities" (29 U.S.C. 669).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        This system is to determine the relationship between worker exposure to hazardous agents or stressors and occupational disease. This information is used to recommend procedures to reduce the incidence of occupational disease.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        In the event of litigation initiated at the request of NIOSH, the Institute may disclose such records as it deems desirable or necessary to the Department of Justice and to the Department of Labor, Office of the Solicitor, where appropriate, to enable the Departments to effectively represent the Institute, provided such disclosure is compatible with the purpose for which the records were collected. The only types of litigative proceedings that NIOSH is authorized to request are: (1) Enforcement of a subpoena issued to an employer to provide relevant information; or (2) contempt citation against an employer for failure to comply with a warrant obtained by the Institute.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to NIOSH collaborating researchers (NIOSH contractors, grantees, cooperative agreement holders, or other Federal or State scientists) in order to accomplish the research purpose for which the records are collected. The collaborating researchers must agree in writing to comply with the confidentiality provisions of the Privacy Act and NIOSH must have determined that the researchers' data security procedures will protect confidentiality.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records subject to the Privacy Act are disclosed to private firms for data entry, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        Manual files, computer cards, computer tapes/disks, computer listings, microfilm.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Name and case number are the indexes used to retrieve records from this system.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Records are kept in locked cabinets in locked rooms. Guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in operation at the Federal Records Center.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with system manager prior to making disclosures of data.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: HHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Mangement Regulations, subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in agency for three years. Personal identifiers are destroyed as soon as the system has stabilized, and statistical summaries can be run. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, Division of Biomedical and Behavioral Science (DBBS), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Information is obtained directly from the individual and from employee records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0136" toc="yes">
                                            <systemNumber>09-20-0136</systemNumber>
                                            <subsection type="systemName"> Epidemiologic Studies and Surveillance of Disease Problems, HHS/CDC/NCID.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        National Center for Infectious Diseases, Bldg. 1, Rm. 6013, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        National Center for Prevention Services, Corporate Square, Bldg. 11, Rm. 2106, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        National Center for Environmental Health, Chamblee Bldg. 101, Rm. 3116, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        National Center for Injury Prevention and Control, Koger Davidson Bldg., Rm. 1078, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        Epidemiology Program Office, Bldg. 1, Rm. 5009, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Public Health Practice Program Office, Executive Park, Bldg. 24, Rm. 110, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        National Center for Chronic Disease Prevention and Health Promotion, Rhodes Bldg., Rm. 4000, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        National Immunization Program, Corporate Square, Bldg. 12, Rm. 5113, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                    </p>
                                                    <p>
                                                        A list of contractor sites where individually identifiable data are currently located is available upon request to the appropriate system manager.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Adults and children with diseases and other preventable conditions of public health significance; also included are control group participants. Workers employed by the Department of Energy and its predecessor agencies and their contractors are also included.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Case reports, medical records, questionnaires, and related documents.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Public Health Service Act, section 301, "Research and Investigation," (42 U.S.C. 241); sections 304, 306 and 308(d) which discuss authority to grant assurances of confidentiality for health research and related activities (42 U.S.C. 242 b, k, and m(d)).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        This record system enables Centers for Disease Control (CDC) officials to better understand disease patterns in the United States, develop programs for prevention and control of health problems, and communicate new knowledge to the health community.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        CDC is under contract with private firms for the purpose of collating, analyzing, aggregating or otherwise refining records in this system.  Relevant records are maintained by such contractors.  Contractors are required to maintain Privacy Act safeguards with respect to such records.
                                                    </p>
                                                    <p>
                                                        The following routine uses apply to all records in this system except those maintained under an assurance of confidentiality provided by section 308(d) of the Public Health Service Act (unless expressly authorized in the consent form or stipulated in the Assurance Statement):
                                                    </p>
                                                    <p>
                                                        A record may be disclosed for a research purpose, when the Department:
                                                    </p>
                                                    <p>
                                                        (A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;
                                                    </p>
                                                    <p>
                                                        (B) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring;
                                                    </p>
                                                    <p>
                                                        (C) has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law;
                                                    </p>
                                                    <p>
                                                        (D) Has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to organizations deemed qualified by the Secretary to carry out quality assessment, medical audits or utilization review.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to health departments and other public health or cooperating medical authorities in connection with program activities and related collaborative efforts to deal more effectively with diseases and conditions of public health significance.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
                                                    </p>
                                                    <p>Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.</p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        Computer tapes/disks and printouts and file folders.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        By name of individual and by identification number.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1.Authorized users: A database security package is implemented on CDC's mainframe computer to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Access to the CDC Clifton Road facility where the mainframe computer is located is controlled by a card key system, with access to the computer room  controlled by a card key and security code (numeric keypad) system. Access to the data entry area is also controlled by a card key system and the hard copy records are kept in locked cabinets in locked rooms. The local fire department is located directly across the street from the Clifton Road facility. The computer room is protected by a dry pipe fire protection system, numerous automatic sensors (e.g., water, heat, smoke, etc.) are installed, and a proper mix of portable fire extinguishers are located throughout the computer room. The system is backed up on a nightly basis with copies of the files stored off site in a secure fire proof safe.  Guard service in buildings provides personal screening of visitors. Electronic anti-intrusion devices are in effect at the Federal Records Center.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: System security includes automatic suspension of accounts, forced password changes, and control of systems and data set access. Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, frequently changed passwords, and Vault Management System. When Privacy Act tapes are scratched, a special "certified" process is performed in which tapes are completely written over to avoid inadvertent data disclosure. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                    </p>
                                                    <p>
                                                        CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31). FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Record copy of study reports maintained in agency from two to three years in accordance with retention schedules. Source documents for computer disposed of when no longer needed by program officials. Personal identifiers may be deleted from records when no longer needed in the study as determined by the system manager, and as provided in the signed consent form, as appropriate. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records are destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, National Center for Infectious Diseases, Bldg. 1, Rm. 6013, MS C12, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Director, National Center for Prevention Services, Corporate Square, Bldg. 11, Rm. 2106, MS E07, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Director, National Center for Environmental Health, Chamblee Bldg. 101, Rm. 3116, MS F29, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        Director, National Center for Injury Prevention and Control, Koger Davidson Bldg., Rm. 1078, MS F36, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        Director, Epidemiology Program Office, Bldg. 1, Rm. 5009, MS C08, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Director, Public Health Practice Program Office, Executive Park, Bldg. 24, Rm. 110, MS E20, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Director, National Center for Chronic Disease Prevention and Health Promotion, Rhodes Bldg., Rm. 4000, MS K40, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                    </p>
                                                    <p>
                                                        Director, National Immunization Program, Corporate Square, Bldg. 12, Rm. 5113, MS E05, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                    <p>
                                                        Policy coordination is provided by: Associate Director for Management and Operations, Bldg. 1, Rm. 2011, MS D15, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself or may obtain information concerning participation in epidemiological studies or surveillance activities by contacting the appropriate system manager at the address listed above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion. A parent or guardian who requests notification of, or access to, a child's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the first official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Individuals, private physicians, State and local health departments, and other health care providers.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0137" toc="yes">
                                            <systemNumber>09-20-0137</systemNumber>
                                            <subsection type="systemName"> Passport File, HHS/CDC/IHPO.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        International Health Program Office, Bldg. 11 South, Centers for Disease Control, l600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        The Centers for Disease Control (CDC) employees.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Passport status records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Title 5, Government Organization and Employees (5 U.S.C. 301).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        To show status of passports of CDC employees who travel to foreign countries on official business.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        File folders.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Retrieved by name.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: Access is granted to only a limited number of International Health Program Office personnel and designated support staff of CDC, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Locked cabinets in locked rooms, 24-hour guard service in buildings, personnel screening of visitors.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with the system manager prior to making disclosures of data.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in agency for five years. When passports expire or when they are cancelled, they are returned to the subject individual. If the individual does not wish to receive the cancelled or expired passport, the document is destroyed by shredding.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, International Health Program Office, Bldg. 11South, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        CDC employees.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0138" toc="yes">
                                            <systemNumber>09-20-0138</systemNumber>
                                            <subsection type="systemName"> Epidemic Intelligence Service Officers Files. HHS/CDC/EPO.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        Epidemiology Program Office, Bldg. 1, Rm. 5127, Centers for Disease Control, l600 Clifton Road, Atlanta, GA 30333
                                                    </p>
                                                    <p>
                                                        Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        EIS Officers - Current, alumni and applicants.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Applications, interview materials, letters of recommendations, call-to-duty papers.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Public Health Service Act, Section 203, "Commissioned Corps" and Section 207, "Appointment of Personnel` (42 U.S.C. 204, 209).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        The system is designed to process individual applications for the Epidemic Intelligence Service Officer program, and to assess a candidate's suitability for a position in the program.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        File folders.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Retrieved by name.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Locked cabinets in locked rooms, 24-hour guard service in buildings, personnel screening of visitors, electronic anti-intrusion devices in operation at the Federal Records Center (FRC).
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with the system manager prior to making disclosures of data.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in agency for eight years. Disposal methods include burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation. Destroyed by paper recycling process after 16 years unless needed for further analysis.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, Epidemiology Program Office, Bldg. 1, Rm. 5009, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Educational institutions, previous employers and subject individuals.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>None.</p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0147" toc="yes">
                                            <systemNumber>09-20-0147</systemNumber>
                                            <subsection type="systemName">Occupational Health Epidemiological Studies and EEOICPA Program Records and WTC Health Program Records, HHS/CDC/NIOSH.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        WTC Health Program, NIOSH, Century Center Boulevard, Building 2400, Mail Stop E-74, Atlanta, GA 30329.
                                                    </p>
                                                    <p>
                                                        Division of Surveillance, Hazard Evaluation, and Field Studies (DSHEFS), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, OH 45226.
                                                    </p>
                                                    <p>
                                                        Division of Respiratory Disease Studies (DRDS), National Institute for Occupational Safety and Health (NIOSH), 1095 Willowdale Road, Morgantown, WV 20505-2888.
                                                    </p>
                                                    <p>
                                                        Pittsburgh Research Laboratory, NIOSH, 626 Cochrans Mill Road, Pittsburgh, PA 15156.
                                                    </p>
                                                    <p>
                                                        Spokane Research Laboratory, NIOSH, 315 E. Montgomery Avenue, Spokane, WA 99207.
                                                    </p>
                                                    <p>
                                                        Office of Compensation Analysis and Support (OCAS), NIOSH, Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226, and Federal Records Center, 3150 Bertwynn Drive, Dayton, OH 45439.
                                                    </p>
                                                    <p>
                                                        Data are also occasionally located at contractor sites as studies are developed, data collected, and reports written. A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.
                                                    </p>
                                                    <p>
                                                        Also, occasionally data may be located at the facilities of collaborating researchers where analyses are performed, data collected and reports written. A list of these facilities is available upon request to the system manager. Data may be located only at those facilities that have an adequate data security program and the collaborating researcher must return the data to NIOSH or destroy individual identifiers at the conclusion of the project.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        That segment of the population exposed to physical and/or chemical agents or other workplace hazards that may damage the human body in any way. Some examples are: (1) Organic carcinogens; (2) inorganic carcinogens; (3) mucosal or dermal irritants; (4) fibrogenic materials; (5) acute toxic agents including sensitizing agents; (6) neurotoxic agents; (7) mutagenic (male and female) and teratogenic agents; (8) bio- accumulating non-carcinogen agents; (9) chronic vascular disease-causing agents; and (10) ionizing radiation. Also included are those individuals in the general population who have been selected as control groups. Workers employed by the Department of Energy and its predecessor agencies and their contractors are also included, as are cancer-related claimants under the Energy Employees Occupational Illness Compensation Program Act of 2000 (EEOICPA). Individuals enrolled in or otherwise claiming eligibility and qualification for enrollment in the WTC Health Program created under Title XXXIII of the Public Health Service Act.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Physical exams, sputum cytology results, questionnaires, urine test records, X-rays, medical history, pulmonary function test records, medical disability forms, blood test records, hearing test results, smoking history, occupational histories, previous and current employment records, union membership records, driver's license data, demographic information, exposure history information and test results are examples of the records in this system. The specific types of records collected and maintained are determined by the needs of the individual study. Also included are records of cancer-related claimants under EEOICPA." Also included are applications for enrollment in the World Trade Center (WTC) Health Program and information on individuals enrolled in or otherwise claiming eligibility and qualification for enrollment; once enrolled, information on these individuals may include screening and medical records, and financial records related to payment and reimbursements for care under the WTC program. Information that is provided to HHS that is from a system of records under the control of the Terrorist Screening Center (TSC), Federal Bureau of Investigation, Department of Justice remains law enforcement information and retains the exemptions listed in Justice/FBI-019, 72 FR 47,073 (Aug. 22, 2007) and promulgated under 28 CFR 16.96 (r).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Public Health Service Act, Section 301, "Research and Investigation" (42 U.S.C. 241); Occupational Safety and Health Act, Section 20, "Research and Related Activities" (29 U.S.C. 669); the Federal Mine Safety and Health Act of 1977, Section 501, "Research" (30 U.S.C. 951) and the Energy Employees Occupational Illness Compensation Program Act of 2000 (EEOICPA) (42 U.S.C.S 7384, <i>et seq.</i>); and the Public Health Service Act, Title XXXIII, "World Trade Center Health Program" (42 U.S.C. 300mm -300mm-61).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        Studies carried out under this system are to evaluate mortality and morbidity of occupationally related diseases and injuries, to determine their causes, and to lead toward prevention of occupationally related diseases and injuries in the future. EEOICPA records are maintained to enable NIOSH to fulfill its dose reconstruction responsibilities under the Act. WTC Health Program records in this system are maintained and used to enable NIOSH to fulfill WTC Program Administrator responsibilities make determinations about eligibility and qualification, provide for medical care, pay for that care, and coordinate with other health benefit programs under Title XXXIII of the Public Health Service Act, 42 U.S.C. 300mm-300mm-61.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>Records may be disclosed to the Department of Justice when (1) HHS, or any component thereof; or (2) any employee of HHS in his or her official capacity; or (3) any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or (4) the United States, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice is deemed by HHS to be relevant and necessary to the litigation; provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
                                                    <p>
                                                        Records may be disclosed to a contractor performing or working on a contract for HHS and who has a need to have access to the information in the performance of its duties or activities for the HHS in accordance with law and with the contract. The contractor is required to comply with the applicable provisions of the Privacy Act.
                                                    </p>
                                                    <p>
                                                        Records subject to the Privacy Act are disclosed to private firms for data entry, scientific support services, nosology coding, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                                    </p>
                                                    <p>
                                                        Certain diseases or exposures may be reported to State and/or local health departments where the State has a legally constituted reporting program for communicable diseases and which provides for the confidentiality of the information.
                                                    </p>
                                                    <p>
                                                        Disclosure of records or portions of records may be made to a Member of Congress or a Congressional staff member submitting a verified request involving an individual who is entitled to the information and has requested assistance from the Member or staff member. The Member of Congress or Congressional staff member must provide a copy of the individual's written request for assistance.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to NIOSH collaborating researchers (<i>e.g.,</i> NIOSH contractors, grantees, cooperative agreement holders, or other Federal or State scientists) in order to accomplish the research purpose for which the records are collected. The collaborating researchers must agree in writing to comply with the confidentiality provisions of the Privacy Act and NIOSH must have determined that the researchers' data security procedures will protect confidentiality
                                                    </p>
                                                    <p>
                                                        THE FOLLOWING ROUTINE USES APPLY ONLY TO EPIDEMIOLOGICAL STUDIES:
                                                    </p>
                                                    <p>
                                                        In the event of litigation initiated at the request of NIOSH, the Institute may disclose such records as it deems desirable or necessary to the Department of Justice and to the Department of Labor, Office of the Solicitor, where appropriate, to enable the Departments to effectively represent the Institute, provided such disclosure is compatible with the purpose for which the records were collected. The only types of litigation proceedings that NIOSH is authorized to request are: (1) Enforcement of a subpoena issued to an employer to provide relevant information; and (2) administrative search warrants to obtain access to places of employment and relevant information therein and related contempt citations against an employer for failure to comply with a warrant obtained by the Institute; and (3) injunctive relief against employers or mine operators to obtain access to relevant information.
                                                    </p>
                                                    <p>
                                                        Portions of records (name, Social Security number if known, date of birth, and last known address) may be disclosed to one or more of the sources selected from those listed in Appendix I, as applicable. This may be done for obtaining a determination regarding an individual's health status and last known address. If the sources determine that the individual is dead, NIOSH may obtain death certificates, which state the cause of death, from the appropriate Federal, State or local agency. If the individual is alive, NIOSH may obtain information on health status from disease registries or on last known address in order to contact the individual for a health study or to inform him or her of health findings. This information on health status enables NIOSH to evaluate whether excess occupationally related mortality or morbidity is occurring.
                                                    </p>
                                                    <p>
                                                        Disclosure of epidemiologic study records pertaining to uranium workers may be made to the Department of Justice to be used in determining eligibility for compensation payments to the uranium workers or their survivors.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.
                                                    </p>
                                                    <p>THE FOLLOWING ROUTINE USES APPLY ONLY TO EEOICPA PROGRAM RECORDS: </p>
                                                    <p>
                                                        Disclosure of dose reconstructions, epidemiologic study records and employment and medical information pertaining to Department of Energy employees and other cancer-related claimants covered under the Energy Employees Occupational Illness Compensation Program Act may be made to the Department of Labor to be used in determining eligibility for compensation payments to such claimants and in defending its determinations under the Act.
                                                    </p>
                                                    <p>
                                                        Disclosure of personal identifying information associated with cancer-related claims under the Energy Employees Occupational Illness Compensation Program Act may be made to the Department of Energy, other Federal agencies, other government or private entities and to private- sector employers to permit these entities to retrieve records required to reconstruct radiation doses and to enable NIOSH to evaluate petitions for inclusion in the Special Exposure Cohort.
                                                    </p>
                                                    <p>
                                                        Completed dose reconstruction reports for cancer-related claims under the Energy Employees Occupational Illness Compensation Program Act may be released to the Department of Energy and the Department of Labor to permit these entities to fulfill EEOICPA and HHS dose reconstruction regulation requirements to notify claimants of their dose reconstruction results.
                                                    </p>
                                                    <p>
                                                        Disclosure of personal identifying information associated with cancer-related claims under the Energy Employees Occupational Illness Compensation Program Act may be made to identified witnesses as designated by the Office of Compensation Analysis and Support to assist NIOSH in obtaining information required to complete the dose reconstruction process and to enable NIOSH to evaluate petitions for inclusion in the Special Exposure Cohort.
                                                    </p>
                                                    <p>
                                                        Records may also be disclosed when deemed desirable or necessary, to the Department of Justice, and/or the Department of Labor, to enable those Departments to effectively represent the Department of Health and Human Services and/or the Department of Labor in litigation involving the Energy Employees Occupational Illness Compensation Program Act of 2000 (EEOICPA).
                                                    </p>
                                                    <p>THE FOLLOWING ROUTINE USES APPLY ONLY TO WTC HEALTH PROGRAM RECORDS: </p>
                                                    <p>
                                                        Disclosure to the Department of Justice and its contractors to provide terrorist screening support in accordance with NIOSH's statutory obligation to determine whether an individual is on the "terrorist watch list" as specified in Section 3311 and Section 3321 of the Zadroga Act and is eligible and qualified to be enrolled or certified in the WTC Health Program as specified by statute. Disclosure by NIOSH, under this routine use, will be limited to only the information that is necessary to determine eligibility and qualification under the statute. The Department of Justice will only retain information provided by HHS that relates to (1) Individuals known or suspected to be or have been engaged in conduct constituting, in preparation for, in aid of, or related to terrorism ("known or suspected terrorists"); (2) individuals identified during the terrorism screening process as a possible identity match to a known or suspected terrorist; (3) individuals who are misidentified as a possible identity match to a known or suspected terrorist in order to expedite future screening of those individuals and to support the appeals process; and/or (4) individuals about whom a terrorist watchlist-related appeal inquiry has been made. Information that does not fall into one of the above listed categories will not be retained by the Department of Justice. Disclosure of personally identifying information to applicable entities for the purpose of reducing or recouping WTC Health Program payments made to individuals under a workers' compensation law or plan of the United States, a State, or locality, or other work-related injury or illness benefit plan of the employer of such worker or public or private health plan as required under Title XXXIII of the Public Health Service Act. NIOSH will maintain, use, and disclose the information in the System of Records in accordance with applicable Federal law.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        Manager files, card files, electronic computer tapes, disks, files and printouts, microfilm, microfiche, and other files as appropriate.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Name, assigned identification number, or social security number.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized Users:  A database software security package is utilized to control unauthorized access to the system. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff or contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical Safeguards:  Hard copy records are kept in locked cabinets in locked rooms. Guard service in buildings provides screening of visitors. The limited access, secured computer room contains fire extinguishers and an overhead sprinkler system. Computer workstations and automated records are located in secured areas. Electronic anti-intrusion devices are in operation at the Federal Records Center.
                                                    </p>
                                                    <p >
                                                        3. Procedural Safeguards: Data sets are password protected and/or encrypted. Protection for computerized records both on the mainframe and the NIOSH Local Area Network (LAN) includes programmed verification of valid user identification code and password prior to logging on to the system, mandatory password changes, limited log-ins, virus protection, and user rights/file attribute restrictions. Password protection imposes user name and password log-in requirements to prevent unauthorized access. Each user name is assigned limited access rights to files and directories at varying levels to control file sharing. There are routine daily backup procedures and secure off-site storage is available for backup tapes. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                    </p>
                                                    <p>
                                                        Employees and contractor staff who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either government or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                    </p>
                                                    <p >
                                                        4. Implementation Guidelines:   The safeguards outlined above are in accordance with the HHS Information Security Program Policy and FIPS Pub 200, "Minimum Security Requirements for Federal Information and Information Systems." Data maintained on CDC's Mainframe and the NIOSH LAN are in compliance with OMB Circular A-130, Appendix III. Security is provided for information collection, processing, transmission, storage, and dissemination in general support systems and major applications. The CDC LAN currently operates under a Microsoft Windows Server and is in compliance with applicable security standards.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are retained and disposed of according to the provisions of the CDC Electronic Records Control Schedule for NIOSH records. Research records are maintained in the agency for three years after the close of the study. Records transferred to the Federal Records Center when no longer needed for evaluation and analysis are destroyed after 75 years for epidemiologic studies, unless needed for further study. Records from health hazard evaluations will be retained at least 20 years. EEOICPA program records are transferred to the Federal Records Center 15 years after the case file becomes inactive and are destroyed after 75 years. WTC Health Program records are transferred to the Federal Records Center 15 years after the case file becomes inactive and are destroyed after 75 years.
                                                    </p>
                                                    <p>
                                                        Paper files that have been scanned to create electronic copies are disposed of after the copies are verified. Disposal methods include erasing computer tapes and burning or shredding paper materials.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, WTC Health Program, NIOSH, Century Center Boulevard, Building 2400, Mail Stop E-74, Atlanta, GA 30329.
                                                    </p>
                                                    <p>
                                                        Program Management Officer, Division of Surveillance, Hazard valuations, and Field Studies (DSHEFS), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, Rm. 40A, 4676 Columbia Parkway, Cincinnati, OH 45226.
                                                    </p>
                                                    <p>
                                                        Director, Division of Respiratory Disease Studies (DRDS), National Institute for Occupational Safety and Health (NIOSH), Bldg. ALOSH, Rm. H2920, 1095 Willowdale Road, Morgantown, WV 26505-2888.
                                                    </p>
                                                    <p>Director, Pittsburgh Research Laboratory, NIOSH, 626 Cochrans Mill Road, Pittsburgh, PA 15156..</p>
                                                    <p>
                                                        Director, Spokane Research Laboratory, NIOSH, 315 E. Montgomery Avenue, Spokane, WA 99207.
                                                    </p>
                                                    <p>
                                                        Director, Office of Compensation and Support (OCAS), NIOSH, Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, OH 45226
                                                    </p>
                                                    <p>
                                                        Policy coordination is provided by: Director, National Institute for Occupational Safety and Health (NIOSH), Bldg. HHH, Rm. 715H, 200 Independence Avenue, SW., Washington, DC 20201.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the above address. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either: (1) Submit a notarized request to verify their identity; or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a $5,000 fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion. A subject individual will be granted direct access to a medical record if the system manager determines direct access is not likely to have adverse effect on the subject individual.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        For research studies, vital status information is obtained from Federal, State and local governments and other available sources selected from those listed in Appendix I, but information is obtained directly from the individual and employer records, whenever possible. EEOICPA records are obtained from the individual subject and the employer's records. WTC Health Program Records are obtained from individual applicants and enrollees, from medical providers who have treated eligible individuals, and from data centers that are repositories of demographic and clinical information about WTC responders and survivors.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                    <p>
                                                        <i>Appendix I--Potential Sources for Determination of Health Status, Vital Status and/or Last Known Address: </i>
                                                    </p>
                                                    <p>
                                                        Military records
                                                    </p>
                                                    <p>
                                                        Appropriate State Motor Vehicle Registration Departments
                                                    </p>
                                                    <p>
                                                        Appropriate State Driver's License Departments
                                                    </p>
                                                    <p>
                                                        Appropriate State Government Division of: Assistance Payments (Welfare), Social Services, Medical Services, Food Stamp Program, Child Support, Board of Corrections, Aging, Indian Affairs, Worker's Compensation, Disability Insurance
                                                    </p>
                                                    <p>
                                                        Retail Credit Association follow-up
                                                    </p>
                                                    <p>
                                                        Veterans Administration files
                                                    </p>
                                                    <p>
                                                        Appropriate employee union or association records
                                                    </p>
                                                    <p>
                                                        Appropriate company pension or employment records
                                                    </p>
                                                    <p>
                                                        Company group insurance records
                                                    </p>
                                                    <p>
                                                        Appropriate State Vital Statistics Offices
                                                    </p>
                                                    <p>
                                                        Life insurance companies
                                                    </p>
                                                    <p>
                                                        Railroad Retirement Board
                                                    </p>
                                                    <p>
                                                        Area nursing homes
                                                    </p>
                                                    <p>
                                                        Area Indian Trading Posts
                                                    </p>
                                                    <p>
                                                        Mailing List Correction Cards (U.S. Postal Service)
                                                    </p>
                                                    <p>
                                                        Letters and telephone conversations with former employees of the same establishment as cohort member
                                                    </p>
                                                    <p>
                                                        Appropriate local newspaper (obituaries)
                                                    </p>
                                                    <p>
                                                        Social Security Administration
                                                    </p>
                                                    <p>
                                                        Internal Revenue Service
                                                    </p>
                                                    <p>
                                                        National Death Index
                                                    </p>
                                                    <p>
                                                        Centers for Medicare &amp; Medicaid Services
                                                    </p>
                                                    <p>
                                                        Pension Benefit Guarantee Corporation
                                                    </p>
                                                    <p>
                                                        State Disease Registries
                                                    </p>
                                                    <p>
                                                        Commercial Telephone Directories
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0149" toc="yes">
                                            <systemNumber>09-20-0149</systemNumber>
                                            <subsection type="systemName"> Morbidity Studies in Coal Mining, Metal and Non-metal Mining and General Industry, HHS/CDC/NIOSH.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        Division of Respiratory Disease Studies (DRDS), National Institute for Occupational Safety and Health (NIOSH), 1095 Willowdale Road, Morgantown, WV 26505-2845.
                                                    </p>
                                                    <p>
                                                        A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.
                                                    </p>
                                                    <p>
                                                        Also, occasionally data may be located at the facilities of collaborating researchers where analyses are performed, data collected and reports written. A list of these facilities is available upon request to the system manager. Data may be located only at those facilities that have an adequate data security program and the collaborating researcher must return the data to NIOSH or destroy individual identifiers at the conclusion of the project.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Persons working, or having worked at coal mining operations, mining operations other than coal and at workplaces not identified as surface mining or below ground mining operations and exposed or potentially exposed to substances which are known or suspected respiratory irritants or carcinogens. Also included are those individuals in the general population who have been selected as a control group.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Previous and current employment records, medical and occupational histories, demographic data, X-rays, smoking histories, results of medical tests such as pulmonary function data and spirometry test results, permission forms, industrial environmental data, and questionnaires. The specific types of records collected and maintained are determined by the research needs of the specific study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Occupational Safety and Health Act, Section 20, "Research and Related Activities" (29 U.S.C. 669); Federal Mine Safety and Health Act of l977, Sections 203, "Medical Examinations" and 50l, "Research" (30 U.S.C. 843, 95l); Public Health Service Act, Section 301, "Research and Investigation" (42 U.S.C. 241).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        The purpose of this system is to investigate occupationally related diseases at workplaces identified as general industry, surface mining, or below ground mining operations and to determine the cause and prevention of such diseases.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Data may be sent to State Vital Statistics Divisions to obtain death certificates and to missing person location agencies to find those individuals who cannot otherwise be located.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                    <p>
                                                        Records subject to the Privacy Act are disclosed to private firms for data entry, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                                    </p>
                                                    <p>
                                                        Data on the incidence of pneumoconiosis may be sent to the Mining Safety and Health Administration, Department of Labor.
                                                    </p>
                                                    <p>
                                                        Test data which indicate the existence of cancer may be provided to the State Cancer Registry where the State has a legally constituted cancer registry program which provides for the confidentiality of information.
                                                    </p>
                                                    <p>
                                                        Certain communicable diseases may be reported to State and/or local health departments where the State has a legally constituted reporting program for communicable diseases and which provides for the confidentiality of the information.
                                                    </p>
                                                    <p>
                                                        In the event of litigation initiated at the request of NIOSH, the Institute may disclose such records as it deems desirable or necessary to the Department of Justice and to the Department of Labor, Office of the Solicitor, where appropriate, to enable the Departments to effectively represent the Institute, provided such disclosure is compatible with the purpose for which the records were collected. The only types of litigative proceedings that NIOSH is authorized to request are: (1) Enforcement of a subpoena issued to an employer to provide relevant information; or (2) contempt citation against an employer for failure to comply with a warrant obtained by the Institute; and (3) injunctive relief against employers or mine operators to obtain access to relevant information.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to NIOSH collaborating researchers (NIOSH contractors, grantees, cooperative agreement holders, or other Federal or State scientists) in order to accomplish the research purpose for which the records are collected. The collaborating researchers must agree in writing to comply with the confidentiality provisions of the Privacy Act and NIOSH must have determined that the researchers' data security procedures will protect confidentiality.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        Computer tapes/disks and printouts, CD ROM; microfiche, and manual files.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Name and/or assigned numerical identifier, plant name and  study name are some of the indices used to retrieve records from this system. Social security numbers, supplied on a voluntary basis may occasionally be used for data retrieval.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: The NIOSH mainframe computer, located within the Morgantown facility, uses a security package to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a daily basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Access to the facility is monitored, and controlled after hours, by a 24-hour guard service. Hard copy records are kept in locked cabinets in locked rooms. Access to the computer room is controlled by a punch lock system. System print-outs are made available to the requester through the use of "pigeon-hole" mailboxes which are individually secured by (combination) locking doors. The local fire department is one mile from the facility, which is of structural steel and cement block construction, with pre-cast cement panels on the envelope. No combustible materials are used in the building construction, including all interior walls. The computer room is protected by a Halon gas, built-in extinguisher system. Heat sensors are installed, and portable fire extinguishers are located throughout the computer room. The active system files are backed up on a weekly basis. The entire system is backed up, with copies of the files stored in a secure, fireproof safe in a separate location within the facility.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: System security includes automatic suspension of accounts, forced password changes, and control of systems and data set access. Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or a job submission. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                    </p>
                                                    <p>
                                                        CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Master records for completed studies are maintained in agency until transferred to the National Archives, which will occur within five years of completion. Source documents for computer data are disposed of when no longer needed in the study, as determined by the system manager, and as provided in the signed consent form, as appropriate. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Electronic records are maintained according to the provisions of the Records Control Schedule for NIOSH Electronic Records, which is consistent with the records maintenance requirements for other forms of records. Copies of notifications to workers/private physicians of needed medical attention and/or medical treatment are destroyed when no longer needed for administrative purposes, but may be retained for as long as seventy years. Paper records are destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Administrative Officer, Division of Respiratory Disease Studies (DRDS), National Institute for Occupational Safety and Health (NIOSH), 1095 Willowdale Road, MS 217, Morgantown, WV 26505-2845.
                                                    </p>
                                                    <p>
                                                        Epidemiologist, Epidemiological Investigations Branch, DRDS, NIOSH, 1095 Willowdale Road, MS 234, Morgantown, WV 26505-2845.
                                                    </p>
                                                    <p>
                                                        Policy coordination is provided by: Director, Division of Respiratory Disease Studies, National Institute for Occupational Safety and Health, 1095 Willowdale Road, MS 220, Morgantown, WV 26505-2845.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Information is obtained from the individual and from employer industry records. Vital status information is obtained from Federal, State and local governments and other available sources.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                        </section>
                                        <section id="09-20-0153" toc="yes">
                                            <systemNumber>09-20-0153</systemNumber>
                                            <subsection type="systemName"> Mortality Studies in Coal Mining, Metal and Non-metal Mining and General Industry, HHS/CDC/NIOSH.</subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        Division of Respiratory Disease Studies, National Institute for Occupational Safety and Health, 1095 Willowdale Road, Morgantown, WV 26505-2845.
                                                    </p>
                                                    <p>
                                                        A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.
                                                    </p>
                                                    <p>
                                                        Also, occasionally data may be located at the facilities of collaborating researchers where analyses are performed, data collected and reports written. A list of these facilities is available upon request to the system manager. Data may be located only at those facilities that have an adequate data security program and the collaborating researcher must return the data to NIOSH or destroy individual identifiers at the conclusion of the project.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        Persons working, or having worked at coal mining operations, mining operations other than coal and at workplaces not identified as surface mining or below ground mining operations and exposed or potentially exposed to substances which are known or suspected respiratory irritants or carcinogens. Also included are those individuals in the general population who have been selected as a control group.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Previous and current employment records, medical and occupational histories, demographic data, X-rays, smoking histories, results of medical tests such as pulmonary function data and spirometry test results, permission forms, industrial environmental data, and questionnaires. The specific types of records collected and maintained are determined by the research needs of the specific study.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Occupational Safety and Health Act, Section 20, "Research and Related Activities" (29 U.S.C. 669); Federal Mine Safety and Health Act of 1977, Section 4, "Mandatory Safety and Health Standards" and Section 501, "Research" (30 U.S.C. 811, 951); Public Health Service Act, Section 301, "Research and Investigation" (42 U.S.C. 241).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        The purpose of this system is to investigate occupationally related diseases at workplaces identified as general industry, surface mining or below ground mining operations, to determine the cause and prevention of such diseases, and to evaluate whether excess occupationally related mortality is occurring.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Data may be sent to State Vital Statistics Divisions to obtain death certificates and to missing person location agencies to find those individuals who cannot otherwise be located.
                                                    </p>
                                                    <p>
                                                        Portions of records (name, Social Security number if known, date of birth, and last known address) may be disclosed to one or more other sources selected from those listed in Appendix I, as applicable. This may be done for obtaining a determination as to whether or not an individual has died and, if alive, last known address. The purpose of determining death is so that NIOSH may obtain death certificates, which state the cause of death, from the appropriate Federal, State, or local agency. Cause of death enables NIOSH to evaluate whether excess occupationally related mortality is occurring.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                    </p>
                                                    <p>
                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                    </p>
                                                    <p>
                                                        Records subject to the Privacy Act are disclosed to private firms for data entry, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                                    </p>
                                                    <p>
                                                        In the event of litigation initiated at the request of NIOSH, the Institute may disclose such records as it deems desirable or necessary to the Department of Justice and to the Department of Labor, Office of the Solicitor, where appropriate, to enable the Departments to effectively represent the Institute, provided such disclosure is compatible with the purpose for which the records were collected. The only types of litigative proceedings that NIOSH is authorized to request are: (1) Enforcement of a subpoena issued to an employer to provide relevant information; or (2) contempt citation against an employer for failure to comply with a warrant obtained by the Institute; and (3) injunctive relief against employers or mine operators to obtain access to relevant information.
                                                    </p>
                                                    <p>
                                                        Disclosure may be made to NIOSH collaborating researchers (NIOSH contractors, grantees, cooperative agreement holders, or other Federal or State scientists) in order to accomplish the research purpose for which the records are collected. The collaborating researchers must agree in writing to comply with the confidentiality provisions of the Privacy Act and NIOSH must have determined that the researchers' data security procedures will protect confidentiality.
                                                    </p>
                                                    <p>
                                                        The records in this System are stored in computer cards, tapes/disks and printouts, microfiche, and manual files. The records in this System are retrieved by Name and/or assigned numerical identifier, plant name and study are some of the indices used to retrieve records from this system. Social Security numbers, supplied on a voluntary basis may occasionally be used for data retrieval.
                                                    </p>
                                                    <p>
                                                        Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        Computer tapes/disks and printouts, CD ROM; microfiche, and manual files.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Name and/or assigned numerical identifier, plant name, and study name are some of the indices used to retrieve records from this system. Social security numbers,  supplied on a voluntary basis may occasionally be used for data retrieval.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        1. Authorized users: The NIOSH mainframe computer, located within the Morgantown facility, uses a security package to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a daily basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                    </p>
                                                    <p>
                                                        2. Physical safeguards: Access to the facility is monitored, and controlled after hours, by a 24-hour guard service. Hard copy records are kept in locked cabinets in locked rooms. Access to the computer room is controlled by a punch lock system. System print-outs are made available to the requester through the use of "pigeon-hole" mailboxes which are individually secured by (combination) locking doors. The local fire department is one mile from the facility, which is of structural steel and cement block construction, with pre-cast cement panels on the envelope. No combustible materials are used in the building construction, including all interior walls. The computer room is protected by a Halon gas, built-in extinguisher system. Heat sensors are installed, and portable fire extinguishers are located throughout the computer room. The active system files are backed up on a weekly basis. The entire system is backed up, with copies of the files stored in a secure, fireproof safe in a separate location within the facility.
                                                    </p>
                                                    <p>
                                                        3. Procedural safeguards: System security includes automatic suspension of accounts, forced password changes, and control of systems and data set access. Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or a job submission. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                    </p>
                                                    <p>
                                                        CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                    </p>
                                                    <p>
                                                        4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>Master records for completed studies are maintained in agency until transferred to the National Archives, which will occur within five years of completion. Source documents for computer data are disposed of when no longer needed in the study, as determined by the system manager, and as provided in the signed consent form, as appropriate. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Electronic records are maintained according to the provisions of the Records Control Schedule for NIOSH Electronic Records, which is consistent with the records maintenance requirements for other forms of records. Copies of notifications to workers/private physicians of needed medical attention and/or medical treatment are destroyed when no longer needed for administrative purposes, but may be retained for as long as seventy years. Paper records are destroyed by paper recycling process when 20 years old, unless needed for further study.</p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Administrative Officer, Division of Respiratory Disease Studies (DRDS), National Institute for Occupational Safety and Health (NIOSH), 1095 Willowdale Road, MS 217, Morgantown, WV 26505-2845.
                                                    </p>
                                                    <p>
                                                        Epidemiologist, Epidemiological Investigations Branch, DRDS, NIOSH, 1095 Willowdale Road, MS 234, Morgantown, WV 26505-2845.
                                                    </p>
                                                    <p>
                                                        Policy coordination is provided by: Director, Division of Respiratory Disease Studies, National Institute for Occupational Safety and Health, 1095 Willowdale Road, MS 220, Morgantown, WV 26505-2845.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                    </p>
                                                    <p>
                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                    </p>
                                                    <p>
                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study or treatment, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Information is obtained from the individual, company personnel records, death certificates, and from industry and trade union records. Vital status information is obtained from Federal, State and local governments and other available sources.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemsExempted">
                                                <xhtmlContent>
                                                    <p>None.</p>
                                                    <p><i>Appendix I - Potential Sources for Determination of Vital Status </i></p>
                                                    <p>
                                                        Military Records Appropriate State Motor Vehicle Registration Departments Appropriate State Drivers License Departments Appropriate State Government Divisions of: Assistance Payments (Welfare), Social Services, Medical Services, Food Stamp Program, Child Support, Board of Corrections, Aging; Indian Affairs, Workman's Compensation, Disability Insurance Veterans Administration Files Appropriate Employee Union or Association Records Appropriate Company Pension or Employment Records Company Group Insurance Records Appropriate State Vital Statistics Offices Life Insurance Companies Railroad Retirement Board Area Nursing Homes Area Indian Trading Posts Mailing List Correction Cards (U.S. Postal Service) Letters and Telephone Conversations with Relatives Letters and Telephone Conversations with Former Employees of the Same Establishment as Cohort Member Appropriate Local Newspaper (Obituaries) Social Security Administration Internal Revenue Service.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection></section>
                                            <section id="09-20-0154" toc="yes">
                                                <systemNumber>09-20-0154</systemNumber>
                                                <subsection type="systemName"> Medical and Laboratory Studies, HHS/CDC/NIOSH.</subsection>
                                                <subsection type="securityClassification">
                                                    <xhtmlContent>
                                                        <p>
                                                            None.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="systemLocation">
                                                    <xhtmlContent>
                                                        <p>
                                                            Division of Respiratory Disease Studies, National Institute for Occupational Safety and Health, 1095 Willowdale Road, Morgantown, WV 26505-2845.
                                                        </p>
                                                        <p>
                                                            A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.
                                                        </p>
                                                        <p>
                                                            Also, occasionally data may be located at the facilities of collaborating researchers where analyses are performed, data collected and reports written. A list of these facilities is available upon request to the system manager. Data may be located only at those facilities that have an adequate data security program and the collaborating researcher must return the data to NIOSH or destroy individual identifiers at the conclusion of the project.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="categoriesOfIndividuals">
                                                    <xhtmlContent>
                                                        <p>
                                                            Individuals who have had examinations at Division of Respiratory Disease Studies (DRDS) staff or submitted medical information in cooperation with a DRDS study.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="categoriesOfRecords">
                                                    <xhtmlContent>
                                                        <p>
                                                            Analyses of biochemical data, occupational and medical histories, and results of medical tests. The specific types of records collected and maintained are determined by the needs of the individual study.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="authorityForMaintenance">
                                                    <xhtmlContent>
                                                        <p>
                                                            Federal Mine Safety and Health Act of 1977, Section 501, "Research" (30 U.S.C. 95l); Occupational Safety and Health Act, Section 20, "Research and Related Activities" and Section 22(d), "Authority of Director, National Institute for Occupational Safety and Health" (29 U.S.C 669, 671(d)).
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="purpose">
                                                    <xhtmlContent>
                                                        <p>
                                                            The purpose of this system is to perform medical and epidemiological research, statistical analysis, and to identify early indicators of occupationally related diseases (biochemical indices); data is given to other NIOSH units for biochemical and epidemiological studies.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="routineUsesOfRecords">
                                                    <xhtmlContent>
                                                        <p>
                                                            Data may be sent to State Vital Statistics Divisions to obtain death certificates and to missing person location agencies to find those individuals who cannot otherwise be located.
                                                        </p>
                                                        <p>
                                                            Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                        </p>
                                                        <p>
                                                            In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                        </p>
                                                        <p>
                                                            Records subject to the Privacy Act are disclosed to private firms for data entry, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                                        </p>
                                                        <p>
                                                            Certain communicable diseases may be reported to State and/or local health departments where the State has a legally constituted reporting program for communicable diseases and which provides for the confidentiality of the information.
                                                        </p>
                                                        <p>
                                                            In the event of litigation initiated at the request of NIOSH, the Institute may disclose such records as it deems desirable or necessary to the Department of Justice and to the Department of Labor, Office of the Solicitor, where appropriate, to enable the Departments to effectively represent the Institute, provided such disclosure is compatible with the purpose for which the records were collected. The only types of litigative proceedings that NIOSH is authorized to request are: (1) enforcement of a subpoena issued to an employer to provide relevant information; or (2) contempt citation against an employer for failure to comply with a warrant obtained by the Institute.
                                                        </p>
                                                        <p>
                                                            Disclosure may be made to NIOSH collaborating researchers (NIOSH contractors, grantees, cooperative agreement holders, or other Federal or State scientists) in order to accomplish the research purpose for which the records are collected. The collaborating researchers must agree in writing to comply with the confidentiality provisions of the Privacy Act and NIOSH must have determined that the researchers' data security procedures will protect confidentiality.
                                                        </p>
                                                        <p>
                                                            Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.
                                                        </p>
                                                        <p>
                                                            Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="policiesAndPractices">
                                                    <xhtmlContent>
                                                        <p>
                                                            Storage:
                                                        </p>
                                                        <p>
                                                            Computer tapes/disks and printouts, CD ROM; microfiche, and manual files.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="retrievability">
                                                    <xhtmlContent>
                                                        <p>
                                                            Name and case number are the indices used to retrieve records from this system.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="safeguards">
                                                    <xhtmlContent>
                                                        <p>
                                                            1. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                        </p>
                                                        <p>
                                                            2. Physical safeguards: Records are kept in locked cabinets in locked rooms. Guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in operation at the Federal Records Center.
                                                        </p>
                                                        <p>
                                                            3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with system manager prior to making disclosures of data.
                                                        </p>
                                                        <p>
                                                            4. Implementation guidelines: HHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Management Regulations, subchapter B--Archives and Records.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="retentionAndDisposal">
                                                    <xhtmlContent>
                                                        <p>
                                                            Master records for completed studies are maintained in agency until transferred to the National Archives, which will occur within five years of completion. Source documents for computer data are disposed of when no longer needed in the study, as determined by the system manager, and as provided in the signed consent form, as appropriate. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Electronic records are maintained according to the provisions of the Records Control Schedule for NIOSH Electronic Records, which is consistent with the records maintenance requirements for other forms of records. Copies of notifications to workers/private physicians of needed medical attention and/or medical treatment are destroyed when no longer needed for administrative purposes, but may be retained for as long as seventy years. Paper records are destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="systemManager">
                                                    <xhtmlContent>
                                                        <p>
                                                            Administrative Officer, Division of Respiratory Disease Studies (DRDS), National Institute for Occupational Safety and Health (NIOSH), 1095 Willowdale Road, MS 217, Morgantown, WV 26505-2845.
                                                        </p>
                                                        <p>
                                                            Health Science Administrator, Clinical Investigations Branch, DRDS, NIOSH, 1095 Willowdale Road, MS 245, Morgantown, WV 26505-2845.
                                                        </p>
                                                        <p>
                                                            Policy coordination is provided by: Director, Division of Respiratory Disease Studies, National Institute for Occupational Safety and Health, 1095 Willowdale Road, MS 220, Morgantown, WV 26505-2845.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="notificationProcedure">
                                                    <xhtmlContent>
                                                        <p>
                                                            An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                        </p>
                                                        <p>
                                                            An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                        </p>
                                                        <p>
                                                            The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="recordAccessProcedures">
                                                    <xhtmlContent>
                                                        <p>
                                                            Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="contestingRecordProcedures">
                                                    <xhtmlContent>
                                                        <p>
                                                            Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="recordSourceCategories">
                                                    <xhtmlContent>
                                                        <p>
                                                            Information is obtained directly from the individual.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection>
                                                <subsection type="systemsExempted">
                                                    <xhtmlContent>
                                                        <p>
                                                            None.
                                                        </p>
                                                    </xhtmlContent>
                                                </subsection></section>

                                                <section id="09-20-0157" toc="yes">
                                                    <systemNumber>09-20-0157</systemNumber>
                                                    <subsection type="systemName"> Clinical Laboratory Personnel Proficiency Test Results (Medicare), HHS/CDC/PHPPO.</subsection>
                                                    <subsection type="securityClassification">
                                                        <xhtmlContent>
                                                            <p>
                                                                None.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="systemLocation">
                                                        <xhtmlContent>
                                                            <p>
                                                                Public Health Practice Program Office, Chamblee Bldg. 102, Rm. 2401, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="categoriesOfIndividuals">
                                                        <xhtmlContent>
                                                            <p>
                                                                Clinical laboratory technicians and technologists, cytotechnologists, independent laboratory directors.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="categoriesOfRecords">
                                                        <xhtmlContent>
                                                            <p>
                                                                Answer sheets, examination scores.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="authorityForMaintenance">
                                                        <xhtmlContent>
                                                            <p>
                                                                Social Security Act, Section 1123 "Qualifications for Health Care Personnel" (42 U.S.C. 1320a-2).
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="purpose">
                                                        <xhtmlContent>
                                                            <p>
                                                                To maintain a record of examination scores. When applicable, answer sheets are used to revalidate results.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="routineUsesOfRecords">
                                                        <xhtmlContent>
                                                            <p>
                                                                Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                            </p>
                                                            <p>
                                                                The Centers for Disease Control is under contract with private firms for the purpose of collating, analyzing, or otherwise refining records in this system. Relevant records are maintained by the contractors. The contractors are required to maintain Privacy Act safeguards with respect to such records.
                                                            </p>
                                                            <p>
                                                                The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="policiesAndPractices">
                                                        <xhtmlContent>
                                                            <p>
                                                                Storage:
                                                            </p>
                                                            <p>
                                                                Computer-generated listings filed by discipline, and by State, in file folders. Computer tapes filed at the Federal Records Center.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="retrievability">
                                                        <xhtmlContent>
                                                            <p>
                                                                Listings and answer sheets are retrieved by examination discipline, State, examinee's name and address, and examination number.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="safeguards">
                                                        <xhtmlContent>
                                                            <p>
                                                                1. Authorized users: Access is granted to only a limited number of Laboratory Program Office personnel and designated support staff of the Centers for Disease Control (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                            </p>
                                                            <p>
                                                                2. Physical safeguards: Locked cabinets in locked rooms, 24-hour guard service in buildings, personnel screening of visitors, electronic anti-intrusion devices in operation at the Federal Records Center.
                                                            </p>
                                                            <p>
                                                                3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with the system manager prior to making disclosures of data.
                                                            </p>
                                                            <p>
                                                                CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                            </p>
                                                            <p>
                                                                4. Implementation guidelines: DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="retentionAndDisposal">
                                                        <xhtmlContent>
                                                            <p>
                                                                Records are retained in agency for three years. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process after 15 years, unless needed for further study.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="systemManager">
                                                        <xhtmlContent>
                                                            <p>
                                                                Director, Public Health Practice Program Office, Executive Park, Bldg. 24, Rm. 110, MS E20, Centers for Disease Control, l600 Clifton Road, NE, Atlanta, GA 30333.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="notificationProcedure">
                                                        <xhtmlContent>
                                                            <p>
                                                                An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                            </p>
                                                            <p>
                                                                The following information should be provided when requesting notification: (1) Full name; (2) approximate date(s) of the examination(s); (3) name of the examination and location at which examination was administered.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="recordAccessProcedures">
                                                        <xhtmlContent>
                                                            <p>
                                                                Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="contestingRecordProcedures">
                                                        <xhtmlContent>
                                                            <p>
                                                                Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="recordSourceCategories">
                                                        <xhtmlContent>
                                                            <p>
                                                                Scored examinations.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="systemsExempted">
                                                        <xhtmlContent>
                                                            <p>
                                                                None.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection></section>

                                                    <section id="09-20-0159" toc="yes">
                                                        <systemNumber>09-20-0159</systemNumber>
                                                        <subsection type="systemName"> Records of Subjects in Certification, Testing, Studies of Personal Protective Devices, and Accident Investigations, HHS/CDC/NIOSH.</subsection>
                                                        <subsection type="securityClassification">
                                                            <xhtmlContent>
                                                                <p>
                                                                    None.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="systemLocation">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Division of Safety Research (DSR), National Institute for Occupational Safety and Health (NIOSH), 944 Chestnut Ridge Road, Morgantown, WV 26505-2888.
                                                                </p>
                                                                <p>
                                                                    A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.
                                                                </p>
                                                                <p>
                                                                    Also, occasionally data may be located at the facilities of collaborating researchers where analyses are performed, data collected and reports written. A list of these facilities is available upon request to the system manager. Data may be located only at those facilities that have an adequate data security program and the collaborating researcher must return the data to NIOSH or destroy individual identifiers at the conclusion of the project.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="categoriesOfIndividuals">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Individuals exposed to hazardous work environments and individuals selected as control groups are covered by this system. Additionally, the system pertains to individuals selected to test the interaction between people, personal protection or safety equipment, users of such equipment, and a hazardous environment. Some examples include individuals involved in investigated accidents and persons selected to perform respirator facepiece fit tests, perform lifting and manual materials handling studies, perform work tests while wearing protective equipment, perform strength test studies, and perform hand speed tests.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="categoriesOfRecords">
                                                            <xhtmlContent>
                                                                <p>
                                                                    The system contains such records as physical examinations, questionnaires, results of laboratory tests (physiological measures and performance tests), workplace performance records, occupational histories, medical histories, demographic data, and related medical information. The specific types of records collected and maintained are determined by the needs of the individual study.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="authorityForMaintenance">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Public Health Service Act, Section 301, "Research and Investigation" (42 U.S.C. 241); Occupational Safety and Health Act, Section 20, "Research and Related Activities" (29 U.S.C. 669); and Federal Mine Safety and Health Act of l977, Section 50l, "Research" (30 U.S.C. 95l).
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="purpose">
                                                            <xhtmlContent>
                                                                <p>
                                                                    The purpose of this system is to permit acquisition of information related to certification and performance of personal protective equipment, and safety research studies.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="routineUsesOfRecords">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                                </p>
                                                                <p>
                                                                    In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                                </p>
                                                                <p>
                                                                    Portions of records (name, Social Security number if known, date of birth, and last known address) may be disclosed to one or more sources selected from those listed in Appendix 1. This may be done to determine if the individual has died so that a death certificate can be obtained. Knowing the cause of death enables NIOSH to evaluate whether excess occupationally-related mortality is occurring.
                                                                </p>
                                                                <p>
                                                                    In the event of litigation initiated at the request of NIOSH, the Institute may disclose such records as it deems desirable or necessary to the Department of Justice and to the Department of Labor, Office of the Solicitor, where appropriate, to enable the Departments to effectively represent the Institute, provided such disclosure is compatible with the purpose for which the records were collected. The only types of litigation proceedings that NIOSH is authorized to request are: (1) Enforcement of a subpoena issued to an employer to provide relevant information; and (2) administrative search warrants to obtain access to places of employment and relevant information therein and related contempt citations against an employer for failure to comply with a warrant obtained by the Institute.
                                                                </p>
                                                                <p>
                                                                    Records subject to the Privacy Act are disclosed to private firms for data entry, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.
                                                                </p>
                                                                <p>
                                                                    Disclosure may be made to NIOSH collaborating researchers (<i>e.g.,</i> NIOSH contractors, grantees, cooperative agreement holders, or other Federal or State scientists) in order to accomplish the research purpose for which the records are collected. The collaborating researchers must agree in writing to comply with the confidentiality provisions of the Privacy Act and NIOSH must have determined that the researchers' data security procedures will protect confidentiality.
                                                                </p>
                                                                <p>
                                                                    Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="policiesAndPractices">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Storage:
                                                                </p>
                                                                <p>
                                                                    Manual files, computer cards, tapes/disks and printouts, microfilm, index audiogram files, audiograms, questionnaire forms.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="retrievability">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Name, assigned number, plant name, and year tested are some of the indices used to retrieve records from these systems. Other retrieval methods are utilized as individual research dictates.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="safeguards">
                                                            <xhtmlContent>
                                                                <p>
                                                                    1. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control (CDC), as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                                </p>
                                                                <p>
                                                                    2. Physical safeguards: Records are kept in locked cabinets in locked rooms. Guard service in buildings provides screening of visitors. Electronic anti-intrusion devices are in operation at the Federal Records Center.
                                                                </p>
                                                                <p>
                                                                    3. Procedural safeguards: Users of individually identified data protect information from public scrutiny, and only specifically authorized personnel may be admitted to the record storage area. CDC employees who maintain records are instructed to check with system manager prior to making disclosures of data.
                                                                </p>
                                                                <p>
                                                                    4. Implementation guidelines: HHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual. FRC safeguards are in compliance with GSA Federal Property Mangement Regulations, subchapter B--Archives and Records.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="retentionAndDisposal">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Records are maintained in agency for three years. Personal identifiers are stripped from records when no longer needed. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="systemManager">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Deputy Director, Division of Safety Research (DRS), National Institute for Occupational Safety and Health (NIOSH), 944 Chestnut Ridge Road, Morgantown, WV 26505-2888.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="notificationProcedure">
                                                            <xhtmlContent>
                                                                <p>
                                                                    An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) must certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                                </p>
                                                                <p>
                                                                    An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                                </p>
                                                                <p>
                                                                    The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known, and (3) nature of the questionnaire or study in which the requester participated.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="recordAccessProcedures">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="contestingRecordProcedures">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="recordSourceCategories">
                                                            <xhtmlContent>
                                                                <p>
                                                                    Information is obtained from the individual and from employer records.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection>
                                                        <subsection type="systemsExempted">
                                                            <xhtmlContent>
                                                                <p>
                                                                    None.
                                                                </p>
                                                            </xhtmlContent>
                                                        </subsection></section>

                                                        <section id="09-20-0160" toc="yes">
                                                            <systemNumber>09-20-0160</systemNumber>
                                                            <subsection type="systemName"> Records of Subjects in Health Promotion and Education Studies, HHS/CDC/CCDPHP.</subsection>
                                                            <subsection type="securityClassification">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        None.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="systemLocation">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        National Center for Chronic Disease Prevention and Health Promotion, Koger/Rhodes Bldg., Rm. 4004, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                                    </p>
                                                                    <p>
                                                                        A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="categoriesOfIndividuals">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Adults and children, including health and education agency administrators, school health personnel, teachers, parents, and students who participate in studies and surveys designed to obtain data on their knowledge, attitudes, and reported behavior related to a variety of health problems and/or other potential preventable conditions of public health significance; also included are control group participants.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="categoriesOfRecords">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Responses to questionnaires by adults and children, including health and education agency administrators, school health personnel, teachers, parents, and students, pertaining to health knowledge, attitudes and behavior, site visit data, organizational data regarding health education in school curriculum, course content, medical histories, demographic data of the survey population as well as identification data for follow-up purposes.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="authorityForMaintenance">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Public Health Service Act, Section 301, "Research and Investigation" (42 U.S.C. 241).
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="purpose">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        This record system enables the Centers for Disease Control (CDC) officials to develop and evaluate existing health promotion programs for disease prevention and control, and to communicate new knowledge to the health community for the implementation of such programs.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="routineUsesOfRecords">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Disclosure may be made to CDC contractors in the conduct of research studies covered by this system notice and in the preparation of scientific reports, in order to accomplish the stated purpose of the system. The recipients will be required to maintain Privacy Act safeguards with respect to such records.
                                                                    </p>
                                                                    <p>
                                                                        Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                                    </p>
                                                                    <p>
                                                                        In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                                                                    </p>
                                                                    <p>
                                                                        Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="policiesAndPractices">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Storage:
                                                                    </p>
                                                                    <p>
                                                                        Computer tapes/disks and printouts, file folders.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="retrievability">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Name of individual, identification number, school name and year tested are some of the indices used to retrieve records from this system.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="safeguards">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        1. Authorized users: Access is granted to only a limited number of researchers and designated support staff of CDC or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                                    </p>
                                                                    <p>
                                                                        2. Physical safeguards: Locked cabinets in locked rooms, guard service in buildings, personnel screening of visitors, fire extinguishers, overhead sprinkler system and card-access control equipment in the computer room, computer terminals and automated records located in secured areas.
                                                                    </p>
                                                                    <p>
                                                                        3. Procedural safeguards: Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, frequently changed passwords, and Vault Management System. Knowledge of individual tape passwords is required to access tapes, and access to systems is limited to users obtaining prior supervisory approval. When Privacy Act tapes are scratched, a special `certified" process is performed in which tapes are completely written over to avoid inadvertent data disclosure. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                                    </p>
                                                                    <p>
                                                                        CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                                    </p>
                                                                    <p>
                                                                        4. Implementation Guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31).
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="retentionAndDisposal">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Records are maintained in agency for two years. Source documents for computer disposed of when no longer needed by program officials. Personal identifiers may be deleted from records when no longer needed in the study as determined by the system manager, and as provided in the signed consent form, as appropriate. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process when 20 years old, unless needed for further study.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="systemManager">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Director, National Center for Chronic Disease Prevention and Health Promotion, Koger/Rhodes Bldg., Rm. 4004, Centers for Disease Control, 1600 Clifton Road, Atlanta, GA 30333.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="notificationProcedure">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) must certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                                    </p>
                                                                    <p>
                                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                                    </p>
                                                                    <p>
                                                                        A parent or guardian who requests notification of, or access to a child's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                                    </p>
                                                                    <p>
                                                                        The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known, and (3) nature of the questionnaire or study in which the requester participated.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="recordAccessProcedures">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="contestingRecordProcedures">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="recordSourceCategories">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Individuals, and participating public and private schools which maintain records on enrolled students.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="systemsExempted">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        None.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
</section>
                                                            <section id="09-20-0161" toc="yes">
                                                                <systemNumber>09-20-0161</systemNumber>
                                                                <subsection type="systemName"> Records of Health Professionals in Disease Prevention and Control Training Programs, HHS/CDC/NCPS.</subsection>
                                                                <subsection type="securityClassification">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            None.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="systemLocation">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            National Center for Prevention Services, Corporate Square, Bldg. 12, Rm. 3308, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                                        </p>
                                                                        <p>
                                                                            Public Health Practice Program Office, Bldg. 2, Rm. B50, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                                        </p>
                                                                        <p>
                                                                            National Center for Injury Prevention and Control, Koger Davidson Bldg., Rm. 1078, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                                        </p>
                                                                        <p>
                                                                            Division of Health Education, Executive Park, Bldg. 4, Agency for Toxic Substances and Disease Registry, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                                        </p>
                                                                        <p>
                                                                            Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                                        </p>
                                                                        <p>
                                                                            A list of contractor sites where individually identifiable data are currently located is available upon request to the appropriate system manager.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="categoriesOfIndividuals">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Physicians, nurses, physician assistants, clinician trainees, and other health personnel who have participated in training activities, surveys, and studies developed by the Centers for Disease Control (CDC), and control group health professionals who have not participated in training activities.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="categoriesOfRecords">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Responses to questionnaires by physicians, nurses, physician assistants, clinician trainees, and related health personnel, pertaining to knowledge, attitude and practices relating to health problems, diseases and/or other potential preventable conditions of public health significance; health care and related training data; and demographic data of the survey population as well as identification data for followup purposes.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="authorityForMaintenance">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Public Health Service Act, Section 301, "Research and Investigation" (42 U.S.C. 241).
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="purpose">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            This record system enables CDC officials to maintain training records and assess the impact of the agency's training programs on the knowledge, attitudes and practices of clinicians and other health care personnel, in order to develop improved training curricula and programs for disease prevention and control for such health care personnel.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="routineUsesOfRecords">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Disclosure may be made to CDC contractors in the conduct of training surveys and studies covered by this system notice and in the preparation of scientific reports, in order to accomplish the stated purposes of the system. The recipients will be required to maintain Privacy Act safeguards with respect to such records.
                                                                        </p>
                                                                        <p>
                                                                            CDC is under contract with private firms for the purpose of collating, analyzing, aggregating or otherwise refining records in this system. Relevant records are disclosed to such contractors. The contractors are required to maintain Privacy Act safeguards with respect to such records.
                                                                        </p>
                                                                        <p>
                                                                            Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                                        </p>
                                                                        <p>
                                                                            The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                                                        </p>
                                                                        <p>
                                                                            Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="policiesAndPractices">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Storage:
                                                                        </p>
                                                                        <p>
                                                                            Computer tapes/disks and printouts, file folders.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="retrievability">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Name of individual respondent, identification number, and type of training received are some of the indices used to retrieve records from this system.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="safeguards">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            1. Authorized users: Access is granted to only a limited number of personnel, i.e., CDC Project Officer, interviewers and designated support staff of CDC or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                                        </p>
                                                                        <p>
                                                                            2. Physical safeguards: Locked cabinets in locked rooms, 24-hour guard service in buildings, personnel screening of visitors, electronic anti-intrusion devices in operation at the Federal Records Center, fire extinguishers, overhead sprinkler system and card-access control equipment in the computer room, computer terminals and automated records located in secured areas.
                                                                        </p>
                                                                        <p>
                                                                            3. Procedural safeguards: Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission, frequently changed passwords, and Vault Management System. Knowledge of individual tape passwords is required to access tapes, and access to systems is limited to users obtaining prior supervisory approval. When Privacy Act tapes are scratched, a special "certified" process is performed in which tapes are completely written over to avoid inadvertent data disclosure. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.
                                                                        </p>
                                                                        <p>
                                                                            CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                                        </p>
                                                                        <p>
                                                                            4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31). FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="retentionAndDisposal">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Records are maintained in agency for two years. Disposal methods include erasing computer tapes, burning or shredding paper materials or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records destroyed by paper recycling process after 12 years, unless needed for further study.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="systemManager">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Director, National Center for Prevention Services, Corporate Square, Bldg. 11, Rm. 2106, MS E07, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                                        </p>
                                                                        <p>
                                                                            Director, Public Health Practice Program Office, Executive Park, Bldg. 24, Rm. 110, MS E20, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                                        </p>
                                                                        <p>
                                                                            Director, National Center for Injury Prevention and Control, Koger Davidson Bldg., Rm. 1078, MS F36, Centers for Disease Control and Prevention, 4770 Buford Highway, NE, Atlanta, GA 30341-3724.
                                                                        </p>
                                                                        <p>
                                                                            Director, Division of Health Education, Executive Park, Bldg. 4, Rm. 2220D, MS E33, Agency for Toxic Substances and Disease Registry, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                                        </p>
                                                                        <p>
                                                                            Policy coordination is provided by: Associate Director for Management and Operations, Bldg. 1, Rm. 2011, MS D15, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Atlanta, GA 30333.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="notificationProcedure">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            An individual may learn if a record exists about himself or herself by contacting the appropriate system manager at the address above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either (1) submit a notarized request to verify their identity or (2) must certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a 5,000 dollars fine.
                                                                        </p>
                                                                        <p>
                                                                            The following information must be provided when requesting notification: (1) Full name; (2) name of the clinic/organization in which requester was employed at time of training or survey participation, and (3) nature of the training or survey questionnaire in which the requester participated.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="recordAccessProcedures">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="contestingRecordProcedures">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="recordSourceCategories">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Individuals in the system and selected clinics which employ individuals who are in the system.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="systemsExempted">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            None.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection></section>

                                                                <section id="09-20-0162" toc="yes">
                                                                    <systemNumber>09-20-0162</systemNumber>
                                                                    <subsection type="systemName"> Records of Subjects in Agent Orange, Vietnam Experience, and Selected Cancers Studies, HHS/CDC/NCEH.</subsection>
                                                                    <subsection type="securityClassification">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                None.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="systemLocation">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                National Center for Environmental Health, Chamblee Bldg. 101, Rm. G336, Centers for Disease Control and Prevention, 4770 Buford Highway NE, Atlanta, GA 30341-3724 and Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
                                                                            </p>
                                                                            <p>
                                                                                Data are located at contractor sites as data are collected. A list of contractor sites where individually identified data are currently located is available upon request to the system manager.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="categoriesOfIndividuals">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Selected male U.S. Army veterans at grade E-5 or below who enlisted or were drafted for one tour of duty in Vietnam or other countries during 1966 - 1972; males with birthdates 1929-1953 who have cases of selected cancers (specifically, lymphomas, soft tissue sarcomas, nasal and nasopharyngeal, and primary liver) diagnosed between December 1, 1984 to November 30, 1988; also included are control group participants.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="categoriesOfRecords">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Information identifying the participants (such as name, address, social security number, military service number, telephone number, date of birth), interview questionnaire responses, medical, laboratory, and psychological test result data, and records on biological specimens (e.g. blood, tumor, urine, etc.).
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="authorityForMaintenance">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Pub. L. 96-151, "Veterans Health Programs Extension and Improvement Act of 1979" (38 U.S.C. 219 note); Pub. L. 97-72, "Veterans' Health Care, Training, and Small Business Loan Act of 1981" (38 U.S.C. 219 note); Public Health Service Act, sections 304, 306, and 308(d), which discuss authority to grant assurances of confidentiality for health research and related activities (42 U.S.C. 242 b, k, and m(d)).
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="purpose">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Records in this system are used to support studies to assess the health of Vietnam veterans relative to the health of other men of similar age. Specifically this information should enable the Centers for Disease Control (CDC) to:
                                                                            </p>
                                                                            <p>
                                                                                1. Evaluate the relationship of documented exposure to herbicides used in Vietnam (primarily Agent Orange) to possible adverse health consequences. Such possible effects to be evaluated include dermatologic, neurological, psychological, immunological, carcinogenic, reproductive, gastrointestinal, and others.
                                                                            </p>
                                                                            <p>
                                                                                2. Assess the health effects of service in Vietnam (including factors other than herbicide exposure) as opposed to the experiences of veterans who served in other countries.
                                                                            </p>
                                                                            <p>
                                                                                3. Evaluate the risk of selected cancers among Vietnam veterans in contrast to men of similar age who did not serve in Vietnam.
                                                                            </p>
                                                                            <p>
                                                                                Portions of records (i.e., name, social security number or military service number, date of birth) may be disclosed to the National Center for Health Statistics for obtaining a determination of vital status. Death certificates stating the cause of death will then be obtained from the appropriate Federal, State, or local agency to enable CDC to evaluate whether excess mortality is occurring among Vietnam veterans. Portions may also be disclosed to the Social Security Administration who will provide additional sources of information for locating veterans involved in the study.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="routineUsesOfRecords">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Records have been disclosed to Department of Health and Human Services contractors to locate veterans, cancer cases and controls, conduct interviews, perform medical examinations, analyze pathology specimens, and similar medical services, so that the research purposes for which the records were collected could be accomplished. The contractor was required to comply with the Privacy Act and to follow Section 308(d) of the Public Health Service Act with respect to such records.
                                                                            </p>
                                                                            <p>
                                                                                Portions of records (<i>i.e.,</i> name, Social Security number or military service number) have been disclosed to other Federal agencies such as the Veterans Administration, Internal Revenue Service, and Social Security Administration only to obtain information to aid in locating veterans involved in the study. These disclosures would have been made to update locating information provided by the Army and Joint Services Environmental Support Group.
                                                                            </p>
                                                                            <p>
                                                                                Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="policiesAndPractices">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Storage:
                                                                            </p>
                                                                            <p>
                                                                                File folders, microfilm, computer cards, tapes/disks and printouts.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="retrievability">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                By name, social security number or military service number (when supplied voluntarily or contained in existing records used in studies under this system), or other identifying number.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="safeguards">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Records in this system are collected under an Assurance of Confidentiality authorized by section 308(d) of the Public Health Service Act. To comply with this Assurance, the following special safeguards are necessary:
                                                                            </p>
                                                                            <p>
                                                                                1. Authorized users: Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of CDC or its contractors, as authorized by the Project Director to accomplish the stated purposes for which the data in this system has been collected.
                                                                            </p>
                                                                            <p>
                                                                                2. Physical safeguards: Questionnaires and other source data are maintained in locked fire-resistant cabinets in locked rooms. When entered into the computer, individually identified information is kept separate from data used for analysis. Tape data are stored in fire-resistant safes. There is 24-hour guard service in buildings, personnel screening of visitors, fire extinguishers, overhead sprinkler system and card- access control equipment in the computer room, and computer terminals and automated records are located in secured areas. Electronic anti- intrusion devices are in operation at the Federal Records Center.
                                                                            </p>
                                                                            <p>
                                                                                3. Procedural safeguards: Protection for computerized records includes programmed verification of valid user identification code, account code and password prior to acceptance of a terminal session or job submission and frequently changed passwords. Knowledge of individual tape passwords is required to access tapes, and access to systems is limited to users obtaining prior supervisory approval. Names and other details necessary to identify individuals are not included in data files used for analysis. These files are indexed by code numbers which are linked with complete identifiers only if there is a specific need such as data verification or followup interviews. Keys which link identification numbers to names are stored separately with access limited to CDC project officers and authorized staff.
                                                                            </p>
                                                                            <p>
                                                                                CDC and contractor employees who maintain records are instructed in specific rules of conduct to protect the security and confidentiality of records in accordance with section 308(d) of the Public Health Service Act. When individually identified records are being used in a room at a contractor site, admittance to the room is restricted to employees pledged to confidentiality under this statute. All data will be either returned to CDC or destroyed, as specified by the contract.
                                                                            </p>
                                                                            <p>
                                                                                Appropriate Privacy Act provisions and confidentiality provisions under section 308(d) of the Public Health Service Act are included in contracts. The CDC Project Director, contract officers, and project officers oversee compliance with these requirements.
                                                                            </p>
                                                                            <p>
                                                                                4. Implementation guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary Chapter PHS.hf: 45-13; Part 6, "Automated Information System Security," of the HHS Information Resources Management Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31). FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B--Archives and Records.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="retentionAndDisposal">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                CDC retains research records in accordance with the CDC Records Control Schedule Item 37, which allows the system manager to maintain the records for 20 years unless needed for future reference. Because five-year mortality updates are planned until the study population expires, and health information from the questionnaire will be correlated with the mortality data, the computerized records to which questionnaire data will be converted may be kept as long as research needs dictate. Contractors will retain the records only as long as necessary to complete data collection and verify CDC's receipt of the data in usable form.
                                                                            </p>
                                                                            <p>
                                                                                Records may be transferred to a Federal Records Center for storage when no longer needed for evaluation or analysis and will be retained there subject to statutory confidentiality requirements. Disposal methods include the paper recycling process, shredding hardcopy records, and erasing computer tapes and disks.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="systemManager">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Director, National Center for Environmental Health, Chamblee Bldg. 101, Rm. 3116, Centers for Disease Control, 4770 Buford Highway NE, Atlanta, GA 30341-3724.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="notificationProcedure">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                An individual may learn if a record exists about himself by contacting the system manager at the address above. Persons who knowingly and willfully request or acquire a record pertaining to an individual under false pretenses are subject to a 5,000 dollars fine for this criminal offense. Requesters in person must provide photo identification (such as driver's license) or other positive identification (i.e., place of birth, etc.) that would authenticate the identity of the individual making the request. Individuals who do not appear in person must submit a notarized request to verify their identity. A guardian who requests notification of, or access to, a mentally incompetent or severely physically impaired person's record must provide a birth certificate (or notarized copy), court order, or other competent evidence of guardianship. An individual who requests notification of, or access to, a medical record shall at the time the request is made, designate in writing a responsible representative (who may be a physician, other health professional, or other responsible individual) who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.
                                                                            </p>
                                                                            <p>
                                                                                In addition, the following information must be provided when requesting notification: (1) Full name and social security or military service number; (2) nature of the study in which the requester participated.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="recordAccessProcedures">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="contestingRecordProcedures">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="recordSourceCategories">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Subject individuals, Department of Defense (Army and Joint Services Environmental Support Group), Surveillance, Epidemiology, and End Results Centers (cancer registries). Records are derived from U.S. Army system of records: AO708.02ADAPC, "Official Military Personnel File.`
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="systemsExempted">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                None.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection></section>

                                                                    <section id="09-20-0163" toc="yes">
                                                                        <systemNumber>09-20-0163</systemNumber>
                                                                        <subsection type="systemName"> Applicants for National Center for Health Statistics Technical Assistance, HHS/OASH/NCHS.</subsection>
                                                                        <subsection type="securityClassification">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    None.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="systemLocation">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    National Center for Health Statistics, Presidential Building, rm. 1140, Centers for Disease Control, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="categoriesOfIndividuals">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Applicants for and students of concentrated, intensive short-term courses related to health statistics. They are employees of Federal, State, and local governments and other persons in health-related fields engaged in collecting and analyzing vital and health statistics.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="categoriesOfRecords">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Applicant form which contains brief education information, current employment, and courses in which applicant is interested.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="authorityForMaintenance">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Public Health Service Act, section 304(b)(1) (42 U.S.C. 242b), authorizing the Secretary to use resources to provide technical assistance.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="purpose">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    To set up courses, notify applicants of acceptance or non-acceptance, and acceptance for a future course if necessary. Used exclusively within the National Center for Health Statistics (NCHS).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="routineUsesOfRecords">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
                                                                                </p>
                                                                                <p>
                                                                                    2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
                                                                                </p>
                                                                                <p>
                                                                                    (a) HHS, or any component thereof; or
                                                                                </p>
                                                                                <p>
                                                                                    (b) Any HHS employee in his or her official capacity; or
                                                                                </p>
                                                                                <p>
                                                                                    (c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
                                                                                </p>
                                                                                <p>
                                                                                    (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
                                                                                </p>
                                                                                <p>
                                                                                    is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                                                                </p>
                                                                                <p>
                                                                                    Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="policiesAndPractices">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Storage:
                                                                                </p>
                                                                                <p>
                                                                                    Alphabetically filed in file cabinet.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="retrievability">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Retrievable by name.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="safeguards">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Measures to prevent unauthorized disclosures are implemented as appropriate for the particular records maintained. NCHS implements personnel, physical, and procedural safeguards as follows:
                                                                                </p>
                                                                                <p>
                                                                                    (1) Authorized Users: Records are used only by staff administering the technical assistance programs.
                                                                                </p>
                                                                                <p>
                                                                                    (2) Physical Safeguards: Routine building security.
                                                                                </p>
                                                                                <p>
                                                                                    (3) Procedural Safeguards: Persons other than staff authorized to work with the records are not allowed access to them.
                                                                                </p>
                                                                                <p>
                                                                                    These safeguards are established in accordance with guidelines in DHHS Chapter 45-13 of the General Administration Manual, in supplementary Chapter PHS.hf:45-13, and in the NCHS Staff Manual on Confidentiality.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="retentionAndDisposal">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    File destroyed six months after each course is completed.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="systemManager">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Director, National Center for Health Statistics, Presidential Building,  Rm. 1140, Centers for Disease Control, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="notificationProcedure">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    To determine if a record exists, write to the System Manager.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="recordAccessProcedures">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Same as notification procedures. Positive identification is required from anyone seeking access. Requestors should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosures that have been made of their records, if any.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="contestingRecordProcedures">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Contact the official at the address specified under System Manager above, reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="recordSourceCategories">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Voluntary submission of Application Form by person wishing to take the courses.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="systemsExempted">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    None.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection></section>

                                                                        <section id="09-20-0164" toc="yes">
                                                                            <systemNumber>09-20-0164</systemNumber>
                                                                            <subsection type="systemName"> Health and Demographic Surveys Conducted in Probability Samples of the U.S. Population, HHS/OASH/NCHS.</subsection>
                                                                            <subsection type="securityClassification">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        None.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="systemLocation">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        National Center for Health Statistics, Presidential Building, rm. 1140, Centers for Disease Control, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="categoriesOfIndividuals">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Individuals and members of households selected by probability sampling techniques to be representative of the civilian population of the United States.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="categoriesOfRecords">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Records containing information on: (1) The incidence of illness and accidental injuries, prevalence of diseases and impairments, the extent of disability, the utilization and cost of health care services, and other health characteristics of individuals obtained in household interviews and from their named health care providers and insurers; or (2) the nutritional status, prevalence levels of specially defined chronic diseases, growth and development patterns and distributions of various health related measurements and related data obtained in a survey involving health examinations, tests, and other measurement procedures; or (3) marital and child bearing history and intended future births, the use of prenatal care, and the family planning practices of individual women obtained by interview. Demographic and socioeconomic characteristics such as age, marital status, education, occupation, and family income are also obtained.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="authorityForMaintenance">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Public Health Service Act, Section 306(b) (42 U.S.C. 242k).
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="purpose">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        The data are used for statistical purposes only. Uses within the Department include the preparation of aggregated data in the form of statistical tables for publication, analysis, and interpretation, to meet the legislative mandates of 42 U.S.C. 242k, i.e., to determine levels of illness and disability and their effects on the population, the use of health care facilities, trends in family formation and dissolution, and the like.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="routineUsesOfRecords">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        The data are disseminated for purposes of statistical research and analysis outside DHHS in forms which do not permit the identification of individuals, such as publications of statistical tables, specially requested tabulations and public use computer tapes. These are communicated to interested persons outside DHHS, such as members of Congress and their staffs, other executive branch agencies, universities, States, cities, private foundations, etc. The findings are used by demographers, sociologist, health statisticians, epidemiologists, other scholars and concerned citizens, to evaluate health matters, make determinations on needs for legislation, appropriations, new service programs, and the like.
                                                                                    </p>
                                                                                    <p>
                                                                                        The Department occasionally contracts with a private firm for the purpose of collecting analyzing, aggregating, or otherwise refining records in this system. Relevant records are disclosed to such a contractor. The contractor is required to maintain Privacy Act safeguards with respect to such records.
                                                                                    </p>
                                                                                    <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="policiesAndPractices">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Storage:
                                                                                    </p>
                                                                                    <p>
                                                                                        Paper files and magnetic tapes.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="retrievability">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        A serial number tied to the selection process of successively smaller geographic areas is assigned to each record on magnetic tape. This serial number is cross-indexed to the original, individually identifiable record.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="safeguards">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Measures to prevent unauthorized disclosures are implemented as appropriate for the particular records maintained. NCHS and its contractors implement personnel, physical, and procedural safeguards as follows:
                                                                                    </p>
                                                                                    <p>
                                                                                        1. Authorized users: Persons authorized and needing to use the records, including project directors, contract officers, interviewers, analysts, statisticians, statistical clerks, and data entry personnel on the staffs of the Center and the contractors.
                                                                                    </p>
                                                                                    <p>
                                                                                        2. Physical safeguards: The manual portions of the records are stored in locked files or offices when not in use. (The automated portions of the records do not contain individually identifiable data. Because they are not subject to the Privacy Act, descriptions of the computer safeguards used are not included in this notice.) Access to the buildings in which the manual records are stored is controlled by special entry devices and 24-hour security guards.
                                                                                    </p>
                                                                                    <p>
                                                                                        3. Procedural safeguards: All employees of NCHS and contractor personnel with access to NCHS records are required, as a condition of employment, to sign an affidavit binding them to nondisclosure of individually identifiable information; periodic training sessions are conducted to reinforce the confidentiality restrictions.
                                                                                    </p>
                                                                                    <p>
                                                                                        Contractors who maintain records in the system are instructed to make no further disclosure of the records. Privacy Act requirements are specifically included in contracts for survey and research activities related to this system. The HHS project directors, contract officers, and project officers oversee compliance with these requirements.
                                                                                    </p>
                                                                                    <p>
                                                                                        These safeguards are in accordance with chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual; supplementary chapter PHS.hf: 45-13; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 312); and the NCHS Staff Manual on Confidentiality.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="retentionAndDisposal">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Original survey records are reviewed for accuracy, edited, and data (without personal identifiers such as name or Social Security Number) are transferred to magnetic tape. The original records are retained in office files of NCHS until the process of conversion to magnetic tape and verification of information is completed. This process is completed within approximately nine months. The original records are then sent to the Federal Records Center where they are stored for 5 years for interview survey records and 10 years for examination records. Microfilm copies of examination records are retained at the Federal Records Center for 40 years.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="systemManager">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Director, National Center for Health Statistics, Presidential Building, rm 1140, Centers for Disease Control, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="notificationProcedure">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        To determine if a record exists, write to the System Manager.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="recordAccessProcedures">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Access to record systems which have been granted an exemption from the Privacy Act access requirement may be made at the discretion of the System Manager. Positive identification is required from anyone seeking access. Appeal of access refusal may be made to the Director, Office of Management, Public Health Service. An individual may also request an accounting of disclosures of his/her record, if any.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="contestingRecordProcedures">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        If access has been granted, contact the System Manager and reasonably identify the record, specify the information being contested, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="recordSourceCategories">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Respondents included in the survey samples.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="systemsExempted">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        With respect to this system of records, exemption has been granted from the requirements contained in subsections 552a(c)(3), (d) (1) through (4), and (e)(4) (G) and (H) in accordance with the provisions of subsection 552a(k)(4) of the Privacy Act of 1974. The reason this system has been exempted is that this system contains only records required by statute to be maintained and used solely as statistical records. The exemption was published in the Federal Register, October 8, 1975, page 47413.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection></section>

                                                                            <section id="09-20-0165" toc="yes">
                                                                                <systemNumber>09-20-0165</systemNumber>
                                                                                <subsection type="systemName"> Health Manpower Inventories and Surveys, HHS/OASH/NCHS.</subsection>
                                                                                <subsection type="securityClassification">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            None.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="systemLocation">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            National Center for Health Statistics, Presidential Building, rm. 1140, Centers for Disease Control, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="categoriesOfIndividuals">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Individuals trained in specific health occupations, such as dentists, nurses, pharmacists, optometrists, dental hygienists, and other providers of health care services.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="categoriesOfRecords">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Records containing information on educational attainment, place of education, activity status, place and setting of employment or practice, place of residence, date of birth, sex, and marital status.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="authorityForMaintenance">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Public Health Service Act, section 306(b) (42 U.S.C. 242k).
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="purpose">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            The data are used for statistical purposes only. Uses within the Department include the preparation of aggregated data in the form of statistical tables for publication, analysis, and interpretation to meet legislative mandates of the Public Health Service Act, section 306 (42 U.S.C. 242k), such as an annual report on health resources, including a description and analysis of the statistics included under section 306(b)(1)(G). In addition, probability samples of individuals are selected by NCHS for statistical research purposes. Tables, magnetic tapes, and statistical samples of individuals are provided for statistical purposes only to the Bureau of Health Professions, Health Resources and Services Administration, for its use in determining health manpower scarcity areas, for loan forgiveness, and developing and evaluating educational and training programs for health manpower.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="routineUsesOfRecords">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            The data are made available to Health Systems Agencies and the State Agency designated under the Public Health Service Act (42 U.S.C 300 l and m) for statistical purposes only for developing and evaluating health plans.
                                                                                        </p>
                                                                                        <p>
                                                                                            The data are also disseminated for the purpose of statistical research and analysis outside DHHS in forms which do not permit the identification of individuals, such as publication of statistical tables, specially requested tables, and public use magnetic tapes. These are communicated to interested persons outside DHHS, such as Members of Congress, other executive branch agencies, professional associations, universities, State, cities, private foundations, etc. The statistical summaries are used by health manpower researchers, legislators statisticians and concerned citizens to evaluate the Nation's health manpower resources, make determinations on needs for legislation, new health manpower training programs, and the like.
                                                                                        </p>
                                                                                        <p>
                                                                                            The Department occasionally contracts with a private firm for the purpose of collecting, analyzing, aggregating or otherwise refining records in the system. Relevant records are disclosed to such a contractor. The contractor is required to maintain Privacy Act safeguards with respect to such records.
                                                                                        </p>
                                                                                        <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.</p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="policiesAndPractices">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Storage:
                                                                                        </p>
                                                                                        <p>
                                                                                            Paper files and magnetic tape.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="retrievability">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Name and address, date of the inventory or survey, and other identifiers permit the retrieval of a computer record of the individual's information contained on magnetic tape. Original records of information are reviewed by the contractor and/or National Center for Health Statistics (NCHS) staff for accuracy and edited, and data with personal identifier (such as name and address) are transferred to magnetic tape. The records are then matched by personal identifiers to produce an unduplicated file of individuals in a health occupation.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="safeguards">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Measures to prevent unauthorized disclosures are implemented as appropriate for the particular records maintained. NCHS and its contractors implement personnel, physical, and procedural safeguards as follows:
                                                                                        </p>
                                                                                        <p>
                                                                                            1. Authorized users: Persons authorized and needing to use the records, including project directors, contract officers, interviewers, analysts, statisticians, statistical clerks, and data entry personnel on the staffs of the Center and the contractors.
                                                                                        </p>
                                                                                        <p>
                                                                                            2. Physical safeguards: The manual portions of the records are stored in locked files or offices when not in use. The automated records and the computer equipment are in secured areas with fire extinguishers and sprinkler system. Access to the buildings in which the manual and the automated records are stored is controlled by special entry devices and 24-hour security guards.
                                                                                        </p>
                                                                                        <p>
                                                                                            3. Procedural safeguards: All employees of NCHS and contractor personnel with access to NCHS records are required, as a condition of employment, to sign an affidavit binding them to nondisclosure of individually identifiable information; periodic training sessions are conducted to reinforce the confidentiality restrictions. Data stored in computers are accessed through the use of passwords/keywords known only to the principal investigators and authorized personnel. These passwords/keywords are changed frequently.
                                                                                        </p>
                                                                                        <p>
                                                                                            Contractors who maintain records in the system are instructed to make no further disclosure of the records. Privacy Act requirements are specifically included in contracts for survey and research activities related to this system. The HHS project directors, contract officers, and project officers oversee compliance with these requirements.
                                                                                        </p>
                                                                                        <p>
                                                                                            These safeguards are in accordance with chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual; supplementary chapter PHS.hf: 45-13; Part 6, "ADP Systems Security," of the HHS ADP Systems Manual; the National Bureau of Standards of Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 312); and the NCHS Staff Manual on Confidentiality.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="retentionAndDisposal">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            The original records are retained in the offices of national professional associations and/or State boards of licensure, or the NCHS data processing facility until the process of conversion to magnetic tape and verification of information is completed and a subsequent inventory or survey is initiated. For these reasons the records may be retained for a period of up to five years before disposal.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="systemManager">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Director, National Center for Health Statistics, Centers for Disease Control, Presidential Building, Rm. 1140, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="notificationProcedure">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            To determine if a record exists, write to the System Manager at the above address.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="recordAccessProcedures">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Access to record systems which have been granted an exemption from the Privacy Act access requirement may be made at the discretion of the System Manager. Positive identification is required from anyone seeking access. Appeal of access refusal may be made to the Director, Office of Management, Public Health Service. An individual may also request an accounting of disclosure of his/her record, if any.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="contestingRecordProcedures">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            If access has been granted, contact the System Manager and reasonably identify the record, specify the information being contested, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="recordSourceCategories">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Health practitioners, state licensing agencies, or professional associations.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="systemsExempted">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            With respect to this system of records, exemption has been granted from the requirements contained in subsections 552a(c)(3), (d)(1) through (4), and (e)(4)(G) and (H) in accordance with the provisions of subsection 552a(k)(4) of the Privacy Act of 1974. The reasons that the system has been exempted is that this system contains only records required by statute to be maintained and used solely as statistical records. The exemption was published in the <i>Federal Register</i>, October 8, 1975, page 47413.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                            </section>
                                                                            <section id="09-20-0166" toc="yes">
                                                                                <systemNumber>09-20-0166</systemNumber>
                                                                                <subsection type="systemName"> Vital Statistics for Births, Deaths, Fetal Deaths, Marriages and Divorces Occurring in the United States during Each Year, HHS/OASH/NCHS.</subsection>
                                                                                <subsection type="securityClassification">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            None.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="systemLocation">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            National Center for Health Statistics, Centers for Disease Control, Presidential Building, Rm. 1140, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="categoriesOfIndividuals">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Individuals who are born and their parents; individuals who die; individuals who are married or divorced; and parents experiencing fetal deaths.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="categoriesOfRecords">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            The records include microfilm images of State records or machine-readable data prepared by the State from records collected under the laws of each State for births, deaths, fetal deaths, marriages and divorces. The records contain the demographic characteristics of individuals associated with each event. In addition, the birth records include information on the characteristics of each live birth, the health status of the infant, and socioeconomic characteristics of the parents. The death records contain medical information relating to cause of death and to socioeconomic characteristics of the deceased; the fetal death record contains medical information relating to cause of death and socioeconomic characteristics of the parents. Marriages and divorces include demographic and socioeconomic characteristics of both parties to the event and legal information regarding the event.
                                                                                        </p>
                                                                                        <p>
                                                                                            Periodically the National Center for Health Statistics (NCHS) conducts followback surveys, collecting information on random samples of births and deaths through mail questionnaires. The content of questionnaires for the followback surveys varies. Past surveys have collected information on such topics as hospital utilization in the last year of life, smoking habits of the deceased, health status of infants, and pregnancy and employment histories of mothers.
                                                                                        </p>
                                                                                        <p>
                                                                                            Lists of names and other identifying information in the system are provided to NCHS by individuals and organizations who for health research purposes seek to have them matched against files of decedents in order to identify State death records.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="authorityForMaintenance">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Public Health Service Act, section 306(h) (42 U.S.C. 242k.)
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="purpose">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            The data are used for statistical purposes only. Uses within the Department include the preparation of aggregated data in the form of statistical tables for publication, analysis, and interpretation, to meet the legislative mandates of 42 U.S.C 242k, i.e., to determine the extent and nature of illness and disability of the population of the U.S., including life expectancy and levels of infant and maternal mortality, environmental and other health hazards, trends in family formation, growth, and dissolution, and other related matters. The followback surveys are designed primarily to expand the scope of data that NCHS can collect from the national registration system, to make the registration system more responsive to changing needs for data, and to evaluate the quality of data collected on the birth and death records.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="routineUsesOfRecords">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            The processed data are disseminated for public use in forms that do not permit identification of individuals, such as published statistical tables, special unpublished tabulations, and public use computer tapes, which carry no individual identifiers. They are used by members of Congress and their staffs, other executive branch agencies, state and city governments, public and private research institutions, life insurance companies, faculty and students of universities, physicians, workers in health information, newspaper reporters and feature writers, etc. The findings are used to make determinations on needs for legislation, appropriations, and programs in the health field; to pinpoint health problems, measure progress of national health programs, and make population estimates; for epidemiological studies, marketing research, sociological studies, and studies of the family; and for other research directed at understanding our society.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="policiesAndPractices">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Storage:
                                                                                        </p>
                                                                                        <p>
                                                                                            Paper files and magnetic tapes.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="retrievability">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Some States submit microfilm copies of certificates of birth, death, fetal death, marriage, and divorce, and statistics are extracted from them. These microfilms contain individual identifiers; they are the only individually identified records in the system. Other States submit vital statistics data on magnetic tape, showing only a State file number for each case but no personal identifiers.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="safeguards">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Measures to prevent unauthorized disclosures are implemented as appropriate for the particular records maintained. NCHS and its contractors implement personnel, physical, and procedural safeguards as follows:
                                                                                        </p>
                                                                                        <p>
                                                                                            1. Authorized users: Persons authorized and needing to use the records, including project directors, contract officers, interviewers, analysts, statisticians, statistical clerks, and data entry personnel on the staffs of the Center and the contractors.
                                                                                        </p>
                                                                                        <p>
                                                                                            2. Physical safeguards: The manual portions of the records are stored in locked files or offices when not in use. (The automated portions of the records do not contain individually identifiable data. Because they are not subject to the Privacy Act, descriptions of the computer safeguards used are not included in this notice.) Access to the buildings in which the manual records are stored is controlled by special entry devices and 24-hour security guards.
                                                                                        </p>
                                                                                        <p>
                                                                                            3. Procedural safeguards: All employees of NCHS and contractor personnel with access to NCHS records are required, as a condition of employment, to sign an affidavit binding them to nondisclosure of individually identifiable information; periodic training sessions are conducted to reinforce the confidentiality restrictions.
                                                                                        </p>
                                                                                        <p>
                                                                                            Contractors who maintain records in the system are instructed to make no further disclosure of the records. Privacy Act requirements are specifically included in contracts for survey and research activities related to this system. The HHS project directors, contract officers, and project officers oversee compliance with these requirements.
                                                                                        </p>
                                                                                        <p>
                                                                                            These safeguards are in accordance with chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual; supplementary chapter PHS.hf: 45-13; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 312); and the NCHS Staff Manual on Confidentiality.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="retentionAndDisposal">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            The microfilm copies of the individually identifiable records are retained in office files of NCHS until the process of conversion to magnetic tape and verification of information is completed. The death records are sent to the Federal Records Center ten years after tabulation for deaths occurring during the three year period surrounding census years and one year after tabulation for other years. They are held until disposed of, 15 years after tabulation for deaths of the censal years, and five years after tabulation for other years. Records of births, fetal deaths, marriages, and divorces are disposed of two years after tabulation. The questionnaires for the followback surveys are destroyed after conversion to magnetic tape, tabulation, and analyses have been completed.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="systemManager">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Director, National Center for Health Statistics, Centers for Disease Control, Presidential Building, Rm. 1140, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="notificationProcedure">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            To determine if a record exists, write to the System Manager at the above address.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="recordAccessProcedures">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Access to record systems which have been granted an exemption from the Privacy Act access requirement may be made at the discretion of the System Manager. Positive identification is required from anyone seeking access. Appeal of access refusal may be made to the Director, Office of Management, Public Health Service. An individual may also request an accounting of disclosures of his/her record, if any.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="contestingRecordProcedures">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            If access has been granted, contact the System Manager and reasonably identify the record, specify the information being contested, and state the corrective action sought with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="recordSourceCategories">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            Vital statistics records are obtained from State vital statistics offices, or, in rare instances, from other State or county repositories of marriage or divorce data. Information in followback surveys is obtained from hospitals, physicians, or relatives of the infants or the deceased.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection>
                                                                                <subsection type="systemsExempted">
                                                                                    <xhtmlContent>
                                                                                        <p>
                                                                                            With respect to this system of records, exemption has been granted from the requirements contained in subsections 552a(c)(3), (d)(1) through (4), and (e)(4)(G) and (H), in accordance with the provision of subsection 552a(k)(4) of the Privacy Act of 1974. The reason that the system has been exempted is that this system contains only records required by statute to be maintained and used solely as statistical records. The exemption was published in the Federal Register, October 8, 1975, page 47413.
                                                                                        </p>
                                                                                    </xhtmlContent>
                                                                                </subsection></section>

                                                                                <section id="09-20-0167" toc="yes">
                                                                                    <systemNumber>09-20-0167</systemNumber>
                                                                                    <subsection type="systemName"> Health Resources Utilization Statistics, HHS/OASH/NCHS.</subsection>
                                                                                    <subsection type="securityClassification">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                None.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="systemLocation">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                National Center for Health Statistics, Centers for Disease Control, Presidential Building, Rm. 1140, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="categoriesOfIndividuals">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                Recipients of medical care included in statistical surveys and reports of the National Center for Health Statistics (NCHS), including but not limited to: (1) Staff and residents of nursing homes selected by random sampling techniques to be representative of nursing homes in the U.S.; (2) physicians providing medical care and patients visiting such physicians; (3) patient medical records from selected short-stay hospitals.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="categoriesOfRecords">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                Records containing information on: (1) The utilization of long-term care and nursing home care through data on clients and residents (demographic and social characteristics, health status and charges paid for care) and the facility (general characteristics, certification, services offered and expense); (2) the demographic characteristics, medical and other problems of persons visiting physicians, and the physicians' diagnosis, treatment, and disposition decisions made during such visits as obtained from physicians during randomly assigned one- week survey periods; (3) the demographic characteristics administrative information (admission and discharge dates, discharge status, and medical record number), and medical information (diagnosis and surgical procedures) abstracted from the face sheet of short-stay hospital medical records.
                                                                                            </p>
                                                                                            <p>
                                                                                                In many cases, these records do not contain individual identifiers when they come under control of the National Center for Health Statistics; they carry only sequence numbers, which only the originating agency would be able to translate into a personal identifier-- and even then, not in all cases. Names of residents and staff of nursing homes and patients of physicians are listed on separated forms for sampling purposes only and are not included in the final statistical records.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="authorityForMaintenance">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                Public Health Service Act, Section 306(b) (42 U.S.C. 242k).
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="purpose">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                The data are used for statistical purposes only, as specified by statute, section 308(d) of 42 U.S.C. 242m. Uses within the Department include the preparation of aggregated data in the form of statistical tables for publication, analysis and interpretation to meet the legislative mandates of 42 U.S.C. 242k, i.e., collection of statistics on the utilization of health services, including the utilization of: (1) Long-term care services and nursing home facilities to determine levels of illness and disability, effects on the serviced population, and the costs of care; (2) ambulatory health services by specialties and types of practice of the health professionals providing such services; and (3) short-stay hospitals to determine characteristics of patients, length of stay, diagnosis and surgical operations, and utilization patterns of care in hospitals of different size and ownership.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="routineUsesOfRecords">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                The data are disseminated in forms which do not permit the identification of individuals, such as publications of statistical tables, special requested tabulations, and public use computer tapes. These are communicated to interested persons outside DHHS, such as members of Congress and their staffs, other executive branch agencies, universities and medical schools, state and local health planning agencies, private foundations, etc. The findings are used by demographers, sociologists, health statisticians, epidemiologists, medical educators, health planners, other scholars, and concerned citizens, to evaluate health matters, make determinations on needs for legislation, appropriations, new service programs, and the like.
                                                                                            </p>
                                                                                            <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.</p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="policiesAndPractices">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                Storage:
                                                                                            </p>
                                                                                            <p>
                                                                                                Paper files and magnetic tapes.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="retrievability">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                Data are retrieved by individual identifier only in the editing stage of data processing and only for the purpose of correcting errors in the recording of information. Original survey records are reviewed for accuracy and edited, then data (without personal identifiers such as name or Social Security Number) are transferred to magnetic tape.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="safeguards">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                Measures to prevent unauthorized disclosures are implemented as appropriate for the particular records maintained. NCHS and its contractors implement personnel, physical, and procedural safeguards as follows:
                                                                                            </p>
                                                                                            <p>
                                                                                                1. Authorized users: Persons authorized and needing to use the records, including project directors, contract officers, interviewers, analysts, statisticians, statistical clerks, and data entry personnel on the staffs of the Center and the contractors.
                                                                                            </p>
                                                                                            <p>
                                                                                                2. Physical safeguards: The manual portions of the records are stored in locked files or offices when not in use. (The automated portions of the records do not contain individually identifiable data. Because they are not subject to the Privacy Act, descriptions of the computer safeguards used are not included in this notice.) Access to the buildings in which the manual records are stored is controlled by special entry devices and 24-hour security guards.
                                                                                            </p>
                                                                                            <p>
                                                                                                3. Procedural safeguards: All employees of NCHS and contractor personnel with access to NCHS records are required, as a condition of employment, to sign an affidavit binding them to nondisclosure of individually identifiable information; periodic training sessions are conducted to reinforce the confidentiality restrictions.
                                                                                            </p>
                                                                                            <p>
                                                                                                Contractors who maintain records in the system are instructed to make no further disclosure of the records. Privacy Act requirements are specifically included in contracts for survey and research activities related to this system. The HHS project directors, contract officers, and project officers oversee compliance with these requirements.
                                                                                            </p>
                                                                                            <p>
                                                                                                These safeguards are in accordance with chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual; supplementary chapter PHS.hf: 45-13; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 312); and the NCHS Staff Manual on Confidentiality.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="retentionAndDisposal">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                The original records are retained in office files of NCHS or NCHS contractors for two years. The procedure for family planning records differs in that the original documents are retained in office files for only two months. In all instances, the original records are then sent to the Federal Records Center where they are stored for five years.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="systemManager">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                Director, National Center for Health Statistics, Centers for Disease Control, Presidential Building, Rm. 1140, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="notificationProcedure">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                To determine if a record exists, write to the System Manager at the above address.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="recordAccessProcedures">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                Access to record systems which have been granted an exemption from the Privacy Act access requirement may be made at the discretion of the System Manager. Positive identification is required from anyone seeking access. Appeal of access refusal may be made to the Director, Office of Management, Public Health Service. An individual may also request an accounting of disclosures of his/her record, if any.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="contestingRecordProcedures">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                If access has been granted, contact the System Manager and reasonably identify the record, specify the information being contested, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="recordSourceCategories">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                Hospitals, physicians, clinics, nursing homes, and other providers of health care.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                    <subsection type="systemsExempted">
                                                                                        <xhtmlContent>
                                                                                            <p>
                                                                                                With respect to this system of records, exemption has been granted from the requirements contained in subsections 552(a)(3), (d)(1) through (4), and (e)(4)(G) and (H), in accordance with provisions of subsections 552a (k)(4) of the Privacy Act of 1974. The reason for this exemption is that this system contains only records required by statute to be maintained and used solely as statistical records. The exemption was published in the <i>Federal Register</i>, September 11, 1978, page 40229.
                                                                                            </p>
                                                                                        </xhtmlContent>
                                                                                    </subsection>
                                                                                </section>

                                                                             
                                                                                    <section id="09-20-0169" toc="yes">
                                                                                        <systemNumber>09-20-0169</systemNumber>
                                                                                        <subsection type="systemName"> Users of Health Statistics, HHS/OASH/NCHS.</subsection>
                                                                                        <subsection type="securityClassification">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    None.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="systemLocation">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    National Center for Health Statistics, Centers for Disease Control, Presidential Building, Rm. 1140, 6525 Belcrest Road, Hyattsville, Maryland 20782.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="categoriesOfIndividuals">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Persons who are past, present, or potential users of health statistics and would therefore have special interests in the programs conducted by NCHS, such as (1) persons who subscribe to NCHS publication series, (2) persons who purchase NCHS public use data tapes or publications, (3) persons who contact NCHS to request data or information on health statistics, (4) persons who attend health statistics conferences, and (5) persons known from their publications or otherwise to have a research, legislative, policy, or adminstrative interest in data produced by NCHS.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="categoriesOfRecords">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    This system consists of information relating to the professional health statistical interests of health statistics users, such as their: Name, address, position, organization, education, memberships in professional organizations, special committee and task force assignments, offices held in organizations, publications, health statistics meetings attended, uses made of health statistics, health statistics projects, purchases of NCHS tapes or publications, and expressions of interests and concerns about health statistics.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="authorityForMaintenance">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Public Health Service Act, section 308(g)(2) (42 U.S.C. 242m(g)(2), which authorizes the Secretary to take necessary action to assure that appropriate, high quality data are disseminated on as wide a basis as is practicable.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="purpose">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    NCHS uses the data in detemining how improvements can be made in (1) the content and methodology of its data programs, (2) its data publications, (3) dissemination of health statistics, and (4) meetings or other means for soliciting users' concerns and knowledge sharing.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="routineUsesOfRecords">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    1. The Department occasionally contracts with a private firm for the purpose of conducting surveys or collecting, analyzing, aggregating, otherwise refining, or evaluating data in this system. Relevant records are disclosed to such a contractor. The contractor is required to maintain Privacy Act safeguards with respect to such records.
                                                                                                </p>
                                                                                                <p>
                                                                                                    2. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
                                                                                                </p>
                                                                                                <p>
                                                                                                    3. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
                                                                                                </p>
                                                                                                <p>
                                                                                                    (a) HHS, or any component thereof; or
                                                                                                </p>
                                                                                                <p>
                                                                                                    (b) Any HHS employee in his or her official capacity; or
                                                                                                </p>
                                                                                                <p>
                                                                                                    (c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
                                                                                                </p>
                                                                                                <p>
                                                                                                    (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
                                                                                                </p>
                                                                                                <p>
                                                                                                    is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                                                                                </p>
                                                                                                <p>
                                                                                                    Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="policiesAndPractices">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Storage:
                                                                                                </p>
                                                                                                <p>
                                                                                                    The information is contained on paper records and/or computer-readable tape.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="retrievability">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Information is retrieved by name, and may also be retrievable by unique identifying number, address, specialty, or other identifying characteristics.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="safeguards">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Measures to prevent unauthorized disclosures are implemented as appropriate for the particular records maintained in each project.
                                                                                                </p>
                                                                                                <p>
                                                                                                    NCHS and its contractors implement personnel, physical, and procedural safeguards such as the following:
                                                                                                </p>
                                                                                                <p>
                                                                                                    (1) Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to authorized contractor personnel, the NCHS project officer, and NCHS employees whose duties require the use of such information. One-time and special access to the data is controlled by the System Manager, the NCHS Project Officer, and the Contract and/or Project Director. Furthermore, all employees of NCHS and contractor personnel with access to NCHS records are required, as a condition of employment, to sign an affidavit binding them to nondisclosure of identifiable individuals' information.
                                                                                                </p>
                                                                                                <p>
                                                                                                    (2) Physical Safeguards: Records are stored in locked files or secured areas. Computer terminals are in secured areas. Computerized files are further protected by the Resources Access Control Facility ("RACF").
                                                                                                </p>
                                                                                                <p>
                                                                                                    (3) Procedural Safeguards: Data stored in computers are accessed through the use of passwords/keywords known only to the principal investigators or authorized personnel. These passwords/keywords are changed frequently.
                                                                                                </p>
                                                                                                <p>
                                                                                                    Contractors who maintain records in this system are instructed to make no further disclosure of the records except as authorized by the system manager and permitted by the Privacy Act. Privacy Act requirements are specifically included in contracts for research activities related to this system. The HHS project directors, contract officers, and project officers oversee compliance with these requirements.
                                                                                                </p>
                                                                                                <p>
                                                                                                    The particular safeguards implemented in each project are developed in accordance with chapter 45-13, "Safeguarding Records Contained in Systems of Records," of the HHS General Administration Manual, supplementary chapter PHS hf. 45-13; Part 6, "ADP Systems Security," of the HHS Information Resources Manual; the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub 31).
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="retentionAndDisposal">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Records are retained for various periods of time depending upon how useful they are considered to be, in accordance with NCHS policy. Some records of users may be maintained indefinitely. Disposal methods include burning or shredding hard copy and erasing computer tapes and disks.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="systemManager">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Director, National Center for Health Statistics, Centers for Disease Control, Presidential Building, Rm. 1140, 6525 Belcrest Road, Hyattsville, MD 20782.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="notificationProcedure">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    To determine if a record exists, write to the System Manager. Information needed consists of name and address of individual.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="recordAccessProcedures">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Same as notification procedures. Requestors should also reasonably specify the record contents being sought. Positive indentification is required from anyone seeking access. You may also request an accounting of disclosures that have been made of your record, if any.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="contestingRecordProcedures">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Write to the official at the address specified under notification procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="recordSourceCategories">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    Records may be obtained from (1) order forms for publications or public use data tapes, (2) mailing lists, (3) registration forms of meeting (4) author information in books and journals, (5) reference citations, and (6) reports of colleagues.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
                                                                                        <subsection type="systemsExempted">
                                                                                            <xhtmlContent>
                                                                                                <p>
                                                                                                    None.
                                                                                                </p>
                                                                                            </xhtmlContent>
                                                                                        </subsection>
</section>
                                                                                        <section id="09-20-0170" toc="yes">
                                                                                            <systemNumber>09-20-0170</systemNumber>

                                                                                            <subsection type="systemName">
                                                                                                National Select Agent Registry (NSAR)/Select Agent Transfer and Entity Registration Information System (SATERIS), HHS/CDC/COTPER.
                                                                                            </subsection>
                                                                                            <subsection type="securityClassification">
                                                                                                <xhtmlContent><p>
                                                                                                    Unclassified.
                                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="systemLocation">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Division of Select Agents and Toxins (DSAT), Coordinating Office for Terrorism Preparedness and Emergency Response (COTPER), Bldg. 20, Centers for Disease Control and Prevention (CDC), 1600 Clifton Road, NE., Atlanta, GA 30333 and Federal Records Center, 4712 Southpark Blvd., Ellenwood, GA 30294.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="categoriesOfIndividuals">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    The Responsible Official, alternate Responsible Official, owners of non-governmental entities, and individuals requesting access to select agents under the provisions of Part 73, of Title 42 of the Code of Federal Regulations (42 CFR part 73), Part 121 of Title 9 of the Code of Federal Regulations (9 CFR Part 121), and Part 331 of Title 7 of the Code of Federal Regulations (7 CFR part 331).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="categoriesOfRecords">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    The DSAT maintains records which include the names of the Responsible Official, alternate Responsible Official, owners of non- governmental entities, and individuals who have access, or who have applied to have access to select agents (defined as a virus, bacteria, fungus or toxin that could pose a severe threat to public health and safety, to animal or plant health; or animal or plant products), and the list of select agents to which they have access. The Responsible Official, alternate Responsible Official, owners of non-governmental entities, and individuals requesting access to select agents are required to provide their name, address, date of birth, and job title and the name of the institution that would be housing the select agent(s).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="authorityForMaintenance">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Public Health Security and Bioterrorism Preparedness and Response Act of 2002 and The Agricultural Bioterrorism Protection Act of 2002 (Pub. L. 107-188).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="purpose">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Records maintained in the National Select Agent Registry (NSAR)--a joint DSAT and U.S. Department of Agriculture/Animal and Plant Health Inspection Service (APHIS) information management system--are accessed by DSAT through the Select Agent Transfer and Entity Registration Information System (SATERIS) which is an user interface for data entry, data query, and routine reporting activities. The purpose of this system of records is to limit access to those select agents listed in 42 CFR Part 73, 9 CFR Part 121, and 7 CFR Part 331 to those individuals who have a legitimate need to handle or use such select agents, and who are not identified as a restricted person by the U.S. Attorney General. The NSAR is also used to track the possession, use, and transfer of select agents and is a single Web-based system shared by DSAT and APHIS.
                                                                                </p>
                                                                                <p>
                                                                                    DSAT conducts regulatory oversight of individuals and entities that possess, use, or transfer select agents. This includes the review of registration applications, conducting inspections of registered facilities or facilities requesting registration, processing requests to import select agents, processing all reports and requests received from individuals or entities regarding a select agent, and maintaining this information pertaining to individuals and entities that possess, use, and/or transfer select agents.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="routineUsesOfRecords">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Storage:
                                                                                </p>
                                                                                <p>
                                                                                    File folders, computer tapes and disks, CD-ROMs.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="retrievability">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    By name or DOJ identifier number.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="safeguards">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    The following special safeguards are provided to protect the records from inadvertent disclosure:
                                                                                </p>
                                                                                <p>
                                                                                    1. Authorized Users: A database security package is implemented on CDC computers to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Individuals who have routine access to these records are limited to Select Agent Program staff (DSAT FTEs and contractors) who have responsibility for conducting regulatory oversight of individuals and entities that possess, use, or transfer select agents.
                                                                                </p>
                                                                                <p>
                                                                                    2. Physical Safeguards: Paper records are maintained in locked cabinets in locked rooms in a restricted access location that is controlled by a cardkey system, and security guard service provides personnel screening of visitors. Electronic data files are password protected and stored in a restricted access location. The computer room is protected by an automatic sprinkler system, numerous automatic sensors (e.g., water, heat, smoke, etc.) are installed, and a proper mix of portable fire extinguishers is located throughout the computer room. The system is backed up on a nightly basis with copies of the files stored off site in a secure location. Computer workstations, lockable personal computers, and automated records are located in secured areas.
                                                                                </p>
                                                                                <p>
                                                                                    3. Procedural Safeguards: Protection for computerized records includes programmed verification of valid user identification code and password prior to logging on to the system; mandatory password changes, limited log-ins, virus protection, and user rights/file attribute restrictions. Password protection imposes user name and password log-in requirements to prevent unauthorized access. Each user name is assigned limited access rights to files and directories at varying levels to control file sharing. There are routine daily backup procedures and secure off-site storage is available for backup files.
                                                                                </p>
                                                                                <p>
                                                                                    Knowledge of individual tape passwords is required to access tapes, and access to the system is limited to users obtaining prior supervisory approval. To avoid inadvertent data disclosure, a special additional procedure is performed to ensure that all Privacy Act data are removed from computer tapes and/or other magnetic media. When possible, a backup copy of data is stored at an offsite location and a log kept of all changes to each file and all persons reviewing the file. Additional safeguards may also be built into the program by the system analyst as warranted by the sensitivity of the data set.
                                                                                </p>
                                                                                <p>
                                                                                    The DSAT and contractor employees who maintain records are instructed in specific procedures to protect the security of records, and are to check with the system manager prior to making disclosure of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel.
                                                                                </p>
                                                                                <p>
                                                                                    Appropriate Privacy Act provisions are included in contracts and the CDC Project Director, contract officers, and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.
                                                                                </p>
                                                                                <p>
                                                                                    The USDA/APHIS maintains similarly stringent safeguards that are discussed within that agency's Select Agent system of records notice.
                                                                                </p>
                                                                                <p>
                                                                                    4. Implementation Guidelines: The safeguards outlined above are in accordance with the HHS Information Security Program Policy and FIPS Pub 200, "Minimum Security Requirements for Federal Information and Information Systems." Data maintained on CDC's Mainframe and the COTPER LAN are in compliance with OMB Circular A-130, Appendix III. Security is provided for information collection, processing, transmission, storage, and dissemination in general support systems and major applications.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="retentionAndDisposal">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    The DSAT records and associated information are retained and dispositioned in accordance with DSAT records retention schedule, N1 -442-06-1, pending approval by the National Archives and Records Administration. The DSAT records will be retained for 10 years in compliance with the records retention schedule requirements or until such time as no longer needed for litigation or other records purposes. Records will be transferred to a Federal Records Center for storage when no longer in active use. Final disposition of records stored offsite at the Federal Records Center will be accomplished by a controlled process requesting final disposition approval from the record owner prior to any destruction to ensure records are not needed for litigation or other records purposes. Hard copy records and Sensitive But Unclassified (SBU) information designated for local disposition will be placed in a locked container or designated secure storage area while awaiting destruction. All SBU data will be destroyed in a manner that precludes its reconstruction, such as shredding. Electronic information will be deleted or overwritten using overwriting software that wipes the entire physical disk and not just the virtual disk. Overwriting is required for the destruction of all electronic SBU information.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="systemManager">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Director, Division of Select Agents and Toxins, Coordinating Office for Terrorism Preparedness and Emergency Response, Bldg. 20, Rm 4100, MS A46, Centers for Disease Control and Prevention, 1600 Clifton Road, NE., Atlanta, GA 30333.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="notificationProcedure">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    An individual may learn if a record exists about himself or herself by contacting the system manager at the above address. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must submit a notarized request on institutional letterhead to verify their identity. The knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a $5,000 fine and/or imprisonment.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="recordAccessProcedures">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Same as notification procedures. Requestors should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may also be requested.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="contestingRecordProcedures">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Contact the system manager at the address specified above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="recordSourceCategories">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Applicants registering for possession, use, and transfer of select agents and the U.S. Attorney General.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection></section>

                                                                        <section id="09-20-0171" toc="yes">
                                                                            <systemNumber>09-20-0171</systemNumber>
                                                                            <subsection type="systemName">Quarantine- and Traveler-Related Activities, Including Records for Contact Tracing Investigation and Notification under 42 CFR Parts 70 and 71, HHS/CDC/CCID.</subsection>
                                                                            <subsection type="securityClassification">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        None.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="systemLocation">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Division of Global Migration and Quarantine, National Center for the Preparedness, Detection, and Control of Infectious Disease (NCPDCID), Coordinating Center for Infectious Diseases (CCID), Centers for Disease Control and Prevention, 1600 Clifton Road, NE., Building 16; MS E03, Atlanta, GA 30333.
                                                                                    </p>
                                                                                    <p>
                                                                                        Records may occasionally be stored at Quarantine Stations located at key ports of entry and at contractor sites.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="categoriesOfIndividuals">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Individuals subject to quarantine or isolation orders, ill travelers (i.e., passengers and crew), contacts of ill travelers, and/or individuals exposed or suspected of being exposed to serious communicable diseases.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="categoriesOfRecords">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Passenger and crew manifests from conveyances carrying individuals subject to 42 CFR parts 70 and 71, case reports, illness response forms, medical assessments, medical records (including but not limited to clinical, hospital and laboratory data and data from other relevant tests), name, address, date of birth, and related information and documents collected for the purpose of carrying out agency responsibilities under sections 311 and 361-368 of the Public Health Services Act.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="authorityForMaintenance">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Sections 311, 361-368 of the Public Health Service Act.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="purpose">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        This system maintains records on the conduct of activities (e.g., quarantine, isolation) that fulfill HHS's and CDC's statutory authority under sections 311, 361-368 of the Public Health Service Act to prevent the introduction, transmission and spread of communicable diseases.
                                                                                    </p>
                                                                                    <p>
                                                                                        Records are collected when individual known or suspected to have been exposed to serious communicable diseases arrives into the United States from foreign countries or is engaged in interstate or international movement These records are used to (1) document reports of illness that may pose a public health risk occurring while on board airplanes, maritime vessels, and at land-border crossings of persons arriving from foreign countries or traveling between states; (2) perform contact tracing investigations and notifications of passengers and crew when known or suspected exposures to serious communicable diseases occur on board a conveyance arriving in the United States from a foreign country or traveling from one state or possession to another; (3) inform international, federal, state or local public health authorities so that these authorities may act to protect public health or safety; and (4) take such actions (e.g., quarantine or isolation) as necessary to prevent the introduction, transmission, and spread of serious communicable diseases from persons arriving into the United States from foreign countries or persons engaged in interstate or international movement.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="routineUsesOfRecords">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        (1) Records may be disclosed to contractors to handle program work duties, performing many of the same functions as FTEs within DGMQ in situations where additional staff is required. Contractors are required to maintain Privacy Act safeguards with respect to such records.
                                                                                    </p>
                                                                                    <p>
                                                                                        (2) Records may be disclosed to state and local health departments and other cooperating medical and public health authorities and their counsel to more effectively deal with outbreaks and other significant public health conditions.
                                                                                    </p>
                                                                                    <p>
                                                                                        (3) Personal information from this system may be disclosed as a routine use to appropriate conveyance personnel, Federal agencies, state and local health departments, Department of State and embassy personnel (U.S. and foreign), and health authorities in foreign countries for contact tracing investigations and notifications of possible exposures to serious communicable diseases in connection with travel.
                                                                                    </p>
                                                                                    <p>
                                                                                        (4) Records may be disclosed to the Department of Homeland Security to restrict travel of persons who pose a public health risk and in the instance of suspected domestic or international terrorism.
                                                                                    </p>
                                                                                    <p>(5) Disclosure may be made to medical personnel providing evaluation and care for ill or exposed persons, including travelers.</p>
                                                                                    <p>
                                                                                        (6) Records may be disclosed to the World Health Organization in accordance with U.S. responsibilities as a signatory to the International Health Regulations or other international agreements.
                                                                                    </p>
                                                                                    <p>
                                                                                        (7) Personal information may be disclosed to federal, state, and local authorities for taking necessary actions to place someone under quarantine or isolation, for enforcement of other quarantine regulations, or to protect the public's health and safety.
                                                                                    </p>
                                                                                    <p>
                                                                                        (8) Records may be disclosed to cooperating state and local legal departments enforcing concurrent legal authority related to quarantine or isolation activities.
                                                                                    </p>
                                                                                    <p>
                                                                                        (9) In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, foreign, state or local, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
                                                                                    </p>
                                                                                    <p>
                                                                                        (10) Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual
                                                                                    </p>
                                                                                    <p>
                                                                                        (11) In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, disclosure may be made to the Department of Justice to enable that Department to present an effective defense.
                                                                                    </p>
                                                                                    <p>
                                                                                        (12) Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="policiesAndPractices">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Storage:
                                                                                    </p>
                                                                                    <p>
                                                                                        Electronic media and file folders for hard-copy records.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="retrievability">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        By name of individual or other identifying particulars.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="safeguards">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        1. <i>Authorized Users:</i> A database security package is implemented on CDC's computer systems to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of the Centers for Disease Control and Prevention (CDC), or its contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.
                                                                                    </p>
                                                                                    <p>
                                                                                        2. <i>Physical Safeguards:</i> Access to the CDC Clifton Road facility where the mainframe computer is located is controlled by a cardkey system. Access to the computer room is controlled by a cardkey and security code (numeric keypad) system. Access to the data entry area is also controlled by a cardkey system. Guard service in buildings provides personnel screening of visitors. The local fire department is located directly next door to the Clifton Road facility. The computer room is protected by an automatic sprinkler system, numerous automatic sensors (e.g., water, heat, smoke, etc.) are installed, and a proper mix of portable fire extinguishers is located throughout the computer room. Computer files are backed up on a routine basis. Hard-copy records are stored in locked cabinets at CDC headquarters and CDC Quarantine stations which are located in a secure area of the airport.
                                                                                    </p>
                                                                                    <p>
                                                                                        3. <i>Procedural Safeguards:</i> Protection for computerized records, both on the mainframe and the National Center Local Area Network (LAN), includes programmed verification of valid user identification code and password prior to logging on to the system, mandatory password changes, limited log-ins, virus protection, and user rights/file attribute restrictions. Password protection imposes user name and password log-in requirements to prevent unauthorized access. Each user name is assigned limited access rights to files and directories at varying levels to control file sharing. There are routine daily back-up procedures, and secure off-site storage is available. To avoid inadvertent data disclosure, measures are taken to ensure that all data are removed from electronic media containing Privacy Act information. Additional safeguards may be built into the program by the system analyst, as warranted by the sensitivity of the data.
                                                                                    </p>
                                                                                    <p>CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the CDC Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.</p>
                                                                                    <p><i>Implementation Guidelines:</i> The safeguards outlined above are in accordance with the HHS Information Security Program Policy and FIPS Pub 200, "Minimum Security Requirements for Federal Information and Information Systems." Data maintained on CDC's Mainframe and the National Centers' LANs are in compliance with OMB Circular A-130, Appendix III. Security is provided for information collection, processing, transmission, storage, and dissemination in general support systems and major applications.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="retentionAndDisposal">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Contact tracing records will be maintained in the agency until the contact investigation is complete or no longer than twelve months, in accordance with proposed retention schedules; remaining quarantine records would be maintained 10 or 20 years, based on the applicable CDC records control schedule. Disposal methods include wiping electronic media and macerating paper materials.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="systemManager">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Director, NCPDCID, Coordinating Center for Infectious Diseases, Bldg. 1, Rm. 6013, MS C12, Centers for Disease Control and Prevention, 1600 Clifton Road, NE., Atlanta, GA 30333.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="notificationProcedure">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        An individual may learn if a record exists about himself or herself by contacting the system manager at the address listed above. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either: (1) Submit a notarized request to verify their identity; or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a $5,000 fine.
                                                                                    </p>
                                                                                    <p>
                                                                                        An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion. A parent or guardian who requests notification of, or access to, a child's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child by means of a birth certificate or court order, as well as verify that he or she is who he or she claims to be.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="recordAccessProcedures">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="contestingRecordProcedures">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="recordSourceCategories">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        Individuals, private physicians, state and local health departments, other health-care providers, conveyance personnel, cooperating public health agencies, foreign governments including ministries of health, and other federal agencies.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="systemsExempted">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        None</p>
                                                                                    </xhtmlContent>
</subsection>
</section>

    <section id="09-70-0500" toc="yes">
        <systemNumber>09-70-0500</systemNumber>
        
        <subsection type="systemName">"Health Plan Management System (HPMS)," HHS/CMS/CBC.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co-locations of CMS agents.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    Information is collected and maintained on recipients of Medicare Part A (Hospital Insurance) and Part B (supplementary medical insurance) services who are enrolled in Medicare health plans and prescription drug plans. Identifiable information will also be collected on individuals who are, but not limited to, complainants, including beneficiaries, relatives and caregivers, Congresspersons and their staff, State Health Insurance Program representatives, and providers of service and their staff.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The system contains demographic and identifying data, as well as survey and deficiency data. Identifying data includes, but is not limited to: name, title, address, city, state, ZIP code, e-mail address, telephone numbers, fax number, licensure number, SSN, Federal tax identification number, alias names, date of birth, gender, date admitted and/or date discharged. In addition, the CTM stores complaint data, including, but not limited to, the following: date complaint received; date of incident; issue level; complainant and/or beneficiary information; complaint summary; complaint category; complaint resolution summary; and plan resolution summary.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of the system is given under section 1875 of the Social Security Act (the Act) (42 U.S.C. 1395ll), entitled Studies and Recommendations; section 1121 of the Act (42 U.S.C. 1121), entitled Uniform Reporting System for Health Services Facilities and Organizations; and &#167; 1876 of the Act (42 U.S.C. 1395mm), entitled Payments to Health Maintenance Organizations and Competitive Medical Plans. Authority for maintenance and dissemination of Health Plan information is also given under the Balanced Budget Act of 1997 (Pub. L. 105-33).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of this modified system is to collect and maintain information on Medicare beneficiaries enrolled in Medicare Health Plans in order to develop and disseminate information required by the Balanced Budget Act of 1997 that will inform beneficiaries and the public of indicators of health plan performance to help beneficiaries choose among health plans, support quality improvement activities within the plans, monitor and evaluate quality improvement activities within the plans, monitor and evaluate care provided by health plans; provide guidance to program management and policies, and provide a research data base for CMS and other researchers. The information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor or consultant; (2) assist another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent, for evaluating and monitoring the quality of home health care and contribute to the accuracy of health insurance operations; (3) support research, evaluation, or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects; (4) support the functions of Quality Improvement Organizations (QIO); (5) support litigation involving the Agency; (6) combat fraud and abuse in certain health care programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>1. To agency contractors, or consultants, or to a grantee of a CMS-administered grant program who have been engaged by the agency to assist in the accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.</p>
                <p>
                    2. To another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                </p>
                <p>
                    a. Contribute to the accuracy of CMS' proper payment of Medicare benefits,
                </p>
                <p>
                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                </p>
                <p>
                    c. Assist Federal/state Medicaid programs within the state.
                </p>
                <p>
                    3. To assist an individual or organization for research, evaluation or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects.
                </p>
                <p>
                    4. To Quality Improvement Organizations (QIO) in order to assist the QIO to perform Title XI and Title XVIII functions relating to assessing and improving quality of care.
                </p>
                <p>
                    5. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the agency in his or her official capacity, or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>6. To assist a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.</p>
                <p>
                    7. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                </p>
                <p>
                    B. Additional Provisions Affecting Routine Use Disclosures
                </p>
                <p>
                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, 65 Fed.  Reg. 82462 (12-28-00), Subparts A and E. Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on the magnetic disk sub-system of the Sun Solaris 10 Server. Furthermore, these records are saved to magnetic tape backup on a nightly basis.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>The records are retrieved by health insurance claims number or other individually identifying numbers.</p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain identifiable HPMS data for at least 10 years or as long as needed for program research.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Plan Data, Plan Oversight and Accountability Group, Center for Beneficiary Choices, Center for Medicare &amp; Medicaid Services, 7500 Security Boulevard, C4-14-21, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    The identifying information contained in these records is obtained from the health plan and Part D organizations (which obtained the data from the individual concerned) or the individuals themselves. Also, these data will be linked with CMS administrative data, such as claims and enrollment.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.</p>
                </xhtmlContent>
</subsection>
</section>
    <section id="09-70-0501" toc="yes">
        <systemNumber>09-70-0501</systemNumber>
     
        <subsection type="systemName">"Medicare Multi-Carrier Claims System (MCS)," HHS/CMS/OIS </subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850. See Appendix A for various remote sites where this system is also maintained.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>The system contains information on Medicare beneficiaries who have submitted claims for Supplemental Medical Insurance (SMI) benefit (Medicare Part B), or individuals whose enrollment in an employer group health benefits plan covers the beneficiary.</p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    Information contained in this system consist of request(s) for payment, provider billing for patient services, prepayment plan for group Medicare practice dealing through a carrier, health insurance claim form, request(s) for medical payment, explanation of benefits, request for claim number verification, payment record transmittal, statement of person regarding Medicare payment for medical services furnished deceased patient, report of prior period of entitlement, itemized bills and other similar documents required to support payments to beneficiaries and to physicians and other suppliers of Part B services, and Medicare secondary payer records containing other party liability insurance information necessary for appropriate Medicare claims payment.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for the collection and maintenance of this system is given under the provisions of sections 1842, 1862 (b) and 1874 of Title XVIII of the Social Security Act (The Act) (42 United States Code (U.S.C.) 1395u, 1395y (b), and 1395kk).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the SOR is to</p>
                    <p>(1)properly pay medical insurance benefits to or on behalf of entitled beneficiaries. Information in this system will also be released to: (1) support regulatory and policy functions performed within the Agency or by a contractor, consultant, or grantee;
                    </p><p>(2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent;
                    </p><p>(3) assist third party contacts;
                    </p><p>(4) support providers and suppliers of services dealing through fiscal intermediaries or carriers;
                    </p><p>(5) support Quality Improvement Organizations (QIO);
                    </p><p>(6) assist insurance companies and other groups providing protection for their enrollees, insurers and other groups providing protection against medical expenses who are primary payers to Medicare in accordance with 42 U.S.C
                
1395y(b)
                    </p><p>(7) support an individual or organization for a research, evaluation, or epidemiological project;
                    </p><p>(8) support litigation involving the Agency related to this SOR; and
                    </p><p>(9) combat fraud, waste, and abuse in certain Federally-funded health care programs.
</p>
</xhtmlContent>
</subsection>
    <subsection type="routineUsesOfRecords">
        <xhtmlContent>
            <p>
                A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
            </p>
            <p>
                1. To support agency contractor, consultant or grantee who have been engaged by the agency to assist in the accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
            </p>
            <p>
                2. To assist another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent:
            </p>
            <p>
                a. Contribute to the accuracy of CMS' proper payment of Medicare benefits,
            </p>
            <p>
                b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
            </p>
            <p>
                c. Assist Federal/state Medicaid programs within the state.
            </p>
            <p>
                3. To assist third party contacts (without the consent of the individuals to whom the information pertains) in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility under the Medicare program and,
            </p>
            <p>
                a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: the individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exists, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
            </p>
            <p>
                b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: The individual's entitlement to benefits under the Medicare program; and the amount of reimbursement; any case in which the evidence is being reviewed as a result of suspected fraud, waste, and abuse, program integrity, quality appraisal, or evaluation and measurement of program activities.
            </p>
            <p>
                4. To assist providers and suppliers of services dealing through fiscal intermediaries or carriers for the administration of Title XVIII of the Act.
            </p>
            <p>
                5. To Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities, conducted pursuant to Part B of Title XI of the Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
            </p>
            <p>
                6. To assist insurance companies, third party administrators (TPA), employers, self-insurers, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, group health plans (i.e., health maintenance organizations (HMO) or a competitive medical plan (CMP) with a Medicare contract, or a Medicare-approved health care prepayment plan (HCPP)), directly or through a contractor, and other groups providing protection for their enrollees. Information to be disclosed shall be limited to Medicare entitlement data. In order to receive the information, they must agree to:
            </p>
            <p>
                a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom the serve as a TPA;
            </p>
            <p>
                b. Utilize the information solely for the purpose of processing the identified individual's insurance claims; and
            </p>
            <p>
                c. Safeguard the confidentiality of the data a prevent unauthorized access.
            </p>
            <p>
                7. To support an individual or organization for a research, evaluation, or epidemiological project related to the prevention of disease or disability, the restoration or maintenance of health, or payment-related projects.
            </p>
            <p>
                8. To support the Department of Justice (DOJ), court or adjudicatory body when:
            </p>
            <p>
                a. The agency or any component thereof, or
            </p>
            <p>
                b. Any employee of the agency in his or her official capacity, or
            </p>
            <p>
                c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
            </p>
            <p>
                d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
            </p>
            <p>
                9. To support a CMS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of the CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
            </p>
            <p>
                10. To support another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
            </p>
            <p>
                B. Additional Provisions Affecting Routine Use Disclosures
            </p>
            <p>
                To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a)(1)).
            </p>
            <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).</p>
        </xhtmlContent>
    </subsection>
    <subsection type="policiesAndPractices">
        <xhtmlContent>
            <p>
                Storage:
            </p>
            <p>
                Records are maintained on paper, computer diskette and on magnetic storage media.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="retrievability">
        <xhtmlContent>
            <p>
                Information can be retrieved by the beneficiary's name, HIC, and assigned unique physician identification number.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="safeguards">
        <xhtmlContent>
            <p>
                CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
            </p>
            <p>
                This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="retentionAndDisposal">
        <xhtmlContent>
            <p>
                Records are maintained in a secure storage area with identifiers. Records are closed at the end of the fiscal year, in which paid, and destroyed after 6 years and 3 months. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="systemManager">
        <xhtmlContent>
            <p>
                Director, Division of Systems Operations, Business Applications Management Group, Office of Information Services, CMS, 7500 Security Boulevard, Room N2-07-27, Baltimore, Maryland 21244-1850.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="notificationProcedure">
        <xhtmlContent>
            <p>
                For purpose of access, the subject individual should write to the system manager who will require the system name, HIC, address, date of birth, and sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), social security number (SSN). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="recordAccessProcedures">
        <xhtmlContent>
            <p>
                For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="contestingRecordProcedures">
        <xhtmlContent>
            <p>
                The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="recordSourceCategories">
        <xhtmlContent>
            <p>
                Sources of information contained in this records system is obtained from third party agencies, Social Security Administration's Master Beneficiary Record, and CMS's Enrollment Database.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="systemsExempted">
        <xhtmlContent>
            <p>None.</p>
            <p>
                <i>Appendix A.--Health Insurance Claims </i>
            </p>
            <p>Medicare records are maintained at the CMS Central Office (see section 1 below for the address). Health Insurance Records of the Medicare program can also be accessed through a representative of the CMS Regional Office (see section 2 below for addresses). Medicare claims records are also maintained by private insurance organizations that share in administering provisions of the health insurance programs. These private insurance organizations, referred to as carriers and intermediaries, are under contract to the Centers for Medicare &amp; Medicaid Services and the Social Security Administration to perform specific task in the Medicare program (see section three below for addresses for intermediaries, section four addresses the carriers, and section five addresses the Payment Safeguard Contractors.</p>
            <p>
                <i>I. Central Office Address </i>
            </p>
            <p>
                CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
            </p>
            <p>
                <i>II. CMS Regional Offices </i>
            </p>
            <p>
                Boston Region--Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont. John F. Kennedy Federal Building, Room 1211, Boston, Massachusetts 02203. Office Hours: 8:30 a.m.-5 p.m.
            </p>
            <p>
                New York Region--New Jersey, New York, Puerto Rico, Virgin Islands. 26 Federal Plaza, Room 715, New York, New York 10007, Office Hours: 8:30 a.m.-5 p.m.
            </p>
            <p>
                Philadelphia Region--Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, West Virginia. Post Office Box 8460, Philadelphia, Pennsylvania 19101. Office Hours: 8:30 a.m.-5 p.m.
            </p>
            <p>
                Atlanta Region--Alabama, North Carolina, South Carolina, Florida, Georgia, Kentucky, Mississippi, Tennessee. 101 Marietta Street, Suite 702, Atlanta, Georgia 30223, Office Hours: 8:30 a.m.-4:30 p.m.
            </p>
            <p>
                Chicago Region--Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin. Suite A-824, Chicago, Illinois 60604. Office Hours: 8 a.m.-4:45 p.m.
            </p>
            <p>
                Dallas Region--Arkansas, Louisiana, New Mexico, Oklahoma, Texas, 1200 Main Tower Building, Dallas, Texas. Office Hours: 8 a.m.- 4:30 p.m.
            </p>
            <p>
                Kansas City Region--Iowa, Kansas, Missouri, Nebraska. New Federal Office Building, 601 East 12th Street-Room 436, Kansas City, Missouri 64106. Office Hours: 8 a.m.-4:45 p.m.
            </p>
            <p>
                Denver Region--Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming. Federal Office Building, 1961 Stout St-Room 1185, Denver, Colorado 80294. Office Hours: 8 a.m.-4:30 p.m.
            </p>
            <p>
                San Francisco Region--American Samoa, Arizona, California, Guam, Hawaii, Nevada. Federal Office Building, 10 Van Ness Avenue, 20th Floor, San Francisco, California 94102. Office Hours: 8 a.m.-4:30 p.m.
            </p>
            <p>
                Seattle Region--Alaska, Idaho, Oregon, Washington. 1321 Second Avenue, Room 615, Mail Stop 211, Seattle, Washington 98101. Office Hours 8 a.m.-4:30 p.m.
            </p>
            <p>
                III. <i>Intermediary Addresses (Hospital Insurance) </i>
            </p>
            <p>
                Medicare Coordinator, Assoc. Hospital Serv. Maine (ME BC), 2 Gannett Drive, South Portland, ME 04106-6911.
            </p>
            <p>
                Medicare Coordinator, Anthem New Hampshire, 300 Goffs Falls Road, Manchester, NH 03111-0001.
            </p>
            <p>
                Medicare Coordinator, BC/BS Rhode Island (RI BC), 444 Westminster Street, Providence, RI 02903-3279.
            </p>
            <p>
                Medicare Coordinator, Empire Medicare Services, 400 S. Salina Street, Syracuse, NY 13202.
            </p>
            <p>
                Medicare Coordinator, Cooperativa, P.O. Box 363428, San Juan, PR 00936-3428.
            </p>
            <p>
                Medicare Coordinator, Maryland B/C, P.O. Box 4368, 1946 Greenspring Ave., Timonium, MD 21093.
            </p>
            <p>
                Medicare Coordinator, Highmark, P5103, 120 Fifth Avenue Place, Pittsburgh, PA 15222-3099.
            </p>
            <p>
                Medicare Coordinator, United Government Services, 1515 N. Rivercenter Dr., Milwaukee, WI 53212.
            </p>
            <p>
                Medicare Coordinator, Alabama B/C, 450 Riverchase Parkway East, Birmingham, AL 35298.
            </p>
            <p>
                Medicare Coordinator, Florida B/C, 532 Riverside Ave., Jacksonville, FL 32202-4918.
            </p>
            <p>
                Medicare Coordinator, Georgia B/C, P.O. Box 9048, 2357 Warm Springs Road, Columbus, GA 31908.
            </p>
            <p>
                Medicare Coordinator, Mississippi B/C B MS, P.O. Box 23035, 3545 Lakeland Drive, Jackson, MI 39225-3035.
            </p>
            <p>
                Medicare Coordinator, North Carolina B/C, P.O. Box 2291, Durham, NC 27702-2291.
            </p>
            <p>
                Medicare Coordinator, Palmetto GBA A/RHHI, 17 Technology Circle, Columbia, SC 29203-0001.
            </p>
            <p>
                Medicare Coordinator, Tennessee B/C, 801 Pine Street, Chattanooga, TN 37402-2555.
            </p>
            <p>
                Medicare Coordinator, Anthem Insurance Co. (Anthem In), P.O. Box 50451, 8115 Knue Road, Indianapolis, IN 46250-1936.
            </p>
            <p>
                Medicare Coordinator, Arkansas B/C, 601 Gaines Street, Little Rock, AR 72203.
            </p>
            <p>
                Medicare Coordinator, Group Health Of Oklahoma, 1215 South Boulder, Tulsa, OK 74119-2827.
            </p>
            <p>
                Medicare Coordinator, TrailBlazer, P.O. Box 660156, Dallas, TX 75266-0156.
            </p>
            <p>
                Medicare Coordinator, Cahaba GBA, Station 7, 636 Grand Avenue, Des Moines, IA 50309-2551.
            </p>
            <p>
                Medicare Coordinator, Kansas B/C, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.
            </p>
            <p>
                Medicare Coordinator, Nebraska B/C, P.O. Box 3248, Main Po Station, Omaha, NE 68180-0001.
            </p>
            <p>
                Medicare Coordinator, Mutual Of Omaha, P.O. Box 1602, Omaha, NE 68101.
            </p>
            <p>
                Medicare Coordinator, Montana B/C, P.O. Box 5017, Great Falls Div., Great Falls, MT 59403-5017.
            </p>
            <p>
                Medicare Coordinator, Noridian, 4510 13th Avenue S.W., Fargo, ND 58121-0001.
            </p>
            <p>
                Medicare Coordinator, Utah B/C, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
            </p>
            <p>
                Medicare Coordinator, Wyoming B/C, 4000 House Avenue, Cheyenne, WY 82003.
            </p>
            <p>
                Medicare Coordinator, Arizona B/C, P.O. Box 37700, Phoenix, AZ 85069.
            </p>
            <p>
                Medicare Coordinator, UGS, P.O. Box 70000, Van Nuys, CA 91470-0000.
            </p>
            <p>
                Medicare Coordinator, Regents BC, P.O. Box 8110 M/S D-4A, Portland, OR 97207-8110.
            </p>
            <p>
                Medicare Coordinator, Premera BC, P.O. Box 2847, Seattle, WA 98111-2847.
            </p>
            <p>
                <i>IV. Medicare Carriers </i>
            </p>
            <p>
                Medicare Coordinator, NHIC, 75 Sargent William Terry Drive, Hingham, MA 02044.
            </p>
            <p>
                Medicare Coordinator, B/S Rhode Island (RI BS), 444 Westminster Street, Providence, RI 02903-2790.
            </p>
            <p>
                Medicare Coordinator, Trailblazer Health Enterprises, Meriden Park, 538 Preston Ave., Meriden, CT 06450.
            </p>
            <p>
                Medicare Coordinator, Upstate Medicare Division, 11 Lewis Road, Binghamton, NY 13902.
            </p>
            <p>
                Medicare Coordinator, Empire Medicare Services, 2651 Strang Blvd., Yorktown Heights, NY 10598.
            </p>
            <p>
                Medicare Coordinator, Empire Medicare Services, NJ, 300 East Park Drive, Harrisburg, PA 17106.
            </p>
            <p>
                Medicare Coordinator, Triple S, #1441 F.D., Roosvelt Ave., Guaynabo, PR 00968.
            </p>
            <p>
                Medicare Coordinator, Group Health Inc., 4th Floor, 88 West End Avenue, New York, NY 10023.
            </p>
            <p>
                Medicare Coordinator, Highmark, P.O. Box 89065, 1800 Center Street, Camp Hill, PA 17089-9065.
            </p>
            <p>
                Medicare Coordinator, Trailblazers Part B, 11150 McCormick Drive, Executive Plaza 3 Suite 200, Hunt Valley, MD 21031.
            </p>
            <p>
                Medicare Coordinator, Trailblazer Health Enterprises, Virginia, P.O. Box 26463, Richmond, VA 23261-6463. United Medicare Coordinator, Tricenturion, 1 Tower Square, Hartford, CT 06183.
            </p>
            <p>
                Medicare Coordinator, Alabama B/S, 450 Riverchase Parkway East, Birmingham, AL 35298.
            </p>
            <p>
                Medicare Coordinator, Cahaba GBA, 12052 Middleground Road, Suite A, Savannah, GA 31419.
            </p>
            <p>
                Medicare Coordinator, Florida B/S, 532 Riverside Ave, Jacksonville, FL 32202-4918.
            </p>
            <p>
                Medicare Coordinator, Administar Federal, 9901 Linnstation Road, Louisville, KY 40223.
            </p>
            <p>
                Medicare Coordinator, Palmetto GBA, 17 Technology Circle, Columbia, SC 29203-0001.
            </p>
            <p>
                Medicare Coordinator, CIGNA, 2 Vantage Way, Nashville, TN 37228.
            </p>
            <p>
                Medicare Coordinator, Railroad Retirement Board, 2743 Perimeter Parkway, Building 250, Augusta, GA 30999.
            </p>
            <p>
                Medicare Coordinator, Cahaba GBA, Jackson Miss, P.O. Box 22545, Jackson, MI 39225-2545.
            </p>
            <p>
                Medicare Coordinator, Adminastar Federal (IN), 8115 Knue Road, Indianapolis, IN 46250-1936.
            </p>
            <p>
                Medicare Coordinator, Wisconsin Physicians Service, P.O. Box 8190, Madison, WI 53708-8190.
            </p>
            <p>
                Medicare Coordinator, Nationwide Mutual Insurance Co., P.O. Box 16788, 1 Nationwide Plaza, Columbus, OH 43216-6788.
            </p>
            <p>
                Medicare Coordinator, Arkansas B/S, 601 Gaines Street, Little Rock, AR 72203.
            </p>
            <p>
                Medicare Coordinator, Arkansas-New Mexico, 601 Gaines Street, Little Rock, AR 72203.
            </p>
            <p>
                Medicare Coordinator, Palmetto GBA-DMERC, 17 Technology Circle, Columbia, SC 29203-0001.
            </p>
            <p>
                Medicare Coordinator, Trailblazer Health Enterprises, 901 South Central Expressway, Richardson, TX 75080.
            </p>
            <p>
                Medicare Coordinator, Nordian, 636 Grand Avenue, Des Moines, IA 50309-2551.
            </p>
            <p>
                Medicare Coordinator, Kansas B/S, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.
            </p>
            <p>
                Medicare Coordinator, Kansas B/S-NE, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0239.
            </p>
            <p>
                Medicare Coordinator, Montana B/S, P.O. Box 4309, Helena, MT 59601.
            </p>
            <p>
                Medicare Coordinator, Nordian, 4305 13th Avenue South, Fargo, ND 58103-3373.
            </p>
            <p>
                Medicare Coordinator, Noridian Backbend (C0), 730 N. Simms #100, Golden, CO 80401-4730.
            </p>
            <p>
                Medicare Coordinator, Noridian BCBSND (WY), 4305 13th Avenue South, Fargo, ND 58103-3373.
            </p>
            <p>
                Medicare Coordinator, Utah B/S, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
            </p>
            <p>
                Medicare Coordinator, Transamerica Occidental, P.O. Box 54905, Los Angeles, CA 90054-4905.
            </p>
            <p>
                Medicare Coordinator, NHIC-California, 450 W. East Avenue, Chico, CA 95926.
            </p>
            <p>
                Medicare Coordinator, Cigna, Suite 254, 3150 Lake Harbor, Boise, ID 83703.
            </p>
            <p>
                Medicare Coordinator, Cigna, Suite 506, 2 Vantage Way, Nashville, TN 37228.
            </p>
            <p>
                <i>V. Payment Safeguard Contractors </i>
            </p>
            <p>
                Medicare Coordinator, Aspen Systems Corporation, 2277 Research Blvd., Rockville, MD 20850.
            </p>
            <p>
                Medicare Coordinator, DynCorp Electronic Data Systems (EDS), 11710 Plaza America Drive, 5400 Legacy Drive, Reston, VA 20190-6017.
            </p>
            <p>
                Medicare Coordinator, Lifecare Management Partners Mutual of Omaha Insurance Co., 6601 Little River Turnpike, Suite 300, Mutual of Omaha Plaza, Omaha, NE 68175.
            </p>
            <p>
                Medicare Coordinator, Reliance Safeguard Solutions, Inc., P.O. Box 30207, 400 South Salina Street, 2890 East Cottonwood Pkwy., Syracuse, NY 13202.
            </p>
            <p>
                Medicare Coordinator, Science Applications International, Inc., 6565 Arlington Blvd. P.O. Box 100282, Falls Church, VA.
            </p>
            <p>
                Medicare Coordinator, California Medical Review, Inc., Integriguard Division Federal Sector Civil Group, One Sansome Street, San Francisco, CA 94104-4448.
            </p>
            <p>
                Medicare Coordinator, Computer Sciences Corporation, Suite 600, 3120 Timanus Lane, Baltimore, MD 21244.
            </p>
            <p>
                Medicare Coordinator, Electronic Data Systems (EDS), 11710 Plaza America Drive, 5400 Legacy Drive, Plano, TX 75204.
            </p>
            <p>
                Medicare Coordinator, TriCenturion, L.L.C., P.O. Box 100282, Columbia, SC 29202.
            </p>
        </xhtmlContent>
    </subsection></section>
    <section id="09-70-0502" toc="yes">
        <systemNumber>09-70-0502</systemNumber>
        <subsection type="systemName">Enrollment Database (EDB), HHS/CMS/CBC.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850, and at various other remote locations.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    Information is collected on individuals age 65 or over who have been, or currently are, entitled to health insurance (Medicare) benefits under Title XVIII of the Act or under provisions of the Railroad Retirement Act, individuals under age 65 who have been, or currently are, entitled to such benefits on the basis of having been entitled for not less than 24 months to disability benefits under Title II of the Act or under the Railroad Retirement Act, individuals who have been, or currently are, entitled to such benefits because they have ESRD, individuals age 64 and 8 months or over who are likely to become entitled to health insurance (Medicare) benefits upon attaining age 65, and individuals under age 65 who have at least 21 months of disability benefits who are likely to become entitled to Medicare upon the 25th month of their being disabled.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The system contains information related to Medicare enrollment and entitlement and Medicare Secondary Payer (MSP) data containing other party liability insurance information necessary for appropriate Medicare claim payment. It contains hospice election, Direct billing and Third Party Premium collection information, and group health plan enrollment data. The system also contains the individual's health insurance numbers, name, geographic location, race/ethnicity, sex, and date of birth.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of the system is given under sections 226, 226A, 1811, 1818, 1818A, 1831, 1836, 1837, 1838, 1843, 1876, and 1881 of the Social Security Act (the Act) and Title 42 Code of Federal Regulations (CFR), parts 406, 407, 408, 411 and 424. Authority for maintenance of the system section 1862 of the Act was a published authority in the published SOR. We included section 1862 in the modified SOR since we do maintain a limited number of data elements in the EDB pertaining to MSP. Authority for maintenance of the system section 1870 of the Act was included in the modified system since the EDB does maintain data regarding direct billing for Medicare premiums. Section 1870 (g) describes refunding these premiums.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the SOR is to maintain information on Medicare enrollment for the administration of the Medicare program, including the following functions: ensuring proper Medicare enrollment, claims payment, Direct billing and Third Party premium collection information, coordination of benefits by validating and verifying the enrollment status of beneficiaries, and validating and studying the characteristics of persons enrolled in the Medicare program including their requirements for information. Information retrieved from this SOR will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by agency contractors, consultants, or to a grantee of a CMS-administered grant; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) assist third parties where the contact is expected to have information relating to the individual's capacity to manage his or her own affairs; (4) assist providers and suppliers of services for administration of Title XVIII of the Act; (5) support Quality Improvement Organizations (QIO); (6) assist other insurers for processing individual insurance claims; (7) facilitate research on the quality and effectiveness of care provided, as well as payment-related and epidemiological projects; (8) support litigation involving the Agency; and (9) combat fraud and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To support agency contractors, or consultants, or to a grantee of a CMS-administered grant program who have been engaged by the agency to assist in the accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
                </p>
                <p>
                    2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                </p>
                <p>
                    a. contribute to the accuracy of CMS's proper payment of Medicare benefits;
                </p>
                <p>
                    b. enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
                </p>
                <p>
                    c. assist Federal/state Medicaid programs within the state.
                </p>
                <p>
                    3. To assist third party contacts (without the consent of the individuals to whom the information pertains) in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program and,
                </p>
                <p>
                    a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: the individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exist, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
                </p>
                <p>
                    b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: the individual's entitlement to benefits under the Medicare program; and the amount of reimbursement; any case in which the evidence is being reviewed as a result of suspected fraud and abuse, program integrity, quality appraisal, or evaluation and measurement of program activities.
                </p>
                <p>
                    4. To assist providers and suppliers of services dealing through fiscal intermediaries or carriers for the administration of Title XVIII of the Social Security Act.
                </p>
                <p>
                    5. To support Quality Improvement Organizations (QIO) in order to assist the QIO to perform Title XI and Title XVIII functions relating to assessing and improving HHA quality of care.
                </p>
                <p>
                    6. To assist insurance companies, third party administrators (TPA), employers, self-insurers, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, group health plans (i.e., health maintenance organizations (HMOs) or a competitive medical plan (CMP) with a Medicare contract, or a Medicare-approved health care prepayment plan (HCPP)), directly or through a contractor, and other groups providing protection for their enrollees. Information to be disclosed shall be limited to Medicare entitlement data. In order to receive the information, they must agree to:
                </p>
                <p>
                    a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a TPA;
                </p>
                <p>
                    b. utilize the information solely for the purpose of processing the identified individual's insurance claims; and
                </p>
                <p>
                    c. safeguard the confidentiality of the data and prevent unauthorized access.
                </p>
                <p>
                    7. To support an individual or organization for a research, evaluation, or epidemiological project related to the prevention of disease or disability, the restoration or maintenance of health, or payment-related projects.
                </p>
                <p>
                    8. To assist the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. the Agency or any component thereof, or
                </p>
                <p>
                    b. any employee of the Agency in his or her official capacity, or
                </p>
                <p>
                    c. any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    9. To assist a CMS contractor (including, but not limited to FIs and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                </p>
                <p>
                    10. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                </p>
                <p>11. To the IRS for the purposes of reporting Medicare Part A enrollment information and to provide statements to the individual enrollees with respect to whom information is reported to the IRS.</p>
                <p>
                    <i> B. Additional Provisions Affecting Routine Use Disclosures </i>
                </p>
                <p>
                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 Fed. Reg. 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the " Standards for Privacy of Individually Identifiable Health Information."
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on magnetic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    All Medicare records are accessible by HIC number or alpha (name) search. This system supports both on-line and batch access.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and systems security requirements. Employees who maintain records in the system are instructed not to release any data until the intended recipient agrees to implement appropriate administrative, technical, procedural, and physical safeguards sufficient to protect the confidentiality of the data and to prevent unauthorized access to the data.
                </p>
                <p>
                    In addition, CMS has physical safeguards in place to reduce the exposure of computer equipment and thus achieve an optimum level of protection and security for the EDB system. For computerized records, safeguards have been established in accordance with the Department of Health and Human Services (HHS) standards and National Institute of Standards and Technology guidelines, e.g., security codes will be used, limiting access to authorized personnel. System securities are established in accordance with HHS, Information Resource Management (IRM) Circular #10, Automated Information Systems Security Program; CMS Automated Information Systems (AIS) Guide, Systems Securities Policies, and OMB Circular No. A-130 (revised), Appendix III.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    Records are maintained for a period of 15 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Enrollment &amp; Eligibility Policy, Medicare Enrollment and Appeals Group, Centers for Beneficiary Choices, Mail Stop C2-09-17, Centers for Medicare &amp; Medicaid Services, 7500 Security Boulevard, Baltimore, MD 21244-1849.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, health insurance claim number, address, date of birth, and sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and social security number (SSN). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the systems manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    The data contained in these records are furnished by the individual, or in the case of some MSP situations, through third party contacts. There are cases, however, in which the identifying information is provided to the physician by the individual; the physician then adds the medical information and submits the bill to the carrier for payment. Updating information is also obtained from the Railroad Retirement Board, and the Master Beneficiary Record maintained by the SSA.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection></section>
        <section id="09-70-0503" toc="yes">
            <systemNumber>09-70-0503</systemNumber>
            <subsection type="systemName">"Fiscal Intermediary Shared System (FISS)," HHS/CMS/OIS.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        Level Three Privacy Act Sensitive Data.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites, CMS Regional Offices, CMS Intermediaries, and at Social Security Field Offices.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>
                        The system contains information on Medicare beneficiaries, on whose behalf providers have submitted claims for reimbursement on a reasonable cost basis under Medicare Part A and B, or are eligible, and/or individuals whose enrollment in an employer group health benefits plan covers the beneficiary.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        Information contained in this system consist of billing for medical and other health care services, uniform bill for provider services or equivalent data in electronic format, and Medicare secondary payer records containing other third party liability insurance information necessary for appropriate Medicare claims payment and other documents used to support payments to beneficiaries and providers of services. These forms contain the beneficiary's name, gender, health insurance claim number (HICN), address, date of birth, medical record number, prior stay information, provider name and address, physician's name, and/or identification number, warranty information when pacemakers are implanted or explanted, date of admission or discharge, other health insurance, diagnosis, surgical procedures, and a statement of services rendered for related charges and other data needed to substantiate claims.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>
                        Authority for maintenance of the system is given under &#167;&#167; 1816, 1862 (b) and 1874 of Title XVIII of the Social Security Act (the Act) (42 U.S.C. &#167;&#167; 1395(h), 1395y (b), and 1395kk).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>
                        The primary purpose of the SOR is to properly pay medical insurance benefits to or on behalf of entitled beneficiaries. Information in this system will also be released to: (1) Support regulatory and policy functions performed within the Agency or by a contractor, consultant, or grantee; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) assist third party contacts; (4) support providers and suppliers of services dealing through fiscal intermediaries or carriers; (5) support Quality Improvement Organizations (QIO); (6) assist insurance companies and other groups providing protection for their enrollees, insurers and other groups providing protection against medical expenses who are primary payers to Medicare in accordance with 42 U.S.C. 1395y (b); (7) support an individual or organization for a research, evaluation, or epidemiological project; (8) support litigation involving the Agency related to this SOR; and (9) combat fraud, waste, and abuse in certain Federally-funded health care programs.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>
                        A. Entities Who May Receive Disclosures Under Routine Use
                    </p>
                    <p>
                        These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the FISS without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We are proposing to establish or modify the following routine use disclosures of information maintained in the system:
                    </p>
                    <p>
                        1. To support agency contractors, consultants, or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                    </p>
                    <p>
                        2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent pursuant to agreements with CMS to:
                    </p>
                    <p>
                        a. contribute to the accuracy of CMS's proper payment of Medicare benefits,
                    </p>
                    <p>
                        b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                    </p>
                    <p>
                        c. Assist Federal/state Medicaid programs within the state.
                    </p>
                    <p>
                        3. To assist third party contacts (without the consent of the individuals to whom the information pertains) in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program and,
                    </p>
                    <p>
                        a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: the individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exist, or the custodian of the information will not, as a matter of policy, prsovide it to the individual), or
                    </p>
                    <p>
                        b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: the individual's entitlement to benefits under the Medicare program; and the amount of reimbursement; any case in which the evidence is being reviewed as a result of suspected fraud and abuse, program integrity, quality appraisal, or evaluation and measurement of program activities.
                    </p>
                    <p>
                        4. To assist providers and suppliers of services dealing through fiscal intermediaries or carriers for the administration of Title XVIII of the Social Security Act.
                    </p>
                    <p>
                        5. To support Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities, conducted pursuant to Part A of Title XI of the Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                    </p>
                    <p>
                        6. To assist insurance companies, third party administrators (TPA), employers, self-insurers, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, group health plans (<i>i.e.</i>, health maintenance organizations (HMOs) or a competitive medical plan (CMP) with a Medicare contract, or a Medicare-approved health care prepayment plan (HCPP)), directly or through a contractor, and other groups providing protection for their enrollees. Information to be disclosed shall be limited to Medicare entitlement data. In order to receive the information, they must agree to:
                    </p>
                    <p>
                        a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a TPA;
                    </p>
                    <p>
                        b. Utilize the information solely for the purpose of processing the identified individual's insurance claims; and
                    </p>
                    <p>
                        c. Safeguard the confidentiality of the data and prevent unauthorized access.
                    </p>
                    <p>
                        7. To support an individual or organization for a research, evaluation, or epidemiological project related to the prevention of disease or disability, the restoration or maintenance of health, or payment-related projects.
                    </p>
                    <p>
                        8. To assist the Department of Justice (DOJ), court or adjudicatory body when:
                    </p>
                    <p>
                        a. The Agency or any component thereof, or
                    </p>
                    <p>
                        b. Any employee of the Agency in his or her official capacity, or
                    </p>
                    <p>
                        c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                    </p>
                    <p>
                        d. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                    </p>
                    <p>9. To assist a CMS contractor (including, but not limited to FIs and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.</p>
                    <p>
                        10. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
                    </p>
                    <p>
                        B. Additional Circumstances Affecting Routine Use Disclosures
                    </p>
                    <p>
                        To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512 (a) (1)).
                    </p>
                    <p>
                        In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p>
                    <p>
                        All records are maintained on paper, computer diskette, and on magnetic storage media.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        Information can be retrieved by the beneficiary's name, HICN, and assigned unique physician identification number.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                    </p>
                    <p>
                        This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        Records are maintained in a secure storage area with identifiers. Records are closed at the end of the fiscal year, in which paid, and destroyed after 6 years and 3 months. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        Director, Division of System Operations, Business Applications Management Group, Office of Information Services, CMS, Room N2-07 -27, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>
                        For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These Procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>
                        The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        Sources on information contained in this records system is obtained by the provider from the individual or, in the case of some Medicare secondary payer situations, through third party contacts. The medical information is provided by the providers of medical services.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemsExempted">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                    <p>
                        <i>Appendix A.--Health Insurance Claims </i>
                    </p>
                    <p>
                        Medicare records are maintained at the CMS Central Office (see section 1 below for the address). Health Insurance Records of the Medicare program can also be accessed through a representative of the CMS Regional Office (see section 2 below for addresses). Medicare claims records are also maintained by private insurance organizations that share in administering provisions of the health insurance programs. These private insurance organizations, referred to as carriers and intermediaries, are under contract to the Centers for Medicare &amp; Medicaid Services and the Social Security Administration to perform specific tasks in the Medicare program (see section three below for addresses for intermediaries, section four for addresses for the carriers, and section five for addresses for the Payment Safeguard Contractors).
                    </p>
                    <p>
                        <i>I. Central Office Address </i>
                    </p>
                    <p>
                        &#149; CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
                    </p>
                    <p>
                        <i>II. CMS Regional Offices </i>
                    </p>
                    <p>
                        &#149; Boston Region--Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont. John F. Kennedy Federal Building, Room 1211, Boston, Massachusetts 02203. Office Hours: 8:30 a.m.-5 p.m.
                    </p>
                    <p>
                        &#149; New York Region--New Jersey, New York, Puerto Rico, Virgin Islands. 26 Federal Plaza, Room 715, New York, New York 10007, Office Hours: 8:30 a.m.-5 p.m.
                    </p>
                    <p>
                        &#149; Philadelphia Region--Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, West Virginia. Post Office Box 8460, Philadelphia, Pennsylvania 19101. Office Hours: 8:30 a.m.-5 p.m.
                    </p>
                    <p>
                        &#149; Atlanta Region--Alabama, North Carolina, South Carolina, Florida, Georgia, Kentucky, Mississippi, Tennessee. 101 Marietta Street, Suite 702, Atlanta, Georgia 30223, Office Hours: 8:30 a.m.-4:30 p.m.
                    </p>
                    <p>
                        &#149; Chicago Region--Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin. Suite A-824, Chicago, Illinois 60604. Office Hours: 8 a.m.-4:45 p.m.
                    </p>
                    <p>
                        &#149; Dallas Region--Arkansas, Louisiana, New Mexico, Oklahoma, Texas, 1200 Main Tower Building, Dallas, Texas. Office Hours: 8 a.m.-4:30 p.m.
                    </p>
                    <p>
                        &#149; Kansas City Region--Iowa, Kansas, Missouri, Nebraska. New Federal Office Building, 601 East 12th Street--Room 436, Kansas City, Missouri 64106. Office Hours: 8 a.m.-4:45 p.m.
                    </p>
                    <p>
                        &#149; Denver Region--Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming. Federal Office Building, 1961 Stout St-- Room 1185, Denver, Colorado 80294. Office Hours: 8 a.m.-4:30 p.m.
                    </p>
                    <p>
                        &#149; San Francisco Region--American Samoa, Arizona, California, Guam, Hawaii, Nevada. Federal Office Building, 10 Van Ness Avenue, 20th Floor, San Francisco, California 94102. Office Hours: 8 a.m.-4:30 p.m.
                    </p>
                    <p>
                        &#149; Seattle Region--Alaska, Idaho, Oregon, Washington. 1321 Second Avenue, Room 615, Mail Stop 211, Seattle, Washington 98101. Office Hours: 8 a.m.-4:30 p.m.
                    </p>
                    <p>
                        <i>III. Intermediary Addresses (Hospital Insurance) </i>
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Assoc. Hospital Serv. Maine (Me Bc), 2 Gannett Drive, South Portland, ME 04106-6911.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Anthem New Hampshire, 300 Goffs Falls Road, Manchester, NH 03111-0001.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, BC/BS Rhode Island (RI BC), 444 Westminster Street, Providence, RI 02903-3279.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Empire Medicare Services, 400 S. Salina Street, Syracuse, NY 13202.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Cooperativa, P.O. Box 363428, San Juan, PR 00936-3428.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Maryland B/C, P.O. Box 4368, 1946 Greenspring Ave., Timonium, MD 21093.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Highmark, P5103, 120 Fifth Avenue Place, Pittsburgh, PA 15222-3099.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, United Government Services, 1515 N. Rivercenter Dr., Milwaukee, WI 53212.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Alabama B/C, 450 Riverchase Parkway East, Birmingham, AL 35298.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Florida B/C, 532 Riverside Ave., Jacksonville, FL 32202-4918.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Georgia B/C, P.O. Box 9048, 2357 Warm Springs Road, Columbus, GA 31908.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Mississippi B/C B MS, P.O. Box 23035, 3545 Lakeland Drive, Jackson, MI 39225-3035.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, North Carolina B/C, P.O. Box 2291, Durham, NC 27702-2291.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Palmetto GBA A/RHHI, 17 Technology Circle, Columbia, SC 29203-0001.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Tennessee B/C, 801 Pine Street, Chattanooga, TN 37402-2555.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Anthem Insurance Co. (Anthem In), P.O. Box 50451, 8115 Knue Road, Indianapolis, IN 46250-1936.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Arkansas B/C, 601 Gaines Street, Little Rock, AR 72203.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Group Health of Oklahoma, 1215 South Boulder, Tulsa, OK 74119-2827.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, TrailBlazer, P.O. Box 660156, Dallas, TX 75266-0156.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Cahaba GBA, STATION 7, 636 Grand Avenue, Des Moines, IA 50309-2551.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Kansas B/C, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Nebraska B/C, P.O. Box 3248, Main Po Station, Omaha, NE 68180-0001.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Mutual of Omaha, P.O. Box 1602, Omaha, NE 68101.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Montana B/C, P.O. Box 5017, Great Falls Div., Great Falls, MT 59403-5017.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Noridian, 4510 13th Avenue SW., Fargo, ND 58121-0001.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Utah B/C, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Wyoming B/C, 4000 House Avenue, Cheyenne, WY 82003.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Arizona B/C, P.O. Box 37700, Phoenix, AZ 85069.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, UGS, P.O. Box 70000, Van Nuys, CA 91470-0000.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Regents BC, P.O. Box 8110 M/S D-4A, Portland, OR 97207-8110.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Premera BC, P.O. Box 2847, Seattle, WA 98111-2847.
                    </p>
                    <p>
                        <i>IV. Medicare Carriers </i>
                    </p>
                    <p>
                        &#149; Medicare Coordinator, NHIC, 75 Sargent William Terry Drive, Hingham, MA 02044.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, B/S Rhode Island (RI BS), 444 Westminster Street, Providence, RI 02903-2790.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Trailblazer Health Enterprises, Meriden Park, 538 Preston Ave., Meriden, CT 06450.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Upstate Medicare Division, 11 Lewis Road, Binghamton, NY 13902.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Empire Medicare Services, 2651 Strang Blvd., Yorktown Heights, NY 10598.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Empire Medicare Services, NJ, 300 East Park Drive, Harrisburg, PA 17106.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Triple S, #1441 F.D., Roosvelt Ave., Guaynabo, PR 00968.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Group Health Inc., 4th Floor, 88 West End Avenue, New York, NY 10023.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Highmark, P.O. Box 89065, 1800 Center Street, Camp Hill, PA 17089-9065.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Trailblazers Part B, 11150 McCormick Drive, Executive Plaza 3 Suite 200, Hunt Valley, MD 21031.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Trailblazer Health Enterprises, Virginia, P.O. Box 26463, Richmond, VA 23261-6463. United Medicare Coordinator, Tricenturion, 1 Tower Square, Hartford, CT 06183.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Alabama B/S, 450 Riverchase Parkway East, Birmingham, AL 35298.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Cahaba GBA, 12052 Middleground Road, Suite A, Savannah, GA 31419.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Florida B/S, 532 Riverside Ave, Jacksonville, FL 32202-4918.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Administar Federal, 9901 Linnstation Road, Louisville, KY 40223.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Palmetto GBA, 17 Technology Circle, Columbia, SC 29203-0001.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, CIGNA, 2 Vantage Way, Nashville, TN 37228.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Railroad Retirement Board, 2743 Perimeter Parkway, Building 250, Augusta, GA 30999.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Cahaba GBA, Jackson Miss, P.O. Box 22545, Jackson, MI 39225-2545.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Adminastar Federal (IN), 8115 Knue Road, Indianapolis, IN 46250-1936.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Wisconsin Physicians Service, P.O. Box 8190, Madison, WI 53708-8190.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Nationwide Mutual Insurance Co., P.O. Box 16788, 1 Nationwide Plaza, Columbus, OH 43216-6788.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Arkansas B/S, 601 Gaines Street, Little Rock, AR 72203.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Arkansas-New Mexico, 601 Gaines Street, Little Rock, AR 72203.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Palmetto GBA-DMERC, 17 Technology Circle, Columbia, SC 29203-0001.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Trailblazer Health Enterprises, 901 South Central Expressway, Richardson, TX 75080.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Noridian, 636 Grand Avenue, Des Moines, IA 50309-2551.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Kansas B/S, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Kansas B/S-NE, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0239.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Montana B/S, P.O. Box 4309, Helena, MT 59601.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Noridian, 4305 13th Avenue South, Fargo, ND 58103-3373.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Noridian Backbend (CO), 730 N. Simms #100, Golden, CO 80401-4730.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Noridian BCBSND (WY), 4305 13th Avenue South, Fargo, ND 58103-3373.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Utah B/S, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Transamerica Occidental, P.O. Box 54905, Los Angeles, CA 90054-4905.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, NHIC-California, 450 W. East Avenue, Chico, CA 95926.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Cigna, Suite 254, 3150 Lake Harbor, Boise, ID 83703.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Cigna, Suite 506, 2 Vantage Way, Nashville, TN 37228.
                    </p>
                    <p>
                        <i>V. Payment Safeguard Contractors </i>
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Aspen Systems Corporation, 2277 Research Blvd., Rockville, MD 20850.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, DynCorp Electronic Data Systems (EDS), 11710 Plaza America Drive, 5400 Legacy Drive, Reston, VA 20190 -6017.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Lifecare Management Partners, Mutual of Omaha Insurance Co., 6601 Little River Turnpike, Suite 300, Mutual of Omaha Plaza, Omaha, NE 68175.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Reliance Safeguard Solutions, Inc., P.O. Box 30207, 400 South Salina Street, 2890 East Cottonwood Pkwy., Syracuse, NY 13202.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Science Applications International, Inc., 6565 Arlington Blvd., P.O. Box 100282, Falls Church, VA.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, California Medical Review, Inc., Integriguard Division Federal Sector Civil Group, One Sansome Street, San Francisco, CA 94104-4448.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Computer Sciences Corporation, Suite 600, 3120 Timanus Lane, Baltimore, MD 21244.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, Electronic Data Systems (EDS), 11710 Plaza America Drive, 5400 Legacy Drive, Plano, TX 75204.
                    </p>
                    <p>
                        &#149; Medicare Coordinator, TriCenturion, L.L.C., P.O. Box 100282, Columbia, SC 29202.
                    </p>
                </xhtmlContent>
            </subsection></section>
            <section id="09-70-0505" toc="yes">
                <systemNumber>09-70-0505</systemNumber>
                <subsection type="systemName">"Third Party System (TPS)," HHS/CMS/OFM.</subsection>
                <subsection type="securityClassification">
                    <xhtmlContent>
                        <p>
                            Level Three Privacy Act Sensitive Data.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="systemLocation">
                    <xhtmlContent>
                        <p>
                            The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites and at CMS Regional Offices.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="categoriesOfIndividuals">
                    <xhtmlContent>
                        <p>
                            The system contains information on Medicare beneficiaries whose Part A benefit and/or Part B Medicare premiums are paid by a state Medicaid agency, OPM, a formal third party group, or a surcharge only group payer.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="categoriesOfRecords">
                    <xhtmlContent>
                        <p>
                            Information collected includes, but is not limited to, name, social security number, health insurance claims number, date of birth, gender, amount of premium liability, date agency first became liable for Part A or Part B premiums or Part B surcharges, last month of agency premium liability, agency identification number, and an OPM annuity number.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="authorityForMaintenance">
                    <xhtmlContent>
                        <p>
                            Authority for maintenance of the system is given under &#167;&#167; 1818, 1818A, (42 United States Code (U.S.C.) 1395i-2 and 2a), 1818(e) and (g) (42 U.S.C. 1395i-2(e) and (g)), 1839(e) (42 U.S.C. 1395r), 1840 (d) and (e) (42 U.S.C. 1395s (d) and (e)), and 1843 (42 U.S.C. 1395v) of Title XVIII of the Social Security Act (the Act).
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="purpose">
                    <xhtmlContent>
                        <p>
                            The primary purpose of this modified system is to process beneficiary premium billing accretions and deletions to third party premium payer accounts (state Medicaid agencies, Office of Personnel Management (OPM), and formal third party groups and surcharge only group payers (latter as defined in 42 Code of Federal Regulations (CFR) 408.80 through 408.92 and 408.200 through 408.210)) for the payment of Part B (SMI) and/or Part A (HI) premiums on behalf of Medicare beneficiaries, the payment of the surcharge portion of the Part B premium on behalf of Medicare beneficiaries by a State or local government entity, and for enrolling individuals for Part A or Part B coverage under state buy-in agreements. The information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant, or a CMS grantee; (2) assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) support formal third party groups and surcharge only group payers pursuant to an agreement with CMS; (4) assist an individual or research organization to support research, evaluation of epidemiological projects; (5) support litigation involving the agency; and (6) combat fraud, waste, and abuse in certain Federally-funded health care programs.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="routineUsesOfRecords">
                    <xhtmlContent>
                        <p>
                            A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                        </p>
                        <p>
                            1. To support agency contractors, consultants, or grantees who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                        </p>
                        <p>
                            2. To assist another Federal and/or State agency, agency of a State government, an agency established by State law, or its fiscal agent:
                        </p>
                        <p>
                            a. Contribute to the accuracy of CMS' proper payment of Medicare benefits,
                        </p>
                        <p>
                            b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                        </p>
                        <p>
                            c. Assist Federal/state Medicaid programs within the State.
                        </p>
                        <p>
                            3. To support formal third party groups and surcharge only group payers pursuant to agreements with CMS to pay the Medicare premiums or surcharge only portion of the Part B premium on behalf of their members and who need to have access to the records in order to perform the activity.
                        </p>
                        <p>
                            4. To assist an individual or organization for research, evaluation, or epidemiological projects related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
                        </p>
                        <p>
                            5. To support the Department of Justice (DOJ), court or adjudicatory body when:
                        </p>
                        <p>
                            a. The agency or any component thereof, or
                        </p>
                        <p>
                            b. Any employee of the agency in his or her official capacity, or
                        </p>
                        <p>
                            c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                        </p>
                        <p>
                            d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                        </p>
                        <p>
                            6. To assist a CMS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such program.
                        </p>
                        <p>
                            7. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, and abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such programs.
                        </p>
                        <p>
                            <i>B. Additional Provisions Affecting Routine Use Disclosures </i>
                        </p>
                        <p>
                            To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
                        </p>
                        <p>
                            In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="policiesAndPractices">
                    <xhtmlContent>
                        <p>
                            Storage:
                        </p>
                        <p>
                            All records are stored on direct access storage devices and other electronically retrievable media.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="retrievability">
                    <xhtmlContent>
                        <p>
                            Information can be retrieved by name, HICN, and assigned agency identification number.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="safeguards">
                    <xhtmlContent>
                        <p>
                            CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                        </p>
                        <p>
                            This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="retentionAndDisposal">
                    <xhtmlContent>
                        <p>
                            Records are maintained in a secure storage area with identifiers for 6 years 3 months after final action of the case is completed. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="systemManager">
                    <xhtmlContent>
                        <p>
                            Director, Division of Premium Billing and Collections, Accounting Management Group, Office of Financial Management, CMS, Mail Stop N3 -21-06, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="notificationProcedure">
                    <xhtmlContent>
                        <p>
                            For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="recordAccessProcedures">
                    <xhtmlContent>
                        <p>
                            For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="contestingRecordProcedures">
                    <xhtmlContent>
                        <p>
                            The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="recordSourceCategories">
                    <xhtmlContent>
                        <p>
                            Information contained in this system is obtained from third party agencies, Social Security Administration's Master Beneficiary Record, and CMS' Enrollment Database.
                        </p>
                    </xhtmlContent>
                </subsection>
                <subsection type="systemsExempted">
                    <xhtmlContent>
                        <p>
                            None.
                        </p>
                    </xhtmlContent>
                </subsection></section>
                <section id="09-70-0507" toc="yes">
                    <systemNumber>09-70-0507</systemNumber>
                    <subsection type="systemName">"Person-Level Medicaid Data System (PMDS)," HHS/CMS/ORDI.</subsection>
                    <subsection type="securityClassification">
                        <xhtmlContent>
                            <p>
                                Level Three Privacy Act Sensitive Data.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="systemLocation">
                        <xhtmlContent>
                            <p>
                                The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites and at CMS Regional Offices.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="categoriesOfIndividuals">
                        <xhtmlContent>
                            <p>
                                PMDS contains information on persons enrolled in the Medicaid program under either Federal or State provisions, as well as health care providers.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="categoriesOfRecords">
                        <xhtmlContent>
                            <p>
                                Information collected includes but is not limited to data from 5 State Medicaid agencies (California, Georgia, Michigan, New York, and Tennessee) showing claims submitted for covered medical services, provider characteristics, name, address, phone number, date of birth, social security number (SSN), health insurance claim number (HICN), unique provider identification number, gender and ethnicity.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="authorityForMaintenance">
                        <xhtmlContent>
                            <p>
                                Authority for maintenance of the system is given under section 1902(a)(6) of the Social Security Act (42 United States Code 1396(a) (6)).
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="purpose">
                        <xhtmlContent>
                            <p>
                                The primary purpose of this modified system is to collect and maintain individually-identifiable data to study Medicaid use and expenditures in order to increase CMS' understanding of the Medicaid and Medicare programs and to improve CMS' ability to conduct program evaluation, strengthen program management, evaluate policy alternatives, conduct and evaluate demonstration projects, and advise States in the area of Medicaid financing. The information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant, or grantee; (2) assist another Federal and/or State agency; (3) support an individual or organization for research, evaluation or epidemiological projects; and (4) support litigation involving the agency.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="routineUsesOfRecords">
                        <xhtmlContent>
                            <p>
                                A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                            </p>
                            <p>
                                5. To support agency contractors, consultants, or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                            </p>
                            <p>
                                6. To assist another Federal or State agency:
                            </p>
                            <p>
                                a. To contribute to the accuracy of CMS's proper payment of Medicare benefits,
                            </p>
                            <p>
                                b. To enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds.
                            </p>
                            <p>
                                7. To assist an individual or organization for research, evaluation or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects.
                            </p>
                            <p>
                                8. To support the Department of Justice (DOJ), court or adjudicatory body when:
                            </p>
                            <p>
                                a. The agency or any component thereof, or
                            </p>
                            <p>
                                b. Any employee of the agency in his or her official capacity, or
                            </p>
                            <p>
                                c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                            </p>
                            <p>
                                d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                            </p>
                            <p>
                                <i>B. Additional Provisions Affecting Routine Use Disclosures.</i>
                            </p>
                            <p>
                                To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a)(1)).
                            </p>
                            <p>
                                In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="policiesAndPractices">
                        <xhtmlContent>
                            <p>
                                Storage:
                            </p>
                            <p>
                                All records are stored on magnetic tape and computer disk.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="retrievability">
                        <xhtmlContent>
                            <p>
                                Enrollment records are retrieved by Medicaid and Medicare identification numbers. Provider records are retrieved by Medicaid and Medicare provider identification numbers. Claims records contain both enrollee and provider identification numbers.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="safeguards">
                        <xhtmlContent>
                            <p>
                                CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                            </p>
                            <p>
                                This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="retentionAndDisposal">
                        <xhtmlContent>
                            <p>
                                CMS will retain information for a total period of 6 years and 3 months. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="systemManager">
                        <xhtmlContent>
                            <p>
                                Deputy Director, Office of Research, Development and Information, CMS, Mail Stop C3-20-11, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="notificationProcedure">
                        <xhtmlContent>
                            <p>
                                For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="recordAccessProcedures">
                        <xhtmlContent>
                            <p>
                                For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="contestingRecordProcedures">
                        <xhtmlContent>
                            <p>
                                The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="recordSourceCategories">
                        <xhtmlContent>
                            <p>
                                Medicaid and Medicare enrollment, claims, and provider records.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="systemsExempted">
                        <xhtmlContent>
                            <p>
                                None.
                            </p>
                        </xhtmlContent>
                    </subsection></section>
                <section id="09-70-0508" toc="yes">
<systemNumber>09-70-0508</systemNumber>
<subsection type="systemName">
CMS Risk Adjustment Suite of Systems (RASS), HHS/CMS/CM.</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>RASS (RAS/RAPS) Location:</p>
<p>CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>Information collected and maintained in this system pertains to:  (1) Medicare beneficiaries enrolled in a Part C MA plan, MA-PD plan, PDP or PACE organization ("enrollees") and (2) the health care provider(s), supplier(s), physician(s), or other practitioner(s) ("Providers") who provide health care items and services to these enrollees. </p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>The MA plans, MA-PDs, PDPs and PACE organizations ("MA organizations and other entities") receive the data from the providers which is then submitted to RAPS via FERAS. The data received from the MA organizations and other entities are primarily diagnosis data extracted from claims information.  Additional FFS and utilization data regarding those submissions are received from the CME and NCH data systems to complete the enrollee data requirements.</p>

<p>Records will consist of the risk score for each enrollee and the data used to calculate the score, contained in Risk Adjustment Factor (RAF) files created in CMS’ Risk Adjustment System (RAS), using data extracted from three other CMS IT systems: </p>
<p>RAPS data: diagnosis data files containing abbreviated current diagnosis data submitted by payee entities to CMS’s Risk Adjustment Processing System (RAPS):</p>
<p>Health Insurance Claim Number (HICN)</p>
<p>Provider Type</p>
<p>Service From Date</p>
<p>Service Through Date</p>
<p>Plan Number (MAO contract number)</p>
<p>Diagnosis Code</p>
<p>Diagnosis Delete Date</p>
<p>RAS Diagnosis Indicator</p>
<p>NCH Category Equitable BIC</p>
<p>Accrete Data </p>
<p>Delete Plan Number</p>
<p>Submitter ID</p>
<p>Daily File Code, and</p>
<p>Delete File Code</p>
<p>CME data: current demographic and enrollment data from CMS’s Common Medicare Environment  (CME):</p>
<p>Beneficiary Link Key Partition number</p>
<p>Beneficiary Link Identifier</p>
<p>Health Insurance Claim Number (HICN) </p>
<p>Beneficiary Social Security Number </p>
<p>Beneficiary Birth Date</p>
<p>Beneficiary Death Date </p>
<p>Beneficiary Sex Code</p>
<p>Beneficiary Race Code </p>
<p>Beneficiary First Name </p>
<p>Beneficiary Middle Name</p>
<p>Beneficiary Last Name</p>

<p>NCH data: current diagnosis data [and past medical history data] from National Claims History Files in CMS’s National Medicare Utilization Database (NMUD):</p>
<p>Health Insurance Claim Number (HICN)</p>
<p>NCH Category Equitable BIC</p>
<p>Diagnosis code</p>
<p>Service Through Date </p>
<p>Service From Date</p>
<p>Beneficiary Link Identifier</p>
<p>Provider Number</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>This system was established pursuant to sections 1853(a), 1860D-15(c), and 1894(d)(2)of the Social Security Act (42 U.S.C. 1395w-23, 1395w-115, 1395eee). </p>

</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>Records will be used within the agency to develop risk adjustment models and to calculate the risk score for each Medicare beneficiary enrolled in the Medicare health plan.  The risk score will be reported to the system that CMS uses to process payments, and ultimately will be used to adjust payments to MA organizations, Part D sponsors, and PACE organizations, based on beneficiary health status. (Note that payment records are not covered under this system of records.)</p>
<p>Information retrieved from this SOR will be used for the following purposes:</p>
<p>to determine the risk adjustment factors used to adjust payments to MA organizations and other entities, as required under 42 CFR 422.304(a) and (c), 423.329 and 460.180.</p>
<p>to update risk adjustment models</p>
<p>to calculate Medicare Disproportionate Share Hospital (DSH) percentages</p>
<p>to conduct quality review and improvement activities for Medicare coverage purposes </p>
<p>to conduct evaluations and other analysis to support the Medicare program (including demonstrations)</p>
<p>to support public health initiatives and other health care related research</p>
<p>for activities to support the administration of the Medicare program </p>
<p>for activities conducted to support program integrity </p>
<p>for purposes authorized by applicable law</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>

<p>Records may be disclosed to parties outside HHS, without the individual record subject’s prior, written consent, for the following purposes:   </p>
<p>1. To determine the risk adjustment factors used to adjust payments, as required under §§ 422.304(a) and (c), 423.329, and 460.180, to update risk adjustment models, to calculate Medicare DSH percentages, to conduct quality review and improvement activities, for Medicare coverage purposes, to conduct evaluations and other analysis to support the Medicare program (including demonstrations) and to support public health initiatives, for activities conducted to support program integrity, and for purposes authorized by applicable law. </p>

<p>2. To support CMS contractors, consultants, or grantees that have been contracted by the Agency when necessary to assist in accomplishment of a CMS function relating to the purposes for this system or a purpose listed in paragraph 1.</p>

<p>3. To support an individual or organization for research to support the Medicare program and public health initiatives, and otherwise related to health care, such as evaluation or epidemiological projects related to the prevention of disease or disability, the restoration or maintenance of health, or for understanding and improving payment projects. </p>

<p>4. To provide information to the U.S. Department of Justice (DOJ), a court, or an adjudicatory body when (a) the Agency or any component thereof, or (b) any employee of the Agency in his or her official capacity, or (c) any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or (d) the United State Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court, or adjudicatory body is compatible with the purpose for which the agency collected the records. </p>

<p>5. To assist a CMS contractor (including, but not limited to Medicare Administrative Contractors, fiscal intermediaries, and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.</p>

<p>6. To assist another Federal agency or an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.  </p>

<p>7. To assist Medicare Advantage organizations, Part D Sponsors and PACE organizations with improving the quality of required risk adjustment data obtained from the provider that furnished the item or service. CMS will be analyzing the data received and advising MA organizations, Part D Sponsors and PACE organizations of trends and data analysis results to help improve the accuracy and completeness of data received from the provider.   </p>

<p>8. To assist appropriate Federal agencies and CMS contractors and consultants that have a need to know the information for the purpose of assisting CMS’ efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided that the information disclosed is relevant and necessary for that assistance. </p>

<p><i> Note:</i> CMS may disclose information from this system of records, without the individual record subject’s consent, for any of the following purposes referenced directly in the Privacy Act:  5 U.S.C. 552a(b)(1), (3) - (8), and (12).  CMS must also disclose information from this system of records, without the individual record subject’s consent, for any of the following purposes referenced directly in the Privacy Act:  5 U.S.C. 552a(b)(2), and (b)(9) - (11).</p>

<p>Additional Provisions Affecting Routine Use Disclosures:</p>
<p> This system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, 65 FR 82462 (12-28-00), subparts A and E).  Disclosures of PHI authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." </p>
<p>In addition, our policy will be to prohibit release even of data that is not directly identifiable, except if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).</p>

<p>
   <b>Note:</b> Information collected or obtained under § 1860D-15 (i.e., risk adjustment data used to pay Part D plan sponsors) will be used and disclosed only in accordance with the statutory limitations under § 1860D-15(f)(2).</p>
</xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>

<p>Storage:</p>
<p>Archived records will be stored on magnetic tapes.  Data that is currently in use is stored in the RAPS database.</p>

</xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Records will be retrieved by National Provider Identifier (NPI), beneficiary provider name, or beneficiary Health Insurance Claim Number.  </p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>Personnel having access to the system have been trained in the Privacy Act and information security requirements.  Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational, and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems; and to prevent unauthorized access.</p>
<p>Access to records in the RASS will be limited to CMS personnel and contractors through password security, encryption, firewalls, and secured operating system(s). </p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>Records (i.e., enrollee diagnosis data files created in RAPS, and Risk Adjustment Factor (RAF) files created in RAS) will be maintained for a period of up to 10 years after date of creation.  Any such records that are needed longer, such as to resolve claims and audit exceptions or to prosecute fraud, will be retained until such matters are resolved.  Enrollee claims records are currently subject to a document preservation order and will be preserved indefinitely pending further notice from the U.S. Department of Justice (DOJ).</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Director, Division of Encounter Data and Risk Adjustment Operations, Medicare Plan Payment Group, Center for Medicare, CMS, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.</p>

</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>Individuals (i.e., the beneficiary or provider) wishing to know if this system contains records about them should write to the system manager and include pertinent personally identifiable information (encrypted and properly transmitted) to be used for retrieval of their records (i.e., NPI or Health Insurance Claim Number).</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Individuals seeking access to records about them in this system should follow the same instructions indicated under "Notification Procedure" and reasonably specify the record content being sought.  (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a)(2)).</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Individuals seeking to contest the content of information about them in this system should follow the same instructions indicated under "Notification Procedure."  The request should: reasonably identify the record and specify the information being contested; state the corrective action sought; and provide the reasons for the correction, with supporting justification.  (These procedures are in accordance with Department regulation 45 CFR 5b.7.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>RASS processes data extracted from RAPS and RAS IT systems to calculate the risk scores used to adjust payments to Medicare Advantage organizations, Part D plan sponsors and PACE plans.  RAS receives the most current data for each Medicare Part C and Part D beneficiary from the following sources: RAPS, Common Medicare Environment (CME) also known as Medicare Beneficiary Database (MBD/CME), and National Medicare Utilization Database (NMUD).  RAPS receives risk adjustment data from MA organizations and other entities defined above.  </p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.</p></xhtmlContent></subsection></section>
    
                    
                    <section id="09-70-0510" toc="yes">
                        <systemNumber>09-70-0510</systemNumber>
                        <subsection type="systemName">"State Health Insurance Assistance Program (SHIP) National Performance Report (SHIP-NPR)," HHS/CMS/OEA.</subsection>
                        <subsection type="securityClassification">
                            <xhtmlContent>
                                <p>
                                    Level Three Privacy Act Sensitive Data.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="systemLocation">
                            <xhtmlContent>
                                <p>
                                    Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co-locations of CMS agents.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="categoriesOfIndividuals">
                            <xhtmlContent>
                                <p>
                                    The system will collect and maintain individually identifiable information on Medicare and Medicaid beneficiaries who have contacted SHIP representatives, as well as the SHIP counselors.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="categoriesOfRecords">
                            <xhtmlContent>
                                <p>
                                    Information collected includes, but is not limited to: Name, counseling zip code, beneficiary zip code, telephone number, data of birth, gender, race/ethnicity and date of contact.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="authorityForMaintenance">
                            <xhtmlContent>
                                <p>
                                    The statutory authority for maintenance of this system is given under &#167; 4360 of Omnibus Budget Reconciliation Act of 1990 (Pub. L. 101-508), the outreach and education requirements of the Balanced Budget Act of 1997, and the Medicare Prescription Drug, Improvement, and Modernization Act of 2003.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="purpose">
                            <xhtmlContent>
                                <p>
                                    The purpose of this system is to collect and maintain information on how beneficiaries use SHIP services, which includes individually identifiable information on Medicare and Medicaid beneficiaries who have contacted SHIP representatives. Information retrieved from this system may be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or CMS grantee; (2) assist another Federal or state agency with information to contribute to the accuracy of CMS's payment of Medicare benefits, enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support litigation involving the agency; and (4) combat fraud, waste and abuse in certain Federally-funded health benefits programs.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="routineUsesOfRecords">
                            <xhtmlContent>
                                <p>
                                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                </p>
                                <p>
                                    1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                                </p>
                                <p>
                                    2. To another Federal or state agency to:
                                </p>
                                <p>
                                    a. Contribute to the accuracy of CMS's proper payment of Medicare benefits;
                                </p>
                                <p>
                                    b. Enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
                                </p>
                                <p>
                                    c. Assist Federal/state Medicaid programs within the state.
                                </p>
                                <p>
                                    3. To the Department of Justice (DOJ), court or adjudicatory body when:
                                </p>
                                <p>
                                    a. The agency or any component thereof, or
                                </p>
                                <p>
                                    b. Any employee of the agency in his or her official capacity, or
                                </p>
                                <p>
                                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                </p>
                                <p>
                                    d. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                </p>
                                <p>
                                    4. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
                                </p>
                                <p>
                                    5. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
                                </p>
                                <p>
                                    <i>
                                        B. Additional Provisions Affecting Routine Use Disclosures.
                                    </i>
                                </p>
                                <p>
                                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 Fed. Reg. 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a) (1)).
                                </p>
                                <p>
                                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that an individual could, because of the small size, use this information to deduce the identity of the beneficiary).
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="policiesAndPractices">
                            <xhtmlContent>
                                <p>
                                    Storage:
                                </p>
                                <p>
                                    All records are stored on electronic media.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="retrievability">
                            <xhtmlContent>
                                <p>
                                    The collected data are retrieved by the name or other identifying information of the participating provider or beneficiary, and may also be retrieved by a distinct identifier such as the Health Insurance Claim Number (HICN), at the individual beneficiary level.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="safeguards">
                            <xhtmlContent>
                                <p>
                                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                </p>
                                <p>
                                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="retentionAndDisposal">
                            <xhtmlContent>
                                <p>
                                    Records will be retained for a period of 6 years and 3 months. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="systemManager">
                            <xhtmlContent>
                                <p>
                                    Division of State Health Insurance Program Relations, Strategic Research &amp; Campaign Management Group, Office of External Affairs, Mail Stop S1-13-05, Centers for Medicare &amp; Medicaid Services, 7500 Security Boulevard, Baltimore, MD 21244-1849.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="notificationProcedure">
                            <xhtmlContent>
                                <p>
                                    For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or Social Security Number (SSN) (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="recordAccessProcedures">
                            <xhtmlContent>
                                <p>
                                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="contestingRecordProcedures">
                            <xhtmlContent>
                                <p>
                                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="recordSourceCategories">
                            <xhtmlContent>
                                <p>
                                    Data will be collected from Medicare and SHIP administrative records.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="systemsExempted">
                            <xhtmlContent>
                                <p>
                                    None.
                                </p>
                            </xhtmlContent>
                        </subsection>
                    </section>
        <section id="09-70-0511" toc="yes">
            <systemNumber>09-70-0511</systemNumber>
            <subsection type="systemName">Risk Adjustment Data Validation System (RAD-V), HHS/CMS/CCIIO</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>Unclassified</p>
                </xhtmlContent> </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>The RAD-V will be physically located at the CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, MD 21244-1850, and at various contractor sites.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>The system will contain information about individuals currently or previously enrolled in a risk adjustment covered plan as defined at 45 CFR § 153.20, and individual providers of medical or health care services.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>CMS will collect demographic, geographic, medical and/or health care information, date of birth, gender, dates of service about individuals that are currently and previously enrolled in risk adjustment covered plans.  In addition, CMS will collect identifiable information about individual health care providers, including but not limited to name, ITIN or EIN, and NPI numbers.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>Authority for the maintenance of the RAD-V is given under the provisions of §§ 1321 and 1343 of the Patient Protection and Affordable Care Act (Pub. L. 111-148) as amended by the Health Care and Education Reconciliation Act of 2010 (Pub. L. 111-152), and the Regulations at 45 CFR §§ 153.350, 153.620, 153.630.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>The primary purpose of this system is to collect and maintain necessary to support the audit functions of the risk adjustment programs, including validation activities under the risk adjustment data validation system (RAD-V).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>A. Entities Who May Receive Disclosures under Routine Uses</p>
                    <p>Records about an individual may be disclosed from this system of records to the following parties outside the agency, without the individual’s consent, for these purposes:</p>
                    <p>1. To CMS contractors who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.</p>
                    <p>2. To a health insurance issuer participating in the risk adjustment data validation program or any agent, contractor, sub-contractor or entity of that health insurance issuer that has entered into an agreement or contract with the issuer to assist in compliance with the risk adjustment data validation program.</p>
                    <p>3. The Department of Justice (DOJ), a court or an adjudicatory body when: a. The agency or any component thereof, or b. Any employee of the agency in his/her official capacity, or c. Any employee of the agency in his/her individual capacity where the DOJ has agreed to represent the employee, or d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, a court or an adjudicatory body is compatible for the purpose for which the agency collected the records.</p>
                    <p>4. To a CMS contractor that assists in the administration of a CMS administered health benefits program, when disclosure is deemed reasonably necessary by CMS, to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.</p>
                    <p>5. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate, potential fraud in the health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.</p>
                    <p>6. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, if the information disclosed is relevant to and necessary for that assistance; and information from this system may become available to U.S. Department of Homeland Security (DHS) cyber security personnel if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cyber security program that monitors internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.</p>
                    <p>Records may also be disclosed to parties outside the agency, without the individual’s consent, for any of the purposes authorized directly in the Privacy Act at 5 U.S.C § 552(a)(b)(1), (2) and (b)(4) - (b)(12).</p>
                    </xhtmlContent>
        </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>Storage:</p>
                    <p>Archived records for the risk adjustment data validation program will be stored in electronic form in the HHS-RADV Audit Tool maintained in the Acumen Web Portal.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>The data collected is retrieved by the name of an individual, or by some other identifying number, symbol, or other identifying particular assigned to an individual.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the RAD-V have been trained in the Privacy Act information privacy and security requirements.  Employees who maintain records in this system are instructed not to release data unless the intended recipient agrees to implement appropriate physical, technical, and administrative safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems, and to prevent unauthorized access.</p>
                    <p>This system will conform to all applicable Federal laws and regulation and Federal, HHS and CMS policies and standards as they relate to information security and data privacy. These laws and regulation mat apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the e-Government Act of 2002; the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and their corresponding implementing regulations.  OMB Circular A-130, Management of Federal Resources, Appendix III Security of Federal Automated Information Resources also applies, as well as Federal, HHS, and CMS information system security and privacy policies.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>Records will be maintained until they become inactive, at which time they will be retired or destroyed in accordance with published records schedules of CMS, as approved by the National Archives and Records Administration, and following the guidelines in National Institutes of Science and Technology (NIST) Special Publication 800-88, Guidelines for Media Sanitation.  Enrollee claims records subject to a document preservation order will be preserved consistent with the terms of the court’s order.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>Director, Division of Risk Adjustment Operations, Payment Policy &amp; Financial Management Group, CCIIO, CMS, 7500 Security Boulevard, Baltimore, MD 21244.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>Individuals wishing to know if this system contains records about them should write to the System Manager and include pertinent personally identifiable information (which CMS recommends be encrypted and properly transmitted) to be used for retrieval of their records.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>Individuals seeking access to records about them in this system should follow the same instructions indicated under "Notification Procedure" and reasonably specify the record content being sought.  (These procedures are in accordance with HHS regulations at 45 CFR § 5b.5(a)(2).)</p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>Individuals seeking to contest the content of information about them in this system should follow the same instructions indicated under "Notification Procedure."  The request should: reasonably identify the record and specify the information being contested; state the corrective action sought; and provide the reasons for the correction, with supporting justification.  (These procedures are in accordance with HHS regulations at 45 CFR § 5b.7.)</p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>The RAD-V will contain individually identifiable enrollment and demographic information, claims and encounter information and enrollees’ medical records provided by issuers of risk adjustment covered plans. The issuers will provide the information as requested by CMS or a contractor on CMS’ behalf.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="exemptionsClaimed">
                <xhtmlContent>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
        </section>


        <section id="09-70-0512" toc="yes">
                        <systemNumber>09-70-012</systemNumber>
                        <subsection type="systemName">"Links To Social Security Administration and Centers For Medicare &amp; Medicaid Services Data (LOD)," HHS/CMS/ORDI. </subsection>
                        <subsection type="securityClassification">
                            <xhtmlContent>
                                <p>Level Three Privacy Act Sensitive Data.</p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="systemLocation">
                            <xhtmlContent>
                                <p>
                                    Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various other locations.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="categoriesOfIndividuals">
                            <xhtmlContent>
                                <p>
                                    The system includes samples of the United States population served by Social Security Administration (SSA) and CMS programs.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="categoriesOfRecords">
                            <xhtmlContent>
                                <p>
                                    The collected information will include, but is not limited to name, social security number (SSN), Medicaid identification number, health insurance claim number (HICN), eligibility for SSA and CMS programs, and benefit record information.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="authorityForMaintenance">
                            <xhtmlContent>
                                <p>
                                    Authority for maintenance of this system is given under Section 1875(a) [42 U.S.C. 1395II(a)] and 1110 of the Social Security Act [42 U.S.C. 1310].
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="purpose">
                            <xhtmlContent>
                                <p>
                                    The primary purpose of the LOD is to collect and maintain information that will be used to conduct research, perform policy analysis, and improve program management for populations served by both SSA and CMS. Information maintained in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant or grantee; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) facilitate research on the quality and effectiveness of care provided, as well as epidemiological projects; and (4) support litigation involving the Agency.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="routineUsesOfRecords">
                            <xhtmlContent>
                                <p>
                                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                </p>
                                <p>
                                    1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                                </p>
                                <p>
                                    2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                                </p>
                                <p>
                                    a. Allow such agency to comply with Title XI, Part C of the Act,
                                </p>
                                <p>
                                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                                </p>
                                <p>
                                    c. Support data exchanges between the cooperating agencies.
                                </p>
                                <p>
                                    3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease, disability, or quality care projects, the restoration or maintenance of health, and payment related projects.
                                </p>
                                <p>
                                    4. To the Department of Justice (DOJ), court or adjudicatory body when:
                                </p>
                                <p>
                                    a. The agency or any component thereof, or
                                </p>
                                <p>
                                    b. Any employee of the agency in his or her official capacity, or
                                </p>
                                <p>
                                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                </p>
                                <p>
                                    d. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                </p>
                                <p>
                                    <i>B. Additional Provisions Affecting Routine Use Disclosures</i>
                                </p>
                                <p>
                                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the " Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512 (a) (1).)
                                </p>
                                <p>
                                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="policiesAndPractices">
                            <xhtmlContent>
                                <p>
                                    Storage:
                                </p>
                                <p>
                                    All records are stored on electronic media.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="retrievability">
                            <xhtmlContent>
                                <p>
                                    The collected data are retrieved by an individual identifier; e.g., beneficiary name, health insurance claim number, State assigned personal identifier, or social security number.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="safeguards">
                            <xhtmlContent>
                                <p>
                                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                </p>
                                <p>
                                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002; the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003; and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="retentionAndDisposal">
                            <xhtmlContent>
                                <p>
                                    CMS will retain information for a total period not to exceed 25 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="systemManager">
                            <xhtmlContent>
                                <p>
                                    Director, Information and Methods Group, Office of Research, Development &amp; Information, Mail Stop C3-16-07, Centers for Medicare &amp; Medicaid Services, 7500 Security Boulevard, Baltimore, MD 21244-1849.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="notificationProcedure">
                            <xhtmlContent>
                                <p>
                                    For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="recordAccessProcedures">
                            <xhtmlContent>
                                <p>
                                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="contestingRecordProcedures">
                            <xhtmlContent>
                                <p>
                                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="recordSourceCategories">
                            <xhtmlContent>
                                <p>
                                    Sources of information contained in this records system include data collected from SSA systems of records, e.g., Supplemental Security Record (09-60-0103), Master Beneficiary Record (09-60-0090), Disability Determination Files (09-60 -0044), and Social Security Account Number Identification File (09-60-0058) and LOD systems of records, e.g., Medicaid Statistical Information System (09-70-0541), Current Beneficiary Survey (09-70-0519), Common Working Files (09- 70-0526), National Claims History Files (09-70-0558) and Enrollment Data Base (09-70-0502).
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="systemsExempted">
                            <xhtmlContent>
                                <p>
                                    None.
                                </p>
                            </xhtmlContent>
                        </subsection></section>
                        <section id="09-70-0513" toc="yes">
                            <systemNumber>09-70-0513</systemNumber>
                            <subsection type="systemName">Medicare Benefits Notices (MBN), HHS/HCFA/CBS.</subsection>
                            <subsection type="securityClassification">
                                <xhtmlContent>
                                    <p>
                                        Level Three Privacy Act Sensitive Data.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="systemLocation">
                                <xhtmlContent>
                                    <p>
                                        HCFA Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850, and Medicare intermediaries and carriers and agents at various locations.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="categoriesOfIndividuals">
                                <xhtmlContent>
                                    <p>
                                        All recipients of Medicare Part A and Part B services and supplies.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="categoriesOfRecords">
                                <xhtmlContent>
                                    <p>
                                        The system includes the following information for each beneficiary: Name; address; health insurance claims number (HIC); dates of service; and the contractor assigned claim control number.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="authorityForMaintenance">
                                <xhtmlContent>
                                    <p>
                                        Sections 205, 226, 1811, and 1832 of Title XVIII of the Social Security Act (42 USC 405, 426, 1395c, and 1395k).
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="purpose">
                                <xhtmlContent>
                                    <p>
                                        The primary purpose of the system of records is to provide an explanation of Medicare claims processed and to advise beneficiaries of supplemental insurance, deductible status, appeals information and general Medicare information. Information retrieved from this system of records will be used to support regulatory and policy functions performed within the agency or by a contractor or consultant, support constituent requests made to a congressional representative, and to support litigation involving the agency related to this system of records.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="routineUsesOfRecords">
                                <xhtmlContent>
                                    <p>
                                        The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine use in this system meets the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information that will be maintained in the system:
                                    </p>
                                    <p>
                                        1. To agency contractors, or consultants who have been engaged by the agency to assist in the performance of a service related to this system of records and who need to have access to the records in order to perform the activity.
                                    </p>
                                    <p>
                                        2. To a Member of Congress or to a congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.
                                    </p>
                                    <p>
                                        3. To the Department of Justice (DOJ), court or adjudicatory body when:
                                    </p>
                                    <p>
                                        (a) The agency or any component thereof, or
                                    </p>
                                    <p>
                                        (b) Any employee of the agency in his or her official capacity, or
                                    </p>
                                    <p>
                                        (c) Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                    </p>
                                    <p>
                                        (d) The United States Government is a party to litigation or has an interest in such litigation, and by careful review, HCFA determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="policiesAndPractices">
                                <xhtmlContent>
                                    <p>
                                        Storage:
                                    </p>
                                    <p>
                                        Computer diskette and on magnetic storage media.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="retrievability">
                                <xhtmlContent>
                                    <p>
                                        Information can be retrieved by the beneficiary's health insurance claims number or a contractor assigned claim control number.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="safeguards">
                                <xhtmlContent>
                                    <p>
                                        HCFA has safeguards for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and systems security requirements. Employees who maintain records in the system are instructed not to release any data until the intended recipient agrees to implement appropriate administrative, technical, procedural, and physical safeguards sufficient to protect the confidentiality of the data and to prevent unauthorized access to the data.
                                    </p>
                                    <p>
                                        In addition, HCFA has physical safeguards in place to reduce the exposure of computer equipment and thus achieve an optimum level of protection and security for the MBN system. For computerized records, safeguards have been established in accordance with HHS standards and National Institute of Standards and Technology guidelines, e.g., security codes will be used, limiting access to authorized personnel. System securities are established in accordance with HHS, Information Resource Management (IRM) Circular 1B10, Automated Information Systems Security Program; HCFA Automated Information Systems (AIS) Guide, Systems Securities Policies, and OMB Circular No. A-130 (revised), Appendix III.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="retentionAndDisposal">
                                <xhtmlContent>
                                    <p>
                                        Records are maintained in a secure storage area with identifiers. Records are placed in an inactive status at the close of the calendar year in which the benefit was paid, held two more years, transferred to a federal records center and destroyed after another six years.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="systemManager">
                                <xhtmlContent>
                                    <p>
                                        Director, Division of Contractor Customer Service Operations, Center for Beneficiary Services, HCFA, C2-26-21, 7500 Security Boulevard, Baltimore, Maryland, 21244-1850. The telephone number is 410-786-2133.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="notificationProcedure">
                                <xhtmlContent>
                                    <p>
                                        For purpose of access, the subject individual should write to the system manager who will require the system name, health insurance claim number, address, date of birth and sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable) and social security number (SSN). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="recordAccessProcedures">
                                <xhtmlContent>
                                    <p>
                                        For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="contestingRecordProcedures">
                                <xhtmlContent>
                                    <p>
                                        The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="recordSourceCategories">
                                <xhtmlContent>
                                    <p>
                                        Sources of information contained in this records system are provided by the beneficiary when applying for benefits or requesting payment, the physician or provider of services when requesting payment, and computations for amounts of payments and remaining benefits provided by the carriers and intermediaries.
                                    </p>
                                </xhtmlContent>
                            </subsection>
                            <subsection type="systemsExempted">
                                <xhtmlContent>
                                    <p>
                                        None.
                                    </p>
                                </xhtmlContent>
                            </subsection></section>
        
        
                            <section id="09-70-0514" toc="yes">
                                <systemNumber>09-70-0514</systemNumber>
                                <subsection type="systemName">"Medicare Provider Analysis and Review (MEDPAR) HHS/CMS/OIS." </subsection>
                                <subsection type="securityClassification">
                                    <xhtmlContent>
                                        <p>
                                            Level Three Privacy Act Sensitive Data.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemLocation">
                                    <xhtmlContent>
                                        <p>
                                            Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfIndividuals">
                                    <xhtmlContent>
                                        <p>
                                            The MEDPAR contains a summary of all services rendered to a Medicare beneficiary, from the time of admission through discharge, for a stay in an inpatient hospital and/or Skilled Nursing Facilities (SNF), Supplemental Security Income (SSI) entitlement information that CMS receives from the Social Security Administration on Medicare beneficiaries who have had stays at inpatient hospitals and SNF, and enrollment data on Medicare beneficiaries.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="categoriesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            The MEDPAR contains information necessary for appropriate Medicare claim processing. It also contains, but is not limited to, the Medicare health insurance claim number (HICN), gender, race, age (no date of birth), zip code, state and county for Medicare beneficiaries who have received inpatient hospital and SNF services.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="authorityForMaintenance">
                                    <xhtmlContent>
                                        <p>
                                            Authority for maintenance of this system is given under sections 1102(a), 1871, and 1886(d)(5)(F) of the Social Security Act, (Title 42 United States Code (U.S.C.) &#167;&#167; 1302(a), 1395hh, and 1395ww(d)(5)(F)). Authority is also given under section 951 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (Pub. L. 108-173).
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="purpose">
                                    <xhtmlContent>
                                        <p>
                                            The primary purpose of the system is to collect and maintain information for all services rendered during Medicare beneficiary stays in an inpatient hospital and/or Skilled Nursing Facilities, so as to enable CMS and its contractors to facilitate research on the quality and effectiveness of care provided, update annual hospital Inpatient Prospective Payment System (IPPS) rates, and to calculate Supplemental Security Income ratios for hospitals that are paid under the hospital IPPS and serve a disproportionate share of low-income patients, (hospitals that serve a disproportionate share of low-income patients are entitled to increased reimbursement under the IPPS). Information retrieved from this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor or consultant; (2) provide system data to a hospital that has an appeal properly pending before the Provider Reimbursement Review Board (PRRB) or before an intermediary; (3) provide system data when all requirements have been met to a hospital that may be entitled to disproportioned share hospital payments and makes a requests in accordance with section 951 of the MMA; (4) assist another Federal or state agency with information to enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (5) support constituent requests made to a Congressional representative; (6) support litigation involving the agency; (7) facilitate research on the quality and effectiveness of care provided; and, (8) combat fraud and abuse in certain Federally-funded health benefits programs.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="routineUsesOfRecords">
                                    <xhtmlContent>
                                        <p>
                                            A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                        </p>
                                        <p>
                                            1. To agency contractors, or consultants who have been engaged by the agency to assist in the performance of a service related to this system of records and who need to have access to the records in order to perform the activity.
                                        </p>
                                        <p>
                                            2. To a hospital that has an appeal properly pending before the Provider Reimbursement Review Board, or before an intermediary, on the issue of whether it is entitled to disproportionate share hospital payments, or the amount of such payments. As a condition of disclosure under this routine use, CMS will require the recipient of the information to:
                                        </p>
                                        <p>
                                            a. Establish reasonable administrative, technical, and physical safeguards to prevent unauthorized access, use, or disclosure of the record or any part thereof;
                                        </p>
                                        <p>
                                            b. Remove or destroy the information that allows the subject individual(s) to be identified at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the request;
                                        </p>
                                        <p>
                                            c. Refrain from using or disclosing the information for any purpose other than the stated purpose under which the information was disclosed; and
                                        </p>
                                        <p>
                                            d. Attest in writing that it understands the foregoing provisions, and is willing to abide by the foregoing provisions and any additional provisions that CMS deems appropriate in the particular circumstances.
                                        </p>
                                        <p>
                                            3. To a hospital that may be entitled to disproportionate share hospital payments, or the amount of such payments, for cost reporting periods that span December 8, 2004, and beyond. As a condition of disclosure under this routine use, CMS will require the recipient of the information to:
                                        </p>
                                        <p>
                                            a. Establish reasonable administrative, technical, and physical safeguards to prevent unauthorized access, use or disclosure of the record or any part thereof;
                                        </p>
                                        <p>
                                            b. Remove or destroy the information that allows the subject individual(s) to be identified at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the request;
                                        </p>
                                        <p>
                                            c. Refrain from using or disclosing the information for any purpose other than the stated purpose under which the information was disclosed; and
                                        </p>
                                        <p>
                                            d. Attest in writing that it understands the foregoing provisions, and is willing to abide by the foregoing provisions and any additional provisions that CMS deems appropriate in the particular circumstances.
                                        </p>
                                        <p>
                                            4. To another Federal or state agency to:
                                        </p>
                                        <p>
                                            a. Contribute to the accuracy of CMS' proper payment of Medicare benefits, and/or
                                        </p>
                                        <p>
                                            b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds.
                                        </p>
                                        <p>
                                            5. To an individual or organization for research, evaluation, or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects.
                                        </p>
                                        <p>
                                            6. To a member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.
                                        </p>
                                        <p>
                                            7. To the Department of Justice (DOJ), court or adjudicatory body when:
                                        </p>
                                        <p>
                                            a. The agency or any component thereof, or
                                        </p>
                                        <p>
                                            b. Any employee of the agency in his or her official capacity, or
                                        </p>
                                        <p>
                                            c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                        </p>
                                        <p>
                                            d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                        </p>
                                        <p>
                                            8. To a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
                                        </p>
                                        <p>
                                            9. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                                        </p>
                                        <p>
                                            B. Additional Provisions Affecting Routine Use Disclosures
                                        </p>
                                        <p>
                                            To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512 (a) (1)).
                                        </p>
                                        <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).</p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="policiesAndPractices">
                                    <xhtmlContent>
                                        <p>
                                            Storage:
                                        </p>
                                        <p>
                                            All records are stored on magnetic media.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retrievability">
                                    <xhtmlContent>
                                        <p>
                                            The Medicare records are retrieved by HICN of the beneficiary.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="safeguards">
                                    <xhtmlContent>
                                        <p>
                                            CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                        </p>
                                        <p>
                                            This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="retentionAndDisposal">
                                    <xhtmlContent>
                                        <p>
                                            CMS will retain identifiable MEDPAR data for a total period not to exceed 25 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemManager">
                                    <xhtmlContent>
                                        <p>
                                            Director, Division of Acute Care, Hospital and Ambulatory Provider Group, Center for Medicare Management, CMS, Room C4-08- 06, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="notificationProcedure">
                                    <xhtmlContent>
                                        <p>
                                            For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, age, gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable) and social security number (SSN). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordAccessProcedures">
                                    <xhtmlContent>
                                        <p>
                                            For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="contestingRecordProcedures">
                                    <xhtmlContent>
                                        <p>
                                            The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="recordSourceCategories">
                                    <xhtmlContent>
                                        <p>
                                            CMS's National Claims History system of records, enrollment data on Medicare beneficiaries, and SSI eligibility information from the Social Security Administration.
                                        </p>
                                    </xhtmlContent>
                                </subsection>
                                <subsection type="systemsExempted">
                                    <xhtmlContent>
                                        <p>
                                            None.
                                        </p>
                                    </xhtmlContent>
                                </subsection></section>
        
        
        
                                <section id="09-70-0515" toc="yes">
                                    <systemNumber>09-70-0515</systemNumber>
                                    <subsection type="systemName">"Record of Individuals Allowed Regular and Special Parking Privileges at the CMS Complex (PRKG)," HHS/CMS/OOM.</subsection>
                                    <subsection type="securityClassification">
                                        <xhtmlContent>
                                            <p>
                                                Level Three Privacy Act Sensitive Data.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="systemLocation">
                                        <xhtmlContent>
                                            <p>
                                                Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and the Office of Operations Management, South Building, Lower Level, Baltimore, Maryland 21244-1850.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="categoriesOfIndividuals">
                                        <xhtmlContent>
                                            <p>
                                                The collected information on all CMS employees and non-CMS employees, contractors, employees of another Federal agency, visitors, and others who require parking privileges at the CMS buildings.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="categoriesOfRecords">
                                        <xhtmlContent>
                                            <p>
                                                This system contains the collected information on all Federal employees at CMS buildings, <i>i.e.</i>, will contain name, social security number, parking permit number, telephone number, work location, position, title and grade, supervisor's name and telephone number and background information relating to medical or specific parking needs.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="authorityForMaintenance">
                                        <xhtmlContent>
                                            <p>
                                                Authority for maintenance of this system is given under Title 5 United States Code &#167; 301.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="purpose">
                                        <xhtmlContent>
                                            <p>
                                                The primary purpose of the system of records is to collect and maintain information on all CMS employees, non-CMS employees, contractors, employees of other Federal agencies, visitors, and others who require parking privileges at the CMS complex at Baltimore, Maryland. Information retrieved from this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or grantee; and (2) support litigation involving the agency.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="routineUsesOfRecords">
                                        <xhtmlContent>
                                            <p>
                                                A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                            </p>
                                            <p>
                                                1. To support agency contractors, consultants or grantees who have been engaged by the agency to assist in the performance of a service related to this system and who need to have access to the records in order to perform the activity.
                                            </p>
                                            <p>
                                                2. To support the Department of Justice (DOJ), court or adjudicatory body when:
                                            </p>
                                            <p>
                                                a. The agency or any component thereof, or
                                            </p>
                                            <p>
                                                b. Any employee of the agency in his or her official capacity, or
                                            </p>
                                            <p>
                                                c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                            </p>
                                            <p>
                                                d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="policiesAndPractices">
                                        <xhtmlContent>
                                            <p>
                                                Storage:
                                            </p>
                                            <p>
                                                Information is maintained on paper, computer diskette and on magnetic storage media.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="retrievability">
                                        <xhtmlContent>
                                            <p>
                                                Name and parking permit identification number are used to retrieve the records.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="safeguards">
                                        <xhtmlContent>
                                            <p>
                                                CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                            </p>
                                            <p>
                                                This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent NIST publications; the HHS Automated Information Systems Security Handbook and the CMS Information Security Handbook.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="retentionAndDisposal">
                                        <xhtmlContent>
                                            <p>
                                                All records are destroyed one year after parking privileges are terminated.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="systemManager">
                                        <xhtmlContent>
                                            <p>
                                                Director, Emergency Resources Management and Response Group, Office of Operations Management, CMS, Room SLL-11-08, CMS, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="notificationProcedure">
                                        <xhtmlContent>
                                            <p>
                                                For purposes of access, the subject individual should write to the system manager who will require the system name, parking permit number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable) and Social Security number (SSN). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="recordAccessProcedures">
                                        <xhtmlContent>
                                            <p>
                                                For purposes of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="contestingRecordProcedures">
                                        <xhtmlContent>
                                            <p>
                                                The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="recordSourceCategories">
                                        <xhtmlContent>
                                            <p>
                                                Sources of information contained in this system are received from the individual requesting parking privileges on CMS Form 182.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="systemsExempted">
                                        <xhtmlContent>
                                            <p>
                                                None.
                                            </p>
                                        </xhtmlContent>
                                    </subsection></section>
                                    <section id="09-70-0516" toc="yes">
                                        <systemNumber>09-70-0516</systemNumber>

                                        <subsection type="systemName">Complaints Against Health Insurance Issuers and Health Plans (CAHII)," HHS/CMS/CBC.</subsection>
                                        <subsection type="securityClassification">
                                            <xhtmlContent>
                                                <p>
                                                    Level Three Privacy Act Sensitive Data.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="systemLocation">
                                            <xhtmlContent>
                                                <p>
                                                    CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various other contractor locations.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="categoriesOfIndividuals">
                                            <xhtmlContent>
                                                <p>
                                                    This system will collect and maintain individually identifiable and other data collected on individuals/consumers who make complaints/inquiries to CMS that their health insurance issuers and/or non-Federal governmental health plans are in violation of the PHS ACT.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="categoriesOfRecords">
                                            <xhtmlContent>
                                                <p>
                                                    The system contains information such as consumer's name, address, phone number, the name and address of their health plan or health insurance issuer, their plan ID number or social security number, the nature of their complaint/inquiry against their health plan or issuer, and any medical and other additional information that is necessary for CAHII to help resolve the consumer's complaint.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="authorityForMaintenance">
                                            <xhtmlContent>
                                                <p>
                                                    Authority for maintenance of this system is given under &#167;&#167; 2722 and 2761 of the Public Health Service (PHS) Act; the Mental Health Parity Act of 1996 (MHPA); the Newborns' and Mothers' Health Protection Act of 1996 (NMHPA); and the Women's Health and Cancer Rights Act of 1998 (WHCRA) with respect to non-Federal governmental plans.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="purpose">
                                            <xhtmlContent>
                                                <p>
                                                    The primary purpose of this system is to collect and maintain information initiated by consumers complaints/reports to CMS that their health insurance issuers and/or non-Federal governmental health plans are in violation of one or more of the following statutes: &#167;&#167; 2722 and 2761 of the Public Health Service (PHS) Act; the Mental Health Parity Act of 1996 (MHPA); the Newborns' and Mothers' Health Protection Act of 1996 (NMHPA); and , the Women's Health and Cancer Rights Act of 1998 (WHCRA). Information maintained in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant or grantee; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) assist third party contacts in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to benefits under the Medicare program; (4) inform a health insurance issuer and/or health plan who has been named in a complaint/inquiry and is believed to be potentially in violation of relevant portions of the PHS ACT; (5) support litigation involving the Agency; and (6) combat fraud, waste, and abuse in certain health benefits programs.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="routineUsesOfRecords">
                                            <xhtmlContent>
                                                <p>
                                                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                                </p>
                                                <p>
                                                    1. To support Agency contractors, consultants, or grantees that have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need access to the records in order to assist CMS.
                                                </p>
                                                <p>
                                                    2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                                                </p>
                                                <p>
                                                    a. Contribute to the accuracy of CMS's payment of Medicare benefits,
                                                </p>
                                                <p>
                                                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                                                </p>
                                                <p>
                                                    c. Refer a complaint or with respect to Title I of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Mental Health Parity Act of 1996 (MHPA), the Newborns' and Mothers' Health Protection Act of 1996 (NMHPA), and the Women's Health and Cancer Rights Act of 1998 (WHCRA).
                                                </p>
                                                <p>
                                                    3. To assist third party contacts in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program and,
                                                </p>
                                                <p>
                                                    a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: The individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exists, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
                                                </p>
                                                <p>
                                                    b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: The individual's entitlement to benefits under the Medicare program, the amount of reimbursement, and in cases in which the evidence is being reviewed as a result of suspected fraud and abuse, program integrity, quality appraisal, or evaluation and measurement of activities.
                                                </p>
                                                <p>
                                                    4. To inform a health insurance issuer and/or health plan, who has been named in a complaint and is believed to be potentially in violation of relevant portions of the PHS Act.
                                                </p>
                                                <p>
                                                    5. To assist the Department of Justice (DOJ), court or adjudicatory body when:
                                                </p>
                                                <p>
                                                    a. The Agency or any component thereof, or
                                                </p>
                                                <p>
                                                    b. any employee of the Agency in his or her official capacity, or
                                                </p>
                                                <p>
                                                    c. any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                </p>
                                                <p>
                                                    d. the United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                                </p>
                                                <p>
                                                    6. To support a CMS contractor that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS- administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                                                </p>
                                                <p>
                                                    7. To support another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in a program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                                                </p>
                                                <p>
                                                    B. Additional Provisions Affecting Routine Use Disclosures
                                                </p>
                                                <p>
                                                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512 (a) (1)).
                                                </p>
                                                <p>
                                                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="policiesAndPractices">
                                            <xhtmlContent>
                                                <p>
                                                    Storage:
                                                </p>
                                                <p>
                                                    All records are stored on electronic media.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="retrievability">
                                            <xhtmlContent>
                                                <p>
                                                    The collected data are retrieved by an individual identifier; e.g., consumer's name or health insurance claims number, if, applicable.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="safeguards">
                                            <xhtmlContent>
                                                <p>
                                                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                                </p>
                                                <p>
                                                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="retentionAndDisposal">
                                            <xhtmlContent>
                                                <p>
                                                    CMS will retain information for a total period not to exceed 6 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="systemManager">
                                            <xhtmlContent>
                                                <p>
                                                    Director, Division of Policy, Employer Policy and Operations Group, Center for Beneficiary Choices, CMS, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="notificationProcedure">
                                            <xhtmlContent>
                                                <p>
                                                    For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="recordAccessProcedures">
                                            <xhtmlContent>
                                                <p>
                                                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2)).
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="contestingRecordProcedures">
                                            <xhtmlContent>
                                                <p>
                                                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="recordSourceCategories">
                                            <xhtmlContent>
                                                <p>
                                                    The data collected and maintained in this system are retrieved from individuals/consumers who file complaints/reports to CMS that their health insurance issuers and/or non-Federal governmental health plans are in violation of the PHS ACT.
                                                </p>
                                            </xhtmlContent>
                                        </subsection>
                                        <subsection type="exemptionsClaimed">
                                            <xhtmlContent>
                                                <p>
                                                    None.
                                                </p>
                                            </xhtmlContent>
                                        </subsection></section>
                                        <section id="09-70-0520" toc="yes">
                                            <systemNumber>09-70-0510</systemNumber>

                                            <subsection type="systemName">
                                                "ESRD Program Management and Medical Information (PMMIS)," HHS/CMS/OCSQ.
                                            </subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        Level Three Privacy Act Sensitive Data.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various other contractor locations.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        This system will collect and maintain individually identifiable and other data collected on individuals with ESRD who receive Medicare benefits or who are treated by DVA health care facilities. The system contains information on both the beneficiary and the provider of services.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        The collected information will include, but is not limited to beneficiary/patient medical records, claims data, and payment data collected from several non-reimbursement data collection instruments and Medicare bills. The provider of services' name, address, Medicare identification number, types of services provided, certification and or termination date, and ESRD network number.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        The statutory authority for this system is given under the provisions of Sections 226A, 1875, and 1881 of the Social Security Act (the Act) (Title 42 United States Code (U.S.C.), sections 426-1, 1395ll, and 1395rr).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        The primary purpose of the system of records is to maintain information on Medicare ESRD beneficiaries, non-Medicare ESRD patients; Medicare approved ESRD hospitals and dialysis facilities, and Department of Veterans Affairs (DVA) patients. The ESRD/PMMIS is used by CMS and the renal community to perform their duties and responsibilities in monitoring the Medicare status, transplant activities, dialysis activities, and Medicare utilization (inpatient and physician/supplier bills) of ESRD patients and their Medicare providers, as well as in calculating the Medicare covered periods of ESRD. Information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant or grantee; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) support an ESRD Network Organizations; (4) assist Quality Improvement Organizations (QIO) to implement quality improvement programs; (5) facilitate research on the quality and effectiveness of care provided and payment related projects; (6) permit the release of priority personal information to complete a transfer out event and/or a transfer-in event; (7) support litigation involving the agency; and, (8) combat fraud, waste, and abuse in certain health benefits programs.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                                    </p>
                                                    <p>
                                                        1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                                                    </p>
                                                    <p>
                                                        2. To another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                                                    </p>
                                                    <p>
                                                        a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
                                                    </p>
                                                    <p>
                                                        b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                                                    </p>
                                                    <p>
                                                        c. Determine compliance with the Federal conditions that an ESRD facility must meet in order to participate in Medicare.
                                                    </p>
                                                    <p>
                                                        3. To ESRD Network Organizations in connection with review of claims, or in connection with studies or quality improvements projects or other review activities, and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                                                    </p>
                                                    <p>
                                                        4. To Quality Improvement Organizations in connection with review of claims, or in connection with studies or quality improvements projects or other review activities, conducted pursuant to Part B of Title XI of the Social Security Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                                                    </p>
                                                    <p>
                                                        5. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
                                                    </p>
                                                    <p>
                                                        6. To assist with a transfer out event from a losing ESRD facility and/or a transfer-in event to a gaining ESRD facility to:
                                                    </p>
                                                    <p>
                                                        a. Contribute to the accuracy of CMS' proper payment of Medicare benefits; and
                                                    </p>
                                                    <p>
                                                        b. Enable such facilities to ensure the proper transfer of health records, and/or as necessary to enable such a facility to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and
                                                    </p>
                                                    <p>
                                                        c. Assist ESRD programs which may require PMMIS information for purposes related to this system.
                                                    </p>
                                                    <p>
                                                        Information will be released to these facilities upon specific request, and only for those facilities if they meet the following requirements:
                                                    </p>
                                                    <p>
                                                        d. Provide an attestation or other qualifying information that they are providing assistance to qualified ESRD beneficiaries/patients;
                                                    </p>
                                                    <p>
                                                        e. Submit a report of the transfer-in or transfer-out event with the following required priority information: Name, address, HICN or SSN, date of birth;
                                                    </p>
                                                    <p>
                                                        f. Safeguard the confidentiality of the data and prevent unauthorized access; and
                                                    </p>
                                                    <p>
                                                        g. Complete a written statement attesting to the information recipient's understanding of and willingness to abide by these provisions.
                                                    </p>
                                                    <p>
                                                        7. To the Department of Justice (DOJ), court or adjudicatory body when:
                                                    </p>
                                                    <p>
                                                        a. The agency or any component thereof, or
                                                    </p>
                                                    <p>
                                                        b. Any employee of the agency in his or her official capacity, or
                                                    </p>
                                                    <p>
                                                        c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                    </p>
                                                    <p>
                                                        d. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                                    </p>
                                                    <p>
                                                        8. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
                                                    </p>
                                                    <p>
                                                        9. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
                                                    </p>
                                                    <p>
                                                        B. Additional Provisions Affecting Routine Use Disclosures: To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512 (a) (1)).
                                                    </p>
                                                    <p>
                                                        In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>
                                                        All records are stored on electronic media.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        The collected data are retrieved by an individual identifier; e.g., beneficiary name or HICN, and unique provider identification number.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                                    </p>
                                                    <p>
                                                        This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records will be retained until an approved disposition authority is obtained from the National Archives and Records Administration. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, Information Support Group, Office of Clinical Standards and Quality, CMS, Room S3-02-01, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2)).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        The data contained in these records are obtained from Medicare ESRD medical evidence reports, kidney transplant reports, ESRD beneficiary reimbursement method selection forms, ESRD death notification forms, Medicare bills, CMS Medicare Master files, ESRD facility surveys, ESRD facility certification notices, and the Medicare/Medicaid Automated Certification System (MMACS).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="exemptionsClaimed">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                    <p>
                                                        <i>Appendix A </i>
                                                    </p>
                                                    <p>
                                                        1. ESRD Network of New England, Incorporated, Post Office Box 9484, New Haven, Connecticut 06534.
                                                    </p>
                                                    <p>
                                                        2. ESRD Network of New York, Incorporated, 1249 Fifth Avenue, A-419, New York, New York 10029.
                                                    </p>
                                                    <p>
                                                        3. Trans-Atlantic Renal Council, Cranbury Plaza, 2525 Route 130--Building C, Cranbury, New Jersey 08512-9595.
                                                    </p>
                                                    <p>
                                                        4. ESRD Network Organization Number 4, 200 Lothrop Street, Pittsburgh, Pennsylvania 15213-2582.
                                                    </p>
                                                    <p>
                                                        5. Mid-Atlantic Renal Coalition, 1527 Huguenot Road, Midlothian, Virginia 23113.
                                                    </p>
                                                    <p>
                                                        6. Southeastern Kidney Council, Incorporated, 1000 Saint Albans Drive, Suite 270, Raleigh, North Carolina 27609.
                                                    </p>
                                                    <p>
                                                        7. ESRD Network of Florida, Incorporated, One Davis Boulevard, Suite 304, Tampa, Florida 33606.
                                                    </p>
                                                    <p>
                                                        8. Network 8, Incorporated, Post Office Box 55868, Jackson, Mississippi 39296-5868.
                                                    </p>
                                                    <p>
                                                        9 &amp; 10. The Renal Network, Incorporated, 911 East 86th Street, Suite 202, Indianapolis, Indiana 46240.
                                                    </p>
                                                    <p>
                                                        11. Renal Network of the Upper Midwest, 970 Raymond Avenue #205, Saint Paul, Minnesota 55114.
                                                    </p>
                                                    <p>
                                                        12. ESRD Network Number 12, 7509 NW T Tiffany Spring Parkway, Suite 105, Kansas City, Missouri 64153.
                                                    </p>
                                                    <p>
                                                        13. ESRD Network Organization Number 13, 6600 North Meridan Avenue, Suite 155, Oklahoma City, Oklahoma 73116-1411.
                                                    </p>
                                                    <p>
                                                        14. ESRD Network of Texas, Incorporated, 14114 Dallas Parkway, Suite 660, Dallas, Texas 75240-4349.
                                                    </p>
                                                    <p>
                                                        15. Intermountain ESRD Network, Incorporated, 1301 Pennsylvania Street, Suite 220, Denver, Colorado 80203-5012.
                                                    </p>
                                                    <p>
                                                        16. Northwest Renal Network, 4702 42nd Avenue, Seattle, Washington 98116.
                                                    </p>
                                                    <p>
                                                        17. TransPacific Renal Network, 25 Mitchell Boulevard, Suite 7, San Rafael, California 94903.
                                                    </p>
                                                    <p>
                                                        18. Southern California Renal Disease Council, 6255 Sunset Boulevard, Suite 2211, Los Angeles, California 90082.
                                                        </p></xhtmlContent></subsection></section><section id="09-70-0517" toc="yes">
                                                            <systemNumber>09-70-0517</systemNumber>
                                                            <subsection type="systemName">Physician/Supplier 1099 File (Statement for Recipients of Medical and Health Care Payments)(1099), HHS/CMS/OFM.</subsection>
                                                            <subsection type="securityClassification">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Level Three Privacy Act Sensitive
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="systemLocation">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="categoriesOfIndividuals">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        The system contains information on total Medicare payments that have been made to physicians and suppliers by Medicare carriers and intermediaries.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="categoriesOfRecords">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        The system contains the name, address, assigned provider number, employer identification number (EIN), and social security number (SSN) of the physicians and suppliers.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="authorityForMaintenance">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Authority for the maintenance of this SOR is given under the Internal Revenue Code, Title 26 United States Code (USC) sec. 6041.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="purpose">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        The primary purpose of the SOR is to provide periodic reporting to the Internal Revenue Service (IRS). Information in this system will also be disclosed to: the IRS, support regulatory and policy functions performed within the agency or by a contractor or consultant, support constituent requests made to a congressional representative, support litigation involving the agency related to this system of records, and combat fraud and abuse in certain federally funded health care programs.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="routineUsesOfRecords">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the EDB without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. In addition, our policy will be to prohibit release even of non-identifiable data, except pursuant to one of the routine uses, if there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
                                                                    </p>
                                                                    <p>
                                                                        This SOR contains Protected Health Information as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, 65 <i>Federal Register</i> (FR) 82462 (12-28-00), as amended by 66 FR 12434 (2-26-01)). Disclosures of Protected Health Information authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." We are proposing to establish or modify the following routine use disclosures of information maintained in the system:
                                                                    </p>
                                                                    <p>
                                                                        1. To the Internal Revenue Service in connection with the determination of the individual's self-employment income.
                                                                    </p>
                                                                    <p>
                                                                        2. To agency contractors, or consultants who have been engaged by the agency to assist in accomplishment of a CMS function relating to the purposes for this SOR and who need to have access to the records in order to assist CMS.
                                                                    </p>
                                                                    <p>
                                                                        3. To a Member of Congress or to a congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.
                                                                    </p>
                                                                    <p>
                                                                        4. To the Department of Justice (DOJ), court or adjudicatory body when:
                                                                    </p>
                                                                    <p>
                                                                        a. The agency or any component thereof, or
                                                                    </p>
                                                                    <p>
                                                                        b. Any employee of the agency in his or her official capacity, or
                                                                    </p>
                                                                    <p>
                                                                        c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                                    </p>
                                                                    <p>
                                                                        d. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation
                                                                    </p>
                                                                    <p>
                                                                        5. To a CMS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS- administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
                                                                    </p>
                                                                    <p>
                                                                        6. To another federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="policiesAndPractices">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Storage:
                                                                    </p>
                                                                    <p>
                                                                        Computer diskette and on magnetic storage media.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="retrievability">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Information maintained in this system can be retrieved by the name, SSN, EIN, and an assigned physician/supplier identification number.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="safeguards">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        CMS has safeguards for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and systems security requirements. Employees who maintain records in the system are instructed not to release any data until the intended recipient agrees to implement appropriate administrative, technical, procedural, and physical safeguards sufficient to protect the confidentiality of the data and to prevent unauthorized access to the data.
                                                                    </p>
                                                                    <p>
                                                                        In addition, CMS has physical safeguards in place to reduce the exposure of computer equipment and thus achieve an optimum level of protection and security for the 1099 system. For computerized records, safeguards have been established in accordance with the Department of Health and Human Services (HHS) standards and National Institute of Standards and Technology guidelines, e.g., security codes will be used, limiting access to authorized personnel. System securities are established in accordance with HHS, Information Resource Management (IRM) Circular #10, Automated Information Systems Security Program; CMS Automated Information Systems (AIS) Guide, Systems Securities Policies, and OMB Circular No. A-130 (revised), Appendix III.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="retentionAndDisposal">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Records are maintained in a secure storage area with identifiers for 5 years.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="systemManager">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        Director, Division of Accounting, Accounting and Risk Management Group, Office of Financial Management, CMS, Room N3-11-17, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="notificationProcedure">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        For purpose of access, the subject individual should write to the system manager who will require the system name, address, date of birth, and sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and social security number (SSN). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="recordAccessProcedures">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="contestingRecordProcedures">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="recordSourceCategories">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        The record of the total annual payments made to each physician or supplier is derived from the individual Medicare bill payments.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection>
                                                            <subsection type="systemsExempted">
                                                                <xhtmlContent>
                                                                    <p>
                                                                        None.
                                                                    </p>
                                                                </xhtmlContent>
                                                            </subsection></section>
                                                            <section id="09-70-0518" toc="yes">
                                                                <systemNumber>09-70-0518</systemNumber>
                                                                <subsection type="systemName">"Record of Individuals Authorized Entry to CMS Building via a Card Key Access System (RICKS), HHS/CMS/OOM".</subsection>
                                                                <subsection type="securityClassification">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Level Three Privacy Act Sensitive Data.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="systemLocation">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and South Building, Baltimore, Maryland 21244-1850.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="categoriesOfIndividuals">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            The system collects and maintains information on Federal employees, contractors and consultants, Government Services Administration (GSA) employees, and contract guards working in the central office complex in Baltimore.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="categoriesOfRecords">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            The information maintained contains the individual's name, assigned card key number, demographic and geographic information, and the building/secure area location. The system also contains the date and time of actual or attempted entry to secured areas.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="authorityForMaintenance">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            The authority for this system is given under the provisions of 5 United States Code (U.S.C.) 301, 40 U.S.C. 121, 41 Code of Federal Regulations (CFR) Part 102-74, Subpart C (Conduct on Federal Property), 5 U.S.C. 552a(e)(10), and Office of Management and Budget Circular A-123, "Internal Control Systems."
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="purpose">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            The primary purpose of the system of records is to issue and control United States Government card keys to all CMS employees and other authorized individuals who require access into certain designated or secured areas. Information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or grantee; (2) assist another Federal agency to conduct activities related to this system; and (3) support litigation involving the agency.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="routineUsesOfRecords">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use."
                                                                        </p>
                                                                        <p>
                                                                            The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                                                        </p>
                                                                        <p>
                                                                            1. To support agency contractors, consultants, or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                                                                        </p>
                                                                        <p>
                                                                            2. To assist another Federal agency to conduct activities related to this system of records and who need to have access to the records in order to perform the activity.
                                                                        </p>
                                                                        <p>
                                                                            3. To support the Department of Justice (DOJ), court or adjudicatory body when:
                                                                        </p>
                                                                        <p>
                                                                            a. The agency or any component thereof, or
                                                                        </p>
                                                                        <p>
                                                                            b. Any employee of the agency in his or her official capacity, or
                                                                        </p>
                                                                        <p>
                                                                            c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                                        </p>
                                                                        <p>
                                                                            d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="policiesAndPractices">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Storage:
                                                                        </p>
                                                                        <p>
                                                                            All records are stored on paper and magnetic disk.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="retrievability">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Magnetic media records are retrieved by the name of the employees or other authorized individual and/or card key number. Paper records are retrieved alphabetically by name.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="safeguards">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                                                        </p>
                                                                        <p>
                                                                            This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="retentionAndDisposal">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Records are retained for up to 3 years following expiration of an individual's authority to enter secured areas. When an individual is no longer authorized, information is deleted from magnetic media immediately.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="systemManager">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            Director, Emergency Management and Response Group, Office of Operations Management, CMS, Room SLL-11-28, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="notificationProcedure">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            For purpose of access, the subject individual should write to the system manager who will require the system name, assigned card key number, and building/secure area, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="recordAccessProcedures">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2).)
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="contestingRecordProcedures">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7.)
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="recordSourceCategories">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            The data contained in this system of records are obtained from the individuals who submit a request for access to a secure building or area.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection>
                                                                <subsection type="systemsExempted">
                                                                    <xhtmlContent>
                                                                        <p>
                                                                            None.
                                                                        </p>
                                                                    </xhtmlContent>
                                                                </subsection></section>
                                                                <section id="09-70-0519" toc="yes">
                                                                    <systemNumber>09-70-0519</systemNumber>
                                                                    <subsection type="systemName">"Medicare Current Beneficiary Survey (MCBS)," HHS/CMS/ORDI.</subsection>
                                                                    <subsection type="securityClassification">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Level Three Privacy Act Sensitive Data.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="systemLocation">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites and at CMS Regional Offices.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="categoriesOfIndividuals">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Records in this system will be maintained on a random sample of persons enrolled for hospital insurance and/or supplemental medical benefits under the Medicare program.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="categoriesOfRecords">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Records in this system will include, but are not limited to, name, social security number (SSN), health insurance claim number (HICN), age, gender, ethnicity, education, military service history, income data, marital status, medical utilization and cost data, prescription drug usage and cost data, health and functional status, health insurance coverage, medical condition status, household composition data, and medical provider names.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="authorityForMaintenance">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Authority for maintenance of the system is given under section 1875 of the Social Security Act (42 United States Code 1395ll).
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="purpose">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                The primary purpose of this modified system is to collect and maintain a research database for CMS and other researchers that is capable of producing data sets suitable for both longitudinal and cross-sectional analysis to be used to: (1) Produce projections for current programs and proposed program changes, (2) produce national level estimates of health care expenditures by the aged and disabled, and (3) provide a research database that can be used to provide guidance to program management and policies. The information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant, or a CMS grantee; (2) assist another Federal or State agency with information to contribute to the accuracy of CMS's proper payment of Medicare benefits, enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) assist an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; and (4) support litigation involving the agency.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="routineUsesOfRecords">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                                                            </p>
                                                                            <p>
                                                                                1. To support agency contractors, consultants, or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                                                                            </p>
                                                                            <p>
                                                                                2. To another Federal or State agency to:
                                                                            </p>
                                                                            <p>
                                                                                a. Contribute to the accuracy of CMS's proper payment of Medicare benefits;
                                                                            </p>
                                                                            <p>
                                                                                b. Enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
                                                                            </p>
                                                                            <p>
                                                                                c. Assist Federal/State Medicaid programs within the State.
                                                                            </p>
                                                                            <p>3. To assist an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.</p>
                                                                            <p>
                                                                                4. To support the Department of Justice (DOJ), court or adjudicatory body when:
                                                                            </p>
                                                                            <p>
                                                                                a. The agency or any component thereof, or
                                                                            </p>
                                                                            <p>
                                                                                b. Any employee of the agency in his or her official capacity, or
                                                                            </p>
                                                                            <p>
                                                                                c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                                            </p>
                                                                            <p>
                                                                                d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                                                            </p>
                                                                            <p>
                                                                                B. Additional Provisions Affecting Routine Use Disclosures.
                                                                            </p>
                                                                            <p>
                                                                                To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a)(1)).
                                                                            </p>
                                                                            <p>
                                                                                In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="policiesAndPractices">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Storage:
                                                                            </p>
                                                                            <p>
                                                                                All records are stored on computer diskette and magnetic storage media.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="retrievability">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Information can be retrieved by the name and HICN of the beneficiary.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="safeguards">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                                                            </p>
                                                                            <p>
                                                                                This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications, the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="retentionAndDisposal">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Records will be maintained for 10 years after the final action of the research project is complete. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="systemManager">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Deputy Director, Office of Research, Development and Information, CMS, Mail Stop C3-20-01, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="notificationProcedure">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="recordAccessProcedures">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b(a)(2)).
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="contestingRecordProcedures">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="recordSourceCategories">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Information contained in these records will be obtained from the Medicare enrollment records, Medicare bill records, Medicare provider records, Medicare beneficiaries and/or their representatives, and Medicare carriers and intermediaries.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="systemsExempted">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                None.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection></section>
                                                                    <section id="09-70-0520" toc="yes">
                                                                        <systemNumber>09-70-0520</systemNumber>

                                                                        <subsection type="systemName">
                                                                            "ESRD Program Management and Medical Information (PMMIS)," HHS/CMS/OCSQ.
                                                                        </subsection>
                                                                        <subsection type="securityClassification">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Level Three Privacy Act Sensitive Data.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="systemLocation">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various other contractor locations.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="categoriesOfIndividuals">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    This system will collect and maintain individually identifiable and other data collected on individuals with ESRD who receive Medicare benefits or who are treated by DVA health care facilities. The system contains information on both the beneficiary and the provider of services.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="categoriesOfRecords">
                                                                            <xhtmlContent>
                                                                                <p>The collected information will include, but is not limited to beneficiary/patient medical records, claims data, and payment data collected from several non-reimbursement data collection instruments and Medicare bills. The provider of services' name, address, Medicare identification number, types of services provided, certification and or termination date, and ESRD network number.</p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="authorityForMaintenance">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    The statutory authority for this system is given under the provisions of Sections 226A, 1875, and 1881 of the Social Security Act (the Act) (Title 42 United States Code (U.S.C.), sections 426-1, 1395ll, and 1395rr).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="purpose">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    The primary purpose of the system of records is to maintain information on Medicare ESRD beneficiaries, non-Medicare ESRD patients; Medicare approved ESRD hospitals and dialysis facilities, and Department of Veterans Affairs (DVA) patients. The ESRD/PMMIS is used by CMS and the renal community to perform their duties and responsibilities in monitoring the Medicare status, transplant activities, dialysis activities, and Medicare utilization (inpatient and physician/supplier bills) of ESRD patients and their Medicare providers, as well as in calculating the Medicare covered periods of ESRD. Information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant or grantee; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) support an ESRD Network Organizations; (4) assist Quality Improvement Organizations (QIO) to implement quality improvement programs; (5) facilitate research on the quality and effectiveness of care provided and payment related projects; (6) permit the release of priority personal information to complete a transfer out event and/or a transfer-in event; (7) support litigation involving the agency; and, (8) combat fraud, waste, and abuse in certain health benefits programs.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="routineUsesOfRecords">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                                                                </p>
                                                                                <p>
                                                                                    1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                                                                                </p>
                                                                                <p>
                                                                                    2. To another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                                                                                </p>
                                                                                <p>
                                                                                    a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
                                                                                </p>
                                                                                <p>
                                                                                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                                                                                </p>
                                                                                <p>
                                                                                    c. Determine compliance with the Federal conditions that an ESRD facility must meet in order to participate in Medicare.
                                                                                </p>
                                                                                <p>
                                                                                    3. To ESRD Network Organizations in connection with review of claims, or in connection with studies or quality improvements projects or other review activities, and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                                                                                </p>
                                                                                <p>
                                                                                    4. To Quality Improvement Organizations in connection with review of claims, or in connection with studies or quality improvements projects or other review activities, conducted pursuant to Part B of Title XI of the Social Security Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                                                                                </p>
                                                                                <p>
                                                                                    5. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
                                                                                </p>
                                                                                <p>
                                                                                    6. To assist with a transfer out event from a losing ESRD facility and/or a transfer-in event to a gaining ESRD facility to:
                                                                                </p>
                                                                                <p>
                                                                                    a. Contribute to the accuracy of CMS' proper payment of Medicare benefits; and
                                                                                </p>
                                                                                <p>
                                                                                    b. Enable such facilities to ensure the proper transfer of health records, and/or as necessary to enable such a facility to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and
                                                                                </p>
                                                                                <p>
                                                                                    c. Assist ESRD programs which may require PMMIS information for purposes related to this system.
                                                                                </p>
                                                                                <p>
                                                                                    Information will be released to these facilities upon specific request, and only for those facilities if they meet the following requirements:
                                                                                </p>
                                                                                <p>
                                                                                    d. Provide an attestation or other qualifying information that they are providing assistance to qualified ESRD beneficiaries/patients;
                                                                                </p>
                                                                                <p>
                                                                                    e. Submit a report of the transfer-in or transfer-out event with the following required priority information: Name, address, HICN or SSN, date of birth;
                                                                                </p>
                                                                                <p>
                                                                                    f. Safeguard the confidentiality of the data and prevent unauthorized access; and
                                                                                </p>
                                                                                <p>
                                                                                    g. Complete a written statement attesting to the information recipient's understanding of and willingness to abide by these provisions.
                                                                                </p>
                                                                                <p>
                                                                                    7. To the Department of Justice (DOJ), court or adjudicatory body when:
                                                                                </p>
                                                                                <p>
                                                                                    a. The agency or any component thereof, or
                                                                                </p>
                                                                                <p>
                                                                                    b. Any employee of the agency in his or her official capacity, or
                                                                                </p>
                                                                                <p>
                                                                                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                                                </p>
                                                                                <p>
                                                                                    d. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                                                                </p>
                                                                                <p>
                                                                                    8. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
                                                                                </p>
                                                                                <p>
                                                                                    9. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
                                                                                </p>
                                                                                <p>
                                                                                    B. Additional Provisions Affecting Routine Use Disclosures: To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512 (a) (1)).
                                                                                </p>
                                                                                <p>
                                                                                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="policiesAndPractices">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Storage:
                                                                                </p>
                                                                                <p>
                                                                                    All records are stored on electronic media.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="retrievability">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    The collected data are retrieved by an individual identifier; e.g., beneficiary name or HICN, and unique provider identification number.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="safeguards">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                                                                </p>
                                                                                <p>
                                                                                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="retentionAndDisposal">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Records will be retained until an approved disposition authority is obtained from the National Archives and Records Administration. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="systemManager">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    Director, Information Support Group, Office of Clinical Standards and Quality, CMS, Room S3-02-01, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="notificationProcedure">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="recordAccessProcedures">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2)).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="contestingRecordProcedures">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="recordSourceCategories">
                                                                            <xhtmlContent>
                                                                                <p>
                                                                                    The data contained in these records are obtained from Medicare ESRD medical evidence reports, kidney transplant reports, ESRD beneficiary reimbursement method selection forms, ESRD death notification forms, Medicare bills, CMS Medicare Master files, ESRD facility surveys, ESRD facility certification notices, and the Medicare/Medicaid Automated Certification System (MMACS).
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection>
                                                                        <subsection type="exemptionsClaimed">
                                                                            <xhtmlContent>
                                                                                <p>None.</p>
                                                                                <p>
                                                                                    <i>Appendix A </i>
                                                                                </p>
                                                                                <p>
                                                                                    1. ESRD Network of New England, Incorporated, Post Office Box 9484, New Haven, Connecticut 06534.
                                                                                </p>
                                                                                <p>
                                                                                    2. ESRD Network of New York, Incorporated, 1249 Fifth Avenue, A-419, New York, New York 10029.
                                                                                </p>
                                                                                <p>
                                                                                    3. Trans-Atlantic Renal Council, Cranbury Plaza, 2525 Route 130--Building C, Cranbury, New Jersey 08512-9595.
                                                                                </p>
                                                                                <p>
                                                                                    4. ESRD Network Organization Number 4, 200 Lothrop Street, Pittsburgh, Pennsylvania 15213-2582.
                                                                                </p>
                                                                                <p>
                                                                                    5. Mid-Atlantic Renal Coalition, 1527 Huguenot Road, Midlothian, Virginia 23113.
                                                                                </p>
                                                                                <p>
                                                                                    6. Southeastern Kidney Council, Incorporated, 1000 Saint Albans Drive, Suite 270, Raleigh, North Carolina 27609.
                                                                                </p>
                                                                                <p>
                                                                                    7. ESRD Network of Florida, Incorporated, One Davis Boulevard, Suite 304, Tampa, Florida 33606.
                                                                                </p>
                                                                                <p>
                                                                                    8. Network 8, Incorporated, Post Office Box 55868, Jackson, Mississippi 39296-5868.
                                                                                </p>
                                                                                <p>
                                                                                    9 &amp; 10. The Renal Network, Incorporated, 911 East 86th Street, Suite 202, Indianapolis, Indiana 46240.
                                                                                </p>
                                                                                <p>
                                                                                    11. Renal Network of the Upper Midwest, 970 Raymond Avenue #205, Saint Paul, Minnesota 55114.
                                                                                </p>
                                                                                <p>
                                                                                    12. ESRD Network Number 12, 7509 NW T Tiffany Spring Parkway, Suite 105, Kansas City, Missouri 64153.
                                                                                </p>
                                                                                <p>
                                                                                    13. ESRD Network Organization Number 13, 6600 North Meridan Avenue, Suite 155, Oklahoma City, Oklahoma 73116-1411.
                                                                                </p>
                                                                                <p>
                                                                                    14. ESRD Network of Texas, Incorporated, 14114 Dallas Parkway, Suite 660, Dallas, Texas 75240-4349.
                                                                                </p>
                                                                                <p>
                                                                                    15. Intermountain ESRD Network, Incorporated, 1301 Pennsylvania Street, Suite 220, Denver, Colorado 80203-5012.
                                                                                </p>
                                                                                <p>
                                                                                    16. Northwest Renal Network, 4702 42nd Avenue, Seattle, Washington 98116.
                                                                                </p>
                                                                                <p>
                                                                                    17. TransPacific Renal Network, 25 Mitchell Boulevard, Suite 7, San Rafael, California 94903.
                                                                                </p>
                                                                                <p>
                                                                                    18. Southern California Renal Disease Council, 6255 Sunset Boulevard, Suite 2211, Los Angeles, California 90082.
                                                                                </p>
                                                                            </xhtmlContent>
                                                                        </subsection></section>
                                                                        <section id="09-70-0521" toc="yes">
                                                                            <systemNumber>09-70-0521</systemNumber>
                                                                            <subsection type="systemName">"Inpatient Rehabilitation Facilities Patient Assessment Instrument (IRF-PAI)," HHS/CMS/CMSO.</subsection>
                                                                            <subsection type="securityClassification">
                                                                                <xhtmlContent>
                                                                                    <p>Level Three Privacy Act Sensitive Data.</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="systemLocation">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites and at CMS Regional Offices.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="categoriesOfIndividuals">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        The IRF-PAI will be completed on all Medicare Part A fee-for-service patients who receive services under Part A from an IRF, it may also be completed on Medicare Advantage enrollees.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="categoriesOfRecords">
                                                                                <xhtmlContent>
                                                                                    <p>Records in this system will include, but are not limited to, name, address, date of birth, gender, ethnicity, social security number (SSN), health insurance claim number (HICN), Medicaid number, patient identification number, patient history, diagnosis, and functional prognosis.</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="authorityForMaintenance">
                                                                                <xhtmlContent>
                                                                                    <p>Authority for maintenance of the system is given under section 1886(j)(2)(D) of the Social Security Act authorizing the secretary to collect the data necessary to establish and administer the payment system.</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="purpose">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        The primary purpose of this modified system is to support the IRF prospective payment system (PPS) for payment of the IRF Medicare Part A fee-for-services furnished by the IRF to Medicare beneficiaries. Information maintained in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant, or a CMS grantee; (2) assist another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent, for evaluating and monitoring the quality of IRF health care and contribute to the accuracy of health insurance operations; (3) support research, evaluation, or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects; (4) support the functions of Quality Improvement Organizations (QIO); (5) assist other insurers; (6) support the functions of national accrediting organizations; (7) support litigation involving the Agency; (8) combat fraud, waste, and abuse in certain health care programs.
                                                                                    </p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="routineUsesOfRecords">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                                                                    </p>
                                                                                    <p>1. To support agency contractors, consultants, or grantees who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.</p>
                                                                                    <p>
                                                                                        2. To assist another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                                                                                    </p>
                                                                                    <p>
                                                                                        a. Contribute to the accuracy of CMS' proper payment of Medicare benefits,
                                                                                    </p>
                                                                                    <p>
                                                                                        b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                                                                                    </p>
                                                                                    <p>c. Improve the state survey process for investigation of complaints related to health and safety or quality of care and to implement a more outcome oriented survey and certification program.</p>
                                                                                    <p>3. To an individual or organization for research on the utilization of inpatient rehabilitation services as well as evaluation or epidemiological projects related to the prevention of disease or disability, the restoration or maintenance of health, or for understanding and improving payment projects.</p>
                                                                                    <p>4. To support Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities conducted pursuant to Part B of Title XI of the Act, and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.</p>
                                                                                    <p>
                                                                                        5. To assist insurance companies, third party administrators (TPA), employers, self-insurers, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, group health plans (i.e., health maintenance organization (HMO) or a competitive medical plan (CMP)) with a Medicare contract, or a Medicare-approved health care payment plan (HCPP), directly or through a contractor, and other groups providing protection for their enrollees. Information to be disclosed shall be limited to Medicare entitlement data. In order to receive the information, they must agree to:
                                                                                    </p>
                                                                                    <p>
                                                                                        a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a third party administrator;
                                                                                    </p>
                                                                                    <p>
                                                                                        b. Utilize the information solely for the purpose of processing the individual's insurance claims; and
                                                                                    </p>
                                                                                    <p>c. Safeguard the confidentiality of the data and prevent unauthorized access.</p>
                                                                                    <p>
                                                                                        6. To assist national accrediting organization(s) whose accredited facilities are presumed to meet certain Medicare requirements for inpatient hospital rehabilitation services (e.g., the Joint Commission for the Accreditation of Healthcare Organizations, the American Osteopathic Association, or the Commission on Accreditation of Rehabilitation Facilities). Information will be released to these organizations for only those facilities that they accredit and that participate in the Medicare program and if they meet the following requirements:
                                                                                    </p>
                                                                                    <p>
                                                                                        a. Provide identifying information for IRFs that have an accreditation status with the requesting deemed organization;
                                                                                    </p>
                                                                                    <p>
                                                                                        b. Submission of a finder file identifying beneficiaries/patients receiving IRF services;
                                                                                    </p>
                                                                                    <p>
                                                                                        c. Safeguard the confidentiality of the data and prevent unauthorized access; and
                                                                                    </p>
                                                                                    <p>d. Upon completion of a signed data exchange agreement or a CMS data use agreement.</p>
                                                                                    <p>
                                                                                        7. To support the Department of Justice (DOJ), court or adjudicatory body when:
                                                                                    </p>
                                                                                    <p>
                                                                                        a. The agency or any component thereof, or
                                                                                    </p>
                                                                                    <p>
                                                                                        b. Any employee of the agency in his or her official capacity, or
                                                                                    </p>
                                                                                    <p>
                                                                                        c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                                                    </p>
                                                                                    <p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.</p>
                                                                                    <p>8. To assist a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.</p>
                                                                                    <p>9. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.</p>
                                                                                    <p>
                                                                                        B. <i>Additional Provisions Affecting Routine Use Disclosures.</i> To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00), disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a) (1)).
                                                                                    </p>
                                                                                    <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="policiesAndPractices">
                                                                                <xhtmlContent>
                                                                                    <p>Storage:</p>
                                                                                    <p>All records are stored on magnetic media.</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="retrievability">
                                                                                <xhtmlContent>
                                                                                    <p>The Medicare records are retrieved by the HICN and SSN.</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="safeguards">
                                                                                <xhtmlContent>
                                                                                    <p>CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.</p>
                                                                                    <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the DHHS Information Systems Program Handbook and the CMS Information Security Handbook.</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="retentionAndDisposal">
                                                                                <xhtmlContent>
                                                                                    <p>CMS will retain identifiable IRF-PAI data for a total period of 15 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="systemManager">
                                                                                <xhtmlContent>
                                                                                    <p>Director, Survey and Certification Group, Center for Medicaid and State Operations, CMS, Mail Stop C3-20-01, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.</p>
                                                                                </xhtmlContent>
                                                                            </subsection>
                                                                            <subsection type="notificationProcedure">
                                                                                <xhtmlContent>
                                                                                    <p>
                                                                                        For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN.
                                                                                    
                                </p><p>Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                                </p>
                                </xhtmlContent>
                                </subsection>
                                    <subsection type="recordAccessProcedures">
                                        <xhtmlContent>
                                            <p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).</p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="contestingRecordProcedures">
                                        <xhtmlContent>
                                            <p>The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.70.</p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="recordSourceCategories">
                                        <xhtmlContent>
                                            <p>Information for this system is collected from the Inpatient Rehabilitation Facilities--Patient Assessment Instrument.</p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="systemsExempted">
                                        <xhtmlContent>
                                            <p>None.</p>
                                        </xhtmlContent>
                                    </subsection>
                                </section>
                                <section id="09-70-0522" toc="yes">
                                    <systemNumber>09-70-0522</systemNumber>
                                    <subsection type="systemName">
                                        "Home Health Agency (HHA) Outcome and Assessment Information Set (OASIS)," HHS/CMS/CMSO.
                                    </subsection>
                                    <subsection type="securityClassification">
                                        <xhtmlContent>
                                            <p>
                                                Level Three Privacy Act Sensitive Data.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="systemLocation">
                                        <xhtmlContent>
                                            <p>
                                                The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and South Building, Baltimore, Maryland 21244-1850.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="categoriesOfIndividuals">
                                        <xhtmlContent>
                                            <p>
                                                The system of records (SOR) will contain clinical assessment information (OASIS) for all patients receiving the services of a Medicare and/or Medicaid approved HHA, except pre-partum and post-partum patients, patients under 18 years of age, and patients receiving other than personal care or health care services; i.e., housekeeping services and chore services. Identifiable information will be maintained in the SOR only for those individuals whose payments come from Medicare or Medicaid.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="categoriesOfRecords">
                                        <xhtmlContent>
                                            <p>
                                                This SOR will contain individual-level demographic and identifying data, as well as clinical status data for patients with the payment sources of Medicare traditional fee for service, Medicaid traditional fee for service, Medicare HMO/managed care or Medicaid HMO/managed care.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="authorityForMaintenance">
                                        <xhtmlContent>
                                            <p>
                                                Authority for maintenance of this system is given under Sections 1102(a), 1154, 1861(m), 1861(o), 1861(z), 1863, 1864, 1865, 1866, 1871, 1891, and 1902 of the Social Security Act. These provisions of the Act authorize the Administrator of CMS to require HHAs participating in the Medicare and Medicaid programs to complete a standard, valid, patient assessment data set; i.e., the OASIS, as part of their comprehensive assessments and updates when evaluating adult, non-maternity patients as required by section 484.55 of the Conditions of Participation. Authority is also given under section 951 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (Pub. L. 108-173).
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="purpose">
                                        <xhtmlContent>
                                            <p>
                                                The primary purposes of the SOR are to collect and maintain information to: (1) Study and help ensure the quality of care provided by home health agencies (HHA); (2) aid in administration of the survey and certification of Medicare/Medicaid HHAs; (3) enable regulators to provide HHAs with data for their internal quality improvement activities; (4) support agencies of the state government to determine, evaluate and assess overall effectiveness and quality of HHA services provided in the state; (5) provide for the validation, and refinements of the Medicare Prospective Payment System; (6) aid in the administration of Federal and state HHA programs within the state; and (7) monitor the continuity of care for patients who reside temporarily outside of the state. Information maintained in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant, or grantee; (2) assist another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent, for evaluating and monitoring the quality of home health care and contribute to the accuracy of health insurance operations; (3) support research, evaluation, or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects; (4) support the functions of Quality Improvement Organizations (QIO); (5) support the functions of national accrediting organizations; (6) support litigation involving the Agency; (7) combat fraud, waste, and abuse in certain health care programs.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="routineUsesOfRecords">
                                        <xhtmlContent>
                                            <p>
                                                A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                                            </p>
                                            <p>
                                                1. To support agency contractors, consultants, or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                                            </p>
                                            <p>
                                                2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                                            </p>
                                            <p>
                                                a. contribute to the accuracy of CMS's proper payment of Medicare benefits,
                                            </p>
                                            <p>
                                                b. enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with federal funds, and/or
                                            </p>
                                            <p>
                                                c. evaluate and monitor the quality of home health care and contribute to the accuracy of health insurance operations.
                                            </p>
                                            <p>
                                                3. To assist an individual or organization for research, evaluation or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects.
                                            </p>
                                            <p>4. To support Quality Improvement Organizations (QIO) in order to assist the QIO to perform Title XI and Title XVIII functions relating to assessing and improving HHA quality of care.</p>
                                            <p>
                                                5. To support national accrediting organizations with approval for deeming authority for Medicare requirements for home health services (i.e., the Joint Commission on Accreditation of Healthcare Organizations, Accreditation Commission for Health Care, Inc., and the Community Health Accreditation Program). Information will be released to these organizations upon specific request, and only for those facilities that they accredit and that participate in the Medicare program and if they meet the following requirements:
                                            </p>
                                            <p>
                                                a. Provide identifying information for HHAs that have an accreditation status with the requesting deemed organization,
                                            </p>
                                            <p>
                                                b. Submit a finder file identifying beneficiaries/patients receiving HHA services,
                                            </p>
                                            <p>
                                                c. Complete a signed data exchange agreement or a CMS data use agreement, and
                                            </p>
                                            <p>
                                                d. Safeguard the confidentiality of the data and prevent unauthorized access.
                                            </p>
                                            <p>
                                                6. To support the Department of Justice (DOJ), court or adjudicatory body when:
                                            </p>
                                            <p>
                                                a. The agency or any component thereof, or
                                            </p>
                                            <p>
                                                b. any employee of the agency in his or her official capacity, or
                                            </p>
                                            <p>
                                                c. any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                            </p>
                                            <p>
                                                d. the United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                            </p>
                                            <p>
                                                7. To assist a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
                                            </p>
                                            <p>
                                                8. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
                                            </p>
                                            <p>
                                                B. Additional Provisions Affecting Routine Use Disclosures. To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 Fed. Reg. 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a) (1)).
                                            </p>
                                            <p>
                                                In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="policiesAndPractices">
                                        <xhtmlContent>
                                            <p>
                                                Storage:
                                            </p>
                                            <p>
                                                All records are stored on paper and magnetic disk.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="retrievability">
                                        <xhtmlContent>
                                            <p>
                                                The Medicare and Medicaid records are retrieved by health insurance claim number, Social Security number (SSN) or by state assigned Medicaid number.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="safeguards">
                                        <xhtmlContent>
                                            <p>
                                                CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                            </p>
                                            <p>
                                                This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="retentionAndDisposal">
                                        <xhtmlContent>
                                            <p>
                                                CMS will retain identifiable OASIS assessment data for a total period not to exceed fifteen (15) years.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="systemManager">
                                        <xhtmlContent>
                                            <p>
                                                Director, Division of Continuing Care Providers, Survey and Certification Group, Center for Medicaid and State Operations, CMS, 7500 Security Boulevard, S2-12-25, Baltimore, Maryland 21244-1850.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="notificationProcedure">
                                        <xhtmlContent>
                                            <p>
                                                For purpose of access, the subject individual should write to the system manager who will require the system name, health insurance claim number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay), address, date of birth, and sex.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="recordAccessProcedures">
                                        <xhtmlContent>
                                            <p>
                                                For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="contestingRecordProcedures">
                                        <xhtmlContent>
                                            <p>
                                                The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="recordSourceCategories">
                                        <xhtmlContent>
                                            <p>
                                                The data contained in this system of records are obtained from The Outcome and Assessment Information Set.
                                            </p>
                                        </xhtmlContent>
                                    </subsection>
                                    <subsection type="exemptionsClaimed">
                                        <xhtmlContent>
                                            <p>
                                                None.</p></xhtmlContent></subsection></section>
                                                <section id="09-70-0524" toc="yes">
                                                    <systemNumber>09-70-0524</systemNumber>

                                                    <subsection type="systemName">"Intern and Resident Information System (IRIS), HHS/CMS/OFM" </subsection>
                                                    <subsection type="securityClassification">
                                                        <xhtmlContent>
                                                            <p>Level Three Privacy Act Sensitive Data.</p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="systemLocation">
                                                        <xhtmlContent>
                                                            <p>
                                                                The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and South Building, Baltimore, Maryland 21244-1850.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="categoriesOfIndividuals">
                                                        <xhtmlContent>
                                                            <p>
                                                                Interns and residents (IR) in medical residency programs approved under 42 CFR &#167; 413.75, working in all areas of the hospital complex, or other freestanding providers, as well as non-hospital or non-provider settings on or after July 1, 1985.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="categoriesOfRecords">
                                                        <xhtmlContent>
                                                            <p>
                                                                The system includes the following information for each IR: name, social security number; name of medical, osteopathic, dental, or podiatric school graduated from and date of graduation, type of residency program for the medical specialty, number of years completed in all types of residency programs, foreign medical school graduation date and certification date, name of employer (e.g., hospital, university, corporation) paying the salary, the percentage of time spent working in either the inpatient areas of the hospital subject to the Prospective Payment System or in the outpatient areas of the hospital or in a non-hospital setting under agreement with the hospital for indirect medical education (IME), the percentage of time spent working in any area of the hospital complex or in a non-provider setting under agreement with the hospital for graduate medical education (GME), the start and end dates assigned to the hospital and any hospital-based providers (assignment periods) during the hospital's cost reporting period, the start and end dates assigned to any non-hospital or non-provider setting in connection with approved residency programs (assignment periods) during the hospital's cost reporting period, and the full-time or part- time percentage during each assignment period.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="authorityForMaintenance">
                                                        <xhtmlContent>
                                                            <p>
                                                                Authority for maintenance of the system is given under the provisions of &#167;&#167; 1886(d)(5)(B) and 1886(h) of the Social Security Act (Title 42 United States Code (U.S.C.) &#167;&#167; 1395ww(d)(5)(B) and 1395ww (h)).
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="purpose">
                                                        <xhtmlContent>
                                                            <p>
                                                                The primary purpose of the SOR is to ensure that no interns and residents (IRs) are counted by the Medicare program as more than one full-time equivalent (FTE) employee in the calculation of payments for the costs of direct graduate medical education (GME) and indirect medical education (IME). Information retrieved from this SOR will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor or consultant, (2) assist another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent, (3) support providers and suppliers of services, (4) assist third-party contacts where necessary to establish or verify information, (5) support litigation involving the Agency, and (6) combat fraud, waste, and abuse in certain health benefits programs.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="routineUsesOfRecords">
                                                        <xhtmlContent>
                                                            <p>
                                                                A. Entities Who May Receive Disclosures Under Routine Use
                                                            </p>
                                                            <p>
                                                                These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the IRIS without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We are proposing to establish or modify the following routine use disclosures of information maintained in the system:
                                                            </p>
                                                            <p>
                                                                1. To support agency contractors, consultants, or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                                                            </p>
                                                            <p>
                                                                2. To another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent:
                                                            </p>
                                                            <p>
                                                                a. To contribute to the accuracy of CMS' proper payment of Medicare benefits,
                                                            </p>
                                                            <p>
                                                                b. To enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with federal funds.
                                                            </p>
                                                            <p>
                                                                3. To providers and suppliers of services (and their authorized billing agents) directly or dealing through fiscal intermediaries or carriers, for administration of provisions of Title XVIII of the Social Security Act.
                                                            </p>
                                                            <p>
                                                                4. To third-party contacts where necessary to establish or verify information provided on or by IR.
                                                            </p>
                                                            <p>
                                                                5. To the Department of Justice (DOJ), court or adjudicatory body when:
                                                            </p>
                                                            <p>
                                                                a. The agency or any component thereof, or
                                                            </p>
                                                            <p>
                                                                b. Any employee of the agency in his or her official capacity, or
                                                            </p>
                                                            <p>
                                                                c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                            </p>
                                                            <p>
                                                                d. The United States Government
                                                            </p>
                                                            <p>
                                                                Is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                                            </p>
                                                            <p>
                                                                6. To a CMS contractor (including, but not limited to FIs and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
                                                            </p>
                                                            <p>7. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.</p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="policiesAndPractices">
                                                        <xhtmlContent>
                                                            <p>
                                                                Storage:
                                                            </p>
                                                            <p>
                                                                All records are stored on paper and magnetic disk.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="retrievability">
                                                        <xhtmlContent>
                                                            <p>
                                                                Magnetic media records are retrieved by the name of the employees or other authorized individual and/or card key number. Paper records are retrieved alphabetically by name.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="safeguards">
                                                        <xhtmlContent>
                                                            <p>
                                                                CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                                            </p>
                                                            <p>
                                                                This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="retentionAndDisposal">
                                                        <xhtmlContent>
                                                            <p>
                                                                Records are maintained in a secure storage area with identifiers. Disposal occurs three years from the last action on the hospital's cost report, and should be coordinated with disposal of the reports.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="systemManager">
                                                        <xhtmlContent>
                                                            <p>
                                                                Director, Division of Provider Audit Operations, Financial Services Group, Office of Financial Management, CMS, 7500 Security Boulevard, C3-14-00, Baltimore, Maryland 21244-1850.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="notificationProcedure">
                                                        <xhtmlContent>
                                                            <p>
                                                                For purpose of access, the subject individual should write to the systems manager who will require the system name, SSN, address, date of birth, sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="recordAccessProcedures">
                                                        <xhtmlContent>
                                                            <p>
                                                                For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="contestingRecordProcedures">
                                                        <xhtmlContent>
                                                            <p>
                                                                The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="recordSourceCategories">
                                                        <xhtmlContent>
                                                            <p>
                                                                Data for this system is collected from IRIS diskettes/CDs as transmitted by the hospitals.
                                                            </p>
                                                        </xhtmlContent>
                                                    </subsection>
                                                    <subsection type="systemsExempted">
                                                        <xhtmlContent>
                                                            <p>
                                                                None.</p></xhtmlContent></subsection></section>
                                                                <section id="09-70-0525" toc="yes">
                                                                    <systemNumber>09-70-0525</systemNumber>
                                                                    <subsection type="systemName">"Unique Physician/Practitioner Identification Number" (UPIN), HHS/CMS/OFM.</subsection>
                                                                    <subsection type="securityClassification">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Level Three Privacy Act Sensitive.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="systemLocation">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850. The system is also located at CMS contractors and agents at various locations (<i>see</i> Appendix A).
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="categoriesOfIndividuals">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                All physicians, non-practitioners and medical groups practices, defined by &#167;&#167; 1124(A), 1861(r), 1842(b)(I)(ii)(iii)(iv) (v)(r), and 1877(h)(4) of the Social Security Act who request or receive Medicare reimbursement for medical services.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="categoriesOfRecords">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                The system contains an UPIN, tax identification, and social security number (SSN) for each physician, non-physician practitioner and medical group. Also, the system contains information concerning a provider's birth, residence, medical education, and eligibility information for Medicare reimbursement.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="authorityForMaintenance">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Authority for the collection and maintenance of this system is given under the provisions of &#167;&#167; 1842(r)-(42 U.S.C. 1395u) of Pub. L. 101-508; 1861(s)(1)-(42 U.S.C. 1395x); &#167;&#167; 1833(q)(1)-(42 U.S.C. 1395l); 1842(b)(18) -(42 U.S.C. 1395u); &#167; 1842(h)(4) &amp; (5)-(42 U.S.C. 1395u); and 4164 of Omnibus Budget Reconciliation Act of 1990 (OBRA).
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="purpose">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                The primary purpose of the SOR is to: (1) Collect and maintain an unique identification of each physician, non-physician practitioner, or medical group practice requesting or receiving Medicare payment, and (2) provide beneficiaries and other interested entities with the identification of each physician or non-physician practitioner assigned an UPIN and who are participating in the Medicare program. Information retrieved from this SOR will be used to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor or consultant, or CMS grantee; (2) assist another Federal and/or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) facilitate research on the quality and effectiveness of care provided, as well as payment related projects; (4) assist Quality Improvement Organizations; (5) provide the American Medical Association with information needed for them to assist us in identifying physicians; (6) support litigation involving the Agency; and (7) combat fraud, waste, and abuse in certain health benefits programs.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="routineUsesOfRecords">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                A. Entities Who May Receive Disclosures Under Routine Use
                                                                            </p>
                                                                            <p>
                                                                                These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the UPIN without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish or modify the following routine use disclosures of information maintained in the system:
                                                                            </p>
                                                                            <p>1. To support Agency contractors, consultants, or grantees who have been engaged by the Agency to assist in accomplishment of a CMS function relating to the purposes for this SOR and who need to have access to the records in order to assist CMS.</p>
                                                                            <p>
                                                                                2. To assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent pursuant to agreements with CMS to:
                                                                            </p>
                                                                            <p>
                                                                                a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
                                                                            </p>
                                                                            <p>
                                                                                b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                                                                            </p>
                                                                            <p>
                                                                                c. Assist Federal/State Medicaid programs within may require UPIN information for purposes related to this system.
                                                                            </p>
                                                                            <p>
                                                                                3. To assist an individual or organization for research, evaluation or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects.
                                                                            </p>
                                                                            <p>
                                                                                4. To support Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities, conducted pursuant to Part B of Title XI of the Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                                                                            </p>
                                                                            <p>
                                                                                5. To support the American Medical Association (AMA), for the purpose of assisting CMS to identify medical doctors when CMS is unable to establish an identity, provided the AMA agrees to:
                                                                            </p>
                                                                            <p>
                                                                                a. Use the information provided by CMS solely to identify a medical doctor;
                                                                            </p>
                                                                            <p>
                                                                                b. Make no copies of the information it receives from the CMS, except for one back-up copy;
                                                                            </p>
                                                                            <p>
                                                                                c. Return such information to CMS upon completion of its matching operation, and erase the back-up copy;
                                                                            </p>
                                                                            <p>
                                                                                d. Establish appropriate administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the records; and,
                                                                            </p>
                                                                            <p>
                                                                                e. Sign a written statement attesting to its understanding of, and willingness to abide by these provisions.
                                                                            </p>
                                                                            <p>
                                                                                6. To assist the Department of Justice (DOJ), court or adjudicatory body when:
                                                                            </p>
                                                                            <p>
                                                                                a. The Agency or any component thereof, or
                                                                            </p>
                                                                            <p>
                                                                                b. Any employee of the Agency in his or her official capacity, or
                                                                            </p>
                                                                            <p>
                                                                                c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                                            </p>
                                                                            <p>
                                                                                d. The United States Government,
                                                                            </p>
                                                                            <p>
                                                                                Is a party to litigation or has an  interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                                                                            </p>
                                                                            <p>
                                                                                7. To assist a CMS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
                                                                            </p>
                                                                            <p>
                                                                                8. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
                                                                            </p>
                                                                            <p>
                                                                                B. Additional Circumstances Affecting Routine Use Disclosures
                                                                            </p>
                                                                            <p>
                                                                                To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (<i>See</i> 45 CFR 164-512(a)(1)).
                                                                            </p>
                                                                            <p>
                                                                                In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="policiesAndPractices">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Storage:
                                                                            </p>
                                                                            <p>
                                                                                All records are stored on magnetic media.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="retrievability">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                The records are retrieved alphabetically by the provider name, social security number or by their assigned UPIN.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="safeguards">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                                                            </p>
                                                                            <p>
                                                                                This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="retentionAndDisposal">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                CMS and the repository of the National Archive and Records Administration will retain identifiable UPIN assessment data for a total period not to exceed fifteen (15) years.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="systemManager">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                Director, Program Integrity Group, Office of Financial Management, CMS, 7500 Security Boulevard, Baltimore, Maryland, 21244- 1850.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="notificationProcedure">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                For purpose of access, the subject individual should write to the system manager, who will require the system name, health insurance claim number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), social security number (SSN) (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay), address, date of birth, and sex.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="recordAccessProcedures">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="contestingRecordProcedures">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="recordSourceCategories">
                                                                        <xhtmlContent>
                                                                            <p>
                                                                                CMS obtains the identifying information in this system from carriers. Information in these records concerning the eligibility of physicians, practitioners, and medical groups for Medicare reimbursement is obtained either directly from such entities through Medicare Regional Offices, contractors, PRO, Department of Justice, State or local judicial systems, medical licensing and certification agencies or organizations, medical societies and medical associations.
                                                                            </p>
                                                                        </xhtmlContent>
                                                                    </subsection>
                                                                    <subsection type="systemsExempted">
                                                                        <xhtmlContent>
                                                                            <p>None.</p>
                                                                            <p>
                                                                                <i>Appendix A. Health Insurance Claims </i>
                                                                            </p>
                                                                            <p>
                                                                                Medicare records are maintained at the CMS Central Office (<i>see</i> section 1 below for the address). Health Insurance Records of the Medicare program can also be accessed through a representative of the CMS Regional Office (<i>see</i> section 2 below for addresses). Medicare claims records are also maintained by private insurance organizations that share in administering provisions of the health insurance programs. These private insurance organizations, referred to as carriers and intermediaries, are under contract to the Centers for Medicare &amp; Medicaid Services and the Social Security Administration to perform specific tasks in the Medicare program (<i>see</i> section three below for addresses for intermediaries, section four addresses the carriers, and section five addresses the Payment Safeguard Contractors.
                                                                            </p>
                                                                            <p>
                                                                                <i>1. Central Office Address </i>
                                                                            </p>
                                                                            <p>CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.</p>
                                                                            <p>
                                                                                <i>2. CMS Regional Offices </i>
                                                                            </p>
                                                                            <p><i>Boston Region</i>--Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont. John F. Kennedy Federal Building, Room 1211, Boston, Massachusetts 02203. Office Hours: 8:30 a.m.-5 p.m.
                                                                            </p>
                                                                            <p><i>New York Region</i>--New Jersey, New York, Puerto Rico, Virgin Islands. 26 Federal Plaza, Room 715, New York, New York 10007, Office Hours: 8:30 a.m.-5 p.m.
                                                                            </p>
                                                                            <p><i>Philadelphia Region</i>--Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, West Virginia. Post Office Box 8460, Philadelphia, Pennsylvania 19101. Office Hours: 8:30 a.m.-5 p.m.
                                                                            </p>
                                                                            <p><i>Atlanta Region</i>--Alabama, North Carolina, South Carolina, Florida, Georgia, Kentucky, Mississippi, Tennessee. 101 Marietta Street, Suite 702, Atlanta, Georgia 30223, Office Hours: 8:30 a.m.-4:30 p.m.
                                                                            </p>
                                                                            <p><i>Chicago Region</i>--Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin. Suite A--824, Chicago, Illinois 60604. Office Hours: 8 a.m.-4:45 p.m.
                                                                            </p>
                                                                            <p><i>Dallas Region</i>--Arkansas, Louisiana, New Mexico, Oklahoma, Texas, 1200 Main Tower Building, Dallas, Texas. Office Hours: 8 a.m-4:30 p.m.
                                                                            </p>
                                                                            <p><i>Kansas City Region</i>--Iowa, Kansas, Missouri, Nebraska. New Federal Office Building, 601 East 12th Street--Room 436, Kansas City, Missouri 64106. Office Hours: 8 a.m.-4:45 p.m.
                                                                            </p>
                                                                            <p><i>Denver Region</i>--Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming. Federal Office Building, 1961 Stout St.--Room 1185, Denver, Colorado 80294. Office Hours: 8 a.m.-4:30 p.m.
                                                                            </p>
                                                                            <p><i>San Francisco Region</i>--American Samoa, Arizona, California, Guam, Hawaii, Nevada. Federal Office Building, 10 Van Ness Avenue, 20th Floor, San Francisco, California 94102. Office Hours: 8 a.m.-4:30 p.m.
                                                                            </p>
                                                                            <p><i>Seattle Region</i>--Alaska, Idaho, Oregon, Washington. 1321 Second Avenue, Room 615, Mail Stop 211, Seattle, Washington 98101. Office Hours 8 a.m.-4:30 p.m
                                                                            </p>
                                
                                    <p><i>3. Intermediary Addresses (Hospital Insurance) </i>
                                </p>
                                    <p>
                                        Medicare Coordinator, Assoc. Hospital Serv. Maine (ME BC), 2 Gannett Drive South, Portland, ME 04106-6911.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Anthem New Hampshire, 300 Goffs Falls Road, Manchester, NH 03111-0001.
                                    </p>
                                    <p>
                                        Medicare Coordinator, BC/BS Rhode Island (RI BC), 444 Westminster Street, Providence, RI 02903-3279.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Empire Medicare Services, 400 S. Salina Street, Syracuse, NY 13202.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Cooperativa, P.O. Box 363428, San Juan, PR 00936-3428.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Maryland B/C, P.O. Box 4368, 1946 Greenspring Ave., Timonium, MD 21093.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Highmark, P5103, 120 Fifth Avenue Place, Pittsburgh, PA 15222-3099.
                                    </p>
                                    <p>
                                        Medicare Coordinator, United Government Services, 1515 N. Rivercenter Dr., Milwaukee, WI 53212.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Alabama B/C, 450 Riverchase Parkway East, Birmingham, AL 35298.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Florida B/C, 532 Riverside Ave., Jacksonville, FL 32202-4918.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Georgia B/C, P.O. Box 9048, 2357 Warm Springs Road, Columbus, GA 31908.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Mississippi B/C MS, P.O. Box 23035, 3545 Lakeland Drive, Jackson, MS 39225-3035.
                                    </p>
                                    <p>
                                        Medicare Coordinator, North Carolina B/C, P.O. Box 2291, Durham, NC 27702-2291.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Palmetto GBA, A/RHHI, 17 Technology Circle, Columbia, SC 29203-0001.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Tennessee B/C, 801 Pine Street, Chattanooga, TN 37402-2555.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Anthem Insurance Co. (ANTHM IN), P.O. Box 50451, 8115 Knue Road, Indianapolis, IN 46250-1936.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Arkansas B/C, 601 Gaines Street, Little Rock, AR 72203.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Group Health of Oklahoma, 1215 South Boulder, Tulsa, OK 74119-2827.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Trailblazer, P.O. Box 660156, Dallas, TX 75266-0156.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Cahaba GBA, Station 7, 636 Grand Avenue, Des Moines, IA 50309-2551.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Kansas B/C, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Nebraska B/C, P.O. Box 3248, Main PO Station, Omaha, NE 68180-0001.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Mutual of Omaha, P.O. Box 1602, Omaha, NE 68101.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Montana B/C, P.O. Box 5017, Great Falls Div., Great Falls, MT 59403-5017.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Noridian, 4510 13th Avenue SW., Fargo, ND 58121-0001.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Utah B/C, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Wyoming B/C, 4000 House Avenue, Cheyenne, WY 82003.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Arizona B/C, P.O. Box 37700, Phoenix, AZ 85069.
                                    </p>
                                    <p>
                                        Medicare Coordinator, UGS, P.O. Box 70000, Van Nuys, CA 91470-0000.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Regents BC, P.O. Box 8110 M/S D-4A, Portland, OR 97207-8110.
                                    </p>
                                    <p>Medicare Coordinator, Premera BC, P.O. Box 2847, Seattle, WA 98111-2847.</p>
                                    <p>
                                        <i>4. Medicare Carriers </i>
                                    </p>
                                    <p>
                                        Medicare Coordinator, NHIC, 75 Sargent William Terry Drive, Hingham, MA 02044.
                                    </p>
                                    <p>
                                        Medicare Coordinator, B/S Rhode Island (RI BS), 444 Westminster Street, Providence, RI 02903-2790.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Trailblazer Health Enterprises, Meriden Park, 538 Preston Ave., Meriden, CT 06450.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Upstate Medicare Division, 11 Lewis Road, Binghamton, NY 13902.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Empire Medicare Services, 2651 Strang Blvd., Yorktown Heights, NY, 10598.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Empire Medicare Services, NJ, 300 East Park Drive, Harrisburg, PA 17106.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Triple S, #1441 F.D., Roosevelt Ave., Guaynabo, PR 00968.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Group Health Inc., 4th Floor, 88 West End Avenue, New York, NY 10023.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Highmark, P.O. Box 89065, 1800 Center Street, Camp Hill, PA 17089-9065.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Trailblazers Part B, 11150 McCormick Drive, Executive Plaza 3 Suite 200, Hunt Valley, MD 21031.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Trailblazer Health Enterprises, Virginia, P.O. Box 26463, Richmond, VA 23261-6463.
                                    </p>
                                    <p>
                                        United Medicare Coordinator, Tricenturion, 1 Tower Square, Hartford, CT 06183.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Alabama B/S, 450 Riverchase Parkway East, Birmingham, AL 35298.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Cahaba GBA, 12052 Middleground Road, Suite A, Savannah, GA 31419.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Florida B/S, 532 Riverside Ave, Jacksonville, FL 32202-4918.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Administar Federal, 9901 Linnstation Road, Louisville, KY 40223.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Palmetto GBA, 17 Technology Circle, Columbia, SC 29203-0001.
                                    </p>
                                    <p>
                                        Medicare Coordinator, CIGNA, 2 Vantage Way, Nashville, TN 37228.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Railroad Retirement Board, 2743 Perimeter Parkway, Building 250, Augusta, GA 30999.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Cahaba GBA, Jackson, Miss, P.O. Box 22545, Jackson, MS 39225-2545.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Adminastar Federal (IN), 8115 Knue Road, Indianapolis, IN 46250-1936.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Wisconsin Physicians Service, P.O. Box 8190, Madison, WI 53708-8190.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Nationwide Mutual Insurance Co., P.O. Box 16788, 1 Nationwide Plaza, Columbus, OH 43216-6788.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Arkansas B/S, 601 Gaines Street, Little Rock, AR 72203.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Arkansas--New Mexico, 601 Gaines Street, Little Rock, AR 72203.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Palmetto GBA--DMERC, 17 Technology Circle, Columbia, SC 29203-0001.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Trailblazer Health Enterprises, 901 South Central Expressway, Richardson, TX 75080.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Nordian, 636 Grand Avenue, Des Moines, IA 50309-2551.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Kansas B/S, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Kansas B/S--NE, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0239.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Montana B/S, P.O. Box 4309, Helena, MT 59601.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Nordian, 4305 13th Avenue South, Fargo, ND 58103-3373.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Noridian Bcbsnd (C0), 730 N. Simms #100, Golden, CO 80401-4730.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Noridian Bcbsnd (WY), 4305 13th Avenue South, Fargo, ND 58103-3373.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Utah B/S, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Transamerica Occidental, P.O. Box 54905, Los Angeles, CA 90054-4905.
                                    </p>
                                    <p>
                                        Medicare Coordinator, NHIC--California, 450 W. East Avenue, Chico, CA 95926.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Cigna, Suite 254, 3150 Lakeharbor, Boise, ID 83703.
                                    </p>
                                    <p>Medicare Coordinator, Cigna, Suite 506, 2 Vantage Way, Nashville, TN 37228.</p>
                                    <p>
                                        <i>Payment Safeguard Contractors </i>
                                    </p>
                                    <p>
                                        Medicare Coordinator, Aspen Systems Corporation, 2277 Research Blvd., Rockville, MD 20850.
                                    </p>
                                    <p>
                                        Medicare Coordinator, DynCorp Electronic Data Systems (EDS), 11710 Plaza America Drive, 5400 Legacy Drive, Reston, VA 20190-6017.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Lifecare Management Partners Mutual of Omaha Insurance Co., 6601 Little River Turnpike, Suite 300, Mutual of Omaha Plaza, Omaha, NE 68175.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Reliance Safeguard Solutions, Inc., P.O. Box 30207, 400 South Salina Street, 2890 East Cottonwood Pkwy., Syracuse, NY 13202.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Science Applications International, Inc., 6565 Arlington Blvd. P.O. Box 100282, Falls Church, VA.
                                    </p>
                                    <p>
                                        Medicare Coordinator, California Medical Review, Inc., Integriguard Division Federal Sector Civil Group One, Sansome Street, San Francisco, CA 94104-4448.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Computer Sciences Corporation, Suite 600, 3120 Timanus Lane, Baltimore, MD 21244.
                                    </p>
                                    <p>
                                        Medicare Coordinator, Electronic Data Systems (EDS), 11710 Plaza America Drive, 5400 Legacy Drive, Plano, TX 75204.
                                    </p>
                                    <p>
                                        Medicare Coordinator, TriCenturion, L.L.C., P.O. Box 100282, Columbia, SC 29202.</p></xhtmlContent></subsection></section>
                                        <section id="09-70-0526" toc="yes">
                                            <systemNumber>09-70-0526</systemNumber>
                                            <subsection type="systemName">
                                                "Common Working File (CWF)," HHS/CMS/OIS.
                                            </subsection>
                                            <subsection type="securityClassification">
                                                <xhtmlContent>
                                                    <p>
                                                        Level Three Privacy Act Sensitive Data.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemLocation">
                                                <xhtmlContent>
                                                    <p>
                                                        The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at CMS Host Sites located in Birmingham, Alabama, and Dallas, Texas.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfIndividuals">
                                                <xhtmlContent>
                                                    <p>
                                                        The system contains information on Medicare beneficiaries, on whose behalf providers have submitted claims for reimbursement on a reasonable cost basis under Medicare Part A and B, or are eligible, and/or individuals whose enrollment in an employer group health benefits plan covers the beneficiary.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="categoriesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        Information contained in this system consist of billing for medical and other health care services, uniform bill for provider services or equivalent data in an electronic format, and Medicare Secondary Payer (MSP) records containing other third party liability insurance information necessary for appropriate Medicare claims payment and other documents used to support payments to beneficiaries and providers of services. These forms contain the beneficiary's name, sex, health insurance claim number (HIC), address, date of birth, medical record number, prior stay information, provider name and address, physician's name, and/or identification number, warranty information when pacemakers are implanted or explanted, date of admission or discharge, other health insurance, diagnosis, surgical procedures, and a statement of services rendered for related charges and other data needed to substantiate claims.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="authorityForMaintenance">
                                                <xhtmlContent>
                                                    <p>
                                                        Authority for the maintenance of this system of records is given under the authority of sections 1816, and 1874 of Title XVIII of the Social Security Act (42 United States Code (U.S.C.) 1395h, and 1395kk).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="purpose">
                                                <xhtmlContent>
                                                    <p>
                                                        The primary purpose of the system of records is to properly pay medical insurance benefits to or on behalf of entitled beneficiaries. Information in this system will also be released to: (1) Support regulatory and policy functions performed within the Agency or by a contractor, consultant, or grantee; (2) assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) assist third party contacts; (4) assist providers and suppliers of services directly or through fiscal intermediaries or carriers; (5) support Quality Improvement Organizations (QIO) or Quality Review Organizations; (6) assist insurance companies and other groups providing protection for their enrollees, or who are primary payers to Medicare in accordance with 42 U.S.C. 1395y (b); (7) support an individual or organization for research, evaluation, or epidemiological projects; (8) support litigation involving the Agency related to this system of records; and (9) combat fraud, waste, and abuse in certain Federally-funded health care programs.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="routineUsesOfRecords">
                                                <xhtmlContent>
                                                    <p>
                                                        A. Entities Who May Receive Disclosures Under Routine Use
                                                    </p>
                                                    <p>
                                                        These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the CWF without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish or modify the following routine use disclosures of information maintained in the system:
                                                    </p>
                                                    <p>1. To agency contractors, consultants, or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.</p>
                                                    <p>
                                                        2. To another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent pursuant to agreements with CMS to:
                                                    </p>
                                                    <p>
                                                        a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
                                                    </p>
                                                    <p>
                                                        b. enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                                                    </p>
                                                    <p>
                                                        c. assist Federal/State Medicaid programs within the State.
                                                    </p>
                                                    <p>
                                                        3. To third party contacts (without the consent of the individuals to whom the information pertains) in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program and,
                                                    </p>
                                                    <p>
                                                        a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: The individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exist, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
                                                    </p>
                                                    <p>
                                                        b. the data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: The individual's entitlement to benefits under the Medicare program; and the amount of reimbursement; any case in which the evidence is being reviewed as a result of suspected fraud, waste, and abuse, program integrity, quality appraisal, or evaluation and measurement of program activities.
                                                    </p>
                                                    <p>
                                                        4. To providers and suppliers of services dealing through fiscal intermediaries or carriers for the administration of Title XVIII of the Act.
                                                    </p>
                                                    <p>
                                                        5. To Quality Improvement Organizations ( QIO) in connection with review of claims, or in connection with studies or other review activities, conducted pursuant to Part A and Part B of Title XI of the Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                                                    </p>
                                                    <p>
                                                        6. To insurance companies, underwriters, third party administrators (TPA), employers, self-insurers, group health plans, health maintenance organizations (HMO), health and welfare benefit funds, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, liability insurers, no-fault medical automobile insurers, workers' compensation carriers or plans, other groups providing protection against medical expenses without the beneficiary's authorization, and any entity having knowledge of the occurrence of any event affecting (a) An individual's right to any such benefit or payment, or (b) the initial right to any such benefit or payment, for the purpose of coordination of benefits with the Medicare program and implementation of the MSP provision at 42 U.S.C. 1395y (b). Information to be disclosed shall be limited to Medicare utilization data necessary to perform that specific function. In order to receive the information, they must agree to:
                                                    </p>
                                                    <p>
                                                        a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a TPA;
                                                    </p>
                                                    <p>
                                                        b. utilize the information solely for the purpose of processing the individual's insurance claims; and
                                                    </p>
                                                    <p>
                                                        c. safeguard the confidentiality of the data and prevent unauthorized access.
                                                    </p>
                                                    <p>
                                                        7. To an individual or organization for research, evaluation, or epidemiological projects related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
                                                    </p>
                                                    <p>
                                                        8. To the Department of Justice (DOJ), court or adjudicatory body when:
                                                    </p>
                                                    <p>
                                                        a. The Agency or any component thereof, or
                                                    </p>
                                                    <p>
                                                        b. any employee of the Agency in his or her official capacity, or
                                                    </p>
                                                    <p>
                                                        c. any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                                                    </p>
                                                    <p>
                                                        d. the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records is deemed by the Agency to be for a purpose that is compatible with the purposes for which the Agency collected the records.
                                                    </p>
                                                    <p>
                                                        9. To a CMS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS- administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
                                                    </p>
                                                    <p>
                                                        10. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
                                                    </p>
                                                    <p>
                                                        B. Additional Circumstances Affecting Routine Use Disclosures
                                                    </p>
                                                    <p>
                                                        To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 <i>Federal Register</i> 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a)(1)).
                                                    </p>
                                                    <p>
                                                        In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="policiesAndPractices">
                                                <xhtmlContent>
                                                    <p>
                                                        Storage:
                                                    </p>
                                                    <p>Records are maintained on paper, computer diskette and on magnetic storage media.</p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retrievability">
                                                <xhtmlContent>
                                                    <p>
                                                        Information can be retrieved by the beneficiary's name, HIC, and assigned unique physician identification number.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="safeguards">
                                                <xhtmlContent>
                                                    <p>
                                                        CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                                                    </p>
                                                    <p>
                                                        This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="retentionAndDisposal">
                                                <xhtmlContent>
                                                    <p>
                                                        Records are maintained in a secure storage area with identifiers. Records are closed at the end of the calendar year in which paid, then destroyed 6 years and 3 months after final payment/action. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="systemManager">
                                                <xhtmlContent>
                                                    <p>
                                                        Director, Division of Systems Operations, Business Applications Management Group, Office of Information Services, CMS, Room N2- 08-18, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="notificationProcedure">
                                                <xhtmlContent>
                                                    <p>
                                                        For purpose of access, the subject individual should write to the system manager who will require the system name, assigned card key number, and building/secure area, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordAccessProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="contestingRecordProcedures">
                                                <xhtmlContent>
                                                    <p>
                                                        The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="recordSourceCategories">
                                                <xhtmlContent>
                                                    <p>
                                                        Sources of information contained in this records system is furnished by the individual. In most cases, the identifying information is provided to the physician by the individual. Information is obtained from other CMS systems of records and data systems: Health Insurance Master Record, Intermediary Medicare Claims Records, Carrier Medicare Claims Records, MSP Record, Third Party Liability Record, Medicare Entitlement Record, Health Maintenance Organization Record, Hospice Record, and in the case of some MSP situations, through third party contacts. The medical information is provided by the providers of medical services.
                                                    </p>
                                                </xhtmlContent>
                                            </subsection>
                                            <subsection type="exemptionsClaimed">
                                                <xhtmlContent>
                                                    <p>
                                                        None.
                                                    </p>
                                                    <p>
                                                        <i> Appendix A. Health Insurance Claims </i>
                                                    </p>
                                                    <p>Medicare records are maintained at the HCFA Central Office (see section 1 below for the address). Health Insurance Records of the Medicare program can also be accessed through a representative of the HCFA Regional Office (see section 2 below for addresses). Medicare claims records are also maintained by private insurance organizations who share in administering provisions of the health insurance programs. These private insurance organizations, referred to as carriers and intermediaries, are under contract to the Health Care Financing Administration and the Social Security Administration to perform specific task in the Medicare program (see section three below for addresses for intermediaries, section four addresses the carriers, and section five addresses the Payment Safeguard Contractors.</p>
                                                    <p>1. Central Office Address .</p>
                                                    <p>HCFA Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.</p>
                                                    <p>2. HCFA Regional Offices .</p>
                                                    <p>Boston Region--Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont. John F. Kennedy Federal Building, Room 1211, Boston, Massachusetts 02203. Office Hours: 8:30 a.m.-5 p.m.</p>
                                                    <p>New York Region--New Jersey, New York, Puerto Rico, Virgin Islands. 26 Federal Plaza, Room 715, New York, New York 10007, Office Hours: 8:30 a.m.-5 p.m.</p>
                                                    <p>Philadelphia Region--Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, West Virginia. Post Office Box 8460, Philadelphia, Pennsylvania 19101. Office Hours:8:30 a.m.-5 p.m.</p>
                                                    <p>Atlanta Region--Alabama, North Carolina, South Carolina, Florida, Georgia, Kentucky, Mississippi, Tennessee. 101 Marietta Street, Suite 702, Atlanta, Georgia 30223, Office Hours: 8:30 a.m.-4:30 p.m.</p>
                                                    <p>Chicago Region--Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin. Suite A-824, Chicago, Illinois 60604. Office Hours: 8 a.m.-4:45 p.m.</p>
                                                    <p>
                                                        Dallas Region--Arkansas, Louisiana, New Mexico, Oklahoma, Texas, 1200 Main Tower Building, Dallas, Texas. Office Hours: 8 a.m-4:30 p.m.
</p>
    <p>Kansas City Region--Iowa, Kansas, Missouri, Nebraska. New Federal Office Building, 601 East 12th Street--Room 436, Kansas City, Missouri 64106. Office Hours: 8 a.m.-4:45 p.m.</p>
    <p>Denver Region--Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming. Federal Office Building, 1961 Stout St--Room 1185, Denver, Colorado 80294. Office Hours: 8 a.m.-4:30 p.m.</p>
    <p>San Francisco Region--American Samoa, Arizona, California, Guam, Hawaii, Nevada. Federal Office Building, 10 Van Ness Avenue, 20th Floor, San Francisco, California 94102. Office Hours: 8 a.m.-4:30 p.m.</p>
    <p>Seattle Region--Alaska, Idaho, Oregon, Washington. 1321 Second Avenue, Room 615, Mail Stop 211, Seattle, Washington 98101. Office Hours 8 a.m.-4:30 p.m.</p>
    <p>3. Intermediary Addresses (Hospital Insurance) .</p>
    <p>Medicare Coordinator, Assoc. Hospital Serv. Maine (ME BC), 2 Gannett Drive South, Portland, ME 04106-6911.</p>
    <p>Medicare Coordinator, Anthem New Hampshire, 300 Goffs Falls Road, Manchester, NH 03111-0001.</p>
    <p>Medicare Coordinator, BC/BS Rhode Island (RI BC), 444 Westminster Street, Providence, RI 02903-3279.</p>
    <p>Medicare Coordinator, Empire Medicare Services, 400 S. Salina Street, Syracuse, NY 13202.</p>
    <p>Medicare Coordinator, Cooperativa, P.O. Box 363428, San Juan, PR 00936-3428.</p>
    <p>Medicare Coordinator, Maryland B/C, P.O. Box 4368, 1946 Greenspring Ave., Timonium, MD 21093.</p>
    <p>Medicare Coordinator, Highmark, P5103, 120 Fifth Avenue Place, Pittsburgh, PA 15222-3099.</p>
    <p>Medicare Coordinator, United Government Services, 1515 N. Rivercenter Dr., Milwaukee, WI 53212.</p>
    <p>Medicare Coordinator, Alabama B/C, 450 Riverchase Parkway East, Birmingham, AL 35298.</p>
    <p>Medicare Coordinator, Florida B/C, 532 Riverside Ave., Jacksonville, FL 32202-4918.</p>
    <p>Medicare Coordinator, Georgia B/C, P.O. Box 9048, 2357 Warm Springs Road, Columbus, GA 31908.</p>
    <p>Medicare Coordinator, Mississippi B/C } MS, P.O. Box 23035, 3545 Lakeland Drive, Jackson, MI 39225-3035.</p>
    <p>Medicare Coordinator, North Carolina B/C, P.O. Box 2291, Durham, NC 27702-2291.</p>
    <p>Medicare Coordinator, Palmetto GBA A/RHHI, 17 Technology Circle, Columbia, SC 29203-0001.</p>
    <p>Medicare Coordinator, Tennessee B/C, 801 Pine Street, Chattanooga, TN 37402-2555.</p>
    <p>Medicare Coordinator, Anthem Insurance Co. (Anthm In), P.O. Box 50451, 8115 Knue Road, Indianapolis, IN 46250-1936.</p>
    <p>Medicare Coordinator, Arkansas B/C, 601 Gaines Street, Little Rock, AR 72203.</p>
    <p>Medicare Coordinator, Group Health of Oklahoma, 1215 South Boulder, Tulsa, OK 74119-2827.</p>
    <p>Medicare Coordinator, TrailBlazer, P.O. Box 660156, Dallas, TX 75266-0156.</p>
    <p>Medicare Coordinator, Cahaba GBA, Station 7, 636 Grand Avenue, Des Moines, IA 50309-2551.</p>
    <p>Medicare Coordinator, Kansas B/C, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.</p>
    <p>Medicare Coordinator, Nebraska B/C, P.O. BOX 3248, Main PO Station, Omaha, NE 68180-0001.</p>
    <p>Medicare Coordinator, Mutual of Omaha, P.O. Box 1602, Omaha, NE 68101.</p>
    <p>Medicare Coordinator, Montana B/C, P.O. Box 5017, Great Falls Div., Great Falls, MT 59403-5017.</p>
    <p>Medicare Coordinator, Noridian, 4510 13th Avenue S.W., Fargo, ND 58121-0001.</p>
    <p>Medicare Coordinator, Utah B/C, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.</p>
    <p>Medicare Coordinator, Wyoming B/C, 4000 House Avenue, Cheyenne, WY 82003.</p>
    <p>Medicare Coordinator, Arizona B/C, P.O. Box 37700, Phoenix, AZ 85069.</p>
    <p>Medicare Coordinator, UGS, P.O. Box 70000, Van Nuys, CA 91470-0000.</p>
    <p>Medicare Coordinator, Regents BC, P.O. Box 8110 M/S D-4A, Portland, OR 97207-8110.</p>
    <p>Medicare Coordinator, Premera BC, P.O. Box 2847, Seattle, WA 98111-2847.</p>
    <p>4. Medicare Carriers .</p>
    <p>Medicare Coordinator, NHIC, 75 Sargent William Terry Drive, Hingham, MA 02044.</p>
    <p>Medicare Coordinator, B/S Rhode Island (RI BS), 444 Westminster Street, Providence, RI 02903-2790.</p>
    <p>Medicare Coordinator, Trailblazer Health Enterprises, Meriden Park, 538 Preston Ave., Meriden, CT 06450.</p>
    <p>Medicare Coordinator, Upstate Medicare Division, 11 Lewis Road, Binghamton, NY 13902.</p>
    <p>Medicare Coordinator, Empire Medicare Services, 2651 Strang Blvd., Yorktown Heights, NY, 10598.</p>
    <p>Medicare Coordinator, Empire Medicare Services, NJ, 300 East Park Drive, Harrisburg, PA 17106.</p>
    <p>Medicare Coordinator, Triple S, 1B1441 F.D., Roosvelt Ave., Guaynabo, PR 00968.</p>
    <p>Medicare Coordinator, Group Health Inc., 4th Floor, 88 West End Avenue, New York, NY 10023.</p>
    <p>Medicare Coordinator, Highmark, P.O. Box 89065, 1800 Center Street, Camp Hill, PA 17089-9065.</p>
    <p>Medicare Coordinator, Trailblazers Part B, 11150 McCormick Drive, Executive Plaza 3 Suite 200, Hunt Valley, MD 21031.</p>
    <p>Medicare Coordinator, Trailblazer Health Enterprises, Virginia, P.O. Box 26463, Richmond, VA 23261-6463. United Medicare Coordinator, Tricenturion, 1 Tower Square, Hartford, CT 06183.</p>
    <p>Medicare Coordinator, Alabama B/S, 450 Riverchase Parkway East, Birmingham, AL 35298.</p>
    <p>Medicare Coordinator, Cahaba GBA, 12052 Middleground Road, Suite A, Savannah, GA 31419.</p>
    <p>Medicare Coordinator, Florida B/S, 532 Riverside Ave, Jacksonville, FL 32202-4918.</p>
    <p>Medicare Coordinator, Administar Federal, 9901 Linnstation Road, Louisville, KY 40223.</p>
    <p>Medicare Coordinator, Palmetto GBA, 17 Technology Circle, Columbia, SC 29203-0001.</p>
    <p>Medicare Coordinator, CIGNA, 2 Vantage Way, Nashville, TN 37228.</p>
    <p>Medicare Coordinator, Railroad Retirement Board, 2743 Perimeter Parkway, Building 250, Augusta, GA 30999.</p>
    <p>Medicare Coordinator, Cahaba GBA, Jackson Miss, P.O. Box 22545, Jackson, MS 39225-2545.</p>
    <p>Medicare Coordinator, Adminastar Federal (IN), 8115 Knue Road, Indianapolis, IN 46250-1936.</p>
    <p>Medicare Coordinator, Wisconsin Physicians Service, P.O. Box 8190, Madison, WI 53708-8190.</p>
    <p>Medicare Coordinator, Nationwide Mutual Insurance Co., P.O. Box 16788, 1 Nationwide Plaza, Columbus, OH 43216-6788.</p>
    <p>Medicare Coordinator, Arkansas B/S, 601 Gaines Street, Little Rock, AR 72203.</p>
    <p>Medicare Coordinator, Arkansas-New Mexico, 601 Gaines Street, Little Rock, AR 72203.</p>
    <p>Medicare Coordinator, Palmetto GBA--DMERC, 17 Technology Circle, Columbia, SC 29203-0001.</p>
    <p>Medicare Coordinator, Trailblazer Health Enterprises, 901 South Central Expressway, Richardson, TX 75080.</p>
    <p>Medicare Coordinator, Nordian, 636 Grand Avenue, Des Moines, IA 50309-2551.</p>
    <p>Medicare Coordinator, Kansas B/S, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.</p>
    <p>Medicare Coordinator, Kansas B/S--NE, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0239.</p>
    <p>Medicare Coordinator, Montana B/S, P.O. Box 4309, Helena, MT 59601.</p>
    <p>Medicare Coordinator, Nordian, 4305 13th Avenue South, Fargo, ND 58103-3373.</p>
    <p>Medicare Coordinator, Noridian Bcbsnd (CO), 730 N. Simms 1B100, Golden, CO 80401-4730.</p>
    <p>Medicare Coordinator, Noridian Bcbsnd (WY), 4305 13th Avenue South, Fargo, ND 58103-3373.</p>
    <p>Medicare Coordinator, Utah B/S, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.</p>
    <p>Medicare Coordinator, Transamerica Occidental, P.O. Box 54905, Los Angeles, CA 90054-4905.</p>
    <p>Medicare Coordinator, NHIC--California, 450 W. East Avenue, Chico, CA 95926.</p>
    <p>Medicare Coordinator, Cigna, Suite 254, 3150 Lakeharbor, Boise, ID 83703.</p>
    <p>Medicare Coordinator, Cigna, Suite 506, 2 Vantage Way, Nashville, TN 37228.</p>
    <p>Payment Safeguard Contractors .</p>
    <p>Medicare Coordinator, Aspen Systems Corporation, 2277 Research Blvd., Rockville, MD 20850.</p>
    <p>Medicare Coordinator, DynCorp Electronic Data Systems (EDS), 11710 Plaza America Drive 5400 Legacy Drive, Reston, VA 20190- 6017.</p>
    <p>Medicare Coordinator, Lifecare Management Partners Mutual of Omaha Insurance Co., 6601 Little River Turnpike, Suite 300, Mutual of Omaha Plaza, Omaha, NE 68175.</p>
    <p>Medicare Coordinator, Reliance Safeguard Solutions, Inc., P.O. Box 30207, 400 South Salina Street, 2890 East Cottonwood Pkwy., Syracuse, NY 13202.</p>
    <p>Medicare Coordinator, Science Applications International, Inc., 6565 Arlington Blvd. P.O. Box 100282, Falls Church, VA.</p>
    <p>Medicare Coordinator, California Medical Review, Inc., Integriguard Division Federal Sector Civil Group, One Sansome Street, San Francisco, CA 94104-4448.</p>
    <p>Medicare Coordinator, Computer Sciences Corporation, Suite 600, 3120 Timanus Lane, Baltimore, MD 21244.</p>
    <p>Medicare Coordinator, Electronic Data Systems (EDS), 11710 Plaza America Drive, 5400 Legacy Drive, Plano, TX 75204.</p>
    <p>
        Medicare Coordinator, TriCenturion, L.L.C., P.O. Box 10028.
    </p>
</xhtmlContent>
</subsection>
</section>
    <section id="09-70-0527" toc="yes">
        <systemNumber>09-70-0527</systemNumber>
        <subsection type="systemName">"Centers for Medicare &amp; Medicaid Services (CMS) Fraud Investigation Database (FID)," HHS/CMS/OFM.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850, and at various other remote locations.</p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    Individuals alleged to have violated provision of the Act related to Medicare (Title XVIII), Medicaid (Title XIX), HMO/Managed Care (Title XX), and Children's Health Insurance Program (Title XXI) or other criminal/civil statutes as they pertain to the Act programs where substantial basis for criminal/civil prosecution exist, defendants in criminal prosecution cases, or persons alleged to have abused the programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The system contains the name, work address, work phone number, social security number, Unique Provider Identification Number (UPIN), and other identifying demographics of individuals alleged to have violated provision of the Act or persons alleged to have abused Medicare and/or Medicaid programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    This system was established under the authority of sections 205, 1106, 1107, 1815, 1816, 1833, 1842, 1872, 1874, 1876, 1877, and 1902 of the Act (Title 42 United States Code (U.S.C.) sections 405, 1306, 1307, 1395g, 1395h, 1395l, 1395u, 1395ii, 1395kk, 1395mm, 1395nn, and 1396a).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the system of records is to collect and maintain information to: (1) Identify if a violation(s) of a provision of the Social Security Act (the Act) or a related penal or civil provision of the U.S.C. related to Medicare (Title XVIII), Medicaid (Title XIX), HMO/Managed Care (Title XX), and Children's Health Insurance Program (Title XXI) have been committed; (2) determine if HHS has made a proper payment as prescribed under applicable sections of the Act; (3) determine whether these programs have been abused; and (4) coordinate investigations related to Medicare, Medicaid, HMO/Managed Care, and Children's Health Insurance Program; (5) prevent duplications investigatory efforts; and (5) provide case file material to the HHS Office of the Inspector General when a case is referred for fraud investigation. Information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant, or a CMS grantee; (2) assist another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) support litigation involving the Agency related to this system of records; and (4) combat fraud, waste, and abuse in certain health care programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To support Agency contractors, consultants, or grantees that have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need access to the records in order to assist CMS.
                </p>
                <p>
                    2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                </p>
                <p>
                    a. contribute to the accuracy of CMS's proper payment of Medicare benefits,
                </p>
                <p>
                    b. enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                </p>
                <p>
                    c. assist Federal/state Medicaid programs within the state.
                </p>
                <p>
                    3. To support the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. the Agency or any component thereof, or
                </p>
                <p>
                    b. any employee of the Agency in his or her official capacity, or
                </p>
                <p>
                    c. any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. the United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    4. To support a CMS contractor that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS- administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such programs.
                </p>
                <p>
                    5. To support another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, and abuse in a program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such programs.
                </p>
                <p >
                    <i> B. Additional Provisions Affecting Routine Use Disclosures </i>
                </p>
                <p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512 (a) (1)).</p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on magnetic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    All records are accessible by UPIN/NPI or alpha (name) search. This system supports both on-line and batch access.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    Records are maintained for a period of 15 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>Director, Program Integrity Group, Office of Financial Management, CMS, Mail Stop C3-02- 16, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.</p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, social security number (SSN) or UPIN, address, date of birth, and sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    Sources of information contained in this records system include data collected from FID computer files as transmitted by the contractor sites.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    HHS claims exemption of certain records (case files on active fraud investigations) in the system from notification and access procedures under 5 U.S.C. 522a (k) (2) inasmuch as these records are investigatory materials compiled for program (law) enforcement in anticipation of a criminal or administrative proceedings. (See Department Regulation (45 CFR 5b.11))
                </p>
                <p>
                    <i>Appendix A. Health Insurance Claims </i>
                </p>
                <p>
                    Medicare records are maintained at the CMS Central Office (see section 1 below for the address). Health Insurance Records of the Medicare program can also be accessed through a representative of the CMS Regional Office (see section 2 below for addresses). Medicare claims records are also maintained by private insurance organizations that share in administering provisions of the health insurance programs. These private insurance organizations, referred to as carriers and intermediaries, are under contract to the Centers for Medicare &amp; Medicaid Services and the Social Security Administration to perform specific task in the Medicare program (see section three below for addresses for intermediaries, section four addresses the carriers, and section five addresses the Payment Safeguard Contractors.
                </p>
                <p>
                    <i> I. Central Office Address </i>
                </p>
                <p>
                    CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
                </p>
                <p>
                    <i> II. CMS Regional Offices </i>
                </p>
                <p><i>Boston Region--</i>Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont. John F. Kennedy Federal Building, Room 1211, Boston, Massachusetts 02203. Office Hours: 8:30 a.m.-5 p.m.
                </p>
                <p><i>New York Region</i>--New Jersey, New York, Puerto Rico, Virgin Islands. 26 Federal Plaza, Room 715, New York, New York 10007, Office Hours: 8:30 a.m.-5 p.m.
                </p>
                <p><i>Philadelphia Region</i>--Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, West Virginia. Post Office Box 8460, Philadelphia, Pennsylvania 19101. Office Hours: 8:30 a.m.-5 p.m.
                </p>
                <p><i>Atlanta Region</i>--Alabama, North Carolina, South Carolina, Florida, Georgia, Kentucky, Mississippi, Tennessee. 101 Marietta Street, Suite 702, Atlanta, Georgia 30223, Office Hours: 8:30 a.m.-4:30 p.m.
                </p>
                <p><i>Chicago Region</i>--Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin. Suite A-824, Chicago, Illinois 60604. Office Hours: 8 a.m.-4:45 p.m.
                </p>
                <p><i>Dallas Region</i>--Arkansas, Louisiana, New Mexico, Oklahoma, Texas, 1200 Main Tower Building, Dallas, Texas. Office Hours: 8 a.m-4:30 p.m.
</p> <p><i>Kansas City Region</i>--Iowa, Kansas, Missouri, Nebraska. New Federal Office Building, 601 East 12th Street Room 436, Kansas City, Missouri 64106. Office Hours: 8 a.m.-4:45 p.m.
    </p> <p><i>Denver Region</i>--Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming. Federal Office Building, 1961 Stout St Room 1185, Denver, Colorado 80294. Office Hours: 8 a.m.-4:30 p.m.
    </p> <p><i>San Francisco Region</i>--American Samoa, Arizona, California, Guam, Hawaii, Nevada. Federal Office Building, 10 Van Ness Avenue, 20th Floor, San Francisco, California 94102. Office Hours: 8 a.m.-4:30 p.m.
    </p> <p><i>Seattle Region</i>--Alaska, Idaho, Oregon, Washington. 1321 Second Avenue, Room 615, Mail Stop 211, Seattle, Washington 98101. Office Hours 8 a.m.-4:30 p.m
    </p>
    <p><i>III. Intermediary Addresses (Hospital Insurance)</i></p>
 <p>
        Medicare Coordinator, Assoc. Hospital Serv. Maine (ME BC), 2 Gannett Drive South, Portland, ME 04106-6911.
    </p> <p>
        Medicare Coordinator, Anthem New Hampshire, 300 Goffs Falls Road, Manchester, NH 03111-0001.
    </p> <p>
        Medicare Coordinator, BC/BS Rhode Island (RI BC), 444 Westminster Street, Providence, RI 02903-3279.
    </p> <p>
        Medicare Coordinator, Empire Medicare Services, 400 S. Salina Street, Syracuse, NY 13202.
    </p> <p>
        Medicare Coordinator, Cooperativa, PO Box 363428, San Juan, PR 00936-3428.
    </p> <p>
        Medicare Coordinator, Maryland B/C, PO Box 4368, 1946 Greenspring Ave., Timonium, MD 21093.
    </p> <p>
        Medicare Coordinator, Highmark, P5103, 120 Fifth Avenue Place, Pittsburgh, PA 15222-3099.
    </p> <p>
        Medicare Coordinator, United Government Services, 1515 N. Rivercenter Dr., Milwaukee, WI 53212.
    </p> <p>
        Medicare Coordinator, Alabama B/C, 450 Riverchase Parkway East, Birmingham, AL 35298.
    </p> <p>
        Medicare Coordinator, Florida B/C, 532 Riverside Ave., Jacksonville, FL 32202-4918.
    </p> <p>
        Medicare Coordinator, Georgia B/C, PO Box 9048, 2357 Warm Springs Road, Columbus, GA 31908.
    </p> <p>
        Medicare Coordinator, Mississippi B/C B MS, PO Box 23035, 3545 Lakeland Drive, Jackson, MI 39225-3035.
    </p> <p>Medicare Coordinator, North Carolina B/C, PO Box 2291, Durham, NC 27702-2291.</p>
    <p>
        Medicare Coordinator, Palmetto GBA A/RHHI, 17 Technology Circle, Columbia, SC 29203-0001.
    </p> <p>
        Medicare Coordinator, Tennessee B/C, 801 Pine Street, Chattanooga, TN 37402-2555.
    </p> <p>
        Medicare Coordinator, Anthem Insurance Co. (Anthm IN), PO Box 50451, 8115 Knue Road, Indianapolis, IN 46250-1936.
    </p> <p>
        Medicare Coordinator, Arkansas B/C, 601 Gaines Street, Little Rock, AR 72203.
    </p> <p>
        Medicare Coordinator, Group Health of Oklahoma, 1215 South Boulder, Tulsa, OK 74119-2827.
    </p> <p>
        Medicare Coordinator, Trailblazer, PO Box 660156, Dallas, TX 75266-0156.
    </p> <p>
        Medicare Coordinator, Cahaba GBA, Station 7, 636 Grand Avenue, Des Moines, IA 50309-2551.
    </p> <p>
        Medicare Coordinator, Kansas B/C, PO Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.
    </p> <p>
        Medicare Coordinator, Nebraska B/C, PO Box 3248, Main PO Station, Omaha, NE 68180-0001.
    </p> <p>
        Medicare Coordinator, Mutual of Omaha, PO Box 1602, Omaha, NE 68101.
    </p> <p>
        Medicare Coordinator, Montana B/C, PO Box 5017, Great Falls Div., Great Falls, MT 59403-5017.
    </p> <p>
        Medicare Coordinator, Noridian, 4510 13th Avenue SW., Fargo, ND 58121-0001.
    </p> <p>
        Medicare Coordinator, Utah B/C, PO Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
    </p> <p>
        Medicare Coordinator, Wyoming B/C, 4000 House Avenue, Cheyenne, WY 82003.
    </p> <p>
        Medicare Coordinator, Arizona B/C, PO Box 37700, Phoenix, AZ 85069.
    </p> <p>
        Medicare Coordinator, UGS, PO Box 70000, Van Nuys, CA 91470-0000.
    </p> <p>
        Medicare Coordinator, Regents BC, PO Box 8110 M/S D-4A, Portland, OR 97207-8110.
    </p> <p>
        Medicare Coordinator, Premera BC, PO Box 2847, Seattle, WA 98111-2847.
    </p>
<p><i> IV. Medicare Carriers
</i></p><p>
        Medicare Coordinator, NHIC, 75 Sargent William Terry Drive, Hingham, MA 02044.
    </p> <p>
        Medicare Coordinator, B/S Rhode Island (RI BS), 444 Westminster Street, Providence, RI 02903-2790.
    </p> <p>
        Medicare Coordinator, Trailblazer Health Enterprises, Meriden Park, 538 Preston Ave., Meriden, CT 06450.
    </p> <p>
        Medicare Coordinator, Upstate Medicare Division, 11 Lewis Road, Binghamton, NY 13902.
    </p> <p>
        Medicare Coordinator, Empire Medicare Services, 2651 Strang Blvd., Yorktown Heights, NY, 10598.
    </p> <p>
        Medicare Coordinator, Empire Medicare Services, NJ, 300 East Park Drive, Harrisburg, PA 17106.
    </p> <p>
        Medicare Coordinator, Triple S, #1441 F.D., Roosvelt Ave., Guaynabo, PR 00968.
    </p> <p>
        Medicare Coordinator, Group Health Inc., 4th Floor, 88 West End Avenue, New York, NY 10023.
    </p> <p>
        Medicare Coordinator, Highmark, PO Box 89065, 1800 Center Street, Camp Hill, PA 17089-9065.
    </p> <p>
        Medicare Coordinator, Trailblazers Part B, 11150 McCormick Drive, Executive Plaza 3 Suite 200, Hunt Valley, MD 21031.
    </p> <p>
        Medicare Coordinator, Trailblazer Health Enterprises, Virginia, PO Box 26463, Richmond, VA 23261-6463. United Medicare Coordinator, Tricenturion, 1 Tower Square, Hartford, CT 06183.
    </p> <p>
        Medicare Coordinator, Alabama B/S, 450 Riverchase Parkway East, Birmingham, AL 35298.
    </p> <p>
        Medicare Coordinator, Cahaba GBA, 12052 Middleground Road, Suite A, Savannah, GA 31419.
    </p> <p>
        Medicare Coordinator, Florida B/S, 532 Riverside Ave, Jacksonville, FL 32202-4918.
    </p> <p>
        Medicare Coordinator, Administar Federal, 9901 Linnstation Road, Louisville, KY 40223.
    </p> <p>
        Medicare Coordinator, Palmetto GBA, 17 Technology Circle, Columbia, SC 29203-0001.
    </p> <p>
        Medicare Coordinator, CIGNA, 2 Vantage Way, Nashville, TN 37228.
    </p> <p>
        Medicare Coordinator, Railroad Retirement Board, 2743 Perimeter Parkway, Building 250, Augusta, GA 30999.
    </p> <p>
        Medicare Coordinator, Cahaba GBA, Jackson Miss, PO Box 22545, Jackson, MI 39225-2545.
    </p> <p>
        Medicare Coordinator, Administar Federal (IN), 8115 Knue Road, Indianapolis, IN 46250-1936.
    </p> <p>
        Medicare Coordinator, Wisconsin Physicians Service, PO Box 8190, Madison, WI 53708-8190.
    </p> <p>
        Medicare Coordinator, Nationwide Mutual Insurance Co., PO Box 16788, 1 Nationwide Plaza, Columbus, OH 43216-6788.
    </p> <p>
        Medicare Coordinator, Arkansas B/S, 601 Gaines Street, Little Rock, AR 72203.
    </p> <p>
        Medicare Coordinator, Arkansas-New Mexico, 601 Gaines Street, Little Rock, AR 72203.
    </p> <p>
        Medicare Coordinator, Palmetto GBA-DMERC, 17 Technology Circle, Columbia, SC 29203-0001.
    </p> <p>
        Medicare Coordinator, Trailblazer Health Enterprises, 901 South Central Expressway, Richardson, TX 75080.
    </p> <p>
        Medicare Coordinator, Nordian, 636 Grand Avenue, Des Moines, IA 50309-2551.
    </p> <p>
        Medicare Coordinator, Kansas B/S, PO Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.
    </p> <p>
        Medicare Coordinator, Kansas B/S-NE, PO Box 239, 1133 Topeka Ave., Topeka, KS 66629-0239.
    </p> <p>
        Medicare Coordinator, Montana B/S, PO Box 4309, Helena, MT 59601.
    </p> <p>
        Medicare Coordinator, Nordian, 4305 13th Avenue South, Fargo, ND 58103-3373.
    </p> <p>
        Medicare Coordinator, Noridian BCBSND (C0), 730 N. Simms #100, Golden, CO 80401-4730.
    </p> <p>
        Medicare Coordinator, Noridian BCBSND (WY), 4305 13th Avenue South, Fargo, ND 58103-3373.
    </p> <p>
        Medicare Coordinator, Utah B/S, PO Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
    </p> <p>
        Medicare Coordinator, Transamerica Occidental, PO Box 54905, Los Angeles, CA 90054-4905.
    </p> <p>
        Medicare Coordinator, NHIC-California, 450 W. East Avenue, Chico, CA 95926.
    </p> <p>
        Medicare Coordinator, Cigna, Suite 254, 3150 Lakeharbor, Boise, ID 83703.
    </p> <p>
        Medicare Coordinator, Cigna, Suite 506, 2 Vantage Way, Nashville, TN 37228.
    </p>
<p><i>V. Payment Safeguard Contractors
</i></p><p>
        Medicare Coordinator, Aspen Systems Corporation, 2277 Research Blvd., Rockville, MD 20850.
    </p> <p>
        Medicare Coordinator, DynCorp Electronic Data Systems (EDS, 11710 Plaza America Drive 5400 Legacy Drive, Reston, VA 20190-6017.
    </p> <p>
        Medicare Coordinator, Lifecare Management Partners Mutual of Omaha Insurance Co. 6601 Little River Turnpike, Suite 300 Mutual of Omaha Plaza, Omaha, NE 68175.
    </p> <p>
        Medicare Coordinator, Reliance Safeguard Solutions, Inc., PO Box 30207 400 South Salina Street, 2890 East Cottonwood Pkwy. Syracuse, NY 13202.
    </p> <p>
        Medicare Coordinator, Science Applications International, Inc., 6565 Arlington Blvd., PO Box 100282, Falls Church, VA.
    </p> <p>
        Medicare Coordinator, California Medical Review, Inc., Integriguard Division Federal Sector Civil Group, One Sansome Street, San Francisco, CA 94104-4448.
    </p> <p>
        Medicare Coordinator, Computer Sciences Corporation, Suite 600 3120 Timanus Lane, Baltimore, MD 21244.
    </p> <p>
        Medicare Coordinator, Electronic Data Systems (EDS), 11710 Plaza America Drive 5400 Legacy Drive, Plano, TX 75204.
    </p> <p>Medicare Coordinator, TriCenturion, L.L.C., PO Box 100282, Columbia, SC 29202.</p>
</xhtmlContent>
</subsection>
</section>
    <section id="09-70-0528" toc="yes">
        <systemNumber>09-70-0528</systemNumber>
        <subsection type="systemName">
            "Long Term Care-Minimum Data Set (MDS)," Department of Health and Human Services (HHS)/Centers for Medicare &amp; Medicaid Services (CMS)/Center for Medicaid and State Operations (CMSO).
        </subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850, and at various other remote locations.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    The system contains information on residents in all long-term care facilities that are Medicare and/or Medicaid certified, including private pay individuals including but not limited to Medicare enrollment and entitlement, and Medicare Secondary Payer (MSP) data containing other party liability insurance information necessary for appropriate Medicare claim payment.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The system also contains the individual's health insurance numbers, name, geographic location, race/ethnicity, sex, and date of birth, hospice election, premium billing and collection, direct billing information, and group health plan enrollment data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of the system is given under of &#167;&#167; 1102(a), 1819(b)(3)(A), 1819(f), 919(b)(3)(A), 1919(f), and 1864 of the Social Security Act.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the system is to aid in the administration of the survey and certification, and payment of Medicare Long Term Care services, which include skilled nursing facilities (SNFs), nursing facilities (NFs) SNFs/NFs, and hospital swing beds, and to study the effectiveness and quality of care given in those facilities. Information in this system will also be used to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor or consultant; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) support Quality Improvement Organizations (QIO); (4) assist other insurers for processing individual insurance claims; (5) facilitate research on the quality and effectiveness of care provided, as well as payment related projects; (6) support litigation involving the Agency; (7) assist national accrediting organizations; and (8) combat fraud, waste, and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. Entities Who May Receive Disclosures under Routine Use
                </p>
                <p>
                    These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the MDS without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We have provided a brief explanation of the routine uses we are proposing to establish or modify for disclosures of information maintained in the system:
                </p>
                <p>
                    1. To support Agency contractors, consultants, or grantees who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
                </p>
                <p>
                    2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                </p>
                <p>
                    a. Contribute to the accuracy of CMS's proper payment of Medicare benefits.
                </p>
                <p>
                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                </p>
                <p>
                    c. Assist Federal/state Medicaid programs within the state.
                </p>
                <p>
                    3. To support Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities, conducted pursuant to Part B of Title XI of the Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                </p>
                <p>
                    4. To assist insurance companies, underwriters, third party administrators (TPA), employers, self-insurers, group health plans, health maintenance organizations (HMO), health and welfare benefit funds, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, liability insurers, no-fault medical automobile insurers, workers compensation carriers or plans, other groups providing protection against medical expenses without the beneficiary's authorization, and any entity having knowledge of the occurrence of any event affecting (a) an individual's right to any such benefit or payment, or (b) the initial right to any such benefit or payment, for the purpose of coordination of benefits with the Medicare program and implementation of the MSP provision at 42 U.S.C. 1395y (b). Information to be disclosed shall be limited to Medicare utilization data necessary to perform that specific function. In order to receive the information, they must agree to:
                </p>
                <p>
                    a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a TPA;
                </p>
                <p>
                    b. Utilize the information solely for the purpose of processing the individual's insurance claims; and
                </p>
                <p>
                    c. Safeguard the confidentiality of the data and prevent unauthorized access.
                </p>
                <p>
                    5. To support an individual or organization for research, evaluation, or epidemiological projects related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
                </p>
                <p>
                    6. To assist the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The Agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the Agency in his or her official capacity, or
                </p>
                <p>
                    c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    7. To support a national accrediting organization whose accredited facilities are presumed to meet certain Medicare requirements for inpatient hospital (including swing beds) services; <i>e.g.</i>, the Joint Commission for the Accrediting of Healthcare Organizations (JCAHO). Information will be released to accrediting organizations only for those facilities that they accredit and that participate in the Medicare program.
                </p>
                <p>
                    8. To assist CMS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS- administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
                </p>
                <p>
                    9. To support another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
                </p>
                <p>
                    B. Additional Circumstances Affecting Routine Use Disclosures
                </p>
                <p>
                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512 (a) (1)).
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on magnetic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    All Medicare records are accessible by HIC number or alpha (name) search. This system supports both online and batch access.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent NIST publications; the HHS Automated Information Systems Security Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    &#149; "Records will be retained until an approved disposition authority is obtained from the National Archives and Records Administration."
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Survey and Certification Group, Center for Medicaid and State Operations, CMS, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, health insurance claim number, address, date of birth, and sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and social security number (SSN). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5 (a) (2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    The data contained in these records are furnished by the individual, or in the case of some MSP situations, through third party contacts. There are cases, however, in which the identifying information is provided to the physician by the individual; the physician then adds the medical information and submits the bill to the carrier for payment. Updating information is also obtained from the Railroad Retirement Board, and the Master Beneficiary Record maintained by the Social Security Administration.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="exemptionsClaimed">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0529" toc="yes">
        <systemNumber>09-70-0529</systemNumber>
        <subsection type="systemName">"Employee Building Pass File (EBPF)," HHS/CMS/OOM.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various other contractor locations.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    The system contains information on Federal employees, contractors, consultants or grantees, Government Services Administration employees, and contract guards working in CMS's central office complex in Baltimore, Maryland, and other CMS and HHS Federal buildings.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The system contains the name of the employee or other authorized individuals, social security number (SSN), identification card number, building/work location, phone number, position, title, grade, supervisor's name and telephone number.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of this system of records is given under Section 5 United States Code (U.S.C.) 301, 40 USCA 121(c)(2), and 41 Code of <i>Federal Register</i> (CFR) 102-74.375.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the SOR is to issue and control United States Government building passes issued to all CMS employees and non- CMS employees who require continuous access to CMS buildings in Baltimore and other CMS and HHS facilities. Information retrieved from this SOR will be used to: (1) Support regulatory and policy functions performed within the Agency or by a contractor, consultant, or grantee; (2) assist other Federal agencies with activities related to this system; and (3) support litigation involving the Agency.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To Agency contractors, consultants, or grantees who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
                </p>
                <p>
                    2. To assist other Federal agencies with activities related to this system and who need to have access to the records in order to perform the activity.
                </p>
                <p>
                    3. To the Department of Justice (DOJ), court or adjudicatory body when
                </p>
                <p>
                    a. the Agency or any component thereof; or
                </p>
                <p>
                    b. any employee of the Agency in his or her official capacity; or
                </p>
                <p>
                    c. any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or
                </p>
                <p>
                    d. the United States Government;
                </p>
                <p>
                    is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on electronic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    The collected data are retrieved by an individual identifier; e.g., name or SSN.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources, also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain information for a total period not to exceed 25 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    CMS obtains information in this system from the individuals who are covered by this system.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section> <section id="09-70-0530" toc="yes">
        <systemNumber>09-70-0530</systemNumber>
        <subsection type="systemName">"Medicare Supplier Identification File (MSIF)," HHS/CMS/OFM </subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>Level Three Privacy Act Sensitive Data. </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    National Supplier Clearing House, Palmetto Government Benefits Administrators, Interstate 20 at Alpine Road, Columbia, South Carolina 29219.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    MSIF contains information on owners and managing employees of suppliers of Durable Medicare Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS), which provide service or supplies to Medicare beneficiaries.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The system contains, but is not limited to: business names and addresses, owner's name, owner's social security number (SSN), Unique Physician/Practitioner Identification Number (UPIN), managing employee's name, employer identification number or other tax reporting number, and the carrier assigned billing numbers.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of the system is given under sections 1124, 1124A, 1126, and 1833(e) of the Social Security Act (Title 42, United States Code (U.S.C.) &#167;&#167; 1320a-3, 1320a-3a, 1320a-5, and 13951(e)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of this modified system is to identify supplier businesses that are eligible to receive Medicare payments for items and services furnished to Medicare beneficiaries as well as owners, managing employees, and subcontractors in those suppliers. The information retrieved from this system of records will also be disclosed to: (1) support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant, or grantee; (2) support litigation involving the agency; and (3) combat fraud, waste, and abuse in Federally-funded health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    B. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To agency contractors, or consultants, or to a grantee of a CMS-administered grant program who have been engaged by the agency to assist in the accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
                </p>
                <p>
                    2. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the agency in his or her official capacity, or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>3. To a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.</p>
                <p>
                    4. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
                </p>
                <p>
                    C. Additional Provisions Affecting Routine Use Disclosures:
                </p>
                <p>
                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a)(1)).
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that an individual could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on computer diskette and magnetic storage media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    Information can be retrieved by the business names and addresses, owner's name, owner's SSN, UPIN, managing employee's name, employer identification number or other tax reporting number, and the Medicare contractor assigned billing numbers.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    Records are maintained by CMS for a period not to exceed 15 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Provider/Supplier Enrollment, Program Integrity Group, Office of Financial Management, CMS, Mail Stop C3- 02-16, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2).)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7.)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    Sources of information contained in this records system include data collected from the application which the supplier completes to obtain Medicare billing numbers. (CMS Form 192--prior to August 1996, CMS Form 888--April 1996 through May 1997, and CMS Form 855S --after May 1997).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0531" toc="yes">
        <systemNumber>09-70-0531</systemNumber>
        <subsection type="systemName">
            "National Emphysema Treatment Trial (NETT)," HHS/CMS/OCSQ.
        </subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various other contractor locations.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    This system will collect and maintain individually identifiable and other data collected on Medicare beneficiaries and providers participating in the study.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    Data will be collected from Medicare administrative and claims records, patient medical charts, physician records, and via survey instruments administered to beneficiaries and providers. The collected information will include, but is not limited to Medicare claims and eligibility data, name, address, telephone number, health insurance claims number, race/ethnicity, gender, date of birth, provider name, unique provider identification number, medical record number, as well as clinical, demographic, health/well-being, family and/or caregiver contact information, and background information relating to Medicare issues.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    The statutory authority for this system is given under the provisions of Section 1862(a)(1)(A) of the Social Security Act, and 42 U.S.C. 1395, which states that Medicare must provide coverage for items and services that are "reasonable and necessary for the diagnosis or treatment of illness or injury or to improve the functioning of a malformed body member."
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the system of records is to collect and maintain data that will allow CMS to provide secure data on participants in the randomized phase of the study, pay claims, and to monitor and evaluate the clinical trial. Information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement and policy functions performed within the agency or by a contractor, consultant, or CMS grantee; (2) assist another Federal or state agency to enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support research, evaluation, or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects; (4) support litigation involving the agency; and (5) combat fraud, waste, and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To agency contractors, consultants or CMS grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                </p>
                <p>
                    2. To another Federal or state agency to:
                </p>
                <p>
                    a. contribute to the accuracy of CMS's proper payment of Medicare benefits;
                </p>
                <p>
                    b. enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
                </p>
                <p>
                    c. assist Federal/state Medicaid programs within the state.
                </p>
                <p>
                    3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
                </p>
                <p>
                    4. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. the agency or any component thereof, or
                </p>
                <p>
                    b. any employee of the agency in his or her official capacity, or
                </p>
                <p>
                    c. any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. the United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    5. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such program.
                </p>
                <p>
                    6. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such programs.
                </p>
                <p>
                    B. Additional Provisions Affecting Routine Use Disclosures
                </p>
                <p>
                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512 (a) (1).)
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on electronic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    The collected data are retrieved by an individual identifier; e.g., beneficiary name or HICN, and unique provider identification number.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain information for a total period not to exceed 25 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Medical and Surgical Services, Coverage and Analysis Group, Office of Clinical Standards and Quality, CMS, Room C4-10-10, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2).)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    The data collected and maintained in this system are retrieved from Medicare enrollment records, Medicare beneficiaries or proxies, and medical providers (such as physicians, medical facilities, home health care providers) for a sample of enrollees.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="exemptionsClaimed">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0532" toc="yes">
        <systemNumber>09-70-0532</systemNumber>
        <subsection type="systemName">"Provider Enrollment, Chain, and Ownership System (PECOS), HHS/CMS/OFM" </subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>Level Three Privacy Act Sensitive Data .</p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and South Building, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>PECOS will collect information provided by an applicant related to identity, qualifications, practice locations, ownership, billing agency information, reassignment of benefits, electronic funds transfer, the national provider identifier (NPI) and related organizations. PECOS will also maintain information on business owners, chain home offices and provider/chain associations, managing/directing employees, partners, authorized and delegated officials, supervising physicians of the supplier, staffing companies, ambulance vehicle information, and/or interpreting physicians and related technicians.</p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    This system of records will contain the names, social security numbers (SSN), date of birth (DOB), and employer identification numbers (EIN) and NPI's for each disclosing entity, owners, as well as managing/directing employees, with 5 percent or more ownership or control interest. Managing/directing employees include general manager, business managers, administrators, directors, and other individuals who exercise operational or managerial control over the provider/supplier. The system will also contain Medicare identification numbers (<i>i.e., </i> UPIN, OSCAR, PIN and the NPI), demographic data, professional data, past and present business history as well as information regarding any adverse actions such as exclusions, sanctions, and felonious behavior.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    The Authority for maintenance of the system is given under provisions of sections 1102(a) (Title 42 U.S.C. 1302(a)), 1128 (42 U.S.C 1320a-7), 1814(a)) (42 U.S.C. 1395f(a)(1), 1815(a) (42 U.S.C. 1395g(a)), 1833(e) (42 U.S.C. 1395I(3)), 1871 (42 U.S.C. 1395hh), and 1886(d)(5)(F), (42 U.S.C. 1395ww(d)(5)(F) of the Social Security Act; 1842(r) (42 U.S.C. 1395u(r)); section 1124(a)(1) (42 U.S.C. 1320a- 3(a)(1), and 1124A (42 U.S.C. 1320a-3a), section 4313, as amended, of the BBA of 1997; and section 31001(i) (31 U.S.C. 7701) of the DCIA (Pub. L. 104-134), as amended.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the SOR is to: (1) Collect information for an applying provider/supplier and record the associations between the applicant and those who have an ownership or control interest in the entity; (2) permit informed enrollment decisions to be made based on past and present business history, any reported exclusions, sanctions and felonious behavior at their location or in multiple contractor jurisdictions; and, (3) ensure that correct payments are made under the Medicare program. Information retrieved from this SOR will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant, or CMS grantee; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) assist an individual or organization for research, evaluation, or epidemiological projects; (5) support litigation involving the Agency; and (5) combat fraud, waste, and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To support agency contractors, consultants, or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                </p>
                <p>
                    2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                </p>
                <p>
                    a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
                </p>
                <p>
                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with federal funds, and/or
                </p>
                <p>
                    c. Evaluate and monitor the quality of home health care and contribute to the accuracy of health insurance operations.
                </p>
                <p>
                    3. To assist an individual or organization for research, evaluation or epidemiological projects related to the prevention of disease or disability, or the restoration or maintenance of health, and for payment related projects.
                </p>
                <p>
                    4. To support the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the agency in his or her official capacity, or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    5. To assist a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
                </p>
                <p>
                    6. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on paper and magnetic disk.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    Magnetic media records are retrieved by the name of the employees or other authorized individual and/or card key number. Paper records are retrieved alphabetically by name.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain identifiable data for a total period of 15 years from the date the information was collected.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Provider/Supplier Enrollment, Office of Financial Management, CMS, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, SSN, EIN, and for verification purposes, the subject individual's name (woman's maiden name, if applicable).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    Information contained in this system is received from the Form(s) CMS 855A, "Medicare Enrollment Application for Institutional Providers," CMS 855B, "Medicare Enrollment Application for Clinic/Group Practices and Certain Other Providers," CMS 855I, "Medicare Enrollment Application for Physician and Non-Physician Practitioners," CMS 855R, "Medicare Enrollment Application for Reassignment of Medicare Benefits," and CMS 855S, "Medicare Enrollment Application for Durable Medial Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS)."
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0533" toc="yes">
        <systemNumber>09-70-0533</systemNumber>
        <subsection type="systemName">"Medicare Managed Care Beneficiary Reconsideration (RECON) System," HHS/CMS/CBC.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites and at CMS Regional Offices.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    RECON contains information concerning Medicare beneficiaries who have been enrolled in a managed care program and who have requested an appeal by CMS, or any person who acts on behalf of these beneficiaries.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    Information in this system includes, but is not limited to, name, address, social security number (SSN), health insurance claim number (HICN), health insurance plan name and address, health insurance plan number, medical records and statement of fact, service request/claims data, date of service request/claim received by the health plan, dates of service, beneficiary enrollment form and disenrollment form, verification of enrollment status, date reconsideration request submitted to CMS, and dates of determination by plan and CMS.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of the system is given under &#167;&#167; 1852, and 1876 of the Social Security Act (Title 42 U.S.C 1395w-22, and 1395mm).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of this modified system is to collect and maintain information necessary to process requests for reconsideration of service requests or claims by or on behalf of Medicare managed care enrollees, promote the effectiveness and integrity of the Medicare managed care program, and reply to future correspondence related to the case. The information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor or consultant; (2) assist another Federal or state agency; (3) assist third party contacts; (4) assist Quality Improvement Organizations; (5) support litigation involving the agency; and (6) combat fraud, waste, and abuse in Federally-funded health benefit programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To support agency contractors, consultants, or a grantee of a CMS-administered grant program, who have been engaged by the agency to assist in the accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
                </p>
                <p>
                    2. To assist another Federal and/or state agency to:
                </p>
                <p>
                    a. contribute to the accuracy of CMS' proper payment of Medicare benefits,
                </p>
                <p>
                    b. enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                </p>
                <p>
                    c. assist Federal/state Medicaid programs within the state.
                </p>
                <p>
                    3. To assist a third party contact in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program.
                </p>
                <p>
                    a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exist: the individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exists, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
                </p>
                <p>
                    b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: The individual's entitlement to benefits under the Medicare program, the amount of reimbursement, or any case in which the evidence is being reviewed as a result of suspected fraud and abuse, program integrity, quality appraisal, or evaluation and measurement of activities.
                </p>
                <p>
                    4. To assist Quality Improvement Organizations (QIO) in order to assist the QIO to perform Title XI and Title XVIII functions relating to assessing and improving quality of care.
                </p>
                <p>
                    5. To support the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. the agency or any component thereof, or
                </p>
                <p>
                    b. any employee of the agency in his or her official capacity, or
                </p>
                <p>
                    c. any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. the United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    6. To assist a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
                </p>
                <p>
                    7. To assist another Federal agency or an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
                </p>
                <p>
                    B. Additional Provisions Affecting Routine Use Disclosures.
                </p>
                <p>
                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a)(1)).
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that an individual could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on computer diskette and magnetic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    Information can be retrieved by the name, SSN, and/or HICN of claimant.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will transfer to and maintain in an archival file for a total period not to exceed 7 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Appeals Policy, Medicare Enrollment &amp; Appeals Group, Center for Beneficiary Choices, CMS, Mail Stop C2 -12-16, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    Sources on information contained in this records system is obtained from the reconsideration requests made by or on behalf of Medicare beneficiaries and from inquiries from congressional offices, health plans, providers, state insurance commissioners, state regulators, disenrollment surveys, Medicare carriers or intermediaries, and QIO records.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0534" toc="yes">
        <systemNumber>09-70-0534</systemNumber>
        <subsection type="systemName">"Medicare Exclusion Database (MED), HHS/CMS/OFM.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850, and at various other remote locations.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    For purposes of this SOR, the system contains information related to individual health care providers who have been excluded from participation in Medicare and other Federal and State health care programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The system contains information such as other provider identifiers used by those individuals, names, demographic information, including, but not limited to gender and date of birth, provider taxonomy information, address data, contact information, and taxpayers identifying number.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of this system is given under &#167;&#167; 1128 A and B, and 1156 of the Social Security Act.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of this system of records is to collect and maintain information on individuals that have been excluded from receiving Medicare payments for any item or service furnished during the period when excluded from participation in the Medicare program. Information maintained in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant or CMS grantee; (2) assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) facilitate research on the quality and effectiveness of care provided, as well as epidemiological projects; (4) support litigation involving the Agency; and (5) combat fraud, waste and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    To support Agency contractors, consultants, or CMS grantees that have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need access to the records in order to assist CMS.
                </p>
                <p>
                    To assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent to: Contribute to the accuracy of CMS's proper payment of Medicare benefits, enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or assist Federal/State Medicaid programs within the State.
                </p>
                <p>To support an individual or organization for a research, evaluation, or epidemiological project related to the prevention of disease or disability or the restoration or maintenance of health.</p>
                <p>
                    To assist the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    The Agency or any component thereof, or any employee of the Agency in his or her official capacity, or any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or the United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    To support a CMS contractor that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS- administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
                </p>
                <p>
                    To support another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in a program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on magnetic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    All records are accessible by UPIN/NPI or alpha (name) search. This system supports both on-line and batch access.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    Records are maintained for a period of 15 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Program Integrity Group, Office of Financial Management, CMS, Mail Stop C3-02-16, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual health care provider should write to the system manager who will require the system name, National Provider Identifier, address, date of birth, and gender, and for verification purposes, the subject individual health care provider's name (woman's maiden name, if applicable), and social security number (SSN). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual health care provider should contact the systems manager named above, reasonably identify the record and specify the information to be contested, state the corrective action sought, and the reasons for the correction with supporting justification. (These procedures are in accordance with department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    The Office of the Inspector General Exclusion file, Online Survey Certification and Reporting System file, National Supplier Clearing House file, Unique Physician Identification Number Registry, Medicare Contractor Provider Files, and Social Security Administration records to assist in a determination of the excluded individual's employers.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p></xhtmlContent>
</subsection>

</section>
    <section id="09-70-0535" toc="yes">
        <systemNumber>09-70-0535</systemNumber>
        <subsection type="systemName">"1-800 Medicare Helpline (HELPLINE)," HHS/CMS/CBC.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various other contractor locations.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    Information is collected on individuals age 65 or over who have been, or currently are, entitled to health insurance (Medicare) benefits under Title XVIII of the Act or under provisions of the Railroad Retirement Act, individuals under age 65 who have been, or currently are, entitled to such benefits on the basis of having been entitled for not less than 24 months to disability benefits under Title II of the Act or under the Railroad Retirement Act, individuals who have been, or currently are, entitled to such benefits because they have ESRD, individuals age 64 and 8 months or over who are likely to become entitled to health insurance (Medicare) benefits upon attaining age 65, and individuals under age 65 who have at least 21 months of disability benefits who are likely to become entitled to Medicare upon the 25th month of their being disabled.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The collected information will contain name, address, telephone number, health insurance claim (HIC) number, geographic location, race/ethnicity, sex, date of birth, as well as, background information relating to Medicare or Medicaid issues. The HELPLINE will also maintain a caller history for purposes of re-contacts by customer service representatives or CMS, contain information related to Medicare enrollment and entitlement, group health plan enrollment data, as well as, background information relating to Medicare or Medicaid issues.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of the system is given under sections 1102, 1804(b), and 1851(d) of the Social Security Act (42 United States Code (U.S.C.) 1302, 1395b-2(b), and 1395w-21(d)), and OMB Circular A-123, Internal Control Systems, and Title 42 U.S.C. section 1395w-21(d) (Pub. L. 105-3, the Balanced Budget Act of 1997).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the SOR is to provide general information to beneficiaries and future beneficiaries so that they can make informed Medicare decisions, maintain information on Medicare enrollment for the administration of the Medicare program, including the following functions: Ensuring proper Medicare enrollment, claims payment, Medicare premium billing and collection, coordination of benefits by validating and verifying the enrollment status of beneficiaries, and validating and studying the characteristics of persons enrolled in the Medicare program including their requirements for information. Information retrieved from this SOR will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by contractors, consultants, or CMS grantees; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) assist providers and suppliers of services for administration of Title XVIII of the Act; (4) assist third parties where the contact is expected to have information relating to the individual's capacity to manage his or her own affairs; (5) assist other insurers for processing individual insurance claims; (6) support litigation involving the Agency; and (7) combat fraud, waste, and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the HELPLINE without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We are proposing to establish or modify the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To support Agency contractors, consultants, or CMS grantees who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this SOR and who need to have access to the records in order to assist CMS.
                </p>
                <p>
                    2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                </p>
                <p>
                    a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
                </p>
                <p>
                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                </p>
                <p>
                    c. Assist Federal/state Medicaid programs within the state.
                </p>
                <p>
                    3. To assist providers and suppliers of services directly or through fiscal intermediaries or carriers for the administration of Title XVIII of the Social Security Act.
                </p>
                <p>
                    4. To assist third party contacts in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program and,
                </p>
                <p>
                    a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: The individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exists or the custodian of the information will not, as a matter of policy, provide it to the individual), or
                </p>
                <p>
                    b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: The individual's entitlement to benefits under the Medicare program, the amount of reimbursement, and in cases in which the evidence is being reviewed as a result of suspected fraud and abuse, program integrity, quality appraisal, or evaluation and measurement of activities.
                </p>
                <p>
                    5. To assist insurance companies, third party administrators (TPA), employers, self-insurers, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, group health plans (i.e., health maintenance organizations (HMOs) or a competitive medical plan (CMP) with a Medicare contract, or a Medicare-approved health care prepayment plan (HCPP)), directly or through a contractor, and other groups providing protection for their enrollees. Information to be disclosed shall be limited to Medicare entitlement data. In order to receive the information, they must agree to:
                </p>
                <p>
                    a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a TPA;
                </p>
                <p>
                    b. Utilize the information solely for the purpose of processing the identified individual's insurance claims; and
                </p>
                <p>
                    c. Safeguard the confidentiality of the data and prevent unauthorized access.
                </p>
                <p>
                    6. To support the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The Agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the Agency in his or her official capacity, or
                </p>
                <p>
                    c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    7. To support a CMS contractor (including, but not limited to FIs and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
                </p>
                <p>
                    8. To assist another Federal agency or an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency) that administers, or that has the authority to investigate potential fraud, waste, and abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on electronic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    The collected data are retrieved by an individual identifier;  e.g., beneficiary name or HICN, and unique provider identification number.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain information for a total period not to exceed 6 years and 3 months. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Call Center Operations, Customer Teleservice Operations Group, Office of Beneficiary Information Services, CMS, 7500 Security Boulevard, C2-26-20, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    The data contained in these records are furnished by the individual, or in the case of some situations, through third party contacts that make calls to 1-800 Medicare Helpline. Updating information is also obtained from the following CMS systems of records: Enrollment Data Base (09-70-0502), Common Working File (09-70-0525), and the Master Beneficiary Record maintained by the Social Security Administration (SSA System of Records SSA/ORSIS 60-0090).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0536" toc="yes">
        <systemNumber>09-70-0536</systemNumber>
        <subsection type="systemName">"Medicare Beneficiary Database (MBD), HHS/CMS/CBC." </subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    Individuals age 65 or over who have been, or currently are, entitled to health insurance (Medicare) benefits under Title XVIII of the Social Security Act (the Act) or under provisions of the Railroad Retirement Act; individuals under age 65 who have been, or currently are, entitled to such benefits on the basis of having been entitled for not less that 24 months to disability benefits under Title II of the Act or under the Railroad Retirement Act; individuals who have been, or currently are, entitled to such benefits because they have End-Stage Renal Disease (ESRD); individuals age 64 and 8 months or over who are likely to become entitled to health insurance (Medicare) benefits upon attaining age 65, and individuals under age 65 who have at least 21 months of disability benefits who are likely to become entitled to Medicare upon the 25th month or entitlement to such benefits and those populations that are dually eligible for both Medicare and Medicaid (Title XIX of the Act).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    Information maintained in the system include, but are not limited to: Standard data for identification such as health insurance claim number, social security number, gender, race/ethnicity, date of birth, geographic location, Medicare enrollment and entitlement information, MSP data necessary for appropriate Medicare claim payment, hospice election, MA plan elections and enrollment, End Stage Renal Disease (ESRD) entitlement, historic and current listing of residences, and Medicare eligibility and Managed Care institutional status.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    The primary purpose of this modified system is to provide CMS with a singular, authoritative, database of comprehensive enrollment data on individuals in the Medicare program to support ongoing and expanded program administration, service delivery modalities, and payment coverage options. This collection will contain a complete "beneficiary insurance profile" that reflects the individual's Medicare health insurance coverage and Medicare health plan and demonstration enrollment. Information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or a CMS grantee; (2) assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) support providers and suppliers of services for administration of Title XVIII; (4) assist third parties where the contact is expected to have information relating to the individual's capacity to manage his or her own affairs; (5) support Quality Improvement Organizations (QIO); (6) assist other insurers for processing individual insurance claims; (7) facilitate research on the quality and effectiveness of care provided, as well as payment related projects; (8) support Patient Assistance Programs and other groups providing pharmaceutical assistance or services to Medicare beneficiaries; (9) support litigation involving the agency; and (10) combat fraud, waste, and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are modifying/altering the routine use disclosures of information maintained in the system so that the routine uses include the following:
                </p>
                <p>
                    1. To support agency contractors, consultants or grantees who have been engaged by the agency to assist in the performance of a service related to this system and who need to have access to the records in order to perform the activity.
                </p>
                <p>
                    2. To assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent to:
                </p>
                <p>
                    a. Contribute to the accuracy of CMS' proper payment of Medicare benefits,
                </p>
                <p>
                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                </p>
                <p>
                    c. Assist Federal/State Medicaid programs within the State.
                </p>
                <p>
                    3. To assist providers and suppliers of services directly or through fiscal intermediaries or carriers for the administration of Title XVIII of the Act.
                </p>
                <p>
                    4. To assist third party contact in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program and;
                </p>
                <p>
                    a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: The individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exists, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
                </p>
                <p>
                    b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: The individual's entitlement to benefits under the Medicare program, the amount of reimbursement, and in cases in which the evidence is being reviewed as a result of suspected fraud and abuse, program integrity, quality appraisal, or evaluation and measurement of activities.
                </p>
                <p>
                    5. To support Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities conducted pursuant to Part B of Title XI of the Act, and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans. As established by the Part D Program, QIOs will conduct reviews of prescription drug events data, or in connection with studies or other review activities conducted pursuant to Part D of Title XVIII of the Act.
                </p>
                <p>
                    6. To other insurers, underwriters, third party administrators (TPAs), self-insurers, group health plans, employers, health maintenance organizations, health and welfare benefit funds, Federal agencies, a State or local government or political subdivision of either (when the organization has assumed the role of an insurer, underwriter, or third party administrator, or in the case of a State that assumes the liabilities of an insolvent insurers pool or fund), multiple-employers trusts, no-fault medical, automobile insurers, workers' compensation carriers plans, liability insurers, and other groups providing protection against medical expenses who are primary payers to Medicare in accordance with 42 U.S.C. 1395y(b), or any entity having knowledge of the occurrence of any event affecting;
                </p>
                <p>
                    a. An individual's right to any such benefit or payment, or
                </p>
                <p>
                    b. The initial or continued right to any such benefit or payment (for example, a State Medicaid Agency, State Workers' Compensation Board, or Department of Motor Vehicles) for the purpose of coordination of benefits with the Medicare program and implementation of the MSP provisions at 42 U.S.C. 1395 y(b). The information CMS may disclose will be:
                </p>
                <p>
                    &#149; Beneficiary Name
                </p>
                <p>
                    &#149; Beneficiary Address
                </p>
                <p>
                    &#149; Beneficiary Health Insurance Claim Number
                </p>
                <p>
                    &#149; Beneficiary Social Security Number
                </p>
                <p>
                    &#149; Beneficiary Gender
                </p>
                <p>
                    &#149; Beneficiary Date of Birth
                </p>
                <p>
                    &#149; Amount of Medicare Conditional Payment
                </p>
                <p>
                    &#149; Provider Name and Number
                </p>
                <p>
                    &#149; Physician Name and Number
                </p>
                <p>
                    &#149; Supplier Name and Number
                </p>
                <p>
                    &#149; Dates of Service
                </p>
                <p>
                    &#149; Nature of Service
                </p>
                <p>
                    &#149; Diagnosis
                </p>
                <p>
                    To administer the MSP provision at 42 U.S.C. 1395 y(b)(2), (3), and (4) more effectively, CMS would receive (to the extent that it is available) and may disclose the following types of information from insurers, underwriters, third party administrator, self-insurers, etc.:
                </p>
                <p>
                    &#149; Subscriber Name and Address
                </p>
                <p>
                    &#149; Subscriber Date of Birth
                </p>
                <p>
                    &#149; Subscriber Social Security number
                </p>
                <p>
                    &#149; Dependent Name
                </p>
                <p>
                    &#149; Dependent Date of Birth
                </p>
                <p>
                    &#149; Dependent Social Security Number
                </p>
                <p>
                    &#149; Dependent Relationship to Subscriber
                </p>
                <p>
                    &#149; Insurer/Underwriter/TPA Name and Address
                </p>
                <p>
                    &#149; Insurer/Underwriter/TPA Group Number
                </p>
                <p>
                    &#149; Insurer/Underwriter/Group Name
                </p>
                <p>
                    &#149; Prescription Drug Coverage
                </p>
                <p>
                    &#149; Policy Number
                </p>
                <p>
                    &#149; Effective Date of Coverage
                </p>
                <p>
                    &#149; Employer Name, Employer Identification Number (EIN) and Address
                </p>
                <p>
                    &#149; Employment Status
                </p>
                <p>
                    &#149; Amounts of Payment
                </p>
                <p>
                    To administer the MSP provision at 42 U.S.C. 1395y(b)(1) more effectively for entities such as Workers' Compensation carriers or boards, liability insurers, no-fault and automobile medical policies or plans, CMS would receive (to the extent that it is available) and may disclose the following information:
                </p>
                <p>
                    &#149; Beneficiary's Name and Address
                </p>
                <p>
                    &#149; Beneficiary's Date of Birth
                </p>
                <p>
                    &#149; Beneficiary's Social Security number
                </p>
                <p>
                    &#149; Name of Insured
                </p>
                <p>
                    &#149; Insurer Name and Address
                </p>
                <p>
                    &#149; Type of coverage; automobile medical, no-fault, liability payment, or workers' compensation settlement
                </p>
                <p>
                    &#149; Insured's Policy Number
                </p>
                <p>
                    &#149; Effective Date of Coverage
                </p>
                <p>
                    &#149; Date of accident, injury or illness
                </p>
                <p>
                    &#149; Amount of payment under liability, no-fault, or automobile medical policies, plans, and workers' compensation settlements
                </p>
                <p>
                    &#149; Employer Name and Address (Workers' Compensation Only)
                </p>
                <p>
                    &#149; Name of insured could be the driver of the car, a business, the beneficiary (<i>i.e.</i>, the name of the individual or entity which carries the insurance policy or plan)
                </p>
                <p>
                    In order to receive this information the entity must agree to the following conditions;
                </p>
                <p>
                    c. To utilize the information solely for the purpose of coordination of benefits with the Medicare program and other third party payer in accordance with Title 42 U.S.C. 1395y(b);
                </p>
                <p>
                    d. To safeguard the confidentiality of the data and to prevent unauthorized access to it; and
                </p>
                <p>
                    e. To prohibit the use of beneficiary-specific data for the purposes other than for the coordination of benefits among third party payers and the Medicare program. This agreement would allow the entities to use the information to determine cases where they or other third party payers have primary responsibility for payment. Examples of prohibited uses would include but are not limited to; creation of a mailing list, sale or transfer of data.
                </p>
                <p>
                    To administer the MSP provisions more effectively, CMS may receive or disclose the following types of information from or to entities including insurers, underwriters, TPAs, and self-insured plans, concerning potentially affected individuals:
                </p>
                <p>
                    &#149; Subscriber HICN
                </p>
                <p>
                    &#149; Dependent Name
                </p>
                <p>
                    &#149; Funding arrangements of employer group health plans, for example, contributory or non-contributory plan, self-insured, re- insured, HMO, TPA insurance
                </p>
                <p>
                    &#149; Claims payment information, for example, the amount paid, the date of payment, the name of the insurers or payer
                </p>
                <p>
                    &#149; Dates of employment including termination date, if appropriate
                </p>
                <p>
                    &#149; Number of full and/or part-time employees in the current and preceding calendar years
                </p>
                <p>
                    &#149; Employment status of subscriber, for example, full or part time or self-employed
                </p>
                <p>
                    7. To assist an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
                </p>
                <p>
                    8. To support Patient Assistance Programs and other groups providing pharmaceutical assistance to a Medicare beneficiary. Medicare Part D enrollment information may be released to these organizations upon specific request, and then only if they meet the following requirements, they must:
                </p>
                <p>
                    a. Provide an attestation or other qualifying information that they are providing pharmaceutical assistance to Medicare beneficiaries;
                </p>
                <p>
                    b. Submit a finder file to CMS to identify Medicare beneficiaries receiving pharmaceutical assistance and/or services consisting of the following data elements:
                </p>
                <p>
                    (1) First initial of the first name,
                </p>
                <p>
                    (2) First 6 letters of the last name,
                </p>
                <p>
                    (3) Social security number or health insurance claims number,
                </p>
                <p>
                    (4) Date of birth,
                </p>
                <p>
                    (5) Sex;
                </p>
                <p>
                    c. Safeguard the confidentiality of any data received and prevent unauthorized access to the data; and
                </p>
                <p>
                    d. Complete a written statement attesting to the information recipient's understanding of and willingness to abide by CMS provisions regarding Privacy protections and information security. Recipients of CMS data must complete the PAP Data Sharing Agreement prior to the release of CMS data.
                </p>
                <p>
                    9. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the agency in his or her official capacity, or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.</p>
                <p>
                    10. To a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
                </p>
                <p>
                    11. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
                </p>
                <p>
                    B. Additional Provisions Affecting Routine Use Disclosures
                </p>
                <p>
                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512 (a)(1).)
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored electronically.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    All Medicare records are accessible by HICN, and SSN search. This system supports both on-line and batch access.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    Records are maintained in the active files for a period of 15 years. The records are then retired to archival files maintained at the Health Care Data Center. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Enrollment and Eligibility Policy, Medicare Enrollment and Appeals Group, Center for Beneficiary Choices, CMS, Mail Stop S1-05-06, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2).)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7.)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    The data contained in this system of records are extracted from other CMS systems of records: Enrollment Database, Medicare Advantage Prescription Drug System, and the Medicaid Statistical Information System. Information will also be provided from the application submitted by the individual through State Medicaid agencies, the Social Security Administration and through other entities assisting beneficiaries.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
                <p>
                    Appendix A. Health Insurance Records
                </p>
                <p>
                    Medicare records are maintained at the CMS Central Office (see section 1 below for the address). Health Insurance Records of the Medicare program can also be accessed through a representative of the CMS Regional Office (see section 2 below for addresses). Medicare records are also maintained by private insurance organizations that share in administering provisions of the health insurance programs. These private insurance organizations, referred to as Managed Care Organizations, are under contract to the Centers for Medicare &amp; Medicaid Services and the Social Security Administration to perform specific task in the Medicare program (see section three below for information on MCOs).
                </p>
                <p>
                    1. Central Office Address: CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
                </p>
                <p>
                    2. CMS Regional Offices: BOSTON REGION--Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont. John F. Kennedy Federal Building, Room 1211, Boston, Massachusetts 02203. Office Hours: 8:30 a.m.-5 p.m.
                </p>
                <p>
                    NEW YORK REGION--New Jersey, New York, Puerto Rico, Virgin Islands. 26 Federal Plaza, Room 715, New York, New York 10007, Office Hours: 8:30 a.m.-5 p.m.
                </p>
                <p>
                    PHILADELPHIA REGION--Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, West Virginia. Post Office Box 8460, Philadelphia, Pennsylvania 19101. Office Hours: 8:30 a.m.-5 p.m.
                </p>
                <p>
                    ATLANTA REGION--Alabama, North Carolina, South Carolina, Florida, Georgia, Kentucky, Mississippi, Tennessee. 101 Marietta Street, Suite 702, Atlanta, Georgia 30223, Office Hours: 8:30 a.m.-4:30 p.m.
                </p>
                <p>
                    CHICAGO REGION--Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin. Suite A--824, Chicago, Illinois 60604. Office Hours: 8 a.m.-4:45 p.m.
                </p>
                <p>
                    DALLAS REGION--Arkansas, Louisiana, New Mexico, Oklahoma, Texas, 1200 Main Tower Building, Dallas, Texas. Office Hours: 8 a.m.- 4:30 p.m.
                </p>
                <p>
                    KANSAS CITY REGION--Iowa, Kansas, Missouri, Nebraska. New Federal Office Building, 601 East 12th Street, Room 436, Kansas City, Missouri 64106. Office Hours: 8 a.m.-4:45 p.m.
                </p>
                <p>
                    DENVER REGION--Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming. Federal Office Building, 1961 Stout Street, Room 1185, Denver, Colorado 80294. Office Hours: 8 a.m.-4:30 p.m.
                </p>
                <p>
                    SAN FRANCISCO REGION--American Samoa, Arizona, California, Guam, Hawaii, Nevada. Federal Office Building, 10 Van Ness Avenue, 20th Floor, San Francisco, California 94102. Office Hours: 8 a.m.-4:30 p.m.
                </p>
                <p>
                    SEATTLE REGION--Alaska, Idaho, Oregon, Washington. 1321 Second Avenue, Room 615, Mail Stop 211, Seattle, Washington 98101. Office Hours 8 a.m.-4:30 p.m.
                </p>
                <p>
                    3. Managed Care Organizations: Monthly report of Managed Care Organizations is available at www.cms.gov.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0537" toc="yes">
        <systemNumber>09-70-0537</systemNumber>
        <subsection type="systemName">Non-Medicare Beneficiary Workers' Compensation (WC) Set-aside File, (WCSAF).</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level 3 Privacy Act Sensitive.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    Group Health Incorporated, 25 Broadway, New York, New York 10004.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    The system of records will contain data on non-Medicare beneficiaries that receive an approval or a denial by the Centers for Medicare &amp; Medicaid Services (CMS) of the adequacy of a WC Medicare Set-aside Arrangement, as part of a WC settlement that is intended to pay for future medical expenses in place of future Medicare benefits.
                </p>
            </xhtmlContent>
        </subsection> <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    This system of records will contain the individual-level identifying data including, but not limited to, name, address, date of birth, social security number (SSN), date of the WC injury/incident, injury diagnosis code(s), effective date and amount of the WC Medicare Set-aside Arrangement. In addition, data will be included to enable CMS to manage the WC Medicare Set-aside Arrangement information when it becomes part of a beneficiary's record on the Common Working File. These data include the WC carrier, the administrator of the WC Medicare Set-aside Arrangement, and the attorney that prepared the arrangement.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Section 1862(b)(2) of the Social Security Act (the Act) requires that Medicare payment may not be made for any item or service to the extent that payment has been made under a WC law or plan. This section of the Act and Title 42 Code of Federal Regulation (CFR) 411.46 require CMS to exclude payments once the injured individual becomes a Medicare beneficiary when payment should be made from WC funds that are always primary to Medicare payment.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the non-Medicare beneficiary WCSAF is to maintain a file of individuals who were injured while employed; are not currently Medicare beneficiaries; whose WC Settlement included a WC Medicare Set-aside Arrangement that is intended to pay for future medical expenses in place of future Medicare benefits; and was approved or not approved (denied) by CMS as submitted. The information retrieved from this system will be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor or consultant; (2) another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent to contribute to the accuracy of CMS' proper payment of Medicare benefits, enable such agency to administer a Federal health benefits program, or enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) an individual or organization for research, evaluation or epidemiological projects related to the prevention of disease or disability, the restoration or maintenance of health, or for understanding and improving payment projects; (4) support constituent requests made to a Congressional representative; (5) support litigation involving the agency; and (6) combat fraud and abuse in health benefits programs funded in whole or in part by Federal funds.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To agency contractors, or consultants that have been contracted by the agency to assist in the performance of a service related to this system and that need to have access to the records in order to perform the activity.
                </p>
                <p>
                    2. To another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                </p>
                <p>
                    a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
                </p>
                <p>
                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds.
                </p>
                <p>
                    3. To an individual or organization for research, evaluation or epidemiological projects related to the prevention of disease or disability, the restoration or maintenance of health, or for understanding and improving payment projects.
                </p>
                <p>
                    4. To a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional Office made at the written request of the constituent about whom the record is maintained.
                </p>
                <p>
                    5. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the agency in his or her official capacity; or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government; is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation.
                </p>
                <p>
                    6. To a CMS contractor (including, but not necessarily limited to intermediaries and carriers) that assists in the administration of a CMS- administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
                </p>
                <p>
                    7. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                </p>
                <p>
                    B. Additional Provisions Affecting Routine Use Disclosures:
                </p>
                <p>
                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, 65 FR 82462 (12-28-00)), Subparts A and E. Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on magnetic media.
                </p>
            </xhtmlContent>
        </subsection><subsection type="retrievability"><xhtmlContent><p>
            The records are retrieved alphabetically by the name and/or SSN of the subject of the records.
        </p>
    </xhtmlContent>
    </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain identifiable WCSAF data for a period of 6 years and 3 months unless the injured individual becomes a Medicare beneficiary prior to that period of time. When either of these criteria is met, the information stored on the injured individual will be deleted from the WCSAF. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Medicare Secondary Payer Policy Operations, Financial Services Group, Office of Financial Management, CMS, Mail Stop C3-14-16, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), address, date of birth, date of WC injury/incident, diagnosis, effective date and amount of the WC Medicare Set-aside Arrangement. (Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b 5(a)(2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    The Electronic Correspondence Referral System, Workers Comp Case Control System, Medicare contractors and the Coordination of Benefit Contractor, Common Working File, CMS Regional Offices, an agency of a State government, Medicare beneficiaries and non-Medicare beneficiaries that have an approved or denied WC Medicare Set-aside arrangement to cover future medical costs resulting from an injury incurred while employed and the Social Security Administration.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0538" toc="yes">
        <systemNumber>09-70-0538</systemNumber>
        <subsection type="systemName">
            "Individuals Authorized Access to Centers for Medicare &amp; Medicaid Services (CMS) Computer Services (IACS), HHS/CMS/OIS".
        </subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level 3 Privacy Act Sensitive.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    Centers for Medicare &amp; Medicaid Services Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    Information for this system is collected and maintained on individuals who voluntarily apply for access to the Web-based Application Systems and individuals with an approved need for access to the computer resources and information maintained by CMS.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    Information collected for this system will include, but is not limited to, name, social security number (SSN), date of birth, current Resource Access Control Facility Identification (RACF ID), e-mail address, telephone number, company name, and geographic location.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of the system is given under Executive Order 9397, the Debt Collection Improvement Act, 31 United States Code (U.S.C.) &#167; 7701(c)(1), and 5 U.S.C. 552a(b)(1).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the system has been to collect and maintain individually identifiable information to assign, control, track, and report authorized access to and use of CMS's computerized information and resources, for those individuals who apply for and are granted access across multiple CMS systems and business contexts. Information in this system will also be used to: (1) Support regulatory and policy functions performed within the Agency or by a contractor, consultant, or CMS grantee; and (2) support litigation involving the Agency related to this system.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To support Agency contractors, consultants, or CMS grantee who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
                </p>
                <p>
                    2. To assist the Department of Justice (DOJ), court or adjudicatory body when
                </p>
                <p>
                    a. The Agency or any component thereof; or
                </p>
                <p>
                    b. Any employee of the Agency in his or her official capacity; or
                </p>
                <p>
                    c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or
                </p>
                <p>
                    d. The United States Government;
                </p>
                <p>
                    is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on magnetic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    Information can be retrieved by assigned User ID, user name, and user e-mail address.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.</p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain information for the duration the user needs access to CMS' computer systems or until no longer needed for administrative, legal, audit or other operations services, whichever is longer. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Development &amp; Engineering, Information Services Design &amp; Development Group, Office of Information Services, CMS, Mail Stop N2-15-18, 7500 Security Boulevard, Baltimore, Maryland, 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    Sources of information contained in this records system include data collected from applications submitted by the individuals requiring access to computer services.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0541" toc="yes">
        <systemNumber>09-70-0541</systemNumber>
        <subsection type="systemName">"Medicaid Statistical Information System (MSIS)," HHS/CMS/CMSO.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites and at CMS Regional Offices.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    MSIS contains information on Medicaid beneficiaries, and physicians and other providers involved in furnishing services to Medicaid beneficiaries.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    Information contained in this system includes, but is not limited to: assigned Medicaid identification number, social security number (SSN), health insurance claim number (HICN), date of birth, gender, ethnicity and race, medical services, equipment, and supplies for which Medicaid reimbursement is requested, and materials used to determine amount of benefits allowable under Medicaid. Information on physicians and other providers of services to the beneficiary consist of an assigned provider identification number, and information used to determine whether a sanction or suspension is warranted.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of the system is given under section 1902(a)(6) of the Social Security Act (42 U.S.C. 1396a(a)(6)), and Title IV of the Balanced Budget Act (Public Law 105-33).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of this modified system is to establish an accurate, current, and comprehensive database containing standardized enrollment, eligibility, and paid claims of Medicaid beneficiaries to be used for the administration of Medicaid at the Federal level, produce statistical reports, support Medicaid related research, and assist in the detection of fraud and abuse in the Medicare and Medicaid programs. Information retrieved from this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor or consultant; (2) assist another Federal or state agency with information to enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support a research or evaluation project; (4) support litigation involving the agency; and (5) combat fraud, waste, and abuse.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To support agency contractors, consultants, or grantees who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
                </p>
                <p>
                    2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
                </p>
                <p>
                    a. Contribute to the accuracy of CMS' proper management of Medicare/Medicaid benefits; and/or
                </p>
                <p>
                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
                </p>
                <p>
                    c. Assist Federal/state Medicaid programs within the state.
                </p>
                <p>
                    3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
                </p>
                <p>
                    4. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the agency in his or her official capacity, or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    5. To a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such program.
                </p>
                <p>
                    6. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, and abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such programs.
                </p>
                <p>
                    B. Additional Provisions Affecting Routine Use Disclosures
                </p>
                <p>
                    To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a)(1).)
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored on computer diskette and magnetic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    Information can be retrieved by the assigned beneficiary identification number, SSN, HICN, and the assigned physician or other providers of services identification number.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain identifiable MSIS data for a total period not to exceed 10 years after the final determination of the case is completed. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Informational Analysis and Technical Assistance, Finance, Systems &amp; Budget Group, Center for Medicaid and State Operations, CMS, Mail Stop S3-18-15, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2).)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7.)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    CMS obtains the identifying information contained in this system from state Medicaid agencies, or Medicaid Management Information Systems maintained by the individual states, and information contained on CMS Form 2082.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0542" toc="yes">
        <systemNumber>09-70-0542</systemNumber>
        <subsection type="systemName">"Medicare Learning Network (MLN) Registration and Product Ordering System (REPOS)," HHS/CMS/CMM.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor locations.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    This system will collect and maintain individually identifiable information and other data collected on health care providers, and other individuals ordering provider educational materials who voluntarily register for computer/Web-based training courses, satellite broadcasts and train-the-trainer sessions.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    Information collected will include, but is not limited to, the health care provider's first and last name, mailing address, provider type, facility type, telephone number, fax number and e-mail address. If CMS becomes an accredited provider of continuing education credits, this system may also contain social security number, provider identification number (UPIN/NPI), or tax identification number.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for this collection is given under the provisions of Title IV of the Benefits Improvement Protection Act of 2000 (Public Law (Pub. L.) 106-554, Appendix F), Title IV of the Balanced Budget Act of 1997 (Pub. L. 105-33), and &#167;&#167; 1816(a) and 1842(a)(3) of the Social Security Act.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the system of records is to collect and maintain information on health care providers, and other individuals ordering provider educational materials who voluntarily register for computer/web-based training courses, satellite broadcasts and train-the- trainer sessions. Information in this system will also be used to: (1) support regulatory and policy functions performed within the Agency or by a contractor, consultant, or grantee; and (2) to support litigation involving the Agency related to this system.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To Agency contractors, or consultants, or grantees who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
                </p>
                <p>
                    2. To the Department of Justice (DOJ), court or adjudicatory body when
                </p>
                <p>
                    a. The Agency or any component thereof; or
                </p>
                <p>
                    b. Any employee of the Agency in his or her official capacity; or
                </p>
                <p>
                    c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or
                </p>
                <p>
                    d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>Storage:</p>
                <p>
                    All records are stored on electronic media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    The collected data are retrieved by an individual identifier; e.g., provider name or unique provider identification number.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain information for a total period not to exceed 8 years.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Provider Information Planning and Development, Providers Communications Group, Center for Medicare Management, CMS, Mail Stop C4-10-07, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    The data collected and maintained in this is voluntary submitted and/or is self reported by the health care provider.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0543" toc="yes">
        <systemNumber>09-70-0543</systemNumber>
        <subsection type="systemName">"Cytology Personnel Record System (CYPERS), HHS/CMS/CMSO." </subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>Level 3, Privacy Act Sensitive.</p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    HCFA Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850. CMS contractors and agents at various locations.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    Individual cytotechnologists and physicians participating in CMS approved gynecologic cytology proficiency testing programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    This system will contain each individual's name, Proficiency Testing Registration Number (a unique identifier), Medical Licensure Number, if employed at more than one laboratory: the names, location, and CLIA number of each laboratory; test scores, and in which testing event the individual has participated. CYPERS will also be able to produce user-defined reports on request by Central Office staff only.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Section 353(f)(4)(A) of the Public Health Service Act (42 U.S.C 263a), Section 353(f)(4)(B)(iv), 42 CFR 493.801, 493.803, 493.807, 493.855, 42 CFR 493.901, 493.903, 493.905, and 493.945.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of CYPERS is to assure CMS of the accuracy and reliability of gynecologic cytology testing by compliance with the CLIA statutory requirements. This will be accomplished by tracking and monitoring the enrollment, participation, and performance of individual cytotechnologists and physicians participating in CMS approved gynecologic cytology proficiency testing programs.
                </p>
                <p>
                    Information retrieved from this system of records will be used to support regulatory, reimbursement, and policy functions performed within the agency or by a contractor or consultant; support constituent requests made to a Congressional representative; and support litigation involving the agency.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the CYPERS Registration and Product Ordering System without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. In addition, CMS policy will be to prohibit release even of non-identifiable data, except pursuant to one of the routine uses, if there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary). Be advised, this System of Records contains Protected Health Information as defined by the Department of Health and Human Services' (HHS) regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, 65 FR 8462 as amended by 66 FR 12434). Disclosures of Protected Health Information authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
                </p>
                <p>
                    1. To agency contractors, or consultants that have been contracted by the agency to assist in the performance of a service related to    this system of records and that need to have access to the records in order to perform the activity.
                </p>
                <p>
                    2. To a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional Office made at the written request of the constituent about whom the record is maintained.
                </p>
                <p>
                    3. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the agency in his or her official capacity; or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government; is a party to litigation or has an interest in such litigation, and by careful review, CMS determines    that the records are both relevant and necessary to the litigation.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>Storage:</p>
                <p>
                    All records are stored on the magnetic disk sub-system of the Windows 2000 server.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    The CYPERS records are retrieved by individual's name, Proficiency Testing Registration Number unique identifier, Medical    Licensure Number, test scores, or which testing event the individual has participated. CYPERS will also be able to produce user-defined    reports on request by Central Office staff only.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use.
                </p>
<p>    Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p><p>
        This system will conform to all applicable Federal laws and regulations and Federal, DHHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger- Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management Of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies.
    </p><p>
        Federal, DHHS, and CMS policies and standards include but are not limited to: all pertinent NIST publications; the DHHS Automated Information Systems Security Handbook and the CMS Information Security Handbook.
    </p>
</xhtmlContent>
</subsection>
    <subsection type="retentionAndDisposal">
        <xhtmlContent>
            <p>
                CMS will retain identifiable CYPERS data for a total period of 10 years.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="systemManager">
        <xhtmlContent>
            <p>
                Director, Finance, Systems and Budget Group, Center for Medicaid and State Operations, Centers for Medicare and Medicaid Services, 7500 Security Boulevard, Room S3-18-11, Baltimore, Maryland 21244-1850, Telephone Number: (410) 786-5401.
            </p>
            <p>
                Director, Survey and Certification Group, Center for Medicaid and State Operations, Centers for Medicare and Medicaid Services, 7500 Security Boulevard, Room S2-12-25, Baltimore, Maryland 21244-1850, Telephone Number: (410) 786-9493.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="notificationProcedure">
        <xhtmlContent>
            <p>
                For purpose of access, the subject individual should write to the system manager, who will require the system name, the subject individual's name (woman's maiden name, if applicable), address, date of correspondence and control number.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="recordAccessProcedures">
        <xhtmlContent>
            <p>
                For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2).)
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="contestingRecordProcedures">
        <xhtmlContent>
            <p>
                The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="recordSourceCategories">
        <xhtmlContent>
            <p>
                CMS will receive CYPERS data periodically from CMS-approved cytology proficiency testing programs only. This System of Records protects the data transmitted by CMS-approved cytology proficiency testing programs at all stages of collection, manipulation, transmissions, storage, and maintenance, at the PT program and at CMS.
            </p>
        </xhtmlContent>
    </subsection>
    <subsection type="systemsExempted">
        <xhtmlContent>
            <p>
                None.
            </p>
        </xhtmlContent>
    </subsection>
</section>
    <section id="09-70-0544" toc="yes">
        <systemNumber>09-70-0544</systemNumber>
        <subsection type="systemName">Health Insurance Portability and Accountability Act (HIPAA) Information Tracking System (HITS), HHS/CMS/OESS. </subsection>
        <subsection type="securityClassification">
            <xhtmlContent><p>
                Level Three Privacy Act Sensitive Data.
            </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    Atlantic Telephone &amp; Telegraph Company, Ashburn, Virginia facility under the control of the Center for Medicare &amp; Medicaid Services.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    Individuals who have filed complaints alleging violations of the Transactions and Code Sets, Security, and Unique Identifier provisions under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, 68 FR 60694 (October 23, 2003). These regulations are codified at 45 CFR, parts 160, 162 and 164.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    HITS will maintain a file of complaint allegations, information gathered during the complaint investigation, findings, and results of the investigation, and correspondence relating to the investigation. The collected information will contain name, address, telephone number, health insurance claim (HIC) number, geographic location, as well as, background information relating to Medicare or Medicaid issues.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of this system is given under provisions of the Health Insurance Portability and Accountability Act of 1996, (Pub. L. 104-191), published at 68 FR 60694 (October 23, 2003). These regulations are codified at 45 Code of Federal Regulation, parts 160, 162, and 164.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The purpose of this system is to store the results of all OESS regional investigations, to determine if there were violations as charged in the original complaint, to investigate complaints that appear to be in violation of the Transactions and Code Sets, Security, and Unique Identifier provisions of HIPAA, to refer violations to law enforcement activities as necessary, and to maintain and retrieve records of the results of the complaint investigations. Information retrieved from this SOR will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency, HIPAA entities, or by a contractor or consultant; (2) assist another Federal or state agency in the enforcement of HIPAA regulations where sharing the information is necessary to complete the processing of a complaint, contribute to the accuracy of CMS's proper payment of Medicare benefits, and/or enable such agency to administer a Federal health benefits program; (3) support constituent requests made to a congressional representative; (4) support litigation involving the agency; and (5) combat fraud and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." We are proposing to establish the following routine use disclosures of information maintained in the system. Information will be disclosed:
                </p>
                <p>
                    1. To agency contractors or consultants who have been engaged by the agency to assist in the performance of a service related to this system of records and who need to have access to the records in order to perform the activity.
                </p>
                <p>
                    2. To another Federal or state agency to:
                </p>
                <p>
                    a. Assist in the enforcement of HIPAA regulations for violations of Transactions and Code Sets, Security, and Unique Identifiers where sharing the information is necessary to complete the processing of a complaint,
                </p>
                <p>
                    b. Contribute to the accuracy of CMS's proper payment of Medicare benefits, and/or
                </p>
                <p>
                    c. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds.
                </p>
                <p>
                    3. To a member of congress or to a congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.
                </p>
                <p>
                    4. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b.Any employee of the agency in hisor h4r official capacity, or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    5. To a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
                </p>
                <p>
                    6. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                </p>
                <p>
                    B. Additional Provisions Affecting Routine Use Disclosures This system contains Protected Health Information as defines by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, 65 FR 82462 (12-28-00), Subparts A and E). Disclosures of Protected Health Information authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of not directly identifiable information, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the complaint population is so small that individuals who are familiar with the complainants could, because of the small size, use this information to deduce the identity of the complainant).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored electronically.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    The complaint data are retrieved by an individual identifier i.e., name of complainant.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implements appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002; the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent NIST publications; the DHHS Information Security Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain complaint information for a total period not to exceed 25 years.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Office of E-Health Standards and Services, CMS, Room S2-26-17, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    Exempt. However, portions of this system notice are non-exempt and consideration will be given to requests addressed to the system manager for those portions. For general inquiries, it would be helpful if the request included the system name, address, age, sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable) and complaint tracking ID number.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    Same as notification procedures. Requestors should also specify the record contents being sought.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    OESS investigative files maintained in HITS are either received as electronic documents or paper records that are compiled for law enforcement purposes. In the course of investigations, OESS often has a need to obtain confidential information involving individuals other than the complainant.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    HHS claims exemption of certain records (case files on active fraud investigations) in the system from notification and access procedures under 5 U.S.C. 552a(k)(2) inasmuch as these records are investigatory materials compiled for program (law) enforcement in anticipation of a criminal or administrative proceedings. (See Department Regulation (45 CFR 5b.11))
                </p></xhtmlContent>
</subsection>

</section>
    <section id="09-70-0546" toc="yes">
        <systemNumber>09-70-0546</systemNumber>
        <subsection type="systemName">Federal Reimbursement of Emergency Health Services Furnished to Undocumented Aliens (Section 1011) HHS/CMS/CMM.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level 3, Privacy Act Sensitive.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and CMS contractors and agents at various locations.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    The Section 1011 program will include information on individuals who have elected to participate in the Section 1011 program, claims information related to Section 1011 payment requests, and information needed to pay claims and administer the Section 1011 program.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The Section 1011 program includes the provider name and identification number, provider address, provider employer identification number, provider banking information, provider Federal tax identification number, patient's control number, medical record number, date of service, patient's gender, zip code, state and county, the principle diagnosis code, admitting diagnosis code, and total charges. It also includes claims information related to Section 1011 payment requests, and other research information needed to pay claims and administer the Section 1011 program.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    The authority to conduct the program is given under the provisions of Section 1011 of the Medicare Prescription Drug, Improvement and Modernization Act of 2003 (Pub. L. 108-173).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the system is to maintain information collected on individuals who submit an enrollment application and make payment requests associated with Section 1011 of the MMA, and other information designed to support the enrollment, claims payment, and research reporting functions of the Section 1011 program. Information retrieved from this system will also be disclosed to: (1) Support regulatory, payment activities, and policy functions performed within the agency or by a designated contractor or consultant; (2) combat fraud and abuse in certain health benefits programs; (3) assist another Federal or state agency with information to enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal; (4) funds support constituent requests made to a Congressional representative; and, (5) support litigation involving the agency.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    A. Entities Who May Receive Disclosures Under Routine Use
                </p>
                <p>
                    These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the Section 1011 program without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We are proposing to establish the following routine use disclosures of information maintained in the system:
                </p>
                <p>
                    1. To agency contractors or consultants who have been contracted by the agency to assist in the performance of a service related to this system and who need to have access to the records in order to perform the activity.
                </p>
                <p>
                    2. To a CMS contractor that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS- administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
                </p>
                <p>
                    3. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                </p>
                <p>
                    4. To another Federal or State agency to:
                </p>
                <p>
                    a. Contribute to the accuracy of CMS' proper payment of a health benefit, or
                </p>
                <p>
                    b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds.
                </p>
                <p>
                    5. To a Member of Congress or to a congressional staff member in response to an inquiry of the Congressional Office made at the written request of the constituent about whom the record is maintained.
                </p>
                <p>
                    6. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the agency in his or her official capacity; or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government;
                </p>
                <p>
                    Is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation.
                </p>
                <p>
                    B. Additional Provisions Affecting Routine Use Disclosures
                </p>
                <p>
                    This system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, 65 FR 82462 (12-28-00), Subparts A and E. Disclosures of PHI authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All claim records are stored on magnetic media. Patient eligibility information may be maintained electronically or in paper format.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    Providers will retrieve medical records by the patient control number. Provider IDs and patient control numbers are used to facilitate inquiries into specific claims as needed.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent NIST publications; the HHS Automated Information Systems Security Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain identifiable Section 1011 data for an indefinite period. Data residing with the designated claims payment contractor shall be returned to CMS at the end of the fifth program year, with all data then being the responsibility of CMS for adequate storage and security.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Section 1011 Project Officer, Center for Medicare Management, CMS, 7500 Security Boulevard, Mail Stop C4-10-07, Baltimore, Maryland, 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the system manager who will require the system name, and for verification purposes, the subject individual's name and provider identification number and the patient's medical record number.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    Information maintained in this system will be collected from individuals volunteering to participate in Section 1011 program through the enrollment application and claims data requesting payment for services.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
    <section id="09-70-0547" toc="yes">
        <systemNumber>09-70-0547</systemNumber>
        <subsection type="systemName">Data Collection Secondary to Coverage Decision (DCSCD) System, HHS/CMS/OCSQ.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Level Three Privacy Act Sensitive Data.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co-locations of CMS contractors.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    Individuals where CMS has determined that the evidence is adequate to conclude that certain identified diagnoses are reasonable and necessary in several patient groups where certain criteria for these patients have been met and the criteria are consistent with the trials reviewed.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The data collection should include baseline patient characteristics. The collected information will contain, but is not limited to, name, address, telephone number, health insurance claim (HIC) number, geographic location, race/ethnicity, gender, and date of birth, as well as, background information relating to Medicare or Medicaid issues.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    The statutory authority for linking coverage decisions to the collection of additional data is derived from Sec. 1862(a)(1)(A) of the Social Security Act (the Act), which states that Medicare may not provide payment for items and services unless they are "reasonable and necessary" for the treatment of illness or injury. In some cases, CMS will determine that an item or service is only reasonable and necessary when specific data collections accompany the provision of the service. In these cases, the collection of data is required to ensure that the care provided to individual patients will improve health outcomes.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The purpose of this system is to collect and maintain data on patients to review determinations of "reasonable and necessary" with respect to whether or not a particular item or service is covered nationally under title XVIII of the Act Section 1869(f)(1)(B). Information retrieved from this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor or consultant; (2) assist another Federal or state agency with information to enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) to an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; (4) support constituent requests made to a congressional representative; (5) support litigation involving the agency; and (6) combat fraud and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." We are proposing to establish the following routine use disclosures of information maintained in the system. Information will be disclosed:
                </p>
                <p>
                    1. To agency contractors or consultants who have been engaged by the agency to assist in the performance of a service related to this system of records and who need to have access to the records in order to perform the activity.
                </p>
                <p>
                    2. To another Federal or state agency to:
                </p>
                <p>
                    a. Assist in the review determinations of "reasonable and necessary" with re spect to whether or not a particular item or service is covered nationally under title XVIII of the Act Section 1869(f)(1)(B).
                </p>
                <p>
                    b. Contribute to the accuracy of CMS's proper payment of Medicare benefits, and/or
                </p>
                <p>
                    c. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds.
                </p>
                <p>
                    3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
                </p>
                <p>
                    4. To a member of Congress or to a congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.
                </p>
                <p>
                    5. To the Department of Justice (DOJ), court or adjudicatory body when:
                </p>
                <p>
                    a. The agency or any component thereof, or
                </p>
                <p>
                    b. Any employee of the agency in his or her official capacity, or
                </p>
                <p>
                    c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                </p>
                <p>
                    d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                </p>
                <p>
                    6. To a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
                </p>
                <p>
                    7. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
                </p>
                <p> Additional Provisions Affecting Routine Use Disclosures: </p>
                <p>
                    This system contains Protected Health Information (PHI) as defined by Department of Health and Human Services (HHS) regulation "Standards for Privacy of Individually Identifiable Health Information" (45 Code of Federal Regulations (CFR) parts 160 and 164, 65 FR 82462 (12-28-00), subparts A and E). Disclosures of PHI authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
                </p>
                <p>
                    In addition, our policy will be to prohibit release even of not directly identifiable information, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the complaint population is so small that individuals who are familiar with the complainants could, because of the small size, use this information to deduce the identity of the complainant).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>
                    All records are stored electronically.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    The data is retrieved by an individual identifier i.e., name of beneficiary.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implements appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                </p>
                <p>
                    This system will conform to all applicable Federal laws and regulations and Federal, HHS; and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002; the Clinger-Cohen Act of 1996; the Medicare Prescription Drug Improvement, Modernization Act (MMA) of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    CMS will retain information for a total period of 10 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from the Department of Justice.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Office of Clinical Standards and Quality, CMS, Room S2-26-17, 7500 Security Boulevard, Baltimore, Maryland 21244 -1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For the purpose of access, the subject individual should write to the system manager who will require the system name, address, age, gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For the purpose of access, use the same procedures outlines in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above and reasonable identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    Records maintained in this system are derived from Carrier and Fiscal Intermediary Systems of Records, Common Working File System of Records, clinics, institutions, hospitals and group practices performing the procedures, and outside registries and professional interest groups.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
        <section id="09-70-0550" toc="yes">
<systemNumber>09-70-0550</systemNumber>
<subsection type="systemName">Medicare Retiree Drug Subsidy Program (RDSP), HHS/CMS/CBC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Group Health Incorporated, 441 Ninth Avenue, New York, NY 10001-1681, and Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information in this system is maintained on qualifying covered retirees who are Medicare Part D eligible individuals covered under a qualified retiree prescription drug plan.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Information maintained in this system include, but are not limited to, standard data for identification such as Plan Sponsor Identification Number, Application Identification Number, Benefit Option Identifier, Coverage Effective Date, Coverage Termination Date, Health Insurance Claim Number (HICN), Social Security Number (SSN), gender, first name, last name, middle initial, date of birth, relationship to member and Medicare eligibility and enrollment status.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for maintenance of this system is given under section 1860D-22 of the Act (Title 42 United States Code (U.S.C.) 1302, 1395w-101 through 1395w-152, and 1395hh.) These provisions of the Act are amended by section 101 of the MMA and its implementing regulations codified at Title 42 Code of Federal Regulations (CFR) Part 423, Subpart R.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain information on individuals who are qualifying covered retirees so that accurate and timely subsidy payments may be made to plan sponsors who continue to offer actuarially equivalent prescription drug coverage to the qualifying covered retirees. Information retrieved from this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency, or by a contractor or consultant; (2) support constituent requests made to a congressional representative; (3) support litigation involving the agency; and (4) combat fraud and abuse in certain health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." We are proposing to establish the following routine use disclosures of information maintained in the system. Information will be disclosed:
</p><p>1. To agency contractors or consultants who have been engaged by the agency to assist in the performance of a service related to this system and who need to have access to the records in order to perform the activity.
</p> <p>2. To a member of congress or to a congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>3. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>4. To a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
</p> <p>5. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures. This system contains Protected Health Information as defined by Department of Health and Human Services (HHS) regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, 65 Fed. Reg. 82462 (12-28-00), Subparts A and E). Disclosures of Protected Health Information authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
</p><p>In addition, our policy will be to prohibit release even of not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the complaint population is so small that individuals who are familiar with the complainants could, because of the small size, use this information to deduce the identity of the complainant).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored electronically.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information is retrievable by Plan Sponsor identification number, Benefit Option Identifier, and Health Insurance Claim Number or Social Security Number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implements appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002; the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained in the active files for a period of 15 years. The records are then retired to archival files maintained at the Health Care Data Center. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from the Department of Justice.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Employer Policy &amp; Operations Group, CMS, Room C1-22-06, 7500 Security Boulevard, Baltimore, Maryland 21244 -1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For the purpose of access, use the same procedures outlines in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Records maintained in this system will be derived from Medicare Beneficiary Database system of records and from medical plans and plan sponsors.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
        <section id="09-70-0552" toc="yes">
            <systemNumber>09-70-0552</systemNumber>
            <subsection type="systemName">
                Medicare Premium Withhold System (PWS) HHS/CMS/OIS.
            </subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        Level Three Privacy Act Sensitive.
                    </p>
                </xhtmlContent>
            </subsection>
     
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    The system will include information on recipients of Medicare hospital insurance (Part A) and Medicare medical insurance (Part B) and recipients of the Prescription Drug Benefits Program (Part D) enrolled in the Medicare Advantage (MA) Program.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    The system will also include information about a beneficiary's entitlement to Medicare benefits and enrollment in Medicare Programs, prescription drug coverage and supplementary medical claims information. The system will contain identifying information such as beneficiary name, health insurance claim number, social security number, and other demographic information.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    Authority for maintenance of the system is given under section 101 of the MMA (Pub. L. 108-173) amended the Title XVIII of the Social Security Act. Authority for maintenance of the system is also given under the provisions of sections 1833(a) (1) (A), 1860, 1866, and 1876 of Title XVIII of the Act (42 CFR parts 417 and 422).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    The primary purpose of the SOR is to process a monthly premium withhold file from SSA and RRB, capture expected premium withholding amounts from MARx and compare them to actual withholding amounts, produce a reconciliation of the reported withholding amounts with amounts transferred via Governmental Payment and Collection (IPAC) files from SSA and RRB, and generate plan payment requests to APPS. Information in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed by a contractor or consultant contracted by the Agency; (2) support Medicare Prescription Drug Plans (PDP) and Medicare Advantage Prescription Drug Plans (MAPD) directly or through a CMS contractor for the administration of Title XVIII of the Act; (3) support another Federal or State agency, agency of a state government, an agency established by state law, or its fiscal agent; (4) support constituent requests made to a congressional representative; (5) support litigation involving the Agency, and (6) combat fraud and abuse in certain health benefits programs.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    Computer diskette and on magnetic storage media.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    Records are maintained with identifiers for all transactions after they are entered into the system for a period of 6 years and 3 months. Records are housed in both active and archival files. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from the Department of Justice.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    Director, Division of Medicare Advantage Appeals and Payment Systems, Information Services Modernization Group, Office of Information Services, CMS, Room N3-16-24, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    For purpose of access, the subject individual should write to the systems manager who will require the system name, SSN, address, date of birth, sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2)).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    Data for this system is collected from the Medicare Advantage Prescription Drug System (MARx) system, the Medicare Beneficiary Database (MBD), as well as two external providers of monthly retirement annuities, SSA, and RRB, with potentially OPM as the third external partner in a future release of the PWS.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemsExempted">
            <xhtmlContent>
                <p>
                    None.
                </p>
            </xhtmlContent>
        </subsection>
    </section>
        <section id="09-70-0553" toc="yes">
            <systemNumber>09-70-0553</systemNumber>
            <subsection type="systemName">Medicare Drug Data Processing System (DDPS), HHS/CMS/CBC.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        Level Three Privacy Act Sensitive.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>
                        This system collects and maintains individually identifiable information on all people with Medicare who have enrolled into a Medicare Part D plan and individually identifiable data on prescribing health care professional, referring/servicing physician, and providers.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        The data includes, but is not limited to, summary prescription drug claim data and individually identifiable beneficiary information such as: Beneficiary name, address, city, state, ZIP code, card holder identification number, date of service, gender, demographic, other identifying data, and optionally, the patient's date of birth. Identifying information of prescribing health care professional and providers of services and referring/servicing physician include provider/physician name, title, address, city, state, ZIP code, e-mail address, telephone numbers, fax number, state licensure number, Social Security Numbers, Federal tax identification numbers, prescriber identification number, assigned provider number (facility, referring/servicing physician), Drug Enforcement Agency (DEA) assigned identification number, and numerous other data elements related to the processing of the prescription drug claim.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>
                        This system is mandated under provisions of the Medicare Prescription Drug, Improvement, and Modernization Act, amending the Social Security Act by adding Part D under Title XVIII (&#167;&#167; 1860D-15(c)(1)(C) and (d)(2)), as described in Title 42, Code of Federal Regulations (CFR) 423.301 <i>et seq.</i> as well as1860D-12(b)(3)(D) and 1106 of the Act, as described in 42 CFR 423.505(b)(8), (f), (l), and (m).
                   </p></xhtmlContent>
        </subsection>
            <subsection type="purpose">
    <xhtmlContent>
            <p>
                                The primary purpose of this system is to collect, maintain, and process information on all Medicare covered, and as many non-covered drug events as possible, for people with Medicare who have enrolled into a Medicare Part D plan. The system will help CMS determine appropriate payment of covered drugs. It will also provide for processing, storing, and maintaining drug transaction data in a large-scale database, while putting data into data marts to support payment analysis. CMS would allow the expanded release of information in this system to: (1) Support regulatory, analysis, oversight, reimbursement, operational and policy functions performed within the agency or by a contractor, consultant, or a CMS grantee; (2) help another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) assist Medicare Part D sponsors; (4) support an individual or organization with projects that provide transparency in health care on a broad-scale enabling consumers to compare the quality and price of health care services or for a research, evaluation, or epidemiological or other project related to protecting the public's health, the prevention of disease or disability, the restoration or maintenance of health, or for payment related purposes; (5) assist Quality Improvement Organizations; (6) support lawsuits involving the agency; and (7) combat fraud, waste, and abuse in certain Federally funded health benefits programs.
                            </p>
                        </xhtmlContent>
        </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>A. Entities Who May Receive Disclosures Under Routine Use: </p>
                    <p>
                        These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may use and disclose information from the DDPS without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish or modify the following routine use disclosures of information maintained in the system:
                    </p>
                    <p>
                        1. To support Agency contractors, consultants, or CMS grantees who have been engaged by the Agency to assist in accomplishment of a CMS function relating to the purposes for this SOR and who need to have access to the records in order to assist CMS.
                    </p> 
                    <p>
                        2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent pursuant to agreements with CMS to:
                    </p>
                    <p>
                        a. Contribute to the accuracy of CMS's payment of Medicare benefits;
                    </p>
                    <p>
                        b. Administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
                    </p>
                    <p>
                        c. Access data required for Federal/state Medicaid programs.
                    </p> 
                    <p>
                        3. To support Part D Prescription Drug sponsors, pharmacy benefit managers, claims processors, and other Prescription Drug Event submitters, in protecting their own members (and former members for the periods enrolled in a given plan) against medical expenses of their enrollees without the beneficiary's authorization, and having knowledge of the occurrence of any event affecting (a) an individual's right to any such benefit or payment, or (b) the initial right to any such benefit or payment, for the purpose of coordination of benefits with the Medicare program and implementation of the Medicare Secondary Payer provision at 42 U.S.C. 1395y(b). Information to be disclosed shall be limited to Medicare utilization data necessary to perform that specific function. In order to receive the information, they must agree to:
                    </p>
                    <p>
                        a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a Third Party Administrator;
                    </p>
                    <p>
                        b. Utilize the information solely for the purpose of processing the individual's insurance claims; and
                    </p>
                    <p>
                        c. Safeguard the confidentiality of the data and prevent unauthorized access.
                    </p> 
                    <p>
                        4. To assist an individual or organization with research, an evaluation, or an epidemiological or other project related to protecting the public's health, the prevention of disease or disability, restoration or maintenance of health, or for payment related purposes. This includes projects that provide transparency in health care on a broad-scale enabling consumers to compare the quality and price of health care services. CMS must:
                    </p>
                    <p>
                        a. Determine if the use or disclosure of data violate legal limitations under which the record was provided, collected, or obtained;
                    </p>
                    <p>
                        b. Determine that the purpose for the use or disclosure of information:
                    </p>
                    <p>
                        (1) Cannot be reasonably accomplished unless the record is provided in individually identifiable form;
                    </p>
                    <p>
                        (2) Is of sufficient importance to warrant the effect or risk on the privacy of the individual; and
                    </p>
                    <p>
                        (3) Meets the objectives of the project;
                    </p>
                    <p>
                        c. Requires the recipient of the information to:
                    </p>
                    <p>
                        (1) Establish reasonable administrative, technical, and physical protections to prevent unauthorized use or disclosure of information;
                    </p>
                    <p>
                        (2) Remove or destroy the information that allows the individual to be identified at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the project, unless the recipient presents an adequate justification for retaining such information; and
                    </p>
                    <p>
                        (3) No longer use or disclose information except:
                    </p>
                    <p>
                        (a) In emergency circumstances affecting the health or safety of any individual;
                    </p>
                    <p>
                        (b) For use in another research project, under these same conditions and with written CMS approval;
                    </p>
                    <p>
                        (c) For an audit related to the research;
                    </p>
                    <p>
                        (d) For disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit; or
                    </p>
                    <p>
                        (e) When required by Federal law.
                    </p> 
                    <p>
                        d. Get signed, written statements from the entity receiving the information that they understand and will follow all provisions in this notice.
                    </p> 
                    <p>
                        e. Complete and submit a Data Use Agreement (CMS Form 0235) in accordance with current CMS policies.
                    </p> 
                    <p>
                        5. To support Quality Improvement Organization (QIO) with claims review process or with studies or other review activities performed in accordance with Part B of Title XI of the Social Security Act. QIOs can also use the data for outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                    </p> 
                    <p>
                        6. To assist the Department of Justice (DOJ), court, or adjudicatory body when there is a lawsuit in which the Agency, any employee of the Agency in his or her official capacity or individuals capacity (if the DOJ agrees to represent the employee), or the United States Government is a part of CMS' policies or operations could be affected by the outcome. The information must be both relevant and necessary to the lawsuit, and the use of records is for a purpose that is compatible with the purpose for which CMS collected records.
                    </p> 
                    <p>
                        7. To support a CMS contractor that assists in the administration of a CMS health benefits program, or a grantee of a CMS-administered grant program, if the information is necessary, in any capacity, to combat fraud, waste, or abuse in such program. CMS will only provide this information if CMS can enter into a contract or grant for this purpose.
                    </p> 
                    <p>
                        8. To support another Federal agency or any United States government jurisdiction (including any state, or local governmental agency), if the information is necessary, in any capacity to combat fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds.
                    </p>
                    <p > B. Additional Circumstances Affecting Routine Use Disclosures: </p>
                    <p>
                        To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00) release of information that are otherwise allowed by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512 (a)(1).)
                    </p>
                    <p>
                        In addition, CMS will not give out information that is not directly identifiable if there is a possibility that a person with Medicare could be identified because the sample is small enough to identify participants. CMS would make exceptions if the information is needed for one of the routine uses or if it's required by law.
                    </p> 
                    <p>
                        9. To assist a public or private entity that is qualified (as determined by the Secretary of the Department of Health and Human Services (the Secretary)) to use Medicare claims data to evaluate the performance of providers of services and suppliers on measures of quality, efficiency, effectiveness, and resource use; and who agrees to meet the requirements regarding the transparency of their methods and their use and protection of Medicare data as the Secretary may specify, if CMS:
                    </p>
                    <p>
                        a. Determines that the use or disclosure does not violate legal limitations under which the record was provided, collected, or obtained; and
                    </p>
                    <p>
                        b. Secures a written statement attesting to the information recipient's understanding of and willingness to abide by these provisions. Every Qualified Entity receiving data must have an agreement with CMS in the form of an Information Exchange Agreement or contract with all security and privacy requirements included. A Data Use Agreement (DUA) (CMS Form 0235) must be completed by the person receiving CMS data in accordance with current CMS policies.
                    </p> 
                    <p>
                        This routine use fulfills the requirement in section 1174(e) of the Social Security Act (42 U.S.C. 1395kk (e)) to make standardized extracts of claims data under Medicare Parts A, B, and D available to a Qualified Entity (QE), recognized by the Secretary to make evaluations of provider/supplier performance in accordance with that section, and that agrees to meet specific requirements regarding the transparency of their methods and their use and protection of Medicare data. The IDR, National Claims History (NCH), CCDR, and Part D data will provide QEs, a broader, longitudinal, national perspective of the performance of Medicare providers/suppliers for use in authorized QE projects that could ultimately improve the care provided to Medicare beneficiaries and the policy that governs the care.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p> 
                    <p>
                        Records are stored on both tape cartridges (magnetic storage media) and in a DB2 relational database management environment (DASD data storage media).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        Information is most frequently retrieved by HICN, provider number (facility, physician, IDs), service dates, and beneficiary state code.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        CMS has protections in place for authorized users to make sure they are properly using the data and there is no unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system cannot use or disclose data until the recipient agrees to implement appropriate management, operational and technical safeguards that will protect the confidentiality, integrity, and availability of the information and information systems.
                    </p> 
                    <p>
                        This system would follow all applicable Federal laws and regulations, and Federal, HHS, and CMS security and data privacy policies and standards. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002 (when applicable); the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E- Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to all pertinent National Institute of Standards and Technology publications, the HHS Information Systems Program Handbook, and the CMS Information Security Handbook.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        Records are maintained with identifiers for all transactions after they are entered into the system for a period of 20 years. Records are housed in both active and archival files. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from the Department of Justice.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        Director, Centers for Beneficiary Choices, CMS, Mail stop C5-19-07, 7500 Security Boulevard, Baltimore, Maryland 21244 -1850.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        For purpose of notification, the subject individual should write to the system manager who will require the system name, and the retrieval selection criteria (e.g., HICN, facility/pharmacy number, service dates, etc.).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>
                        For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a)(2).)
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>
                        The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        Summary prescription drug claim information contained in this system is obtained from the Part D Sponsor daily and monthly drug event transaction reports, Medicare Beneficiary Database (09-70-0530), and other payer information to be provided by the TROOP Facilitator.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemsExempted">
                <xhtmlContent><p>None.</p></xhtmlContent>
                </subsection>
        </section>
<section id="09-70-055" toc="yes">
<systemNumber>09-70-0555</systemNumber>
<subsection type="systemName">National Plan and Provider Enumeration System" (NPPES), HHS/CMS/OFM.</subsection>
<subsection type="systemLocation"><xhtmlContent><p>The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>For purposes of this SOR, the system contains information related to health care providers who are individuals who have applied for and have been assigned a NPI. The definition of a health care provider is limited to those entities that furnish or bill and are paid for, health care services in the normal course of business. The statutory definition of a health care provider is found at 45 CFR 160.103.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system contains name(s), demographic information, (gender, date of birth), provider taxonomy information, address data, contact information, practice location information, and certain optional information such as social security numbers and provider identifiers assigned to these health care providers by health plans.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for maintenance of this system is given under &#167;&#167; 1173 and 1175 of the Act; as amended by Public Law 104 -191, authorize the assignment of a unique identifier to all health care providers and the maintenance of a data base on containing the information they furnished in their application for an NPI.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of the NPPES is to collect and maintain, on behalf of the Secretary, information needed to uniquely identify an individual physician or non-physician practitioner, assign a National Provider Identifier (NPI) to that physician or non-physician practitioner, and maintain and update the information in that health care provider's record in NPPES. Information maintained in this system will also be disclosed to: (1) Support the NPI Enumerator and other agency contractors who need NPPES data to perform their contractual requirements; (2) to assist Federal and State agencies to identify health care providers for debt collection under Federal statutes; (3) to assist the Department of Justice in litigation; (4) to support CMS contractors in combating fraud, waste, and abuse in CMS-administered health benefits programs; (5) to support other Federal agencies or States in combating fraud, waste, and abuse in federally-funded programs; and (6) to assist Federal agencies in responding to security breaches of information contained in NPPES.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To support Agency contractors (such as the NPI Enumerator contractor), consultants, or grantees that have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need access to the records in order to assist CMS.
</p> <p>2. To assist another Federal or State agency, agency of a State government, agency established by State law, or its fiscal agent to identify health care providers for debt collection under the provisions of the Debt Collection Information Act of 1996 and the Balanced Budget Act of 1997.
</p> <p>3. To assist the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The Agency or any component thereof, or
</p><p>b. Any employee of the Agency in his or her official capacity, or
</p><p>c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>4. To support a CMS contractor that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS- administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>5. To support another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in a program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>6. To assist appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and unnecessary for the assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on paper and magnetic disk.</p>
</xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Magnetic media records are retrieved by the name of the health care provider or the NPI. Paper records are retrieved alphabetically by name of health care provider or the NPI.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements to maintain the confidentiality of protected information.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain identifiable data indefinitely in accordance with 69 FR 3434.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Provider/Supplier Enrollment, Office of Financial Management, CMS, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access by a subject individual, the subject individual may access to view or update his or her own record in NPPES by using his or her NPPES User ID and password or the subject individual should write to the system manager who will require the system name, the subject individual's SSN, and, for verification purposes, the subject individual's name (woman's maiden name, if applicable). NPPES data that are publicly available may be found in the NPI Registry at <i>https://nppes.cms.gov/NPPES/NPIRegistryHome.do</i> and in the downloadable monthly NPPES File at <i>http://nppesdata.cms.gov/CMS_NPI_files.html.</i> </p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, the same procedures outlined in Notification Procedures above are applicable to subject individuals. Other requestors must write to the system manager and specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a)(2).)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information contained in this system is received from the Form(s) CMS-10114, "National Provider Identifier Application/Update Form."
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-70-0557" toc="yes">
<systemNumber>09-70-0557</systemNumber>
<subsection type="systemName">True Out-of-Pocket (TrOOP) Expenditures System, HHS/CMS/OIS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co- locations of CMS contractors.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system will maintain individually identifiable information on individuals and entities that make payments on covered drugs under the Medicare Part D Program.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will contain name, address, telephone number, health insurance claim number (HICN), gender type, and date of birth.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for this system is given under Part D of Title XVIII of the Social Security Act, as amended by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain a master file to establish a "TrOOP" facilitation process, maintain information on individuals and entities that make payments on covered drugs under the Medicare Part D Program, and coordinate TrOOP relevant data from State Pharmaceutical Programs (SPAPs) and other health insurers. Information retrieved from this system may be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, grantee, consultant or other legal agent; (2) support Medicare Prescription Drug Plans (PDP) and Medicare Advantage Prescription Drug Plans (MAPD) directly or through a CMS contractor for the administration of Title XVIII of the Act; (3) assist another Federal or state agency with information to enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (4) assist Quality Improvement Organization (QIO) in connection with review of claims; (5) assist insurance companies and other groups providing protection against medical expenses of their enrollees; (6) assist an individual or organization engaged in the performance activities of the demonstration or in a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; (7) support constituent requests made to a congressional representative; (8) support litigation involving the agency; and (9) combat fraud and abuse in certain health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>C. Entities Who May Receive Disclosures Under Routine Use
</p><p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the TrOOP facilitator without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish or modify the following routine use disclosures of information maintained in the system:
</p><p>To Agency contractors or consultants who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this SOR and who need to have access to the records in order to assist CMS.
</p> <p>1. To Medicare Prescription Drug Plans (PDP) and Medicare Advantage Prescription Drug Plans (MAPD) directly or through the Enterprise Business Services, a CMS intermediary for the administration of Title XVIII of the Act.
</p> <p>2. To another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent pursuant to agreements with CMS to:
</p><p>d. Contribute to the accuracy of CMS's proper payment of Medicare benefits;
</p><p>e. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>f. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To Quality Improvement Organization (QIO) in connection with review of claims, or in connection with studies or other review activities conducted pursuant to Part D of Title XVIII of the Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare Prescription Drug Program benefits or other drug plan benefits.
</p> <p>4. To insurance companies, underwriters, third party administrators (TPA), employers, self-insurers, group health plans, health maintenance organizations (HMO), health and welfare benefit funds, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, other groups providing protection against medical expenses of their enrollees without the beneficiary's authorization, and any entity having knowledge of the occurrence of any event affecting: (a) An individual's right to any such benefit or payment, or (b) the initial right to any such benefit or payment, for the purpose of coordination of benefits with the Medicare program and implementation of the Medicare Secondary Payer (MSP) provision at 42 U.S.C. 1395y (b). Information to be disclosed shall be limited to Medicare utilization data necessary to perform that specific function. In order to receive the information, they must agree to:
</p><p>b. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a TPA;
</p><p>c. Utilize the information solely for the purpose of processing the individual's insurance claims; and
</p><p>d. Safeguard the confidentiality of the data and prevent unauthorized access.
</p> <p>5. To an individual or organization for research, evaluation, or epidemiological projects related to the prevention of disease or disability, and the restoration or maintenance of health, or payment related projects.
</p> <p>6. To a Member of Congress or congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>7. To the Department of Justice (DOJ), court, or adjudicatory body when:
</p><p>d. The Agency or any component thereof, or
</p><p>e. Any employee of the Agency in his or her official capacity, or
</p><p>f. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>g. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>8. To a CMS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS- administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
</p> <p>9. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p> <p>D. Additional Circumstances Affecting Routine Use Disclosures
</p><p>This system contains Protected Health Information as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E, 65 FR 82462 (12-28-00). Disclosures of Protected Health Information authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
</p><p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored electronically. Some input may be generated in hardcopy, such as eligibility, enrollment, or other health insurance information before transcription to electronic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The collected data are retrieved by an individual identifier; e.g., beneficiary name or HIC number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain information for a total period not to exceed 25 years. Data residing with the TrOOP facilitation contractor site agent shall be returned to CMS at the end of the contract period, with all data then being the responsibility of CMS for adequate storage and security.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Henry Chao, Manager, Immediate Office of the Director, Office of Information Services, CMS, Room N3-19-23, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For the purpose of access, the subject individual should write to the system manager who will require the system name, address, age, gender type, and, for verification purposes, the subject individual's name (woman's maiden name, if applicable).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For the purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR, parts 160, 162, and 164.)
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0558" toc="yes">
<systemNumber>09-70-0558</systemNumber>
<subsection type="systemName">National Claims History (NCH), HHS/CMS/OIS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, MD 21244-1850 and at various contractor sites and at CMS Regional Offices.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>NCH contains billing and utilization information on Medicare beneficiaries enrolled in hospital insurance (Part A) or medical insurance (Part B) of the Medicare program.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Information maintained in this system includes, but is not limited to Medicare billing and utilization data, name, health insurance claim number, ethnicity, gender, date of birth, state and county code, zip code, as well as the basis for the beneficiary's Medicare entitlement. The system also contains provider characteristics, assigned provider number (facility, referring/servicing physician), admission date, service dates, diagnosis and procedural codes, total charges, Medicare payment amount, and beneficiary's liability.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for maintenance of the system is given under &#167;&#167; 1874(a) and 1875 of the Social Security Act (the Act) and Title 42 United States Code (U.S.C.) section 1395kk(a) and 1395ll.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this modified system is to collect and maintain billing and utilization data on Medicare beneficiaries enrolled in hospital insurance (Part A) or medical insurance (Part B) of the Medicare program for statistical and research purposes related to evaluating and studying the operation and effectiveness of the Medicare program. The information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant, or grantee; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) support providers and suppliers of services for administration of Title XVIII; (4) assist third parties where the contact is expected to have information relating to the individual's capacity to manage his or her own affairs; (5) assist QIOs; (6) process individual insurance claims by other insurers; (7) facilitate research on the quality and effectiveness of care provided, as well as payment-related projects; (8) support litigation involving the agency; and (9) combat fraud, waste, and abuse in federally-funded health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To support Agency contractors, consultants, or grantees who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.</p>
<p>2. To assist another Federal and/or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
</p><p>a. Contribute to the accuracy of CMS' proper payment of Medicare benefits,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To support providers and suppliers of services directly or through fiscal intermediaries or carriers for the administration of Title XVIII of the Act.
</p> <p>4. To assist third party contact in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program and;
</p><p>a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: the individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exist, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
</p><p>b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: The individual's entitlement to benefits under the Medicare program, the amount of reimbursement, and in cases in which the evidence is being reviewed as a result of suspected fraud and abuse, program integrity, quality appraisal, or evaluation and measurement of activities.
</p> <p>5. To support Quality Improvement Organizations (QIO) in order to assist the QIO to perform Title XI and Title XVIII functions relating to assessing and improving quality of care.
</p> <p>6. To facilitate insurance companies, underwriters, third party administrators (TPA), employers, self-insurers, group health plans, health maintenance organizations (HMO), health and welfare benefit funds, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, other groups providing protection against medical expenses of their enrollees without the beneficiary's authorization, and any entity having knowledge of the occurrence of any event affecting: (a) An individual's right to any such benefit or payment, or (b) the initial right to any such benefit or payment, for the purpose of coordination of benefits with the Medicare program and implementation of the Medicare Secondary Payer (MSP) provision at 42 U.S.C. 1395y (b). Information to be disclosed shall be limited to Medicare utilization data necessary to perform that specific function. In order to receive the information, they must agree to:
</p><p>a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a TPA;
</p><p>b. Utilize the information solely for the purpose of processing the individual's insurance claims; and
</p><p>c. Safeguard the confidentiality of the data and prevent unauthorized access.
</p> <p>7. To assist an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>8. To support the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>9. To assist a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
</p> <p>10. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>B. <i>Additional Provisions Affecting Routine Use Disclosures.</i> To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
</p> <p>11. To assist a public or private entity that is qualified (as determined by the Secretary of the Department of Health and Human Services (the Secretary)) to use Medicare claims data to evaluate the performance of providers of services and suppliers on measures of quality, efficiency, effectiveness, and resource use; and who agrees to meet the requirements regarding the transparency of their methods and their use and protection of Medicare data as the Secretary may specify, if CMS:
</p><p>a. Determines that the use or disclosure does not violate legal limitations under which the record was provided, collected, or obtained; and
</p><p>b. Secures a written statement attesting to the information recipient's understanding of and willingness to abide by these provisions. Every Qualified Entity receiving data must have an agreement with CMS in the form of an Information Exchange Agreement or contract with all security and privacy requirements included. A Data Use Agreement (DUA) (CMS Form 0235) must be completed by the person receiving CMS data in accordance with current CMS policies.
</p> <p>This routine use fulfills the requirement in section 1174(e) of the Social Security Act (42 U.S.C. 1395kk (e)) to make standardized extracts of claims data under Medicare Parts A, B, and D available to a Qualified Entity (QE), recognized by the Secretary to make evaluations of provider/supplier performance in accordance with that section, and that agrees to meet specific requirements regarding the transparency of their methods and their use and protection of Medicare data. The IDR, National Claims History (NCH), CCDR, and Part D data will provide QEs, a broader, longitudinal, national perspective of the performance of Medicare providers/suppliers for use in authorized QE projects that could ultimately improve the care provided to Medicare beneficiaries and the policy that governs the care.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on both magnetic storage media and in a DB2 relational database management environment (DASD data storage media).
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information in this system is retrieved by HICN, provider number (facility, physician, supplier Ids), service dates, type of bill, Medicare status code, diagnosis, procedural codes, and beneficiary state code.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be retained and disposed of in accordance with the National Archives and Records Administration guidelines. Records are housed in both active and archival files. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Integrated Data Program Management, Enterprise Databases Group, Office of Information Services, CMS, Mail Stop N2-17-07, 7500 Security Boulevard, Baltimore, MD 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of notification, the subject individual should write to the system manager who will require the system name, and the retrieval selection criteria (e.g., HIC, facility ID, physician/supplier number, service dates, type of bill, etc.).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Fee-for-Service (FFS) billing and utilization information contained in this records system is obtained from the Common Working File.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0564" toc="yes">
<systemNumber>09-70-0564</systemNumber>
<subsection type="systemName">"Medicare Prescription Drug Plan Finder (MPDPF) System, HHS/CMS/CBC"</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level 3 Privacy Act Sensitive </p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850, and at various contractor locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information collected for this system will include but is not limited to, individuals who voluntarily access and who successfully validate information required by the Web-based Application Systems maintained by CMS.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Information collected for this system will include, but is not limited to, last name, gender, Health Insurance Claim Number (HICN), telephone number, geographic location, type of enrollment (Medicare Part A or Part B), and effective date of enrollment in Part A and Part B.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for this system is given under the provisions of Section 101 of the Medicare Prescription Drug, Improvement, and    Modernization Act of 2003 (MMA) (Public Law 108-173). This new prescription drug benefit program was enacted into law on December 8, 2003,    amended Title XVIII of the Social Security Act (the Act), and codified at Title 42 Code of Federal Regulations (CFR) parts 403, 411, 417    and 423 by establishing a new Medicare "Part D" Prescription Drug Benefit program. Part D of Title XVIII of the Act, as amended by the    MMA, and its implementing regulations at 42 CFR Parts 403, 411, 417 and 423.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this system is to provide a Web accessible inquiry system that will provide a mechanism to support an individual beneficiary's efforts in performing drug benefit eligibility queries and to enroll them into selected plans. Information in this system will also be used to: (1) Support regulatory and policy functions performed within the Agency or by a contractor or consultant; (2) assist PDPs and MAPDs directly or through the Enterprise Business Services; (3) support constituent requests made to a Congressional representative; and (4) support litigation involving the Agency related to this system.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:   
</p><p>1. To Agency contractors, or consultants who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.   
</p><p>2. To Medicare Prescription Drug Plans (PDP) and Medicare Advantage Prescription Drug Plans (MAPD) directly or through the Enterprise Business Services, a CMS intermediary for the administration of Title XVIII of the Act.
</p><p>3. To a Member of Congress or to a congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.   
</p><p>4. To the Department of Justice (DOJ), court or adjudicatory body when   
</p><p>a. The Agency or any component thereof; or   
</p><p>b. any employee of the Agency in his or her official capacity; or   
</p><p>c. any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or   
</p><p>d. The United States Government;   
</p><p>Is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation.   
</p><p>B. Additional Provisions Affecting Routine Use Disclosures. This system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E , 65 Fed. Reg. 82462 (12-28-00)). Disclosures of PHI authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."   
</p><p>In addition, our policy will be to prohibit release even of not directly identifiable information, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:</p><p>Computer diskette and on magnetic storage media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information can be retrieved by the individual identifiable information of the beneficiary.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.   
</p><p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger- Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained in a secure storage area with identifiers. Disposal occurs 6 years and 3 months from the time the individual accesses the MPDPF.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Beneficiary Information Services Group, Center for Beneficiary Choices, CMS, Mail Stop S1-01-26, 7500 Security Boulevard, Baltimore, Maryland, 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, and for verification purposes, the subject individual's name (woman's maiden name, if applicable).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a)(2).)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Sources of information contained in this records system include data collected from the initial voluntary inquiry made by or on behalf of the individual and validated through the Medicare Beneficiary Database.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p></xhtmlContent></subsection> </section>
<section id="09-70-0565" toc="yes">
<systemNumber>09-70-0565</systemNumber>
<subsection type="systemName">"Automated Survey Processing Environment (ASPEN) Complaints/Incidents Tracking System (ACTS)," HHS/CMS/CMSO.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites and at CMS Regional Offices.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>ACTS contains information related to allegations of complaints and incidents filed against Medicare/Medicaid-certified providers and suppliers and CLIA-certified laboratories. ACTS contains identifiable information on individuals who are complainants, residents/patients/clients, contacts/witnesses, alleged perpetrators, survey team members, laboratory directors and laboratory owners, including the investigation of complaints and entity-reported incidents.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system contains demographic and identifying data, as well as survey and deficiency data. Identifying data includes, but is not limited to: name, title, address, city, state, ZIP code, e-mail address, telephone numbers, fax number, licensure number, social security number, Federal tax identification number, alias names, date of birth, gender, date admitted and/or date discharged.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for maintenance of the system is given under &#167;&#167; 1819, 1864, 1865, 1867, 1891, 1902(a)(9)(A), 1902(a)(33)(B), and 1919 of the Social Security Act, section 353 of the Public Health Service Act (42 United States Code 263a) and 42 Code of Federal Regulations (CFR) Subchapter G.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this modified system is to track and process complaints and incidents reported against Medicare and/or Medicaid certified providers and suppliers, and CLIA-certified laboratories, these include: skilled nursing facilities, nursing facilities, hospitals, home health agencies, end-stage renal disease facilities, hospices, rural health clinics, comprehensive outpatient rehabilitation facilities, outpatient physical therapy services, community mental health centers, ambulatory surgical centers, suppliers of portable X-ray services, and intermediate care facilities for persons with mental retardation. The information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or grantee; (2) assist another Federal or state agency, an agency established by state law, or its fiscal agent; (3) assist Quality Improvement Organizations; (4) support constituent requests made to a Congressional representative; (5) support litigation involving the agency; (6) assist a national accreditation organization that has been granted deeming authority by CMS; (7) assist a state-mandated Protection and Advocacy System that provides legal representation and other advocacy services to beneficiaries; and (8) combat fraud and abuse in certain Federally-funded health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants, or to a grantee who have been engaged by the agency to assist in the accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
</p> <p>2. To another Federal and/or state agency, an agency established by state law, or its fiscal agent to:
</p><p>a. Contribute to the accuracy of CMS' proper payment of Medicare benefits,
</p><p>b. enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. assist Federal/state Medicaid programs within the state.
</p> <p>3. To Quality Improvement Organizations (QIO) in order to assist the QIO to perform Title XI and Title XVIII functions relating to assessing and improving quality of care.
</p> <p>4. To a member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>5. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. the agency or any component thereof, or
</p><p>b. any employee of the agency in his or her official capacity, or
</p><p>c. any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. the United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>6. To a national accreditation organization that has been granted deeming authority or certified by the Secretary for the purpose of improving the quality of care provided through the provision of health care accreditation and related services that support performance improvement and monitors the quality of deemed providers/suppliers through the investigation of complaints. CMS will provide facility information to approved accreditation organizations on their accredited entities that are deemed for participation in the Medicare program.
</p> <p>7. To a state-designated Protection and Advocacy System that provides legal representation and other advocacy services for the purposes of monitoring, investigating and attempting to remedy adverse conditions, and for responding to allegations of abuse, neglect and violations of the rights of persons with disabilities.
</p> <p>8. To a CMS contractor (including, but not necessarily limited to Medicare administrative contractors, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
</p> <p>9. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures: To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on the magnetic disk sub-system of the Windows 2000 server. Furthermore, these records are saved to magnetic tape backup on a nightly basis.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The Medicare, Medicaid, and CLIA records are retrieved by name of provider/supplier, Medicare provider number, ACTS Intake ID, state assigned Medicaid number, or other CMS assigned numbers, complainant's name, resident/patient/client's name, contact/witness name, alleged perpetrator's name, survey team member's name, surveyor identification number, laboratory director's name, laboratory owner's name or Federal tax identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002; the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003; and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook; and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain identifiable ACTS data for a total period not to exceed 15 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of National Systems, Finance, Systems and Budget Group, Center for Medicaid and State Operations, CMS, Mail Stop S3 -13-15, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, provider/supplier's name, date the complaint/incident occurred, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The following forms and the ACTS software are used to collect ACTS data: Medicare/Medicaid/CLIA Complaint Form (CMS-562); Statement of Deficiencies and Plan of Correction (CMS-2567); Post-Certification Revisit Report (CMS-2567B); Survey Team Composition and Workload Report (CMS-670); Request for Validation of Accreditation Survey for Hospital (CMS-2802); Request for Validation of Accreditation Survey for Laboratory (CMS-2802A); Request for Validation of Accreditation Survey for Hospice (CMS- 2802B); Request for Validation of Accreditation Survey for Home Health Agency (CMS-2802C); and Request for Validation of Accreditation Survey for Ambulatory Surgical Center (CMS-2802D). Request for Survey of 489.20 and 489.24 Essentials of Provider Agreements: Responsibilities of Medicare Participating Hospitals in Emergency Cases (CMS-1541A) and CMS-116-CLIA Laboratory Application.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>HHS claims exemption of certain records in the system from notification and access procedures under 5 U.S.C. 522a(k)(2) inasmuch as these records are investigatory materials compiled for program (law) enforcement in anticipation of  criminal or administrative proceedings (See Department Regulation (45 CFR 5b.11)).
</p>
    <p>
        <i>Appendix A Location of State Servers
        </i>
    </p> <p>North Dakota Department of Health Resources, 600 East Boulevard Avenue, Suite 206, Bismarck, ND 58505.
</p> <p>Department of Health, Facility Licensing and Certification Bureau, 2040 South Pacheco, Colgate Building 2nd Floor, Santa Fe, NM 87505.
</p> <p>Utah Department of Health, M/M Program Certification, 288 North, 1460 West, Salt Lake City, UT 84114-2905.
</p> <p>Department of Public Health and Human Services, Senior and Long Term Care Division, 111 Sanders Avenue, Suite 210, PO Box 4210, Helena, MT 59601.
</p> <p>Division of Medicaid, Bureau of Facility Standards, Myers &amp; Stauffer, 8555 West Hackamore Dr., Suite 100, Boise, ID 83709-1665.
</p> <p>Rhode Island Department of Health, Three Capitol Hill, Cannon Building, Room 306, Providence, RI 02908-5097.
</p> <p>State of Connecticut, Department of Public Health, 410 Capitol Avenue MS#13DPR, PO Box 340308, Hartford, CT 06134-0308.
</p> <p>Minnesota Department of Health, F&amp;PC Division, 85 East 7th Place-Suite 300, PO Box 64900, St. Paul, MN 55101.
</p> <p>Bureau of Quality Assurance, Department of Health and Family Services, 1 West Wilson Street, Suite 150, P.O. Box 7850, Madison, WI 53701-0309.
</p> <p>Louisiana Department of Health and Hospitals, Health Standards Section, 500 Laurel Street, Suite 100, Baton Rouge, LA 70801.
</p> <p>Texas Department of Human Services (TDHS), 701 West 51st Street, P.O. Box 149030, MC W-519, Austin, TX 78751.
</p> <p>Alabama Department of Public Health, Division of Health Care Facilities, 201 Monroe Street, Suite 840, PO Box 303017, Montgomery, AL 36104-3017.
</p> <p>Division of Emergency Medical Services, 570 East Woodrow Wilson Blvd., Third Floor A-300, Jackson, MS 39215.
</p> <p>State of New Jersey, Department of Health and Senior Services Long Term Care. Systems Development and Quality, 120 S Stockton Street, lower level, Trenton, NJ 08625.
</p> <p>Office of Health Facilities Licensing and Certification, LTC Residents Protection, Three Mill Road, Suite 308, Wilmington, DE 19806.
</p> <p>Colorado Department of Public Health and Environment, Health Facilities Division, HFD-a2, 4300 Cherry Creek Drive, South, Second Floor, Denver, CO 80246-1530.
</p> <p>Office of Health Quality, 2020 Carey Avenue, First Bank Building, 8th Floor, Cheyenne, WY 82002.
</p> <p>Department of Health &amp; Human Services Division of Facility Services Licensure and Certification Section, 805 Briggs Drive, Raleigh, NC 27603.
</p> <p>SCDHEC, Division of Certification, 1777 Saint Julian Place, Suite 302, Columbia, SC 29204.
</p> <p>Seniors and People with Disabilities, 875 Union St.--4th Fl., Salem, OR 97310.
</p> <p>AASA--Division of Residential Services, 0B2 1115 North Washington, Olympia, WA 98503.
</p> <p>Myers and Stauffer, 6380 Flank Drive, Suite 100, Harrisburg, PA 17112.
</p> <p>DHHR, Management Information Services, 350 Capital Street, Room 206, Third Floor Computer Room, Charleston, WV 25301-3178.
</p> <p>Office of Regulatory Services, Georgia Department of Human Resources, 2 Peachtree Street North West, Suite 24, Atlanta, GA 30303-3167.
</p> <p>Management Information Systems, Agency for Health Care Administration, 2727 Mahan Dr, Fort Knox, Bldg 3, Room 100, MS9a, Tallahassee, FL 32308-5403.
</p> <p>Illinois Department of Public Aid, Division of Medical Programs, 201 South Grand Avenue, East, Prescott Bloom Bldg. 2nd floor, Springfield, IL 62763.
</p> <p>Indiana State Department of Health, 2 North Meridian Street, Indianapolis, IN 46204.
</p> <p>Cabinet for Health Services Office of Inspector General, 275 East Main Street 5E-A, Frankfurt, KY 40621.
</p> <p>Tennessee Department of Health, Division of Health Care Facilities, 426 5th Avenue, North, Cordell Hull Building, 1st Floor, Nashville, TN 37247-0508.
</p> <p>Massachusetts Department of Public Health, Division of Health Care Quality, 10 West Street, 5th floor, Boston, MA 02111.
</p> <p>Division of Licensing and Protection, 103 South Main Street, Ladd Hall room 898, Waterbury, VT 05671.
</p> <p>Missouri Department of Social Services, Division of Aging, 615 Howerton Court, Jefferson City, MO 65109.
</p> <p>Department of Human Services DMS/OLTC/ Reimbursement Unit, 700 Main, 4th Floor, PO Box 8059--Slot 407, Little Rock, AR 72203-8059.
</p> <p>Oklahoma State Department of Health, SHS, 1000 North East 10th Street, Oklahoma City, OK 73117-1299.
</p> <p>Myers &amp; Stauffer Consulting Services, 4123 Southwest Gage Center Drive, Suite 200, Topeka, KS 66604.
</p> <p>Bureau of Licensure and Certification, 1550 East College Parkway, Suite 158, Carson City, NV 89706.
</p> <p>Arizona Department of Health Services, 1647 East Morten Ave., Suite 200, Phoenix, AZ 85020.
</p> <p>Virginia Department of Health, 1500 East Main Street, Room 211, Main Street Station, Richmond, VA 23219.
</p> <p>Department of Consumer and Regulatory Affairs, Service Facility Regulation Administration, 825 N Capitol Street NE., 2nd Floor LRA--Room 221, Washington, DC 20002.
</p> <p>Michigan Department of Community Health, 300 East Michigan, Chandler River Plaza Building, Lansing, MI 48933.
</p> <p>Ohio Department of Health, 246 N. High St., 3rd Floor, Columbus, OH 43215.
</p> <p>Dept of Human Services, 442 Civic Center Drive, Augusta, ME 04330.
</p> <p>Department of Health and Human Services, Office of Program Support, Office of Information Systems, 129 Pleasant Street, Brown Bldg., Concord, NH 03301-3857.
</p> <p>Office of Health Care Assurance, 601 Kamokila, RM 395, Kapolei, HI 96707.
</p> <p>South Dakota Department of Social Services, Office of Adult Services and Aging, 700 Governors Drive, Pierre, SD 57501.
</p> <p>California Department of Health Services, Licensing and Certification, 630 Bercut Dr. Suite B, Sacramento, CA 95814.
</p> <p>State of Maryland, Department of Health Care Quality, 55 Wade Avenue, Spring Grove Center, Bland Bryant Bldg., Fourth Floor, Catonsville, MD 21228.
</p> <p>Department of Health and Human Services, Medicaid Division, PO Box 95026--301 Centennial Mall, South, 5th Floor, Lincoln, NE 68509.
</p> <p>DHHS Div of Med. Assistance Heath Facilities Licensing and Certification, 4730 Business Park Boulevard, Suite 18, Anchorage, AK 99503.
</p> <p>NYS Dept. of Health, Empire State Plaza, Concourse Room 148, Albany, NY 12237.
</p> <p>Virgin Islands, IFMC, 6000 Westown Parkway, West Des Moines, IA 50266.
</p> <p>Puerto Rico Department of Health, Assistant Secretariat for the Regulation and Accreditation of Health Facilities, Former Ruez Soler Hospital Road #2, Bayamon, PR 00959.
</p></xhtmlContent></subsection></section>
<section id="09-70-0566" toc="yes">
<systemNumber>09-70-0566</systemNumber>
<subsection type="systemName">"Medicare Appeals System (MAS)," HHS/CMS/CBC.
</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850. This system is also located in locations listed in Appendix A.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>MAS contains information concerning Medicare beneficiaries, physicians, providers, practitioners, suppliers and other persons involved in furnishing items and services to health insurance beneficiaries.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Information on beneficiaries includes, but is not limited to: Name, address, social security number (SSN), health insurance claim number (HICN), medical services, equipment and supplies for which Medicare reimbursement is requested, and materials used to determine the amount of benefits allowable under Medicare. Information on appellants, physicians, and other persons includes, but is not limited to: name, work address, work phone number, and assigned provider identification number, specialty, medical services for which Medicare reimbursement is requested, and materials used to determine amounts of benefits allowable under Medicare.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for maintenance of the system is given under &#167; 205 of Title II, &#167;&#167; 1155 and 1156 of Title XI, &#167;&#167; 1812, 1814, 1816, 1842, 1869, and 1872 of Title XVIII of the Social Security Act (the Act), as amended (42 United States Code (U.S.C.) sections 405, 1320c-4, 1320c-5, 1395d, 1395f, 1395h, 1395u, 1395ff, and 1395ii). Additional authority for this system is given under the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (Public Law (Pub. L.) 108-173).
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this modified system is to collect and maintain information necessary to: (1) Process level two and level three appeal requests made by an appellant or appealing party; (2) track appeal data, including: status, type, history, timeliness, and decisions; and (3) respond to future correspondence related to the case. The information retrieved from this system of records will also be disclosed to: (1) Support regulatory and policy functions performed within the agency or by a contractor, consultant, or grantee; (2) another Federal agency; (3) assist Quality Improvement Organizations; (4) support litigation involving the agency; and (5) combat fraud, waste, and abuse.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act Allows Us To Disclose Information Without an Individual's Consent if the Information Is To Be Used for a Purpose That Is Compatible With the Purpose(s) for Which the Information Was Collected.
</p> <p>Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To support agency contractor, consultant, or grantee who have been engaged by the agency to assist in the accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
</p> <p>2. To assist another Federal agency in the accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to support CMS.
</p> <p>3. To assist Quality Improvement Organizations (QIO) in connection with the review of claims, or in connection with studies or other review activities, conducted pursuant to Part B of Title XI of the Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
</p> <p>4. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
</p> <p>6. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures.
</p> <p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that an individual could, because of the small size of the information provided, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on computer diskette and magnetic storage media.</p>
</xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information can be retrieved by the name, SSN, HICN, and assigned provider number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained in a secure storage area with identifiers. Disposal occurs ten years after the final determination of the case is completed. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Director, Division of Appeals Operations, Medicare Enrollment and Appeals Group, Center for Beneficiary Choices, CMS, Mail Stop S1 -05-06, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. In addition the individual should state the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Sources on information contained in this records system include data collected from the individual on the completed form requesting a Medicare hearing or appeal. In addition, information contained in this system may be obtained from Medicare carriers or intermediaries and Quality Improvement Organizations' records.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.</p>
<p><i>Appendix A. Health Insurance Claims </i> Medicare records are maintained at the CMS Central Office (see section 1 below for the address). Health Insurance Records of the Medicare program can also be accessed through a representative of the CMS Regional Office (see section 2 below for addresses). Medicare claims records are also maintained by private insurance organizations that share in administering provisions of the health insurance programs. These private insurance organizations, referred to as carriers and intermediaries, are under contract to the Centers for Medicare &amp; Medicaid Services to perform specific task in the Medicare program (see section 3 below for addresses for intermediaries, section 4 for addresses for carriers, and section 5 for addresses for the Payment Safeguard Contractors).</p>
<p><i>1. Central Office Address </i> CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.</p>
<p><i>2. CMS Regional Offices </i> &#149; Boston Region--Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont. John F. Kennedy Federal Building, Room 1211, Boston, Massachusetts 02203. Office Hours: 8:30 a.m.-5 p.m.
</p> <p>&#149; New York Region--New Jersey, New York, Puerto Rico, Virgin Islands. 26 Federal Plaza, Room 715, New York, New York 10007. Office Hours: 8:30 a.m.-5 p.m.
</p> <p>&#149; Philadelphia Region--Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, West Virginia. Post Office Box 8460, Philadelphia, Pennsylvania 19101. Office Hours: 8: 30 a.m.-5 p.m.
</p> <p>&#149; Atlanta Region--Alabama, North Carolina, South Carolina, Florida, Georgia, Kentucky, Mississippi, Tennessee. 101 Marietta Street, Suite 702, Atlanta, Georgia 30223. Office Hours: 8:30 a.m.-4:30 p.m.
</p> <p>&#149; Chicago Region--Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin. Suite A--824, Chicago, Illinois 60604. Office Hours: 8 a.m.-4:45 p.m.
</p> <p>&#149; Dallas Region--Arkansas, Louisiana, New Mexico, Oklahoma, Texas. 1200 Main Tower Building, Dallas, Texas. Office Hours: 8 a.m.-4:30 p.m.
</p> <p>&#149; Kansas Region--Iowa, Kansas, Missouri, Nebraska. New Federal Office Building, 601 East 12th Street--Room 436, Kansas City, Missouri 64106. Office Hours: 8 a.m.-4:45 p.m.
</p> <p>&#149; Denver Region--Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming. Federal Office Building, 1961 Stout St-- Room 1185, Denver, Colorado 80294. Office Hours: 8 a.m.-4:30 p.m.
</p> <p>&#149; San Francisco Region--American Samoa, Arizona, California, Guam, Hawaii, Nevada. Federal Office Building, 10 Van Ness Avenue, 20th Floor, San Francisco, California 94102. Office Hours: 8 a.m.-4:30 p.m.
</p> <p>&#149; Seattle Region--Alaska, Idaho, Oregon, Washington. 1321 Second Avenue, Room 615, Mail Stop 211, Seattle, Washington 98101. Office Hours: 8 a.m.-4:30 p.m.</p>
<p><i>3. Intermediary Addresses (Hospital Insurance) </i> &#149; Medicare Coordinator, Assoc. Hospital Serv. Main (ME BC), 2 Gannett Drive, South Portland, ME 04106-6911.
</p> <p>&#149; Medicare Coordinator, Anthem New Hampshire, 300 Goffs Falls Road, Manchester, NH 03111-0001.
</p> <p>&#149; Medicare Coordinator, BC/BS Rhode Island (RI BC), 444 Westminster Street, Providence, RI 02903-3279.
</p> <p>&#149; Medicare Coordinator, Empire Medicare Services, 400 S. Salina Street, Syracuse, NY 13202.
</p> <p>&#149; Medicare Coordinator, Cooperativa, P.O. Box 363428, San Juan, PR 00936-3428.
</p> <p>&#149; Medicare Coordinator, Maryland B/C, P.O. Box 4368, 1946 Greenspring Ave., Timonium, MD 21093.
</p> <p>&#149; Medicare Coordinator, Highmark, P5103, 120 Fifth Avenue Place, Pittsburgh, PA 15222-3099.
</p> <p>&#149; Medicare Coordinator, United Government Services, 1515 N. Rivercenter Dr., Milwaukee, WI 53212.
</p> <p>&#149; Medicare Coordinator, Alabama B/C, 450 Riverchase Parkway East, Birmingham, AL 35298.
</p> <p>&#149; Medicare Coordinator, Florida B/C, 532 Riverside Ave., Jacksonville, FL 32202-4918.
</p> <p>&#149; Medicare Coordinator, Georgia B/C, P.O. Box 9048, 2357 Warm Springs Road, Columbus, GA 31908.
</p> <p>&#149; Medicare Coordinator, Mississippi B/C B MS, P.O. Box 23035, 3545 Lakeland Drive, Jackson, MI 9225-3035.
</p> <p>&#149; Medicare Coordinator, North Carolina B/C, P.O. Box 2291, Durham, NC 27702-2291.
</p> <p>&#149; Medicare Coordinator, Palmetto GBA A/RHHI, 17 Technology Circle, Columbia, SC 29203-0001.
</p> <p>&#149; Medicare Coordinator, Tennessee B/C, 801 Pine Street, Chattanooga, TN 37402-2555.
</p> <p>&#149; Medicare Coordinator, Anthem Insurance Co. (Anthem IN), P.O. Box 50451, 8115 Knue Road, Indianapolis, IN 46250-1936.
</p> <p>&#149; Medicare Coordinator, Arkansas B/C, 601 Gaines Street, Little Rock, AR 72203.
</p> <p>&#149; Medicare Coordinator, Group Health of Oklahoma, 1215 South Boulder, Tulsa, OK 74119-2827.
</p> <p>&#149; Medicare Coordinator, Trailblazer, P.O. Box 660156, Dallas, TX 75266-0156.
</p> <p>&#149; Medicare Coordinator, Cahaba GBA, Station 7, 636 Grand Avenue, Des Moines, IA 50309-2551.
</p> <p>&#149; Medicare Coordinator, Kansas B/C, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629-0001.
</p> <p>&#149; Medicare Coordinator, Nebraska B/C, P.O. Box 3248, Main PO Station, Omaha, NE 68180-0001.</p>
<p>&#149; Medicare Coordinator, Mutual of Omaha, P.O. Box 1602, Omaha, NE 68101.
</p> <p>&#149; Medicare Coordinator, Montana B/C, P.O. Box 5017, Great Falls Div., Great Falls, MT 59403-5017.
</p> <p>&#149; Medicare Coordinator, Noridian, 4510 13th Avenue S.W., Fargo, ND 58121-0001.
</p> <p>&#149; Medicare Coordinator, Utah B/C, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
</p> <p>&#149; Medicare Coordinator, Wyoming B/C, 4000 House Avenue, Cheyenne, WY 82003.
</p> <p>&#149; Medicare Coordinator, Arizona B/C, P.O. Box 37700, Phoenix, AZ 85069.
</p> <p>&#149; Medicare Coordinator, UGS, P.O. Box 70000, Van Nuys, CA 91470-0000.
</p> <p>&#149; Medicare Coordinator, Regents BC, P.O. Box 8110 M/S D-4A, Portland, OR 97207-8110.
</p> <p>&#149; Medicare Coordinator, Premera BC, P.O. Box 2847, Seattle, WA 98111-2847.</p>
<p><i>4. Medicare Carriers </i> &#149; Medicare Coordinator, NHIC, 75 Sargent William Terry Drive, Hingham, MA 02044.
</p> <p>&#149; Medicare Coordinator, B/S Rhode Island (RI BS), 444 Westminster Street, Providence, RI 02903-2790.
</p> <p>&#149; Medicare Coordinator, Trailblazer Health Enterprises, Meriden Park, 538 Preston Ave., Meriden, CT 06450.
</p> <p>&#149; Medicare Coordinator, Upstate Medicare Division, 11 Lewis Road, Binghamton, NY 13902.
</p> <p>&#149; Medicare Coordinator, Empire Medicare Services, 2651 Strang Blvd., Yorktown Heights, NY 10598.
</p> <p>&#149; Medicare Coordinator, Empire Medicare Services, NJ, 300 East Park Drive, Harrisburg, PA 17106.
</p> <p>&#149; Medicare Coordinator, Triple S, #1441 F.D., Roosevelt Ave., Guaynabo, PR 00968.
</p> <p>&#149; Medicare Coordinator, Group Health Inc., 4th Floor, 88 west End Avenue, New York, NY 10023.
</p> <p>&#149; Medicare Coordinator, Highmark, P.O. Box 89065, 1800 Center Street, Camp Hill, PA 17089-9065.
</p> <p>&#149; Medicare Coordinator, Trailblazers Part B, 11150 McCormick Drive, Executive Plaza 3 Suite 200, Hunt Valley, MD 21031.
</p> <p>&#149; Medicare Coordinator, Trailblazer Health Enterprises, Virginia, P.O. Box 26463, Richmond, VA 23261-6463. United Medicare Coordinator, Tricenturion, 1 Tower Square, Hartford, CT 06183.
</p> <p>&#149; Medicare Coordinator, Alabama B/S, 450 Riverchase Parkway East, Birmingham, AL 35298.
</p> <p>&#149; Medicare Coordinator, Cahaba GBA, 12052 Middleground Road, Suite A, Savannah, GA 31419.
</p> <p>&#149; Medicare Coordinator, Florida B/S, 532 Riverside Ave., Jacksonville, FL 32202-4918.
</p> <p>&#149; Medicare Coordinator, Administar Federal, 9901 Linnstation Road, Louisville, KY 40223.
</p> <p>&#149; Medicare Coordinator, Palmetto GBA, 17 Technology Circle, Columbia, SC 29203-0001.
</p> <p>&#149; Medicare Coordinator, CIGNA, 2 Vantage Way, Nashville, TN 37228.
</p> <p>&#149; Medicare Coordinator, Railroad Retirement Board, 2743 Perimeter Parkway, Building 250, Augusta, GA 30999.
</p> <p>&#149; Medicare Coordinator, Cahaba GBA, Jackson Miss., P.O. Box 22545, Jackson, MI 39225-2545.
</p> <p>&#149; Medicare Coordinator, Administar Federal (IN), 8115 Knue Road, Indianapolis, IN 46250-1936.
</p> <p>&#149; Medicare Coordinator, Wisconsin Physicians Service, P.O. Box 8190, Madison, WI 53708-8190.
</p> <p>&#149; Medicare Coordinator, Nationwide Mutual Insurance Co., P.O. Box 16788, 1 Nationwise Plaza, Columbus, OH 3216-6788.
</p> <p>&#149; Medicare Coordinator, Arkansas B/S, 601 Gaines Street, Little Rock, AR 72203.
</p> <p>&#149; Medicare Coordinator, Arkansas-New Mexico, 601 Gaines Street, Little Rock, AR 72203.
</p> <p>&#149; Medicare Coordinator, Palmetto GBA--DMERC, 17 Technology Circle, Columbia SC 29203-0001.
</p> <p>&#149; Medicare Coordinator, Trailblazer Health Enterprises, 901 South Central Expressway, Richardson, TX 75080.
</p> <p>&#149; Medicare Coordinator, Nordian, 636 Grand Avenue, Des Moines, IA 50309-2551.
</p> <p>&#149; Medicare Coordinator, Kansas B/S, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629.
</p> <p>&#149; Medicare Coordinator, Kansas B/S--NE, P.O. Box 239, 1133 Topeka Ave., Topeka, KS 66629.
</p> <p>&#149; Medicare Coordinator, Montana B/S, P.O. Box 4309, Helena, MT 59601.
</p> <p>&#149; Medicare Coordinator, Nordian, 4305 13th Avenue South, Fargo, ND 58103-3373.
</p> <p>&#149; Medicare Coordinator, Noridian BCBSND (CO), 730 N. Simms #100, Golden, CO 80401-4730.
</p> <p>&#149; Medicare Coordinator, Noridian BCBSND (WY), 4305 13th Avenue South, Fargo, ND 58103-3373.
</p> <p>&#149; Medicare Coordinator, Utah B/S, P.O. Box 30270, 2455 Parleys Way, Salt Lake City, UT 84130-0270.
</p> <p>&#149; Medicare Coordinator, Transamerica Occidental, P.O. Box 54905, Los Angeles, CA 90054-4905.
</p> <p>&#149; Medicare Coordinator, NHIC--California, 450 W. East Avenue, Chico, CO 95926.
</p> <p>&#149; Medicare Coordinator, Cigna, Suite 254, 3150 Lakeharbor, Boise, ID 83703.
</p> <p>&#149; Medicare Coordinator, Cigna, Suite 506, 2 Vantage Way, Nashville, TN 37228.</p>
<p><i>5. Payment Safeguard Contractors </i> &#149; Medicare Coordinator, Aspen Systems Corporation, 2277 Research Blvd., Rockville, MD 20850.
</p> <p>&#149; Medicare Coordinator, DynCorp Electronic Data Systems (EDS), 11710 Plaza America Drive 5400 Legacy Drive, Reston, VA 20190 -6017.
</p> <p>&#149; Medicare Coordinator, Lifecare management Partners Mutual of Omaha Insurance Co., 6601 Little Rive Turnpike, Suite 300 Mutual of Omaha Plaza, Omaha, NE 68175.
</p> <p>&#149; Medicare Coordinator, Reliance Safeguard Solutions, Inc., P.O. Box 30207 400 South Salina Street, 2890 East Cottonwood Parkway, Syracuse, NY 13202.
</p> <p>&#149; Medicare Coordinator, Science Applications International Inc., 6565 Arlington Blvd. P.O. Box 100282, Falls Church, VA.
</p> <p>&#149; Medicare Coordinator, California Medical Review, Inc., Integriguard Division Federal Sector Civil Group One Sansome Street, San Francisco, CA 94104-4448.
</p> <p>&#149; Medicare Coordinator, Computer Sciences Corporation Suite 600 3120 Timanus Lane, Baltimore, MD 21244.
</p> <p>&#149; Medicare Coordinator, Electronic Data System (EDS), 11710 Plaza American Drive, 5400 Legacy Drive, Plano, TX 75204.
</p> <p>&#149; Medicare Coordinator, TriCenturion, L.L.C., P.O. Box 100282, Columbia, SC 29202.</p>
<p>6. Qualified Independent Contractors </p><p>&#149; Medicare Contractor, Maximus Federal Services, Inc., 1040 First Avenue, Suite 400, King of Prussia, PA 19406.
</p> <p>&#149; Medicare Contractor, Maximus Federal Services, Inc., 50 Square Drive, Victor, NY 19406.
</p> <p>&#149; Medicare Contractor, Q&#8322; Administrators, 17 Technology Circle, Columbia, SC 29203. Medicare Contractor, Q</p>
<p>&#8322;Administrators, 5150 East Dublin-Granville Road, Suite 200, Westerville, OH 43081. Medicare Contractor, First Coast Service Options, 532 Riverside Avenue, Jacksonville, FL 32202.
</p></xhtmlContent></subsection></section>
<section id="09-70-0568" toc="yes">
<systemNumber>09-70-0568</systemNumber>
<subsection type="systemName">"One Program Integrity Data Repository (ODR), HHS/CMS/OFM".</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system will maintain information on Medicare beneficiaries Parts A, B, C, and D and physicians, providers, employer plans, Medicaid recipients and Medicare secondary payers.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Information maintained in the system include, but are not limited to: Standard data for identification such as health insurance claim number, social security number, gender, race/ethnicity, date of birth, geographic location, Medicare enrollment, entitlement, and utilization information, Medicaid enrollment, entitlement, and utilization information, MSP data necessary for appropriate Medicare claim payment, hospice election, MA plan elections and enrollment, End Stage Renal Disease (ESRD) entitlement, historic and current listing of residences, and Medicare eligibility and Managed Care institutional status.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for maintenance of this system is given under section 1893 of the Social Security Act.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this system is to establish an enterprise resource that will provide a single source of information for all CMS fraud and abuse activities. Information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or grantee; (2) assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) support Quality Improvement Organizations (QIO); (4) assist other insurers for processing individual insurance claims; (5) facilitate research on the quality and effectiveness of care provided, as well as payment related projects; (6) support litigation involving the agency; and (7) combat fraud, waste, and abuse in certain health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees who have been engaged by the agency to assist in the performance of a service related to this system and who need to have access to the records in order to perform the activity.
</p> <p>2. To another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent to:
</p><p>a. Contribute to the accuracy of CMS' proper payment of Medicare and Medicaid benefits,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. Assist Federal/State Medicaid programs within the State.
</p> <p>3. To Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities conducted pursuant to Part B of Title XI of the Act, and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.</p>
<p>4. To insurance companies, underwriters, third party administrators (TPA), employers, self-insurers, group health plans, health maintenance organizations (HMO), health and welfare benefit funds, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, other groups providing protection against medical expenses of their enrollees without the beneficiary's authorization, and any entity having knowledge of the occurrence of any event affecting: (a) An individual's right to any such benefit or payment, or (b) the initial right to any such benefit or payment, for the purpose of coordination of benefits with the Medicare program and implementation of the Medicare Secondary Payer (MSP) provision at 42 U.S.C. 1395y (b). Information to be disclosed shall be limited to Medicare utilization data necessary to perform that specific function. In order to receive the information, they must agree to:
</p><p>a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a TPA;
</p><p>b. Utilize the information solely for the purpose of processing the individual's insurance claims; and
</p><p>c. Safeguard the confidentiality of the data and prevent unauthorized access.
</p> <p>5. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>6. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>7. To a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
</p> <p>8. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures
</p><p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (<i>See</i> 45 CFR 164-512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored electronically.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>All records are accessible by HICN, SSN, and unique provider identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be retained until an approved disposition authority is obtained from the National Archives and Records Administration. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of MMA Integrity, Program Integrity Group, Office of Financial Management, CMS, Mailstop: C3-02-16, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The data contained in this system of records are extracted from other CMS systems of records: Medicare Drug Data Processing System; Medicare Beneficiary Database; Medicare Advantage Prescription Drug System; State Medicaid Records; Medicaid Statistical Information System; Retiree Drug Subsidy Program; Common Working File; National Claims History; Enrollment Database; Carrier Medicare Claims Record; Intermediary Medicare Claims Record; Unique Physician/Provider Identification Number; Provider Enrollment Chain &amp; Ownership System (PECOS); and Medicare Supplier Identification File. Information will also be provided from the participating state Medicaid agencies.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0569" toc="yes">
<systemNumber>09-70-0569</systemNumber>
<subsection type="systemName">"Post-Acute Care Payment Reform / Continuity of Assessment Record and Evaluation Demonstration and Evaluation (PAC-CARE)," HHS/CMS/ORDI.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites and at CMS Regional Offices.</p>
</xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system will collect and maintain individually identifiable and other data collected on Medicare and potentially, Medicaid beneficiaries who require treatment in a designated acute care or post-acute care provider. We will also collect certain identifying information on Medicare providers who provide services to such beneficiaries.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will include, but is not limited to: Medicare claims and eligibility data, name, health insurance claims number (HICN), social security number (SSN) (the submission of a beneficiary's SSN is optional), race/ethnicity, gender, date of birth, provider name, unique CMS Certification Number (CCN), medical record number, as well as clinical, demographic, medication, procedure, treatment information, health/well-being, and background information relating to Medicare issues. Data will be collected from Medicare administrative and claims records, PAC-CARE site administrative data systems, patient medical charts, physician records, and via information submitted by beneficiaries and providers.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for this system is given under Sections 5008 of the Deficit Reduction Act of 2005.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this proposed system is to collect and maintain, and release when appropriate, demographic, health records, and health resource use related data on the target population of Medicare and potentially, Medicaid beneficiaries who require treatment by a designated acute care or post-acute care provider. We will also collect certain identifying information on Medicare providers who provide services to such beneficiaries. Information retrieved from this system may be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, grantee, consultant or other legal agent; (2) assist another Federal or state agency with information to contribute to the accuracy of CMS's proper payment of Medicare benefits, enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; (4) support the functions of Quality Improvement Organizations; (5) support the functions of national accreditation organizations; (6) permit the release of personal health information to complete a transfer-out (discharge) event and/or a transfer-in (admission) event; (7) support litigation involving the agency; and (8) combat fraud, waste, and abuse in certain Federally-funded health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
</p> <p>2. To another Federal or state agency to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits;
</p><p>b. Enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>4. To support Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities conducted pursuant to Part B of Title XI of the Act, and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
</p> <p>5. To assist national accreditation organization(s) whose accredited facilities are deemed to meet certain Medicare conditions of participation for inpatient hospital rehabilitation services (<i>e.g.</i>, the Joint Commission and the American Osteopathic Association) with their survey process, information will be released by CMS for only those providers that they deem and that participate in the Medicare program and if they meet the following requirements:
</p><p>a. Provide identifying information for post acute care facilities that have deemed status with the requesting accreditation organization;
</p><p>b. Submission of a finder file identifying beneficiaries/patients receiving post acute care services;
</p><p>c. Safeguard the confidentiality of the data and prevent unauthorized access; and
</p><p>d. Upon completion of a signed data exchange agreement or a CMS data use agreement.
</p> <p>6. To assist with a transfer-out event from a discharging acute or post-acute care provider and/or a transfer-in event to an admitting acute or post-acute care provider to:
</p><p>a. Contribute to the accuracy of CMS' proper payment of Medicare benefits; and
</p><p>b. Enable such providers to ensure the proper transfer of health records, and/or as necessary to enable such a provider to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal fund.
</p> <p>Individuals from the admitting providers will only be granted access to personal health information, if they have the approved, authenticated, role-based authority, and the defined need for access to that information. Individuals will only be granted access to information if they meet the following requirements:
</p><p>a. Provide an attestation or other qualifying information that they are providing assistance to a qualified acute or post-acute care beneficiary receiving care/services through their provider site; 
</p><p>b. Have physically admitted the beneficiary to their care site, and are initiating an assessment of the beneficiary, and can validate the beneficiary's name, HICN (or payer number or SSN), date of birth, and gender;
</p><p>c. Safeguard the confidentiality of the data and prevent unauthorized access; and
</p><p>d. Accept a written, on-line statement attesting to the information recipient's understanding of and willingness to abide by these provisions.
</p> <p>7. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>8. To a CMS contractor (including, but not necessarily limited to, Medicare Administrative Contractors (MAC), fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such program.
</p> <p>9. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures.
</p> <p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on magnetic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The Medicare records are retrieved by the HICN and SSN.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002; the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the DHHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be retained until an approved disposition authority is obtained from the National Archives and Records Administration. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Research and Evaluation Group, Office of Research Development &amp; Information, Mail Stop C3-19-26, Centers for Medicare &amp; Medicaid Services, 7500 Security Boulevard, Baltimore, MD 21244-1849.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Data will be collected from Medicare administrative and claims records (Outcome and Assessment Information Set, Inpatient Rehabilitation Facilities Patient Assessment Instrument, Long Term Care Minimum Data Set), post-acute care site administrative data systems, patient medical charts, physician records, and via information submitted by beneficiaries and providers.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0571" toc="yes">
<systemNumber>09-70-0571</systemNumber>
<subsection type="systemName">Medicare Integrated Data Repository (IDR), HHS/CMS/OIS.</subsection>
    <subsection type="securityClassification">
        <xhtmlContent>
            <p>Level Three Privacy Act Sensitive Data </p>
        </xhtmlContent>
    </subsection> <subsection type="systemLocation"><xhtmlContent><p>The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system maintains information on individuals age 65 or over who have been, or currently are, entitled to health insurance (Medicare) benefits under Title XVIII of the Social Security Act (the Act) or under provisions of the Railroad Retirement Act; individuals under age 65 who have been, or currently are, entitled to such benefits on the basis of having been entitled for not less than 24 months to disability benefits under Title II of the Act or under the Railroad Retirement Act; individuals who have been, or currently are, entitled to such benefits because they have End-Stage Renal Disease (ESRD); individuals age 64 and 8 months or over who are likely to become entitled to health insurance (Medicare) benefits upon attaining age 65, and individuals under age 65 who have at least 21 months of disability benefits who are likely to become entitled to Medicare upon the 25th month or entitlement to such benefits and those populations that are dually eligible for both Medicare and Medicaid (Title XIX of the Act). Additionally, this system will maintain information on Medicare beneficiaries Parts A, B, C, and D and physicians, providers, employer plans, Medicaid recipients and Medicare secondary payers.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Information maintained in the system include, but are not limited to: standard data for identification such as health insurance claim number, social security number, gender, race/ethnicity, date of birth, geographic location, Medicare enrollment and entitlement information, MSP data necessary for appropriate Medicare claim payment, hospice election, MA plan elections and enrollment, End Stage Renal Disease (ESRD) entitlement, historic and current listing of residences, and Medicare eligibility and Managed Care institutional status. Additionally, this system will maintain identifying information on physicians, providers, employer plans, Medicaid recipients and Medicare secondary payers.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for the collection of data maintained in this system is given under &#167;&#167; 226, 226A, 1811, 1818, 1818A, 1831, 1833(a)(1)(A), 1836, 1837, 1838, 1843, 1866, 1874a, 1875, 1876, 1881, and 1902(a)(6) of the Social Security Act (the Act). The following are the corresponding sections from Title 42 of the United States Code (U.S.C.): 426, 426-1, 1395c, 1395i-2, 1395i-2a, 1395j, 1395l(a)(1)(A), 1395o, 1395p, 1395q, 1395v, 1395cc, 1395kk-l, 1395ll, 1395mm, 1395rr, 1396a(a)(6), and &#167; 101 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173), which established the Medicare Part D program.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this system is to establish an enterprise resource that will provide one integrated view of all CMS data to administer the Medicare and Medicaid programs. Information retrieved from this system of records will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or CMS grantee; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) support providers and suppliers of services for administration of Title XVIII; (4) assist third parties where the contact is expected to have information relating to the individual's capacity to manage his or her own affairs; (5) assist Medicare Advantage Plans and Part D Prescription Drug Plans; (6) support Quality Improvement Organizations (QIO); (7) assist other insurers for processing individual insurance claims; (8) facilitate research on the quality and effectiveness of care provided, as well as payment related projects; (9) support litigation involving the agency; and (10) combat fraud, waste, and abuse in certain health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To support agency contractors, consultants or grantees who have been engaged by the agency to assist in the performance of a service related to this system and who need to have access to the records in order to perform the activity.
</p> <p>2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
</p><p>a. Contribute to the accuracy of CMS' proper payment of Medicare benefits,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To support providers and suppliers of services directly or through fiscal intermediaries or carriers for the administration of Title XVIII of the Act.
</p> <p>4. To assist third party contact in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program; and
</p><p>a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: The individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exists, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
</p><p>b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: the individual's entitlement to benefits under the Medicare program, the amount of reimbursement, and in cases in which the evidence is being reviewed as a result of suspected fraud, waste, and abuse, program integrity, quality appraisal, or evaluation and measurement of activities.
</p> <p>5. To assist Medicare Advantage Plans, Part D Prescription Drug Plans and their Prescription Drug Event submitters, providing protection against medical expenses of their enrollees without the beneficiary's authorization, and having knowledge of the occurrence of any event affecting (a) an individual's right to any such benefit or payment, or (b) the initial right to any such benefit or payment, for the purpose of coordination of benefits with the Medicare program and implementation of the Medicare Secondary Payer provision at 42 U.S.C. 1395y(b).
</p> <p>Information to be disclosed shall be limited to Medicare entitlement, enrollment and utilization data necessary to perform that specific function. In order to receive the information, they must agree to:
</p><p>a. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a Third Party Administrator;
</p><p>b. Utilize the information solely for the purpose of processing the individual's enrollment or insurance claim; and
</p><p>c. Safeguard the confidentiality of the data and prevent unauthorized access.
</p> <p>6. To support Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities conducted pursuant to Part B of Title XI of the Act, and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans. As established by the Part D Program, QIOs will conduct reviews of prescription drug events data, or in connection with studies or other review activities conducted pursuant to Part D of Title XVIII of the Act.
</p> <p>7. To assist other insurers, underwriters, third party administrators (TPAs), self-insurers, group health plans, employers, health maintenance organizations, health and welfare benefit funds, Federal agencies, a state or local government or political subdivision of either (when the organization has assumed the role of an insurer, underwriter, or third party administrator, or in the case of a state that assumes the liabilities of an insolvent insurers pool or fund), multiple-employers trusts, no-fault medical, automobile insurers, workers' compensation carriers plans, liability insurers, and other groups providing protection against medical expenses who are primary payers to Medicare in accordance with 42 U.S.C. 1395y(b), or any entity having knowledge of the occurrence of any event affecting;
</p><p>a. An individual's right to any such benefit or payment, or
</p><p>b. The initial or continued right to any such benefit or payment (for example, a State Medicaid Agency, State Workers' Compensation Board, or Department of Motor Vehicles) for the purpose of coordination of benefits with the Medicare program and implementation of the MSP provisions at 42 U.S.C. 1395y(b). The information CMS may disclose will be:
</p><p>&#149; Beneficiary Name
</p><p>&#149; Beneficiary Address
</p><p>&#149; Beneficiary Health Insurance Claim Number
</p><p>&#149; Beneficiary Social Security Number
</p><p>&#149; Beneficiary Gender
</p><p>&#149; Beneficiary Date of Birth
</p><p>&#149; Amount of Medicare Conditional Payment
</p><p>&#149; Provider Name and Number
</p><p>&#149; Physician Name and Number
</p><p>&#149; Supplier Name and Number
</p><p>&#149; Dates of Service
</p><p>&#149; Nature of Service
</p><p>&#149; Diagnosis
</p><p>To administer the MSP provision at 42 U.S.C. 1395y(b)(2), (3), and (4) more effectively, CMS would receive (to the extent that it is available) and may disclose the following types of information from insurers, underwriters, third party administrator, self-insurers, etc.:
</p><p>&#149; Subscriber Name and Address
</p><p>&#149; Subscriber Date of Birth
</p><p>&#149; Subscriber Social Security number
</p><p>&#149; Dependent Name
</p><p>&#149; Dependent Date of Birth
</p><p>&#149; Dependent Social Security Number
</p><p>&#149; Dependent Relationship to Subscriber
</p><p>&#149; Insurer/Underwriter/TPA Name and Address
</p><p>&#149; Insurer/Underwriter/TPA Group Number
</p><p>&#149; Insurer/Underwriter/Group Name
</p><p>&#149; Prescription Drug Coverage
</p><p>&#149; Policy Number
</p><p>&#149; Effective Date of Coverage
</p><p>&#149; Employer Name, Employer Identification Number (EIN) and Address
</p><p>&#149; Employment Status
</p><p>&#149; Amounts of Payment
</p><p>To administer the MSP provision at 42 U.S.C. 1395y(b)(1) more effectively for entities such as Workers' Compensation carriers or boards, liability insurers, no-fault and automobile medical policies or plans, CMS would receive (to the extent that it is available) and may disclose the following information:
</p><p>&#149; Beneficiary's Name and Address
</p><p>&#149; Beneficiary's Date of Birth
</p><p>&#149; Beneficiary's Social Security number
</p><p>&#149; Name of Insured
</p><p>&#149; Insurer Name and Address
</p><p>&#149; Type of coverage; automobile medical, no-fault, liability payment, or workers' compensation settlement
</p><p>&#149; Insured's Policy Number
</p><p>&#149; Effective Date of Coverage
</p><p>&#149; Date of accident, injury or illness
</p><p>&#149; Amount of payment under liability, no-fault, or automobile medical policies, plans, and workers' compensation settlements
</p><p>&#149; Employer Name and Address (Workers' Compensation Only)
</p><p>&#149; Name of insured could be the driver of the car, a business, the beneficiary (i.e., the name of the individual or entity which carries the insurance policy or plan).
</p> <p>In order to receive this information the entity must agree to the following conditions;
</p><p>a. To utilize the information solely for the purpose of coordination of benefits with the Medicare program and other third party payer in accordance with Title 42 U.S.C. 1395y(b);
</p><p>b. To safeguard the confidentiality of the data and to prevent unauthorized access to it; and,
</p><p>c. To prohibit the use of beneficiary-specific data for the purposes other than for the coordination of benefits among third party payers and the Medicare program. This agreement would allow the entities to use the information to determine cases where they or other third party payers have primary responsibility for payment. Examples of prohibited uses would include but are not limited to; creation of a mailing list, sale or transfer of data.
</p> <p>To administer the MSP provisions more effectively, CMS may receive or disclose the following types of information from or to entities including insurers, underwriters, TPAs, and self-insured plans, concerning potentially affected individuals:
</p><p>&#149; Subscriber HICN
</p><p>&#149; Dependent Name
</p><p>&#149; Funding arrangements of employer group health plans, for example, contributory or non-contributory plan, self-insured, re- insured, HMO, TPA insurance.</p>
<p>&#149; Claims payment information, for example, the amount paid, the date of payment, the name of the insurers or payer
</p><p>&#149; Dates of employment including termination date, if appropriate
</p><p>&#149; Number of full and/or part-time employees in the current and preceding calendar years
</p><p>&#149; Employment status of subscriber, for example, full or part time or self-employed
</p><p>8. To assist an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>9. To support the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>10. To support a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
</p> <p>11. To support another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures
</p><p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that, because of the small size, use this information to deduce the identity of the beneficiary).
</p> <p>12. To assist a public or private entity that is qualified (as determined by the Secretary of the Department of Health and Human Services (the Secretary)) to use Medicare claims data to evaluate the performance of providers of services and suppliers on measures of quality, efficiency, effectiveness, and resource use; and who agrees to meet the requirements regarding the transparency of their methods and their use and protection of Medicare data as the Secretary may specify, if CMS:
</p><p>a. Determines that the use or disclosure does not violate legal limitations under which the record was provided, collected, or obtained; and
</p><p>b. Secures a written statement attesting to the information recipient's understanding of and willingness to abide by these provisions. Every Qualified Entity receiving data must have an agreement with CMS in the form of an Information Exchange Agreement or contract with all security and privacy requirements included. A Data Use Agreement (DUA) (CMS Form 0235) must be completed by the person receiving CMS data in accordance with current CMS policies.
</p> <p>This routine use fulfills the requirement in section 1174(e) of the Social Security Act (42 U.S.C. 1395kk (e)) to make standardized extracts of claims data under Medicare Parts A, B, and D available to a Qualified Entity (QE), recognized by the Secretary to make evaluations of provider/supplier performance in accordance with that section, and that agrees to meet specific requirements regarding the transparency of their methods and their use and protection of Medicare data. The IDR, National Claims History (NCH), CCDR, and Part D data will provide QEs, a broader, longitudinal, national perspective of the performance of Medicare providers/suppliers for use in authorized QE projects that could ultimately improve the care provided to Medicare beneficiaries and the policy that governs the care.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored electronically.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>All Medicare records are accessible by HICN, SSN, and unique provider identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.</p>
<p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained for a period of 6 years and 3 months. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Business Analysis &amp; Analysis, Enterprise Databases Group, Office of Information Services, CMS, Room N1 -14-08, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The data collected and maintained in this system are retrieved from the following databases: Medicare Drug Data Processing System, System No. 09-70-0553 (70 Federal Register (FR) 58436 (October 6, 2005)); Medicare Beneficiary Database, System No. 09-70 -0536 (71 FR 11425 (March 7, 2006)); Medicare Advantage Prescription Drug System, System No. 09-70-4001 (70 FR 60530 (October 18, 2005)); Medicaid Statistical Information System, System No. 09-70-0541 (71 FR 65527 (November 8, 2006)); Retiree Drug Subsidy Program, System No. 09-70-0550 (70 FR 41035 (July 15, 2005)); Common Working File, System No. 09-70-0526 (71 FR 64955 (November 6, 2006)); National Claims History, System No. 09-70-0005 (67 FR 57015 (September 6, 2002)); Enrollment Database, System No. 09-70-0502 (67 FR 3203 (January 23, 2002)); Multi-Carrier Claims System (formerly known as the Carrier Medicare Claims Record), System No. 09-70-0501 (71 FR 64968 (November 6, 2006)); Fiscal Intermediary Shared System (formerly known as the Intermediary Medicare Claims Record), System No. 09-70-0503 (71 FR 64961 (November 6, 2006)); Unique Physician/Provider Identification Number, System No. 09-70-0525, (69 FR 75316 (December 16, 2004)); Medicare Supplier Identification File, System No 09-70-0530 (71 FR 65527 (November 8, 2006). Information will also be provided from the application submitted by the individual through state Medicaid agencies, the Social Security Administration and through other entities assisting beneficiaries.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0572" toc="yes">
<systemNumber>09-70-0572</systemNumber>
<subsection type="systemName">National Disaster Medical System Claims Processing System (NDMS-CPS) HHS/CMS/CMM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The new system will collect data from individuals who receive treatment for services in an NDMS hospital for illness or injury resulting from a specified public health emergency or non-deferrable medical treatment or services to maintain health when such are temporarily not available as a result of the public health emergency. Patient data will be collected by the Federal Coordinating Centers and claims data on medical treatment and services furnished to NDMS-authorized patients will be reported by NDMS-participating hospitals (and practitioners within those facilities) to a CMS-contracted claims processor who will process claims under the NDMS-CPS.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The system will include, but is not limited to, name, social security number (SSN), address, dates of care, Diagnostic Related Group/Current Procedure Terminology (DRG/CPT) data, provider name, provider address, provider number, amount billed, amount allowed, other insurance payment, amount to be paid, and applicable Employer Identification Number.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for reimbursement of providers is found under section 102(a) of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, Pub. L. 107-188, which added section 2811 of the Public Health Service Act, 42 U.S.C. 300hh-11, as transferred to the Department of Homeland Security under the Homeland Security Act of 2002, Pub. L. 107-296, 6 U.S.C. 313(5), and the Economy Act, 31 U.S.C. 1535.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of the system is to justify and document payments for inpatient hospital and related practitioner services provided in connection to the NDMS. Information in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed by CMS and the NDMS Partners, contractors (including the NDMS claims contractor), and consultants contracted by the Agency; (2) support another Federal (including the NDMS Partners), agency of a State government, an agency established by state law, or its fiscal agent; (3) assist NDMS-participating hospitals (and practitioners within those hospitals) who have furnished services to individuals evacuated and placed by the NDMS; (4) assist third party contacts in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs; (5) facilitate research on the quality and effectiveness of care provided, as well as payment-related projects; (6) support constituent requests made to a congressional representative; (7) support litigation involving the Agency, and (8) combat fraud and abuse in certain Federal health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent>
     <p>
         <i>
             A. Entities Who May Receive Disclosures Under Routine Use:
         </i>
     </p>
     <p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the NDMS-CPS without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To Agency contractors (including the NDMS claims contractor), or consultants who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
</p> <p>2. To another Federal agency (including any of the NDMS Partner Agencies), an agency of a State government, an agency established by State law, or its fiscal agent to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. Assist Federal/State Medicaid programs within the State.
</p> <p>3. To providers and practitioners who have furnished NDMS-authorized medical treatment and/or services to individuals evacuated and placed for NDMS definitive medical care by the NDMS.
</p> <p>4. To third party contacts in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the NDMS program and,
</p><p>a. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: The individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exist, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
</p><p>b. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: The individual's entitlement to benefits under the NDMS program, the amount of reimbursement, and in cases in which the evidence is being reviewed as a result of suspected fraud and abuse, program integrity, quality appraisal, or evaluation and measurement of activities.
</p> <p>5. To an individual or organization for a research, evaluation, or epidemiological project related to the prevention of disease or disability, the restoration or maintenance of health, or payment-related projects.
</p> <p>6. To a Member of Congress or a congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>7. To the Department of Justice (DOJ), court or adjudicatory body when: The Agency or any component thereof, or
</p><p>a. Any employee of the Agency in his or her official capacity, or
</p><p>b. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>c. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>8. To a CMS contractor (including, but not limited to FIs and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p> <p>9. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p>
     <p>B. Additional Circumstances Affecting Routine Use Disclosures: </p><p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, 65 FR 82462 (12-28-00), subparts A and E. Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
</p><p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Computer diskette, magnetic storage media, and paper claims.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information will be retrieved by patient's name and SSN; and may be sorted by geographical area or medical provider.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. Office of Management and Budget Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained in a secure storage area with identifiers. Disposal occurs five years from the last action on the hospital's cost report, and should be coordinated with disposal of the reports. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Medicare Contractor Management Group, Center for Medicare Management, CMS, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the systems manager who will require the system name, SSN, address, date of birth, sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information contained in this system will be submitted by NDMS hospitals, other providers, and States.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0573" toc="yes">
<systemNumber>09-70-0573</systemNumber>
<subsection type="systemName"> "Chronic Condition Warehouse" (CCW) HHS/CMS/OEM.

</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified</p>

</xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850, and at various contractor sites.</p>

</xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>CCW will collect and maintain individually identifiable and other data collected on Medicare beneficiaries, Medicaid recipients, and individually identifiable data on certain health care professionals.</p>

</xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>The collected information will include, but is not limited to, individually identifiable Medicare and Medicaid claims, enrollment, and eligibility data, including names, addresses,  health insurance claims numbers, social security numbers, race/ethnicity data, gender, date of birth, Medicare Part A, B and C enrollment information, prescription drug coverage information, surgical procedures, diagnoses, provider name(s), unique provider identification numbers, National Provider Identification Numbers (NPI) as well as clinical assessment and outcome measures, and demographic, health/well-being, and background information relating to Medicare and Medicaid issues.</p>

</xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>The CCW is authorized by Sections 723 of the Medicare Prescription Drug Improvement and Modernization Act of 2003 (MMA) (Pub. L. 108""173), which was enacted into law on December 8, 2003, and amended Title XVIII of the Social Security Act (the Act); Section 1902(a)(6) of the Act; Section 1142(c)(6) of the Act; and Title IV of the Balanced Budget Act (Pub. L. 105-33).</p>

</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>The purpose of this system is to support research, policy analysis, quality improvement activities, and demonstrations that attempt to foster a better understanding of how to improve the quality of life and contain the health care costs of the chronically ill. This system will utilize data analytic tools to support accessing data by chronic conditions and process complex customized data requests related to chronic illnesses.

</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>The Privacy Act allows CMS to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "˜"˜routine use''. The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:</p>

<p>1. To CMS contractors who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity. </p>

<p>2. To another Federal or state agency to:</p>
<p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits;</p>
<p>b. Enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that  implements a health benefits program funded in whole or in part  with Federal funds; and/or</p>
<p>c. Assist Federal and/or state officials carrying out the Medicaid program.</p>

<p>3. To an individual or organization including grantees of a CMS administered grant program that require individually identifiable health information for use in research projects including any evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment reform related projects that produces generalizable knowledge.</p>

<p>4. To a healthcare provider who seeks patient information for use in care coordination and quality improvement activities as described at 45 CFR 164.506(c)(4);</p>

<p>5. To Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities conducted pursuant to Part B of Title XI of the Act, and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.</p>

<p>6. To a public or private Qualified Entity (QE) that uses Medicare claims data to evaluate the performance of providers of services and suppliers on measures of quality, efficiency, effectiveness, and resource use; and who agrees to meet the requirements regarding the transparency of their methods and their use and protection of Medicare data.</p>

<p>7. To the Department of Justice (DOJ), court or adjudicatory body when: a. The agency or any component thereof, or b. Any employee of the agency in his or her official capacity, or c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or d. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.</p>

<p>8. To a CMS contractor (including, but not necessarily limited to, Medicare Administrative Contractors (MACs)) that assists in the administration of a CMS- administered health benefits program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.</p>

<p>9. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part  by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend  against, correct, remedy, or otherwise combat fraud or abuse in such programs.</p>

<p>10.  To Federal Departments, agencies and their contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, where the information disclosed is relevant to and necessary for that assistance.</p>

<p>11.  To the U.S. Department of Homeland Security (DHS) cyber security personnel, if captured in an intrusion detection system used by HHS and DHS pursuant to the Einstein 2 program.</p>

<p>12.  To public health authorities, and those entities acting under a delegation of authority from a public health authority, when requesting beneficiary-identifiable information to carry out statutorily-authorized public health activities pertaining to emergency preparedness and response.  </p>

<p>B. ADDITIONAL CIRCUMSTANCES AFFECTING DISCLOSURE OF PII DATA:  </p>
<p>To the extent that the individual claims records in this system contain Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, Subparts A and E), disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information" (see 45 CFR 164-512 (a) (1)). </p>

<p>In addition, HHS policy will be to prohibit release even of data not directly identifiable with a particular individual, except pursuant to one of the routine uses or if required by law, if CMS determines there is a possibility that a particular individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of a particular individual).</p>

</xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>CMS will retain information for a total period not to exceed 30 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.

</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>

<p>Storage:</p>
<p>All records are stored on electronic media.

</p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>The collected data are retrieved by an individual identifier; e.g., beneficiary, recipient or provider name, HICN, or unique provider identification number (NPI).</p>

</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use.  Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.</p>

<p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; and the Federal Information Department regulation 45 CFR 5b.7.</p>

</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Director,  Data Development and Services Group, Office of Information Products and Data Analytics (OIPDA), OEM, Mail Stop B2-29-04, CMS,  7500 Security Boulevard, Baltimore, MD 21244""1849.</p>

</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>An individual record subject who wishes to know if this system contains records about him or her should write to the system manager who will require the system name, HICN, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).</p>

</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>An individual seeking access to records about him or her in this system should use the same procedures outlined in Notification Procedures above.  The requestor should also reasonably specify the record contents being sought.  (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2).)</p>

</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>To contest a record, the subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested.  The individual should state the corrective action sought and the reasons for the correction with supporting justification.  (These procedures are in accordance with Department regulation 45 CFR 5b.7.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>The data  collected and  maintained in this  system are retrieved from the following databases: Medicare Drug Data Processing System, System No. 09""70""0553 (73 FR 30943 (May 29, 2008)); Medicare Beneficiary Database, System No. 09""70""0536 (71 FR 70396 (December 4, 2006)); Medicare Advantage Prescription Drug System, System No. 09""70""0588 (76 FR 47190 (August 4, 2011)); Medicaid Statistical Information System, System No. 09""70""0541 (71 FR 65527 (November 8, 2006)); Retiree Drug Subsidy Program, System No. 09""70""0550 (70 FR 41035  (July 15, 2005)); Common Working File,  System No. 09""70""0526 (71 FR 64955 (November 6, 2006)); National Claims History, System No. 09""70""0558 (71 FR 67137 11/20/2006 (November 20, 2006)); Enrollment Database, System No. 09""70""0502 (73 FR 10249 2/26/2008 (February 26, 2008)); Carrier Medicare Claims Record, System No. 09""70""0501 (71 FR 64968 11/6/2006 (November 6, 2006)); Intermediary Medicare Claims Record, System No. 09""70""0503 (71 FR 648961 (November 6, 2006)); Unique Physician/Provider Identification Number, System No. 09""70""0525 (71 FR 66535  (November 15, 2006)); Medicare Supplier Identification File, System No. 09""70""0530 (71 FR 70404 (December 4, 2006)),  A Current Beneficiary Survey, System No. 09""70""0519 (71 FR 60722 (October 16, 2006)); National Plan  &amp; Provider Enumerator System, System No. 09""70""0555, (75 FR 30411 (June 1, 2010)); Long Term  Care MDS, System No. 09""70""0528 (72 FR 12801  (March 19, 2007)); HHA Outcome and Assessment Information Set, System No. 09""70""0522 (72 FR 63906 (November 13, 2007)); and  Integrated Data Repository, System No. 09""70""0571 (71 FR 74915 (December 13, 2006))); Provider Enrollment Chain and Ownership System, System No. 09-70-0532 (71FR 60536 (October 13, 2006); Medicare and Medicaid Electronic Health Record (EHR) Incentive Program National Level Repository, System No. 09-70-0587 (75 FR 73095 (November 29, 2010)); Performance Measurement and Reporting System, System No. 09-70-0584 (74 FR 17672  (April 16, 2009)); Encounter Data System, 09-70-0506 (79 FR 34539 (June 17, 2014)); and National Death Index, 09-20-0166 (49 FR 37692 (September 25, 1984)).

</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.

</p></xhtmlContent></subsection></section>
<section id="09-70-0574" toc="yes">
<systemNumber>09-70-0574</systemNumber>
<subsection type="systemName">"Medicare Health Support System (MHS)," HHS/CMS/CMM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co- locations of CMS agents.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system will collect and maintain individually identifiable and other data collected on Medicare beneficiaries who are potential participants in the MHS program and their providers who provide services to such beneficiaries. Data will be collected from Medicare administrative and claims records, CCIO administrative data systems, patient medical charts, physician records, and via survey instruments administered to beneficiaries and providers.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will include, but is not limited to: Medicare claims and eligibility data, name, address, telephone number, health insurance claims number, race/ethnicity, gender, date of birth, provider name, unique provider identification number, medical record number, as well as clinical, demographic, health/well-being, family and/or caregiver contact information, and background information relating to Medicare issues. It will also include chronic care diagnosis, treatment, program participation, and evaluation, survey, and research information needed to evaluate the program and develop research reports on findings.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for this system is given under the provisions of Section 721 of the Medicare Prescription Drug Improvement, and Modernization Act of 2003 and Section 1807(a)(1) of the Social Security Act.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain demographic and health related data on the target population of Medicare beneficiaries who are potential participants in the MHS program. We will also collect certain identifying information on Medicare providers who provide services to such beneficiaries. Information retrieved from this system may be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, grantee, consultant or other legal agent; (2) assist another Federal or state agency with information to contribute to the accuracy of CMS's proper payment of Medicare benefits, enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; (4) support constituent requests made to a Congressional representative; (5) support litigation involving the agency; and (6) combat fraud and abuse in certain Federally-funded health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
</p> <p>2. To another Federal or state agency to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits;
</p><p>b. Enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>4. To a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>5. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>6. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
</p> <p>7. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures
</p><p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on electronic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The collected data are retrieved by an individual identifier; <i>e.g.</i>, beneficiary name or HICN.</p></xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain information for a total period not to exceed 25 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Chronic Care Improvement Programs, Provider Billing Group, Center for Medicare Management, CMS, Mail Stop C4 -10-07, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The data contained in this system of records will be collected from Medicare administrative and claims records, CCIO administrative data systems, patient medical charts, physician records, and via survey instruments administered to beneficiaries and providers.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0575" toc="yes">
<systemNumber>09-70-0575</systemNumber>
<subsection type="systemName">"Organ Procurement Organizations System (OPOS)" HHS/CMS/OCSQ.
</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS) Central Office and Regional Offices, and at various contractor locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>OPOS will maintain a file of complaint allegations filed by a complainant, beneficiary, or providers of services made against OPOs, information gathered during the complaint investigation, findings and results of the investigation, and correspondence relating to the investigation.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will contain name, address, telephone number, health insurance claim number (HICN), geographic location, as well as, background information relating to Medicare or Medicaid issues of the complainant.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for this system is given under the Organ Procurement Organization Certification Act of 2000 (&#167; 701 of Pub. L. 106 -505) and &#167; 219 of the Conference Report accompanying the Consolidated Appropriations Act, 2001 (Pub. L. 106-554) containing identical provisions that amended &#167; 371(b)(1) of the Public Health Service (PHS) Act (42 U.S.C. 273(b)(1)). Authority is also given under &#167;&#167; 1102 and 1138 of the Social Security Act (the Act) (42 U.S.C. 1302, and 42 U.S.C. 1320b-8), &#167; 1138(b) of the Act also specifies that an OPO must operate under a grant made under &#167; 371(a) of the PHS Act.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain individually identifiable information pertaining to complaint allegations filed by a complainant, beneficiary, or providers of services made against OPOs, information gathered during the complaint investigation, findings and results of the investigation, and correspondence relating to the outcome of the investigation. Information retrieved from this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency, or by a contractor, consultant or grantee; (2) assist another Federal or state agency in the enforcement of OPO regulations where sharing the information is necessary to complete the processing of a complaint, contribute to the accuracy of CMS's proper payment of Medicare benefits, and/or enable such agency to administer a Federal health benefits program; (3) support constituent requests made to a Congressional representative; and (4) support litigation involving the agency.</p>
</xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>C. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees who have been engaged by the agency to assist in the performance of a service related to this system of records and who need to have access to the records in order to perform the activity.
</p> <p>2. To another Federal or state agency to:
</p><p>a. Assist in the enforcement of Organ Procurement Organizations regulations for violations of Conditions for Coverage for Organ Procurement Organizations where sharing the information is necessary to complete the processing of a complaint,
</p><p>b. Contribute to the accuracy of CMS's proper payment of Medicare benefits, and/or
</p><p>c. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds.
</p> <p>3. To a member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>4. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>D. Additional Provisions Affecting Routine Use Disclosures. To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the individual).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored electronically and in hard copy.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The complaint data are retrieved by an individual identifier i.e., name of complainant.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain complaint information for a total period not to exceed 25 years.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Director, Division of Continuing Care Providers, Survey and Certification Group, Center for Medicaid and State Operations, CMS, 7500 Security Boulevard, Mail Stop S2-01-16, Baltimore, Maryland 21244-1849.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>This system is exempt under the provisions of 5 U.S.C. 552a(k)(2) of the Privacy Act. However, portions of this system notice are non- exempt and consideration will be given to requests addressed to the system manager for those portions. For general inquiries, it would be helpful if the request included the system name, address, age, sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable) and complaint tracking identification number.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>CMS investigative files maintained in OPOS are either received as electronic documents or paper records that are compiled for administrative, civil, and law enforcement purposes. In the course of investigations, CMS often has a need to obtain confidential information involving individuals other than the complainant.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>HHS claims exemption of certain records (case files on active fraud investigations) in the system from notification and access procedures under 5 U.S.C. 552a(k)(2) inasmuch as these records are investigatory materials compiled for program, administrative, and law enforcement in anticipation of a criminal or administrative proceedings. (See Department Regulation (45 CFR 5b.11)).
</p></xhtmlContent></subsection></section>
<section id="09-70-0576" toc="yes">
<systemNumber>09-70-0576</systemNumber>
<subsection type="systemName">"Healthcare Common Procedure Coding System (HCPCS) Level II".</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level 3 Privacy Act Sensitive.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS), 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information is collected for this system on individuals who voluntarily submit information regarding any modification and/or applications to modify the HCPCS Level II Code Set.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Information collected for this system will include, but is not limited to, applicant name, company name, product's generic or trade name, company mailing address, e-mail address, telephone number, and fax number.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for this system is given under the Health Insurance Portability and Accountability Act (HIPAA) of 1996, Public Law 104 -191, its implementing regulation on "Code Sets" (45 Code of Federal Regulations part 162, Subpart J) and 65 <i>Federal Register</i> 50312 (8-17-00).
</p><p>The primary purpose of this system is to facilitate the management and maintenance of the HCPCS Level II code set. Information in this system will also be used to: (1) Support regulatory and policy functions performed within the Agency or by a contractor, consultant, or grantee; (2) assist another Federal or state agency; (3) support litigation involving the Agency related to this system; and (4) combat fraud, waste, and abuse in certain health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To Agency contractor, consultant, or grantee who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
</p> <p>2. To another Federal or state agency to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To the Department of Justice (DOJ), court or adjudicatory body when
</p><p>a. The Agency or any component thereof; or
</p><p>b. Any employee of the Agency in his or her official capacity; or
</p><p>c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or
</p><p>d. The United States Government; is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation.
</p> <p>4. To a CMS contractor (including, but not necessarily limited to Medicare administrative contractors, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
</p> <p>5. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures
</p><p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the specified population is so small that an individual could, because of the small size, use this information to deduce the identity of the applicant).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on electronic and hard copy media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information can be retrieved by applicant name, e-mail address, manufacturer name, product name, generic name, or code assigned.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, the Federal Records Act of 1950, as amended, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook, CMS Information Security Handbook, and the National Archives and Records Administration's General Record Schedules and CMS' Records Schedules.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain information for a total period of 15 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Chronic Care Policy Group, Centers for Medicare Management, CMS, Mail Stop C5-09-16, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, and for verification purposes, the subject individual's name (woman's maiden name, if applicable).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Sources of information contained in this records system include data collected from HCPCS applications, submitted by the individuals who voluntarily apply for HCPCS Level II Code modifications.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-70-0578" toc="yes">
<systemNumber>09-70-0578</systemNumber>
    <subsection type="systemName">
        Medicaid Program and State Children's Health Insurance Program Payment Error Rate Measurement (PERM)".
    </subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level 3 Privacy Act Sensitive.
</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS), 7500 Security Boulevard, Baltimore, Maryland 21244-1850; and at various contractor location.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information in this system is collected on eligibility and claims information included in the annual random sample to measure Medicaid and SCHIP payment error rates.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Information collected for this system will include, but is not limited to, name, Medicaid and SCHIP identification number, Medicaid and SCHIP claims data, provider's medical records, claim numbers, managed care capitation payment data, and eligibility-related information on the Medicaid and SCHIP beneficiaries included in the eligibility sample.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for this system is given under provisions of the Improper Payments Information Act of 2002 (Pub. L. 107-300), sections 1102, 1902(a)(6), 1902(a)(27), and 2107(b)(1) of the Social Security Act.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this system is to collect and maintain individually identifiable claims information to calculate payment error rates for Medicaid and SCHIP programs. Information in this system will also be used to: (1) Support regulatory and policy functions performed within the Agency or by a contractor, consultant or grantee; (2) assist another Federal or state agency in the proper administration of the Medicare program, enable such agency to administer a Federal health benefits program, and/or assist Federal/state Medicaid programs within the state; (3) support constituent requests made to a Congressional representative; (4) to support litigation involving the Agency related to this system; and (5) combat fraud and abuse in certain health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system to:
</p><p>1. Agency contractors, consultants or grantees who have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
</p> <p>2. Another Federal or state agency to:
</p><p>a. Contribute to the accuracy of CMS's proper administration of the Medicare program,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. Assist Federal/state Medicaid and/or SCHIP programs within the state.
</p> <p>3. Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>4. The Department of Justice (DOJ), court or adjudicatory body when
</p><p>a. The Agency or any component thereof; or
</p><p>b. Any employee of the Agency in his or her official capacity; or
</p><p>c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. A CMS contractor (including, but not necessarily limited to Federal contractors engaged by CMS to develop and calculate Medicaid and SCHIP payment and eligibility error rates) that assists in the administration of a CMS-administered program to measure payment error rates in the Medicaid and SCHIP programs, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
</p> <p>6. Another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures. To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on electronic and/or hard copy media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information can be retrieved by provider name, beneficiary name, claim number, Medicaid or SCHIP identification number, or other identifying variables.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain information for a total period of 6 years and 3 months. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Director, Division of Analysis and Evaluation, Program Integrity Group, Office of Financial Management, CMS, Mail Stop C3-02 -16, 7500 Security Boulevard, Baltimore, Maryland, 21244-1850.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, Medicaid Identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and Social Security Number (SSN) (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2)).
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Sources of information contained in this records system include data collected from claims submitted by providers participating in the Medicaid and SCHIP programs, provider's medical records, and information collected on individuals to establish their eligibility for these programs.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0580" toc="yes">
<systemNumber>09-70-0580</systemNumber>
<subsection type="systemName">"Medicare Care Management for High Cost Beneficiaries (CMHCB)," HHS/CMS/CMM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co-locations of CMS agents.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system will collect and maintain individually identifiable and other data collected on Medicare beneficiaries who are potential participants in the CMHCB program and providers who provide services to such beneficiaries. Data will be collected from Medicare administrative and claims records, CMHCB site administrative data systems, patient medical charts, physician records, and via survey instruments administered to beneficiaries and providers.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will include, but is not limited to: Medicare claims and eligibility data, name, address, telephone number, health insurance claims number, race/ethnicity, gender, date of birth, provider name, unique provider identification number, medical record number, as well as clinical, demographic, health/well-being, family and/or caregiver contact information, and background information relating to Medicare issues. It will also include chronic care diagnosis, treatment, program participation, and evaluation, survey, and research information needed to evaluate the program and develop research reports on findings.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for this system is given under the provisions of the Social Security Act (42 U.S.C. Section 1395b-1(a)).
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain demographic and health related data on the target population of Medicare beneficiaries who are potential participants in the CMHCB program. We will also collect certain identifying information on Medicare providers who provide services to such beneficiaries. Information retrieved from this system may be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, grantee, consultant or other legal agent; (2) assist another Federal or state agency with information to contribute to the accuracy of CMS's proper payment of Medicare benefits, enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; (4) support litigation involving the agency; and (5) combat fraud and abuse in certain Federally-funded health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
</p> <p>2. To another Federal or state agency to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits;
</p><p>b. Enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>4. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
</p> <p>6. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures. To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a) (1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that because of the small size, use of this information could allow for the deduction of the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on electronic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The collected data are retrieved by an individual identifier; e.g., beneficiary name or HICN.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain information for a total period not to exceed 25 years. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Chronic Care Improvement Programs, Provider Billing Group, Center for Medicare Management, CMS, Mail Stop C4 -10-07, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Data will be collected from Medicare administrative and claims records, CMHCB site administrative data systems, patient medical charts, physician records, and via survey instruments administered to beneficiaries and providers.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0582" toc="yes">
<systemNumber>09-70-082</systemNumber>
<subsection type="systemName">"Low Vision Rehabilitation Demonstration (LVRD)" HHS/CMS/ORDI.
</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level 3 Privacy Act Sensitive.
</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>This system is maintained at the Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850, and CMS contractors and agents at various locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The data will be collected and maintained on individual beneficiaries receiving the services and who participate in Medicare Part B fee-for-service coverage, qualified physicians, such as ophthalmologists or optometrists, qualified occupational therapists, and certified low vision therapists, orientation and mobility specialists, and vision rehabilitation therapists (aka rehabilitation teachers) who are certified by the Academy for Certification of Vision Rehabilitation Professionals.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The data collected will consist of, but not limited to, clinical quality measures collected from physicians participating in the demonstration. The collected information will contain provider name, unique provider identification number, unique demonstration practice identification number, beneficiary health insurance claim number (HICN), beneficiary demographic and diagnostic information relevant to the project.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>The authority for maintenance of this system is given under the provisions of Section 641 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (Public Law 108-173), enacted into law on December 8, 2003, and amended Title XVIII of the Social Security Act.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of the system is to collect and maintain identifiable information on Medicare beneficiaries who participate in Medicare Part B fee-for-service coverage, qualified physicians, such as ophthalmologists or optometrists, qualified occupational therapists, and vision rehabilitation therapists who are certified by the Academy for Certification of Vision Rehabilitation Professionals. Information retrieved from this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant, or grantee; (2) assist another Federal or state agency with information to enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) assist an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; (4) support litigation involving the agency; and (5) combat fraud, waste, and abuse in certain health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. Entities Who May Receive Disclosures Under Routine Use </p><p>The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To support agency contractors, consultants, or grantees who have been contracted by the agency to assist in the performance of a service related to this system and who need to have access to the records in order to perform the activity.
</p> <p>2. To assist another Federal or state agency to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>3. To assist an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>4. To support the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Aany employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. To assist a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.
</p> <p>6. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p>
<p>B. Additional Provisions Affecting Routine Use Disclosures </p><p>This system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 Code of Federal Regulation Parts 160 and 164, 65 Fed. Reg. 82462 (12-28-00), Subparts A and E. Disclosures of PHI authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
</p><p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the population is so small that one could use this information to deduce the identity of the individual).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on magnetic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information collected will be retrieved by the name or other identifying information of the participating provider, and may also be retrievable by HICN at the individual beneficiary record level.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. Office of Management and Budget Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain identifiable information maintained in the LVRD system of records for a period of 6 years. Data residing with the designated claims payment contractor shall be returned to CMS at the end of the project, with all data then being the responsibility of CMS for adequate storage and security. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from the DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Research and Evaluation Group, Office of Research Development and Information, CMS, 7500 Security Boulevard, Mail stop C3 -18-07, Baltimore, Maryland, 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, and for verification purposes, the subject individual's name, provider identification number, and the patient's medical record number.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information maintained in this system will be collected from physicians volunteering to participate in the LVRD Demonstration. Additional data will be collected from Medicare claims payment records.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
        <section id="09-70-0584" toc="yes">
            <systemNumber>09-70-0584</systemNumber>
            <subsection type="systemName">Performance Measurement and Reporting System (PMRS), HHS/CMS/OCSQ.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        Level Three Privacy Act Sensitive.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>The system contains single and multi-payer, patient de-identified, individual physician, practitioner or other provider-level performance measurement results as well as, clinical and claims information provided by individual physicians, practitioners and providers of services, individuals assigned to provider groups, insurance and provider associations, government agencies, accrediting and quality organizations, and others who are committed to improving the quality of physician, practitioner, and other providers services.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        This system contains the patient's or beneficiary's name, sex, health insurance claim number (HIC), Social Security Number (SSN), address, date of birth, medical record number(s), prior stay information, provider name and address, physician's name, and/or identification number, date of admission or discharge, other health insurance, diagnosis, surgical procedures, and a statement of services rendered for related charges and other data needed to substantiate claims. The system contains provider characteristics, prescriber identification number(s), assigned provider number(s) (facility, referring/servicing physician), and national drug code information, total charges, and Medicare payment amounts.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>Authority for the collection, maintenance, and disclosures from this system is given under provisions of sections 1152, 1153(c), 1153(e), 1154, 1160, 1833(t), 1848(k), 1848(m), 1851(d) and 1862(g) of the Social Security Act; sections 101 and 109 of division B of the Tax Relief and Health Care Act of 2006; section 101 of the Medicare, Medicaid, and SCHIP Extension Act of 2007, sections 131 and 132 of MIPPA, and sections 901, 912, and 914 of the Public Health Service Act.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        The primary purpose of this system is to support the collection, maintenance, and processing of information to promote the delivery of high quality, efficient, effective and economical delivery of health care services, and promoting the quality of services of the type for which payment may be made under title XVIII by allowing for the establishment and implementation of performance measures, provision of feedback to physicians, and public reporting of performance information. Information in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed for the Agency or by a contractor, consultant, or a CMS grantee; (2) assist another Federal and/or state agency, agency of a state government, or an agency established by state law; (3) promote more informed choices by Medicare beneficiaries among their Medicare group options by making physician performance measurement information available to Medicare beneficiaries through a website and other forms of data dissemination; (4) provide CVEs and data aggregators with information that will assist in generating single or multi-payer performance measurement results to promote transparency in health care to members of their community; (5) assist individual physicians, practitioners, providers of services, suppliers, laboratories, and others health care professionals who are participating in health care transparency projects; (6) assist individuals or organizations with projects that provide transparency in health care on a broad-scale enabling consumers to compare the quality and price of health care services; or for research, evaluation, and epidemiological projects related to the prevention of disease or disability; restoration or maintenance of health or for payment purposes; (7) assist Quality Improvement Organizations; (8) support litigation involving the agency; and (9) and (10) combat fraud, waste, and abuse in certain health benefits programs.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>
                        A. Entities Who May Receive Disclosures Under Routine Use
                    </p>
                    <p>
                        These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the PMRS without the consent/authorization of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish the following routine use disclosures of information maintained in the system:
                    </p>
                    <p>
                        1. To support Agency contractors, consultants, or CMS grantees who have been engaged by the Agency to assist in accomplishment of a CMS function relating to the purposes for this SOR and who need to have access to the records in order to assist CMS.
                    </p> 
                    <p>
                        2. Pursuant to agreements with CMS to assist another Federal or state agency, agency of a state government, or an agency established by state law to:
                    </p>
                    <p>
                        a. contribute to projects that provide transparency in health care on a broad-scale enabling consumers to compare the quality and price of health care services,
                    </p>
                    <p>
                        b. contribute to the accuracy of CMS's proper payment of Medicare benefits,
                    </p>
                    <p>
                        c. enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
                    </p>
                    <p>
                        d. assist Federal/state Medicaid programs which may require PMRS information for purposes related to this system.
                    </p> 
                    <p>
                        3. To assist in making the individual physician-level performance measurement results available to Medicare beneficiaries, through a website and other forms of data dissemination, in order to promote more informed choices by Medicare beneficiaries among their Medicare coverage options.
                    </p> 
                    <p>
                        4. To provide Chartered Value Exchanges (CVE) and data aggregators with information that will assist in generating single or multi-payer performance measurement results that will assist beneficiaries in making informed choices among individual physicians, practitioners and providers of services; enable consumers to compare the quality and price of health care services; and assist in providing transparency in health care at the local level if CMS:
                    </p>
                    <p>
                        a. determines that the use or disclosure does not violate legal limitations under which the record was provided, collected, or obtained;
                    </p>
                    <p>
                        b. determines that the purpose for which the disclosure is to be made:
                    </p>
                    <p>
                        (1) is of sufficient importance to warrant the effect and/or risk on the privacy of the individual that additional exposure of the record might bring, and
                    </p>
                    <p>
                        (2) there is reasonable probability that the objective for the use would be accomplished;
                    </p>
                    <p>
                        c. requires the recipient of the information to establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record,
                    </p>
                    <p>
                        d. make no further use or disclosure of the record except:
                    </p>
                    <p>
                        (1) for use in another project providing transparency in health care, under these same conditions, and with written authorization of CMS;
                    </p>
                    <p>
                        (2) when required by law.
                    </p> 
                    <p>
                        e. secures a written statement attesting to the information recipient's understanding of and willingness to abide by these provisions. CVEs and data aggregators should complete a Data Use Agreement (CMS Form 0235) in accordance with current CMS policies.
                    </p> 
                    <p>
                        5. To assist individual physicians, practitioners, providers of services, suppliers, laboratories, and others health care professionals who are participating in health care transparency projects.
                    </p> 
                    <p>
                        6. To assist an individual or organization with projects that provide transparency in health care on a broad-scale enabling consumers to compare the quality and price of health care services; or for research, evaluation, and epidemiological projects related to the prevention of disease or disability; restoration or maintenance of health or for payment purposes if CMS:
                    </p>
                    <p>
                        a. determines that the use or disclosure does not violate legal limitations under which the record was provided, collected, or obtained;
                    </p>
                    <p>
                        b. determines that the purpose for which the disclosure is to be made:
                    </p>
                    <p>
                        (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form,
                    </p>
                    <p>
                        (2) is of sufficient importance to warrant the effect and/or risk on the privacy of the individual that additional exposure of the record might bring, and
                    </p>
                    <p>
                        (3) there is reasonable probability that the objective for the use would be accomplished;
                    </p>
                    <p>
                        c. requires the recipient of the information to:
                    </p>
                    <p>
                        (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, and
                    </p>
                    <p>
                        (2) remove or destroy the information that allows the individual to be identified at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the project, unless the recipient presents an adequate justification of a research or health nature for retaining such information, and
                    </p>
                    <p>
                        (3) make no further use or disclosure of the record except:
                    </p>
                    <p>
                        (a) for disclosure to a properly identified person, for purposes of providing transparency in health care enabling consumers to compare the quality and price of health care services so that they can make informed choices among individual physicians, practitioners and providers of services;
                    </p>
                    <p>
                        (b) in emergency circumstances affecting the health or safety of any individual;
                    </p>
                    <p>
                        (c) for use in another research project, under these same conditions, and with written authorization of CMS;
                    </p>
                    <p>
                        (d) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit; or
                    </p>
                    <p>
                        (e) when required by law.
                    </p> 
                    <p>
                        d. secures a written statement attesting to the information recipient's understanding of and willingness to abide by these provisions. Researchers should complete a Data Use Agreement (CMS Form 0235) in accordance with current CMS policies.
                    </p> 
                    <p>
                        7. To support Quality Improvement Organizations (QIO) in connection with review of claims, or in connection with studies or other review activities conducted pursuant to Part B of Title XI of the Act and in performing affirmative outreach activities to individuals for the purpose of establishing and maintaining their entitlement to Medicare benefits or health insurance plans.
                    </p> 
                    <p>
                        8. To support the Department of Justice (DOJ), court, or adjudicatory body when:
                    </p>
                    <p>
                        a. the Agency or any component thereof, or
                    </p>
                    <p>
                        b. any employee of the Agency in his or her official capacity, or
                    </p>
                    <p>
                        c. any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                    </p>
                    <p>
                        d. the United States Government,
                    </p>
                    <p>
                        is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                    </p> 
                    <p>
                        9. To assist a CMS contractor (including, but not limited to MACs, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
                    </p> 
                    <p>10. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.</p>
                    <p>
                        B. Additional Circumstances Affecting Routine Use Disclosures
                    </p>
                    <p>
                        To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the " Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164-512(a)(1).)
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p> 
                    <p>
                        Records are stored on both tape cartridges (magnetic storage media) and in a DB2 relational database management environment (DASD data storage media).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        Information is most frequently retrieved by HICN, provider number (facility, physician, IDs), service dates, and beneficiary state code.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                    </p> 
                    <p>
                        This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        Records are maintained with identifiers for all transactions after they are entered into the system for a period of 20 years. Records are housed in both active and archival files. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from the Department of Justice.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        Director, Quality Measurement and Health Assessment Group, Office of Clinical Standards and Quality, CMS, Room C1-23-14, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        For purpose of notification, the subject individual should write to the system manager who will require the system name, and the retrieval selection criteria (e.g., HICN, Provider number, etc.).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>
                        For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>
                        The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        Medicare Beneficiary Database (09-70-0536), National Claims History File (09-70-0558), and private physicians, private providers, laboratories, other providers and suppliers who are participating in health care transparency projects sponsored by the Agency.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemsExempted">
                <xhtmlContent>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
        </section>
        <section id="09-70-0586" toc="yes">
            <systemNumber>09-70-0586</systemNumber>
            <subsection type="systemName">Health Insurance Assistance Database (HIAD), HHS/CMS/CCIIO.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        Level Three Privacy Act Sensitive.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites.
                    </p> 
                    <p>
                        Center for Consumer Information and Insurance Oversight, Centers for Medicare and Medicaid Services, U.S. Department of Health &amp; Human Services, Triple-I Core Site, 12100 Sunrise Valley Drive, Reston, Virginia 20191.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>
                        Information in this system is maintained on individuals who contact the CCIIO Health Insurance Assistance Team, complainants or other individuals with health insurance issues.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        The HIAD contains the name, address, State of residence and zip code; contact information such as telephone numbers, e-mail address, demographic information such as age, gender, ethnicity, family status, employment status, income level and veteran's status; and health insurance identification number, health insurance status, background, recent history and available options.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>
                        Authority for the collection, maintenance, and disclosures from this system is provided under provisions of &#167;&#167; 2719, 2723, and 2761 of the Public Health Service Act (PHS Act) (Public Law (Pub. L.) 97-35) and &#167; 1321(c) of the Patient Protection and Affordable Care Act (Affordable Care Act) (Pub. L. 111-148).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>
                        The primary purposes of this system is to collect and maintain information on consumer inquiries and complaints regarding insurance issuers that will permit CCIIO to exercise its direct enforcement authority over non-Federal governmental health plans, investigate any inquiries or complaints from enrollees of those plans, to determine which States may not be substantially enforcing the Affordable Care Act and PHS Act provisions and to determine whether complaints that indicate possible noncompliance with Federal law are resolved by the plans. In addition, information maintained will enable CCIIO to develop aggregate reports that will inform CMS and HHS about compliance issues. Information in this system will also be disclosed to: (1) Support regulatory and programmatic activities such as investigations and reporting activities performed by an Agency contractor, consultants, CMS grantees, student volunteers, interns and other workers who do not have the status of Federal employees; (2) assist another Federal and/or State agency, agency of a State government, or an agency established by State law; (3) support litigation involving the Agency; (4) combat fraud, waste, and abuse in certain health benefits programs, and (5) assist in a response to a suspected or confirmed breach of the security or confidentiality of information.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>
                        B. Entities Who May Receive Disclosure Under Routine Use
                    </p>
                    <p>
                        These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the HIAD without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish the following routine use disclosures of information maintained in the system:
                    </p>
                    <p>3. To support Agency contractors, consultants, CMS grantees, student, volunteers, interns and other workers who do not have the status of Federal employees, who have been engaged by the Agency to assist in accomplishment of a CMS function relating to the purposes for this SOR and who need to have access to the records in order to assist CMS.</p>
                    <p>
                        4. To assist another Federal or State agency, agency of a State government, or an agency established by State law pursuant to agreements with CMS to:
                    </p>
                    <p>
                        a. Increase consumer assistance and accessibility to health care coverage by identifying insurer noncompliance with Federal, State and other applicable law, and
                    </p>
                    <p>
                        b. Assist Federally funded health insurance programs in administering functions tasked to them pursuant to the Affordable Care Act and other relevant Federal and State laws which may require CCIIO Program information related to this system.
                    </p> 
                    <p>
                        c. Assist other Federal/State agencies that have the authority to perform collection of debts owed to the Federal government.
                    </p> 
                    <p>
                        5. To support the Department of Justice (DOJ), court, or adjudicatory body when:
                    </p>
                    <p>
                        e. The Agency or any component thereof, or
                    </p>
                    <p>
                        f. Any employee of the Agency in his or her official capacity, or
                    </p>
                    <p>
                        g. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                    </p>
                    <p>
                        h. The United States Government,
                    </p>
                    <p>
                        is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                    </p> 
                    <p>
                        6. To assist a CMS contractor (including, but not limited to Medicare Administrative Contractors, fiscal intermediaries, and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
                    </p> 
                    <p>
                        7. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
                    </p> 
                    <p>
                        8. To assist appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and unnecessary for the assistance.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                    </p> 
                    <p>
                        This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p> 
                    <p>
                        Records are maintained electronically in the CCIIO developed database for collection, tracking and storage of casework information and for reporting purposes. Any manually maintained records will be kept in locked cabinets or otherwise secured areas.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        The records are retrieved electronically by a variety of fields, including but not limited to name, State, zip code, and health insurance identification number issued to the individual.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        Records are maintained with identifiers for all transactions after they are entered into the system for a period of 10 years. Records are housed in both active and archival files. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from the Department of Justice.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        Team Lead, Health Insurance Assistance Team, Office of Consumer Support, Center for Consumer Information and Insurance Oversight, Centers for Medicare and Medicaid Services, 7500 Security Boulevard, Baltimore, Maryland 21244.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        For purpose of notification, the subject individual should write to the system manager who will require the system name and the retrieval selection criteria (<i>e.g.,</i> name, health insurance claim number, SSN, <i>etc.</i>)
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>
                        For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>
                        The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        The identifying information contained in these records is provided voluntarily by the individual consumers, confidential informants, or by reports received from other sources . Additional case-relevant information may also be provided by the individual's employer or insurer to assist in achieving resolution of the specific case.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemsExempted">
                <xhtmlContent>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
        </section>
        <section id="09-70-0587" toc="yes">
            <systemNumber>09-70-0587</systemNumber>
            <subsection type="systemName">Medicare and Medicaid Electronic Health Record (EHR) Incentive Program National Level Repository, HHS/CMS/OESS.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        Level Three Privacy Act Sensitive.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>
                        The National Level Repository (NLR) contains information on eligible professionals who receive Medicare incentives as meaningful users of certified EHR technology.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        The NLR will contain provider name, National Provider Identifier (NPI), business address and phone number, Taxpayer Identification Number (TIN) to which the EP, eligible hospital or CAH, or MA Organization wants the incentive payment to be made, and, for EPs, whether they choose to participate in the Medicare EHR Incentive Program or the Medicaid EHR Incentive Program. For eligible hospitals and CAHs, their CCN will also be included. For MA Organizations, their CMS contract number will be included. For providers participating in the Medicaid EHR Incentive Program, it will include the State in which they choose to participate. Additionally, EPs, eligible hospitals and CAHs will have the option to provide an e-mail address for inclusion in the system. At this time, participation in the Medicare and Medicaid EHR Incentive Program is voluntary for EPs, eligible hospitals and CAHs.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>
                        Authority for the collection, maintenance, and disclosures from this system is provided under &#167;&#167; 1848(o), 1886(m), 1848(l), and 1853(m) of the Social Security Act which were added by the HITECH Act, respectively authorize incentive payments for EPs, eligible hospitals, CAHs and MA Organizations that successfully demonstrate meaningful use of certified EHR technology. Sections 1903(a)(3) and 1903(t) of the Social Security Act provides authority for the Medicaid EHR Incentive Program. These provisions are implemented by 75 FR 44314 and 42 CFR parts 412, 413, 422, collectively known as the Medicare and Medicaid Programs; Electronic Health Record Incentive Program; Final Rule.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>
                        The primary purpose of this system, called the National Level Repository or NLR, is to collect, maintain, and process information that is required for the Medicare and Medicaid EHR Incentive Program. Information in this system will also be disclosed to: (1) Support regulatory, incentive payments and policy functions such as evaluation and reporting, whether performed by the Agency or by an Agency contractor or consultant; (2) assist another Federal and/or state agency, agency of a state government, or an agency established by state law; (3) assist in making the individual physician-level participation data available through an Agency website and by various other means of data dissemination; (4) assist the Department's Office of the National Coordinator of Health Information Technology's (ONC's) grantees for the purpose of supporting "eligible professional" (EP) adoption and meaningful use of certified EHR technology; (5) support litigation involving the Agency; (6) combat fraud, waste, and abuse in certain health benefits programs, and (7) assist in a response to a suspected or confirmed breach of the security or confidentiality of information.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>
                        <i>
                            A. Entities Who May Receive Disclosures under Routine Use
                        </i>
                    </p>
                    <p>
                        These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the EHRI without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish the following routine use disclosures of information maintained in the system:
                    </p>
                    <p>
                        1. To support Agency contractors, consultants, or CMS grantees who have been engaged by the Agency to assist in accomplishment of a CMS function relating to the purposes for this SOR and who need to have access to the records in order to assist CMS.
                    </p> 
                    <p>
                        2. To assist another Federal or state agency, agency of a state government, or an agency established by state law pursuant to agreements with CMS to:
                    </p>
                    <p>
                        a. Contribute to the accuracy of CMS's proper incentive payment to Medicare and Medicaid EHR Incentive Program participants, and
                    </p>
                    <p>
                        b. Assist Federal/state Medicaid programs which may require Medicare and Medicaid EHR Incentive Program information for purposes related to this system.
                    </p> 
                    <p>
                        c. Assist other Federal agencies that have the authority to perform collection of debts owed to the Federal government.
                    </p> 
                    <p>
                        3. To assist in making the information for EPs, eligible hospitals and critical access hospitals (CAHs), who receive EHR incentive payments through the new payment contractor, available through a public website. If local Web sites are used by a local or regional collaborative, CMS would have links to these websites on its main website.
                    </p> 
                    <p>
                        4. To assist the Department's Office of the National Coordinator of Health Information Technology's (ONC's) grantees for the purpose of supporting "eligible professional" (EP) adoption and meaningful use of certified EHR technology.
                    </p> 
                    <p>
                        5. To support the Department of Justice (DOJ), court, or adjudicatory body when:
                    </p>
                    <p>
                        a. The Agency or any component thereof, or
                    </p>
                    <p>
                        b. Any employee of the Agency in his or her official capacity, or
                    </p>
                    <p>
                        c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
                    </p>
                    <p>
                        d. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
                    </p> 
                    <p>
                        6. To assist a CMS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
                    </p> 
                    <p>
                        7. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
                    </p> 
                    <p>8. To assist appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for the assistance.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p> 
                    <p>
                        Records are stored on both tape cartridges (magnetic storage media) and in a DB2 relational database management environment (DASD data storage media).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        Information is most frequently retrieved by provider number (facility, physician, IDs), service dates, and prescriber identification number.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
                    </p> 
                    <p>
                        This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        Records are maintained with identifiers for all transactions after they are entered into the system for a period of 10 years. Records are housed in both active and archival files. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from the Department of Justice.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        Director, Office of E-Health Standards and Services, Centers for Medicare &amp; Medicaid Services, 7500 Security Blvd, Mail- stop: S2-26-17, Baltimore, MD 21244-1850.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        For purpose of notification, the subject individual should write to the system manager who will require the system name, and the retrieval selection criteria (<i>e.g.,</i> Provider number, SSN, etc.).
                    </p>
                </xhtmlContent>
            </subsection>
       
     <subsection type="recordAccessProcedures"><xhtmlContent> 
<p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information in the National Level Repository will be populated from other CMS systems of records, including the Provider Enrollment, Chain, and Ownership System (PECOS) and the National Plan &amp; Provider Enumeration System (NPPES).
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p></xhtmlContent></subsection> </section>
<section id="09-70-0588" toc="yes">
<systemNumber>09-70-0588</systemNumber>
<subsection type="systemName">Medicare Advantage Prescription Drug (MARx) System, HHS/CMS/CM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>CMS Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system includes information on recipients of Medicare hospital insurance (Part A) and Medicare medical insurance (Part B), and recipients of the Prescription Drug Benefits Program (Part D) enrolled in the Medicare Advantage (MA) Program .
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system includes information about a beneficiary's entitlement to Medicare benefits and enrollment in Medicare Programs, prescription drug coverage and supplementary medical claims information. The system contains identifying information such as beneficiary name, health insurance claim number, social security number, and other demographic information.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for maintenance of the system is given under Section 101 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173), which amended the Title XVIII of the Social Security Act. Authority for maintenance of the system is also given under the provisions of &#167;&#167; 1833(a)(1)(A), 1860D-1 to D-43, 1866, and 1876 of Title XVIII of the Act (42 U.S.C. 1395(A)(1)(a), 1395w-101 to 1395w-153, 1395cc, and 1395mm).
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of the SOR is to maintain a master file of Medicare Advantage (MA) and Medicare Advantage Prescription Drug (MA -PD) plan members for accounting and payment control; expedite the exchange of data with MA and MA-PD; control the posting of pro- rata amounts to the Part B deductible of currently enrolled MA members; and track participation of the prescription drug benefits provided under prescription drug plans (PDPs) and Medicare employer plans.. Information in this system is disclosed to: (1) Support regulatory, reimbursement, and policy functions performed by a contractor, consultant, or CMS grantee contracted by the Agency; (2) support another Federal or State agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) assist providers and suppliers of service directly or dealing through contractors, fiscal intermediaries (FI) or carriers for the administration of Title XVIII (4) assist third party contacts in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs; (5) assist insurance companies, third party administrators, employers, self-insurers, managed care organizations, and other supplemental insurers; (6) facilitate research on the quality and effectiveness of care provided, as well as payment- related projects; (7) support litigation involving the Agency; (8) combat fraud, waste, and abuse in certain health benefits programs, and (9) assist in a response to a suspected or confirmed breach of the security or confidentiality of information.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>B. Entities Who May Receive Disclosures Under Routine Use.
</p> <p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the MARx without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.
</p> <p>1. To Agency contractors, consultants, or CMS grantees that have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need access to the records in order to assist CMS.
</p> <p>5. To another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>6. To assist providers and suppliers of services directly or through fiscal intermediaries or carriers for the administration of Title XVIII of the Act.
</p> <p>7. To third party contacts in situations where the party to be contacted has, or is expected to have information relating to the individual's capacity to manage his or her affairs or to his or her eligibility for, or an entitlement to, benefits under the Medicare program and,
</p><p>b. The individual is unable to provide the information being sought (an individual is considered to be unable to provide certain types of information when any of the following conditions exists: The individual is confined to a mental institution, a court of competent jurisdiction has appointed a guardian to manage the affairs of that individual, a court of competent jurisdiction has declared the individual to be mentally incompetent, or the individual's attending physician has certified that the individual is not sufficiently mentally competent to manage his or her own affairs or to provide the information being sought, the individual cannot read or write, cannot afford the cost of obtaining the information, a language barrier exists, or the custodian of the information will not, as a matter of policy, provide it to the individual), or
</p><p>d. The data are needed to establish the validity of evidence or to verify the accuracy of information presented by the individual, and it concerns one or more of the following: The individual's entitlement to benefits under the Medicare program, the amount of reimbursement, and in cases in which the evidence is being reviewed as a result of suspected fraud and abuse, program integrity, quality appraisal, or evaluation and measurement of activities.
</p> <p>6. To insurance companies, third party administrators (TPA), employers, self-insurers, managed care organizations, other supplemental insurers, non-coordinating insurers, multiple employer trusts, group health plans (<i>i.e.,</i> health maintenance organizations (HMOs) or a competitive medical plan with a Medicare contract, or a Medicare-approved health care prepayment plan (HCPP)), directly or through a contractor, and other groups providing protection for their enrollees. Information to be disclosed shall be limited to Medicare entitlement data. In order to receive the information, they must agree to:
</p><p>e. Certify that the individual about whom the information is being provided is one of its insured or employees, or is insured and/or employed by another entity for whom they serve as a TPA;
</p><p>f. Utilize the information solely for the purpose of processing the identified individual's insurance claims; and
</p><p>g. Safeguard the confidentiality of the data and prevent unauthorized access.
</p> <p>11. To an individual or organization for a research, evaluation, or epidemiological project related to the prevention of disease or disability, the restoration or maintenance of health, or payment-related projects.
</p> <p>12. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The Agency or any component thereof, or
</p><p>b. Any employee of the Agency in his or her official capacity, or
</p><p>c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>13. To a CMS contractor (including, but not limited to FIs and carriers) that assists in the administration of a CMS-administered health benefits program, or to a CMS grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.</p>
<p>14. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>15. To assist appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for the assistance. In order to receive the information, CMS must:
</p><p>a. Determines that the use or disclosure does not violate legal limitations under which the record was provided, collected, or obtained;
</p><p>b. Determines that the purpose for which the disclosure is to be made:
</p><p>(1) Cannot be reasonably accomplished unless the record is provided in individually identifiable form,
</p><p>(2) is of sufficient importance to warrant the effect and/or risk on the privacy of the individual that additional exposure of the record might bring, and
</p><p>(3) there is reasonable probability that the objective for the use would be accomplished;
</p><p>c. Require the recipient of the information to:
</p><p>(1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, and
</p><p>(2) remove or destroy the information that allows the individual to be identified at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the disclosure, and
</p><p>(3) Make no further use or disclosure of the record except:
</p><p>(a) In emergency circumstances affecting the health or safety of any individual, or
</p><p>(b) When required by law.
</p> <p>d. Secure a written statement attesting to the information recipient's understanding of and willingness to abide by these provisions and complete a Data Use Agreement (CMS Form 0235) in accordance with current CMS policies.
</p>
     <p>
         <i>
     
     C. Additional Circumstances Affecting Routine Use Disclosures </i> This system contains Protected Health Information as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, 65 Fed. Reg. 82462 (12-28-00), Subparts A and E. The protected health information is collected from the Plan during the enrollment process and passed onto the Medicare Beneficiary Database. These elements include the Beneficiary Name, Sex, Date of Birth, and Health Insurance Claim Number. Disclosures of Protected Health Information authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
</p><p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if CMS determines there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Magnetic storage media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information can be retrieved by name and health insurance claim number of the beneficiary.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained with identifiers for all transactions after they are entered into the system for a period of 6 years and 3 months. Records are housed in both active and archival files. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from the Department of Justice.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of MA &amp; Part D Application Analysis, Information Services Design and Development Group, Office of Information Services, CMS.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the systems manager who will require the system name, SSN, address, date of birth, sex, and for verification purposes, the subject individual's name (woman's maiden name, if applicable). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Data for this system is collected from MAs, MA-PDs, and PDPs (which obtained the data from the individuals concerned); Social Security Administration; and the Medicare Beneficiary Database, 1-800 Medicare Choice, and Health Plan Management System.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0591" toc="yes">
<systemNumber>09-70-0591</systemNumber>
<subsection type="systemName">"Master Demonstration, Evaluation, and Research Studies for the Officer of Research, Development and Information (DERS)," HHS/CMS/ORDI.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co-locations of CMS agents.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system will collect and maintain records related to Medicare beneficiaries, Medicaid recipients, and physician and providers of services who voluntarily participate in demonstrations, evaluation, and research studies administered by ORDI. In addition, Medicare enrollment data, claims data or provider enrollment information currently maintained in existing systems of records will be used in demonstrations, evaluation, and research studies administered by ORDI.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will include, but is not limited to: provider name, unique provider identification number, unique demonstration practice identification number, beneficiary name, health insurance claim number (HICN), beneficiary demographic and diagnostic information relevant to the project, types and costs of health services used, and measures of the quality of health care received.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for maintenance of this system is given under the provisions of &#167; 1110 of the Social Security Act (the Act), which authorizes research and demonstration projects under Social Security Act programs; &#167; 1115 of the Act, which authorizes Medicaid demonstrations; and &#167; 402 of the Social Security Amendments of 1967 (42 U.S.C. 1395b-1), which authorizes waivers of Medicaid and Medicare provisions under certain demonstrations. Many of the individual studies and demonstrations are specifically mandated in other legislation (&#167;&#167; 235, 302 (b) [amends section 1847(e) (42 United States Code (U.S.C.) &#167;&#167; 1395w -3)], 303(d), 409, 410(a), 434, 623(e), 641, 646, 648, 649, 651, 702, and 703 of the Medicare Modernization Act, &#167;&#167; 121 and 122 of the Benefits Improvement and Protection Act of 2000, the Deficit Reduction Act of 1984, &#167; 5007 of the Deficit Reduction Act of 2005, the Balanced Budget Act of 1997, &#167; 222 of the Consolidated Appropriations Act of 2001, and Conference Report No. 106 --1033 for the Consolidated Appropriations Act of 2001. This system also covers all demonstrations, evaluation, and research studies administered by ORDI that may be authorized or mandated by future legislation.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to document, track, monitor, evaluate, and conduct ORDI-administered demonstration, evaluation, and research studies. Information retrieved from this system may be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or CMS grantee; (2) assist another Federal or state agency with information to contribute to the accuracy of CMS's payment of Medicare benefits, enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; (4) support litigation involving the agency; and (5) combat fraud, waste and abuse in certain federally-funded health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
</p> <p>2. To another Federal or state agency to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits;
</p><p>b. Enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>4. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
</p> <p>6. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures
</p><p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that an individual could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on electronic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The collected data are retrieved by the name or other identifying information of the participating provider or beneficiary, and may also be retrieved by a distinct identifier such as the HICN, at the individual beneficiary level.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain identifiable information maintained in the DERS system of records for a period of 5 years after the end of the research, demonstration, or evaluation project. Data residing with the designated claims payment contractor shall be returned to CMS at the end of the project, with all data then being the responsibility of CMS for adequate storage and security. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Deputy Director, Office of Research Development and Information, Mail Stop C3-18-07, CMS, 7500 Security Boulevard, Baltimore, MD 21244-1849.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Data will be collected from Medicare administrative and claims records, patient medical charts, and physician records.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted">
     <xhtmlContent>
         <p>None.</p>
         <p>
             <i>Appendix A. Current ORDI run Demonstration, Evaluation and Research Activities </i>
         </p>
         <p>
             The following is a listing of the current ORDI run demonstration, evaluation and research activities at CMS, with the appropriate contact person. A perpetual list of current demonstrations and evaluations will be made accessible through the CMS public Web site (<i> http://www.cms.hhs.gov</i>). The list will be amended for each new project that is implemented.
         </p>
         <p>
             <i>1. ORDI Run Demonstration, Evaluation and Research Activities </i>
         </p>
         <p>
             &#149; Bundled Case-Mix Adjusted Payment System for End Stage Renal Disease Services Demonstration
         </p>
         <p>
             Contact: Henry Bachofer, 410-786-0340
         </p>
         <p>
             &#149; Cancer Prevention and Treatment Demonstration for Ethnic and Racial Minorities
         </p>
         <p>
             Contact: Diane Merriman, 410-786-7237
         </p>
         <p>
             &#149; Consumer Directed Chronic Outpatient Services
         </p>
         <p>
             Contact: Pauline Lapin, 410-786-6883
         </p>
         <p>
             &#149; Cost-effectiveness of Daily versus Conventional Hemodialysis for the Medicare Population
         </p>
         <p>
             Contact: Penny Mohr, 410-786-6502
         </p>
         <p>
             &#149; Data Collection and Administering the Medicare Health Improvement Survey
         </p>
         <p>
             Contact: David Bott, 410-786-0249
         </p>
         <p>
             &#149; Design and Implementation of a Beneficiary Survey on Access to Selected Prescriptions and Biologicals
         </p>
         <p>
             Contact: Penny Mohr, 410-786-6502
         </p>
         <p>
             &#149; Disease Management for Severely Chronically Ill Medicare Beneficiaries
         </p>
         <p>
             Contact: J. Sherwood, 410-786-6651
         </p>
         <p>
             &#149; End Stage Renal Disease (ESRD) Disease Management Demonstration
         </p>
         <p>
             Contact: Sid Mazumdar, 410-786-6673
         </p>
         <p>
             &#149; Evaluation of Care Management for High Cost Beneficiaries Demonstration
         </p>
         <p>
             Contact: David Bott, 410-786-0249
         </p>
         <p>
             &#149; Evaluation of Second Phase of Oncology Demonstration Program
         </p>
         <p>
             Contact: James Menas, 410-786-4507
         </p>
         <p>
             &#149; Evaluation of the Medicare Preferred Provider Organization Demonstration
         </p>
         <p>
             Contact: Victor McVicker, 410-786-6681
         </p>
         <p>
             &#149; Evaluation of the State Medicaid Reform Demonstrations
         </p>
         <p>
             Contact: Paul Boben, 410-786-6629
         </p>
         <p>
             &#149; Expansion of Coverage of Chiropractic Services Demonstration
         </p>
         <p>
             Contact: Carol Magee, 410-786-6611
         </p>
         <p>
             &#149; Frontier Extended Stay Clinic Demonstration Project
         </p>
         <p>
             Contact: Sid Mazumdar, 410-786-6673
         </p>
         <p>
             &#149; Home Health Agency Prospective Payment Demonstration
         </p>
         <p>
             Contact: J. Sherwood, 410-786-6651
         </p>
         <p>
             &#149; Impact of Payment Reform for Part B Covered Outpatient Drugs and Biologicals
         </p>
         <p>
             Contact: Usree Bandyopadhyay, 410-786-6650
         </p>
         <p>
             &#149; Informatics for Diabetes Education and Telemedicine Demonstration (IDEATel)
         </p>
         <p>
             Contact: Diana Ayres: 410-786-7203
         </p>
         <p>
             &#149; Inhalation Drug Therapy Demonstration
         </p>
         <p>
             Contact: Debbie Vanhoven, 410-786-6625
         </p>
         <p>
             &#149; Life Masters
         </p>
         <p>
             Contact: Linda Colantino, 410-786-3343
         </p>
         <p>
             &#149; Low Vision Rehabilitation Demonstration
         </p>
         <p>
             Contact: James Coan, 410-786-9168
         </p>
         <p>
             &#149; Massachusetts Senior Care Options
         </p>
         <p>
             Contact: William Clark, 410-786-1484
         </p>
         <p>
             &#149; Medical Adult Day Care Services Demonstration
         </p>
         <p>
             Contact: Armen Thoumaian, PhD, 410-786-6672
         </p>
         <p>
             &#149; Medicare + Choice Phase II--PPO Demonstration
         </p>
         <p>
             Contact: Debbie Vanhoven, 410-786-6625
         </p>
         <p>
             &#149; Medicare Advantage CCRC (Erickson) Demonstration
         </p>
         <p>
             Contact: Henry Bachofer, 410-786-0340
         </p>
         <p>
             &#149; Medicare Cancer Registry Record System
         </p>
         <p>
             Contact: Gerald Riley, 410-786-6699
         </p>
         <p>
             &#149; Medicare Care Management Performance Demonstration
         </p>
         <p>
             Contact: Jody Blatt, 410-786-6921
         </p>
         <p>
             &#149; Medicare Clinical Laboratory Services Competitive Bidding Demonstration Project
         </p>
         <p>
             Contact: Linda Lebovic, 410-786-3402
         </p>
         <p>
             &#149; Medicare Coordinated Care Demonstration
         </p>
         <p>
             Contact: Cynthia Mason, 410-786-6680
         </p>
         <p>
             &#149; Medicare Drug Replacement Demonstration
         </p>
         <p>
             Contact: Jody Blatt, 410-786-6921
         </p>
         <p>
             &#149; Medicare Health Care Quality Demonstration Programs
         </p>
         <p>
             Contact: Cynthia Mason, 410-786-6680
         </p>
         <p>
             &#149; Medicare Home Health Independence Demonstration
         </p>
         <p>
             Contact: Armen Thoumaian, Ph.D., 410-786-6672
         </p>
         <p>
             &#149; Medicare Hospital Gainsharing Demonstration
         </p>
         <p>
             Contact: Lisa Waters, 410-786-6615
         </p>
         <p>
             &#149; Medicare Preventive Services--Medicare Lifestyle Modification Program Demonstration
         </p>
         <p>
             Contact: Armen Thoumaian, PhD, 410-786-6672
         </p>
         <p>
             &#149; Mercy Medicare Skilled Nursing Facility Payment Demonstration
         </p>
         <p>
             Contact: J. Sherwood, 410-786-6651
         </p>
         <p>
             &#149; Minnesota Senior Health Options
         </p>
         <p>
             Contact: Susan Radke, 410-786-4450
         </p>
         <p>
             &#149; Municipal Health Services Program Demonstration
         </p>
         <p>
             Contact: Michael Henesch, 410-786-6685
         </p>
         <p>
             &#149; New York Graduate Medical Education Demonstration
         </p>
         <p>
             Contact: Sid Mazumdar, 410-786-6673
         </p>
         <p>
             &#149; Nursing Home Value-Based Purchasing
         </p>
         <p>
             Contact: Ronald Lambert, 410-786-6624
         </p>
         <p>
             &#149; PACE-for-Profit Demonstration
         </p>
         <p>
             Contact: Michael Henesch, 410-786-6685
         </p>
         <p>
             &#149; Payment Development, Implementation and Monitoring for the BIPA Disease Management Demonstration
         </p>
         <p>
             Contact: J. Sherwood, 410-786-6651
         </p>
         <p>
             &#149; Person-Level Medicaid Data System
         </p>
         <p>
             Contact: Dave Baugh, 410-786-7716
         </p>
         <p>
             &#149; Physician Group Practice Demonstration
         </p>
         <p>
             Contact: John Pilotte, 410-786-6658
         </p>
         <p>
             &#149; Premier Hospital Quality Incentive Demonstration
         </p>
         <p>
             Contact: Katharine Pirotte, 410-786-6774
         </p>
         <p>
             &#149; Rural Community Hospital Demonstration
         </p>
         <p>
             Contact: Sid Mazumdar, 410-786-6673
         </p>
         <p>
             &#149; Rural Hospice Demonstration: Quality Assurance Metrics Implementation Support
         </p>
         <p>
             Contact: Cindy Massuda, 410-786-0652
         </p>
         <p>
             &#149; Senior Risk Reduction Demonstration
         </p>
         <p>
             Contact: Pauline Lapin, 410-786-6883
         </p>
         <p>
             &#149; Social Health Maintenance Organization for Long-Term Care Demonstration
         </p>
         <p>
             Contact: Thomas Theis, 410-786-6654
         </p>
         <p>
             &#149; State-based Home Health Agency TPL Payments
         </p>
         <p>
             Contact: J. Sherwood, 410-786-6651
         </p>
         <p>
             &#149; United Mine Workers of America Demonstration
         </p>
         <p>
             Contact: Jason Petroski, 410-786-4681
         </p>
         <p>
             &#149; Utah Graduate Medical Education
         </p>
         <p>
             Contact: Sid Mazumdar, 410-786-6673
         </p>
         <p>
             &#149; Wisconsin Partnership Program
         </p>
         <p>Contact: James Hawthorne, 410-786-6689 </p>
</xhtmlContent></subsection> </section>
<section id="09-70-0593" toc="yes">
<systemNumber>09-70-093</systemNumber>
<subsection type="systemName">Money Follows the Person (MFP) Demonstration (MFPD)," HHS/CMS/CMSO.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co-locations of CMS agents.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system will collect and maintain individually identifiable and other data collected on Medicaid recipients and state grantees who voluntarily participate in the MFPD demonstration and evaluation as well as program-level information.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The individual-level information collected will include but is not limited to: name, address, telephone number, health insurance claims number (HICN), Medicaid identification number, social security number (SSN), race/ethnicity, gender, date of birth, Medicaid and Medicare eligibility and claims records, and self-reported quality of life (including living situation, choice and control, respect and dignity, access to personal care, community integration and inclusion, satisfaction with quality of life, and health status). The program- level information will include, but is not limited to: program performance measures for mandatory and state-specific benchmarks. States will also report progress on outreach and enrollment in the demonstration, informed consent and guardianship, benefits and services, self-direction programs, quality management systems, housing, and organization factors. This information will be primarily narrative, qualitative information, but will include some aggregate data.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for this system is given under section 6071 of the Deficit Reduction Act of 2005.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain individually identifiable information on Medicaid recipients, those who participate in the MFPD and other comparable Medicaid recipients, and to collect and maintain program level information on grantee implementation of the MFPD. Information retrieved from this system may be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, grantee, or consultant; (2) assist another Federal or state agency with information to contribute to the accuracy of CMS's proper payment of Medicaid benefits, enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; (4) support litigation involving the agency; and (5) combat fraud, waste, and abuse in certain Federally-funded health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
</p> <p>2. To another Federal or state agency to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicaid benefits;
</p><p>b. Enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>4. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such program.</p>
<p>6. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures--To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 Fed. Reg. 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on electronic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The collected data are retrieved by the name or other identifying information of the participating beneficiary or grantee, and may be retrieved by a distinct identifier such as the HICN, Medicare identification number, or SSN at the individual beneficiary level. At the program level, data are retrieved by state name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be retained for a period of 10 years after the demonstration and evaluation project has completed. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Data will be collected from Medicaid administrative and claims records, and from grantee progress reports.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0594" toc="yes">
<systemNumber>09-70-0594</systemNumber>
<subsection type="systemName">&#149; "Home and Community-Based Alternatives (CBA) to Psychiatric Residential Treatment Facilities (PRTF) Demonstration (CBA -PRTF)," HHS/CMS/CMM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co-locations of CMS agents.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system will collect and maintain individually identifiable and other data collected on Medicaid recipients, and providers of services who voluntarily participate in the national evaluation of the CBA-PRTF.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will include, but is not limited to: name, address, telephone number, health insurance claims number (HICN), race/ethnicity, gender, date of birth, patient medical charts, physician records, community living, school functioning, juvenile justice activity, alcohol and other drug use, mental health, social support, family functioning outcomes, program satisfaction and changes in the patient's environment.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for this system is given under Section 6063 of the Deficit Reduction Act of 2005.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain individually identifiable information on Medicaid recipients, and providers of services who voluntarily participate in the national evaluation of the CBA-PRTF. Information retrieved from this system may be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, grantee, or consultant; (2) assist another Federal or state agency with information to contribute to the accuracy of CMS's proper payment of Medicaid benefits, enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects; (4) support litigation involving the agency; and (5) combat fraud, waste, and abuse in certain Federally-funded health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
</p> <p>2. To another Federal or state agency to:
</p><p>a. contribute to the accuracy of CMS's proper payment of Medicaid benefits;
</p><p>b. enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>c. assist Federal/state Medicaid programs within the state.
</p> <p>3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>4. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. the agency or any component thereof, or
</p><p>b. any employee of the agency in his or her official capacity, or
</p><p>c. any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. the United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. To a CMS contractor (including, but not necessarily limited to, fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, and abuse in such program.
</p> <p>6. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures. To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, Subparts A and E) 65 Fed. Reg. 82462 (12-28-00). Disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 CFR 164.512(a)(1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on electronic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The collected data are retrieved by the name or other identifying information of the participating provider or beneficiary, and may be retrieved by a distinct identifier such as the HICN, at the individual beneficiary level.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002; the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be retained for a period of 10 years after the demonstration and evaluation project has completed. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Advocacy and Special Initiatives, Disabled and Elderly Health Programs Group, Center for Medicaid and State Operations, Mail Stop S2-14-26, Centers for Medicare &amp; Medicaid Services, 7500 Security Boulevard, Baltimore, MD 21244- 1849.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Data will be collected from Medicaid administrative and claims records, patient medical charts, and physician records.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>

<section id="09-70-0595" toc="yes">
<systemNumber>09-70-0595</systemNumber>
<subsection type="systemName">"Evaluation of Drug Usage Under the Staff Time and Resource Intensity Verification Study (STRIVE)," HHS/CMS/CMM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co-locations of CMS agents.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system will collect and maintain individually identifiable and other data collected by CMS and its contractors on Medicare participants and providers of service who are participating in STRIVE, in order to analyze relevant data to create adjustments based upon a resident classification system established by the Secretary that accounts for the relative resource utilization of different patient types.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will include, but is not limited to: Facility name, Federal provider identification number, facility national provider identifier, beneficiary name, social security number, health insurance claim number, gender, date of birth, NDC Code, drug name, drug strength, dosage form (drops (gtts), gram (gm), <i>etc.</i>), quantity dispensed or returned, date drug dispensed or returned, dose and frequency, routine or PRN, compound code, and cost data if available.</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for this system is given under Section 1888(e)(G) of the Social Security Act.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain during the STRIVE time study individually identifiable information on selected beneficiaries' medication utilization while in a nursing home, skilled nursing facility or swing bed hospital. Information retrieved from this system may be disclosed to: (1) support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, grantee, or consultant.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.</p>
<p><i>B. Additional Provisions Affecting Routine Use Disclosures </i></p><p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, subparts A and E) 65 FR 82462 (12-28-00), disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (<i>See</i> 45 CFR 164.512(a) (1)).
</p> <p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that an individual could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records will be stored electronically and on hard copy.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The collected data are retrieved by an individual identifier; <i>e.g.</i>, beneficiary name or HICN.</p></xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain information for a total period not to exceed 5 years after the final report is released. All claims-related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director Division of Institutional Post Acute Care, Chronic Care Policy Group, Center for Medicare Management, Mail Stop C5-06-27, Centers for Medicare &amp; Medicaid Services, 7500 Security Boulevard, Baltimore, MD 21244-1849.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), HICN, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Data will be collected from OmniCare, pharmacies, nursing homes, and Long Term Care Minimum Data Set, System No. 09-70- 1517.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-0597" toc="yes">
<systemNumber>09-70-0597</systemNumber>
<subsection type="systemName">"Medicare Master Death Records File (MMDRF)," HHS/CMS/OFM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various co-locations of CMS agents.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information is collected on all providers with a Social Security number (SSN) whose death has been reported to the Social Security Administration or to CMS, and the death has not been verified. The system will comprise death records about providers who participate in the Medicare program.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will include, but is not limited to: name, SSN, demographic information, unique provider identification number, National Provider Identifier (NPI), etc.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for maintenance of this system is given under the provisions of Sections 1106 (42 U.S.C. 1306) and 205(r) (42 U.S.C. 405(r)) of the Social Security Act (the Act).
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this system is to collect and maintain Social Security Administration death records for physicians, non- physician practitioners and individuals associated with organizational providers and suppliers to ensure payments are not made for services rendered after confirmed date of death and to prevent and/or detect any fraud, waste and abuse. Information retrieved from this system may be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant, CMS grantee; (2) assist another Federal or State agency with information to contribute to the accuracy of CMS's proper payment of Medicare benefits, enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support litigation involving the agency; and (4) combat fraud, waste, and abuse in certain Federally-funded health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, consultants or grantees, who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.
</p> <p>2. To another Federal or State agency to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits;
</p><p>b. Enable such agency to administer a Federal health benefits program, or, as necessary, to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity, or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government, is a party to litigation or has an interest in such litigation, and, by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>4. To a CMS contractor that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS- administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
</p> <p>5. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on electronic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The collected data are retrieved by the name or other identifying information of the physician/practitioner, health care provider.
</p></xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain identifiable information maintained in the MMDRF system of records for a period of 6 years 3 months. All claims- related records are encompassed by the document preservation order and will be retained until notification is received from DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Provider/Supplier Enrollment, Program Integrity Group, Office of Financial Management, Mail Stop C3-24 -01, Centers for Medicare &amp; Medicaid Services, 7500 Security Boulevard, Baltimore, MD 21244-1849.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, employee identification number, tax identification number, national provider number, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), NPI, and/or SSN (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Data will be collected from beneficiary enrollment records, provider enrollment records, and the Death Master File including unrestricted State death data provided by the Social Security Administration.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>The primary purpose of the system is to collect and maintain information needed to provide a mechanism for CMS' central and regional office to capture, track, manage, report and trend inquiries, complaints and issues related to Fee-for-Service (FFS) programs. Information maintained in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the Agency or by a contractor, consultant or CMS grantee; (2) assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent; (3) facilitate research on the quality and effectiveness of care provided, as well as epidemiological projects; (4) support litigation involving the Agency; and (5) combat fraud, waste, and abuse in certain health benefits programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To support Agency contractors, consultants, or grantees that have been contracted by the Agency to assist in accomplishment of a CMS function relating to the purposes for this system and who need access to the records in order to assist CMS.
</p> <p>2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent pursuant to agreements with CMS to:
</p><p>a. Contribute to the accuracy of CMS's proper payment of Medicare benefits,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>4. To assist the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The Agency or any component thereof, or
</p><p>b. Any employee of the Agency in his or her official capacity, or
</p><p>c. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. To support a CMS contractor that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS- administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p> <p>6. To support another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste, or abuse in a program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such programs.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on magnetic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>All records are accessible by individual name or identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained for a period of six years and three months. All claims-related records are encompassed by the document preservation order and will be retained until notification is received by DOJ.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Ombudsman Casework and Trends Management, Medicare Ombudsman Group, Office of External Affairs, CMS, 7500 Security Boulevard, Mail Stop S1-11-21, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual health care provider should write to the system manager who will require the system name, National Provider Identifier, address, date of birth, and gender, and for verification purposes, the subject individual health care provider's name (woman's maiden name, if applicable), and Social Security number (SSN). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a) (2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual health care provider should contact the systems manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification (These procedures are in accordance with department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The data contained in this system of records are obtained from the individuals who communicate or correspond with CMS.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent> <p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-70-00599" toc="yes">
<systemNumber>09-70-0599</systemNumber>
<subsection type="systemName">"Medicaid Integrity Program System (MIPS)," HHS/CMS/CMSO.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive Data.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The Centers for Medicare &amp; Medicaid Services (CMS) Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850 and at various contractor sites and at CMS Regional Offices.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>MIPS contain information on Medicaid beneficiaries, and physicians and other providers involved in furnishing services to Medicaid beneficiaries.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Information contained in this system includes, but is not limited to: Assigned Medicaid identification number, name, address, social security number (SSN), health insurance claim number (HICN), date of birth, gender, ethnicity and race, medical services, equipment, and supplies for which Medicaid reimbursement is requested, and materials used to determine amount of benefits allowable under Medicaid. Information on physicians and other providers of services to the beneficiary consist of an assigned provider identification number, and information used to determine whether a sanction or suspension is warranted.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for maintenance of the system is given under section 6034 of the Deficient Reduction Act of 2005 Act (Pub. L. 109-171) (revising Title XIX of the Social Security Act (42 U.S.C. 1396 et seq.)) which establishes the Medicaid Integrity Program under which the Secretary shall provide CMS the resources necessary to combat fraud, waste and abuse in the Medicaid program.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purpose of this system is to establish an accurate, current, and comprehensive database containing standardized enrollment, eligibility, and paid claims of Medicaid beneficiaries to assist in the detection of fraud, waste and abuse in the Medicare and Medicaid programs. Information retrieved from this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed within the agency or by a contractor, consultant or a CMS grantee; (2) assist another Federal or state agency with information to enable such agency to administer a Federal health benefits program, or to enable such agency to fulfill a requirement of Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; (3) support a research or evaluation project; (4) support litigation involving the agency; and (5) combat fraud, waste, and abuse in a federally-funded health benefit program.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use." The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To agency contractors, or consultants, or to a grantee of a CMS-administered grant program who have been engaged by the agency to assist in the accomplishment of a CMS function relating to the purposes for this system and who need to have access to the records in order to assist CMS.
</p> <p>2. To another Federal or state agency to:
</p><p>a. Contribute to the accuracy of CMS' proper management of Medicare/Medicaid benefits; and/or
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>c. Assist Federal/state Medicaid programs within the state.
</p> <p>3. To an individual or organization for a research project or in support of an evaluation project related to the prevention of disease or disability, the restoration or maintenance of health, or payment related projects.
</p> <p>4. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. any employee of the agency in his or her official capacity, or
</p><p>c. any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. the United States Government is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. To a CMS contractor (including, but not necessarily limited to fiscal intermediaries and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such program.
</p> <p>6. To another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud or abuse in, a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud or abuse in such programs.
</p> <p>B. Additional Provisions Affecting Routine Use Disclosures
</p><p>To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, 65 FR 82462 (12-28-00), Subparts A and E) disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the " Standards for Privacy of Individually Identifiable Health Information."
</p><p>In addition, our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on computer diskette and magnetic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information can be retrieved by the assigned beneficiary identification number, SSN, HICN, and the assigned physician or other providers of services identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and CMS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002; the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003; and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and CMS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>CMS will retain identifiable MIPS data for a total period not to exceed 5 years after the final determination of the case is completed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Medicaid Integrity Contracting, Program Integrity Group, Center for Medicaid and State Operations, CMS, Mail Stop B2-2923, 7111 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager who will require the system name, HICN, address, date of birth, and gender, and for verification purposes, the subject individual's name (woman's maiden name, if applicable), and SSN. Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also specify the record contents being sought. (These procedures are in accordance with department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the records and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These Procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>CMS obtains the identifying information contained in this system from state Medicaid agencies, or Medicaid Management Information Systems maintained by the individual states, and information contained on CMS Form 2082.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-70-3002" toc="yes">
<systemNumber>09-70-3002</systemNumber>
<subsection type="systemName"> Health Care Financing Administration (HCFA) Employee Building Pass Files, HHS/HCFA/OBA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Health Care Financing Administration, 1-P-4 East Low Rise Building, 6325 Security Boulevard, Baltimore, Maryland 21207.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>All HCFA employees and non-HCFA employees who require continuous access to buildings, e.g., the Health and Human Services Building in Washington, D.C., the Social Security Administration complex.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system contains the employees' name, social security number, identification card number, work location, phone number, position title and grade, supervisor's name and telephone number.
</p> <p>
</p><p>Note: Records will not be retrieved by the social security number.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 486(c) of Title 40, U.S.C.
</p> <p>41 CFR Chapter 101-20.302 (46 FR 3524, January 15, 1981)
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To ensure that Federal employees and other authorized personnel receive United States Government Identification.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosures may be made:
</p><p>1. To the Federal Protective Service if investigating a crime.
</p> <p>2. To management officials inquiring about an individual's authorization to enter Federal occupied buildings.
</p> <p>3. To a contractor for the purpose of collating, analyzing, aggregating or otherwise refining or processing records in this system for developing, modifying and/or manipulating ADP software. Data would also be disclosed to contractors incidential to consultation, programming, operation, user assistance, or maintenance for an ADP or telecommunications systems containing or supporting records in the system.
</p> <p>4. To a congressional office from the record of an individual in response to an inquiry from the congressional office at the request of that individual.
</p> <p>5. To the Department of Justice, to a court or other tribunal, or to another party before such tribunal, when
</p><p>(a) HHS, or any component thereof; or
</p><p>(b) Any HHS employee in his or her official capacity; or
</p><p>(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
</p><p>is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the tribunal, or the other party is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>To the Social Security Administration for their assistance in the implementation of HCFA's administration of the Medicare and Medicaid programs.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Information is maintained on paper forms.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by the employees' name and identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>The records are stored in locked files. Access to the records is limited to those employees who have a need for them in the performance of their duties.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained for 90 days following resignation or expiration of contract (contracts) and then are shredded.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of General Services, Office of Administrative Services, Office of Management and Budget, Health Care Financing Administration, 578 East High Rise Building, 6325 Security Boulevard, Baltimore, Maryland 21207.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the system manager at the address indicated above and specify name and/or identification number.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requestors should also reasonably specify the record contents being sought. You may also request an accounting of disclosures that have been made of your records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the system manager named above and reasonably identify the record and specify the information to be contested, and state the corrective action sought and your reasons for requesting the correction, along with information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>HCFA obtains information in this system from the individuals who are covered by the system.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-70-3005" toc="yes">
<systemNumber>09-70-3005</systemNumber>
<subsection type="systemName">Correspondence Tracking Management System, (CMTS).</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level 3, Privacy Act Sensitive.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>HCFA Data Center, 7500 Security Boulevard, North Building, First Floor, Baltimore, Maryland 21244-1850. CMS contractors and agents at various locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system of records will contain data on any correspondent whose letter is sent to CMS and on individuals referenced in such correspondence (e.g., beneficiaries, the public, other government agencies, contractors, and members of the Congress.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The system contains incoming correspondence, responses to correspondence and information CMS uses to track correspondence, and e.g. CMTS control number.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 CFR 401.101-401.148 and sec 1106(a) of the Social Security Act, 42 U.S.C. 1306(a).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The primary purpose of the system of records is to aid CMS in tracking incoming correspondence about CMS programs from the Office of the Secretary, Medicare beneficiaries and Medicaid recipients. In addition, it will track all correspondence from the public, other government agencies, contractors, and members of the Congress. Information retrieved from this system of records will be used to support regulatory, reimbursement, and policy functions performed within the agency or by a contractor or consultant; support constituent requests made to a Congressional representative; and support litigation involving the agency.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which CMS may release information from the CMTS without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. In addition, CMS policy will be to prohibit release even of non-identifiable data, except pursuant to one of the routine uses, if there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals who are familiar with the enrollees could, because of the small size, use this information to deduce the identity of the beneficiary). Be advised, this System of Records contains Protected Health Information as defined by the Department of Health and Human Services' (HHS) regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR parts 160 and 164, 65 FR 8462 as amended by 66 FR 12434). Disclosures of Protected Health Information authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
</p><p>1. To agency contractors, or consultants that have been contracted by the agency to assist in the performance of a service related to this system of records and that need to have access to the records in order to perform the activity.
</p> <p>2. To a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional Office made at the written request of the constituent about whom the record is maintained.
</p> <p>3. To the Department of Justice (DOJ), court or adjudicatory body when:
</p><p>a. The agency or any component thereof, or
</p><p>b. Any employee of the agency in his or her official capacity; or
</p><p>c. Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>d. The United States Government; is a party to litigation or has an interest in such litigation, and by careful review, CMS determines that the records are both relevant and necessary to the litigation.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on magnetic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Name of correspondent, name of individual referenced in the correspondence, or correspondence control number retrieves the records.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>CMS has safeguards for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and systems security requirements. Employees who maintain records in the system are instructed not to release any data until the intended recipient agrees to implement appropriate administrative, technical, procedural, and physical safeguards sufficient to protect the confidentiality of the data and to prevent unauthorized access to the data.
</p> <p>In addition, CMS has physical safeguards in place to reduce the exposure of computer equipment and thus achieve an optimum level of protection and security for the CMS system. For computerized records, safeguards have been established in accordance with HHS standards and National Institute of Standards and Technology guidelines; e.g., security codes will be used, limiting access to authorized personnel. System securities are established in accordance with HHS, Information Resource Management Circular #10, Automated Information Systems Security Program; CMS Information Systems Security, Standards Guidelines Handbook and OMB Circular No. A-130 (revised) Appendix III.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records are maintained on-line in the system for 2 years. After a 2-year period, records are transferred to an archive file and destroyed three years later.
</p> <p>Due to a freeze imposed by the Department of Justice in 1992, correspondence documenting/supporting a specific claim, reconsideration, appeal or similar case will be maintained until further notice. Once the freeze is lifted, destroy 6 years and 3 months after final payment/resolution.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Correspondence Control, Office of Communications and Operations Support, Health Care Financing Administration, 7500 Security Boulevard, Baltimore, Maryland 21244-1850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of access, the subject individual should write to the system manager, who will require the system name, the subject individual's name (woman's maiden name, if applicable), social security number (SSN) (furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay), address, date of correspondence.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Incoming correspondence and responses to such correspondence.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-10-0002" toc="yes">
<systemNumber>09-10-0002</systemNumber>
<subsection type="systemName"> Regulated Industry Employee Enforcement Records, HHS/FDA/OC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>FDA employees:
</p><p>Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857
</p><p>Investigations Operations Branch (HFC-132), 5600 Fishers Lane, Rockville, MD 20857
</p><p>Administrative, Investigations, and Compliance Branches at Field/District Offices.  For the location of Field/District Offices, see Appendix A.
</p> <p>For the location of Federal Records Centers, see Appendix B.
</p></xhtmlContent></subsection><subsection type="categoriesOfIndividuals"><xhtmlContent><p>Employees of nterprises regulated by the Food and Drug Administration (FDA) and other individuals subject to FDA enforcement actions.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Includes correspondence, memoranda, inspection reports, and related documents that are investigatory material compiled for law enforcement purposes.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Federal Food, Drug and Cosmetic Act (21 U.S.C. 321 et seq.), the Public Health Service Act (42 U.S.C. 201 et seq.), and authority delegated to the Commissioner, 21 CFR part 5.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To provide records used by FDA employees in investigations of possible violation of the law.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Records that indicate violation or potential violation of law may be: (1) Referred for investigation and possible enforcement action under the applicable Federal, State, or foreign laws to the Department of Justice and other appropriate Federal agencies; an appropriate State food and drug enforcement health agency or licensing authority; or, the government of a foreign country; or (2) disclosed in administrative or court proceeding in determining whether a record is relevant to an Agency decision concerning documents of investigatory materials.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from that congressional office at the request of that individual.
</p> <p>3. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
</p><p>(a) HHS, or any component thereof; or
</p><p>(b) Any HHS employee in his or her official capacity; or
</p><p>(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
</p><p>Is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Manual files are maintained in letter-size folders. Automated files are maintained on computer discs and tapes stored in a locked safe.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Indexed by company or subject, sometimes with individual name in a cross-index on an automated index system.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized users: Administrative Services Branch and Office of Regulatory Affairs personnel.
</p> <p>2. Physical safeguards: Records are kept in locked cabinets in a secured area, locked rooms, locked buildings and limited access to authorized personnel. Computer tapes and discs are stored in a locked safe.
</p> <p>3. Procedural (or technical) safeguards: Computer software providing restricted commands.
</p> <p>4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf: 45-13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records may be retired to a Federal Records Center and subsequently disposed of in accordance with FDA's Records Control Schedule. The Records Control Schedule and disposal standard for these records may be obtained by writing to the system manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The policy coordinating official for this system of records is also the system manager for the Investigations Operations Branch.
</p> <p>Chief, Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857
</p><p>Assistant to the Director, Investigations Operations Branch (HFC-132), Office of Regulatory Affairs, 5600 Fishers Lane, Rockville, MD 20857
</p><p>Director, Office of Criminal Investigations, Office of Regulatory Affairs, (HFC-300), 7500 Standish Place, Suite 250N, Rockville, MD 20855
</p><p>Administrative, Investigative and Compliance Branches at Field/District Offices, see Appendix A.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to:
</p><p>FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. Access to record systems which have been granted an exemption from the Privacy Act access requirement may be made at the discretion of the system manager. If access is denied to requested records, an appeal may be made to:
</p><p>Commissioner, Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857
</p><p>You may also request an accounting of disclosures that have been made of your record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>If access has been granted, contact the official at the address specified under notification procedures and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual on whom the record is maintained, from third parties such as consumers, scientists, representatives of other companies, state agencies, or developed by FDA during investigations for law enforcement purposes.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>This system is exempt from access and contest and certain other provisions of the Privacy Act (5 U.S.C. 552a (c)(3), (d)(1) to (4), (e)(3), (e)(4)(G) to (H) and (f), to the extent that it includes investigatory material  compiled for law enforcement purposes, including criminal law enforcement purposes, where access would be likely to prejudice the conduct of the investigation.</p>
<p><i>Appendix A- Addresses and working hours of the Food and Drug Administration Field Offices </i></p><p>The following is a list of the Food and Drug Administration Field Offices, their addresses and working hours where individuals may have access to records in Food and Drug Administration Privacy Act Record Systems:
</p><p>NORTHEAST REGION
</p><p>Regional Office
</p><p>830 Third Avenue, Brooklyn, NY 11232, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>District Offices
</p><p>One Montvale Avenue, 3rd Floor, Stoneham, MA 02180, Office hours: 8 am. to 4:30 pm (e.s.t.).
</p> <p>850 Third Avenue, 4th Floor, Brooklyn, NY 11232-1593, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>599 Delaware Avenue, Buffalo, NY 14202, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>Regional Laboratory
</p><p>850 Third Avenue, 4th Floor, Brooklyn, NY 11232-1593, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>Winchester Engineering and Analytical Center (WEAC), 109 Holton Street, Winchester, MA 01890.
</p> <p>MID-ATLANTIC REGION
</p><p>Regional Office
</p><p>2nd and Chestnut Streets, Room 900, Philadelphia, PA 19106, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>District Offices
</p><p>2nd and Chestnut Streets, Room 900, Philadelphia, PA 19106, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>61 Main Street, West Orange, NJ 07052, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>900 Madison Avenue, Baltimore, MD 21201, Office hours: 7:45 am to 4:15 pm (e.s.t.).
</p> <p>1141 Central Parkway, Cincinnati, OH 45202-1097, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>SOUTHEAST REGION
</p><p>Regional Office
</p><p>60 Eighth Street, NE, Atlanta, GA 30309, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>District Offices
</p><p>60 Eighth Street, NE, Atlanta, GA 30309, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>297 Plus Park Boulevard, Nashville, TN 37217, Office hours: 8 am to 4:30 pm (c.t.).
</p> <p>7200 Lake Ellenor Drive, Suite 120, Orlando, FL 32809, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>4298 Elysian Fields Avenue, New Orleans, LA 70122, Office hours: 8 am to 4:30 pm (c.t.).
</p> <p>Fernandez Juncos Avenue, Puerta de Tierra, San Juan, PR 00906-5719, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>Regional Laboratory
</p><p>60 Eighth Street, NE, Atlanta, GA 30309, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>MIDWEST REGION
</p><p>Regional Office
</p><p>20 N. Michigan Avenue, Room 550, Chicago, IL 60602, Working hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>District Offices
</p><p>433 W. Van Buren Street, Room 1222, Chicago, IL 60607, Working hours: 8 am to 4:30 p.m. (e.s.t.).
</p> <p>1560 East Jefferson Avenue, Detroit, MI 48207, Office hours: 8 am to 4:30 pm (e.s.t.).
</p> <p>240 Hennepin Avenue, Minneapolis, MN 55401, Office hours: 8 am to 4:30 pm (c.t.).
</p> <p>SOUTHWEST REGION
</p><p>Regional Office
</p><p>3032 Bryan Street, Dallas, TX 75204, Office hours: 8 am to 4:30 (c.t.).
</p> <p> District Offices
</p><p>3032 Bryan Street, Dallas, TX 75204, Office hours: 8 am to 4:30 (c.t.).
</p> <p>1009 Cherry Street, Kansas City, MO 64106, Office hours: 8 am to 4:30 pm (c.t.).
</p> <p>Denver Federal Center, Building 20, PO Box 25087, Denver, CO 80225-0087, Working hours: 8 am to 4:30 pm (m.t.).
</p> <p>PACIFIC REGION
</p><p>Regional Office
</p><p>Federal Office Building, Room 526, 50 U.N. Plaza, San Francisco, CA 94102, Working hours: 8 am to 4:30 pm (p.t.).
</p> <p>District Offices
</p><p>Federal Office Building, Room 526, 50 U.N. Plaza, San Francisco, CA 94102, Working hours: 8 am to 4:30 pm (p.t.).
</p> <p>1521 W. Pico Boulevard, Los Angeles, CA 90015-2486, Office hours: 8 am to 4:30 pm (p.t.).
</p> <p>22201 23rd Drive, SE, Bothell, WA 98021-4421, Office hours: 8 am to 4:30 pm (c.t.).</p>
<p><i>Appendix B--General Services Administration, Federal Archives, and Records Centers </i></p><p>National Centers:
</p><p>District of Columbia, Maryland, Virginia, and West Virginia except for U.S. Court records for Maryland, Virginia, and West Virginia: Washington National Records Center, Washington, DC 20409.
</p> <p>National Personnel Records Center (Civilian Personnel Records), 111 Winnebago Street, St. Louis, MO 63118.
</p> <p>National Personnel Records Center (Military Personnel Records), 9700 Page Boulevard, St. Louis, MO 63132.
</p> <p>Regional Centers
</p><p>Maine, Vermont, New Hampshire, Massachusetts, Connecticut, and Rhode Island, Federal Archives and Records Center, 380 Trapelo Road, Waltham, MA 02154.
</p> <p>New York, New Jersey, Puerto Rico, the Virgin Islands, and the Panama Canal Zone, Federal Records Center, Military Ocean Terminal, Building 22, Bayonne, NJ 07002-5388.
</p> <p>Delaware, Pennsylvania, and U.S. Court records for Maryland, Virginia, and West Virginia, Federal Records Center, 5000 Wissahickon Avenue, Philadelphia, PA 19144.
</p> <p>North Carolina, South Carolina, Tennessee, Mississipi, Alabama, Georgia, Florida and Kentucky, Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
</p> <p>Illinois, Wisconsin, Minnesota, and U.S. Court records for Indiana, Michigan, and Ohio, Federal Records Center, 7358 South Pulaski Road, Chicago, IL 60629.
</p> <p>Indiana, Michigan, and Ohio except for U.S. Court records, Federal Records Center, 3150 Springboro Road, Dayton, OH 45439.
</p> <p>Kansas, Iowa, Nebraska, and Missouri, Federal Records Center, 2306 East Bannister Road, Kansas City, MO 64131.
</p> <p>Texas, Oklahoma, Arkansas, Louisiana, and New Mexico, Federal Records Center, PO Box 6216, Fort Worth, TX 76115.
</p> <p>Shipping address only (do not use for mail), 4900 Hemphill Street, Building 1, Dock 1, Fort Worth, TX.
</p> <p>Colorado, Wyoming, Utah, Montana, North Dakota, and South Dakota, Federal Records Center, PO Box 25307, Denver, CO 80225.
</p> <p>American Samoa, California, except Southern California, and Nevada, except Clark County, Federal Records Center, 1000 Commodore Drive, San Bruno, CA 94066.
</p> <p>Arizona; Clark County, Nevada; and Southern California (counties of San Luis Obispo, Kern, San Bernardino, Santa Barbara, Ventura, Los Angeles, Riverside, Orange, Imperial, Inyo, and San Diego). Federal Records Center, 24000 Avila Road, 1st Floor, PO Box 6719, Laguna Niguel, CA 92677.
</p> <p>Washington, Oregon, Idaho, Alaska, Hawaii, and Pacific Ocean areas (except American Samoa), Federal Records Center, 6125 Sand Point Way NE, Seattle, WA 98115.
</p></xhtmlContent></subsection></section>
<section id="09-10-0003" toc="yes">
<systemNumber>09-10-0003</systemNumber>
<subsection type="systemName"> FDA Credential Holder File, HHS/FDA/OC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>FDA employees:
</p><p>Personnel Property Management Section, (HFA-227), Office of Management, 5600 Fishers Lane, Rockville, MD 20857
</p><p>Metropolitan Office Services Section (HFA-216), Office of Management, 200 C Street, SW, Washington, DC 20204
</p><p>Division of Field Investigations (HFC-130), Office of Regulatory Affairs, 5600 Fishers Lane, Rockville, MD 20857
</p><p>Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10 -0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC.
</p> <p>State and Local Employees: Division of Federal-State Relations (HFC-151), 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10 -0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>FDA employees and state and local government employees who have been issued FDA credentials for enforcement activities.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Contains name, job title, height, weight, color of eyes and hair, duty status, and for state and local government employees, professional qualifications.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Sections 702 to 704, the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 372 to 374).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To issue or reissue credentials which are used to gain entry to regulated establishments.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Information may be disclosed to provide assurance to regulated enterprises that an individual is a duly designated enforcement officer and, in the case of state employees, an officer commissioned as an officer of the Department.
</p> <p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
</p><p>(a) HHS, or any component thereof; or
</p><p>(b) Any HHS employee in his or her official capacity; or
</p><p>(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
</p><p>is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Maintained in file folders and on computer tapes.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Indexed by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized users: Administrative Services Branch and Office of Regulatory Affairs personnel.
</p> <p>2. Physical safeguards: Records are kept in locked cabinets in a secured area, locked rooms, locked buildings and limited access to authorized personnel. Computer tapes and discs are stored in locked safe.
</p> <p>3. Procedural (or technical) safeguards: Computer software providing restricted commands.
</p> <p>4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained as long as individual is a duly designated or commissioned official; inactive files destroyed after 10 years. The records are destroyed by shredding, burning, or other appropriate means so as to render them illegible.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>FDA employees:
</p><p>Chief, Services Unit (HFA-227), Office of Management, 5600 Fishers Lane, Rockville, MD 20857
</p><p>Chief, Metropolitan Office Services Unit (HFA-216), Office of Management,  200 C Street, SW, Washington, DC 20204
</p><p>Administrative Branch at Field/District Offices. For the location of Field /District Offices, see appendix A to system notice 09-10 -0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC.
</p> <p>Federal-State Officer at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10 -0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OMO/DMS.
</p> <p>State employees:
</p><p>Director, Division of Federal-State Relations (HFC-151), 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10 -0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to:
</p><p>FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedure. Requesters should also reasonably specify the record contents being sought. You may also request an accounting of disclosures that have been made of your record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual on whom the record is maintained.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-10-0004" toc="yes">
<systemNumber>09-10-0004</systemNumber>
<subsection type="systemName"> Communications (Oral and Written) With the Public, HHS/FDA/OC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857
</p><p>Office of Legislative Affairs (HFW-1), 5600 Fishers Lane, Rockville, MD 20857
</p><p>Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10 -0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OMO/DMS.
</p> <p>For the location of Federal Archives and Records Centers, see appendix B to system notice 09-10-0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OMO/DMS.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals, other than employees of enterprises regulated by FDA, who communicate with FDA or, in some cases, are the subject of communications by others with FDA.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Includes correspondence from and to individuals, summaries of conversations prepared by FDA employees, and records prepared by FDA as a follow-up to consumer complaints, oral and written. Administrative Services Branch files include copies of correspondence received from the public, and the FDA reply. The Office of Legislative Affairs maintains duplicates of letters FDA sends to members of Congress and summaries of oral inquiries in files organized by members' names. The Office of Legislative Affairs maintains a manual control system and the Executive Secretariat, Office of the Commissioner, maintains an automated control system of pending correspondence requiring a reply.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Federal Food, Drug, and Cosmetic Act (21 U.S.C. 321 et seq.); the Public Health Service Act (42 U.S.C. 201 et seq.), and authority delegated to the Commissioner (21 CFR 5.1).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To aid FDA employees in carrying out their responsibilities, e.g., responding to follow-up correspondence on complaints, requests for information, etc.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Records that indicate violation or potential violation of law may be: (1) Referred for investigation and possible enforcement action under the applicable Federal, State, or foreign laws to the Department of Justice; an appropriate State food and drug enforcement health agency or licensing authority; or the government of a foreign country; or (2) disclosed in administrative or court proceedings in determining whether a record is relevant to an agency decision concerning documents of investigatory materials.
</p> <p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
</p><p>(a) HHS, or any component thereof; or
</p><p>(b) Any HHS employee in his or her official capacity; or
</p><p>(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
</p><p>is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Manual records are maintained in letter-size folders. Automated records are maintained on computer tapes and discs and stored in a locked safe.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are arranged by company or by subject. A computer index gives correspondent's name, date of letter, subject, and location. Field offices file consumer complaints by complaint number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized users: FDA employees who display an FDA identification card; GAO employees upon approval of GAO Liaison Officer, Operations Coordination Staff, OMO, employees of DHHS agencies other than FDA whose duties require the use of information in the system.
</p> <p>2. Physical safeguards: Records are stored in locked cabinets in secured areas, locked buildings and locked rooms. Computer tapes and discs are stored in a locked safe.
</p> <p>3. Procedural (or technical) safeguards: Computer software providing restricted commands. Employees of DHHS agencies other than FDA must display government identification card, complete agreement between FDA and the agency concerned, and sign a commitment to protect privileged information.
</p> <p>4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual and part 6 of the Department's ADP Systems Manual.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records may be retired to a Federal Records Center and subsequently disposed of in accordance with FDA's Records Control Schedule. The Records Control Schedule and disposal standard for these records may be obtained by writing to the system manager at the appropriate address below.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857
</p><p>Office of Legislative Affairs (HFW-1), 5600 Fishers Lane, Rockville, MD 20857
</p><p>Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10 -0002, Regulated Industry Employee Enforcement Records, HHS/OMO/DMS.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual may learn if a record exists about him or her upon written request with notarized signature if request is made by mail, or with identification if request is made in person, directed to:
</p><p>FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedure. Requesters should also reasonably specify the record contents being sought. You may also request an accounting of disclosures that have been made of your record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedure above and reasonably specify the record, information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual on whom the record is maintained or others (generally members of Congress) who write to FDA about them.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
        <section id="09-10-0005" toc="yes">
            <systemNumber>09-10-0005</systemNumber>
            <subsection type="systemName"> State Food and Drug Official File, HHS/FDA/ORA.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        Regional Food and Drug Offices (See Appendix A 0.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>
                        State officials who have responsibilities related to those of the Food and Drug Administration.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        Contains name, date of birth, education and professional experience, and state in which employed.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>
                        Section 702(a) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 372(a)).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>
                        To provide FDA with the names of State officials who have responsibilities related to those of the Food and Drug Administration.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>
                        Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
                    </p> 
                    <p>
                        The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
                    </p>
                    <p>
                        (a) HHS, or any component thereof; or
                    </p>
                    <p>
                        (b) Any HHS employee in his or her official capacity; or
                    </p>
                    <p>
                        (c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
                    </p>
                    <p>
                        (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
                    </p>
                    <p>
                        is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p> 
                    <p>
                        Maintained in letter-size manila folders.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        Indexed by name and state.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        1. Authorized users: Personnel of the Division of Federal State Relations who are engaged in contracts or any other activity involving commissioning.
                    </p> 
                    <p>
                        2. Physical safeguards: Records are kept in locked cabinets in a secured area, locked rooms and locked building.
                    </p> 
                    <p>
                        3. Procedural safeguards: Users of personal information in the performance of their duties have been instructed to protect personal information from public view and from unauthorized personnel. Access is strictly limited to those staff members trained in accordance with the Privacy Act.
                    </p> 
                    <p>
                        4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        Records are retained as long as individual is a state employee.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        Regional Food and Drug Directors (See Appendix A for Address).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to:
                    </p>
                    <p>
                        FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>
                        Same as notification procedure. Requests should also reasonably specify the records content being sought. You may also request an accounting of disclosures that have been made of your record, if any.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>
                        Contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        Individual on whom the record is maintained.
                    </p>
                </xhtmlContent>
            </subsection>
        </section>
 

<section id="09-10-0009" toc="yes">
<systemNumber>09-10-0009</systemNumber>
<subsection type="systemName"> Special Studies and Surveys on FDA-Regulated Products, HHS/FDA/OM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Division of Contracts and Procurement Management, Office of Contracts and Grants Management, 5600 Fishers Lane, Park Building, Room 3-32, Rockville, MD 20857.
</p> <p>A current list of contact sites is available by writing to the system manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals, specialty groups, and households participating voluntarily in studies and surveys conducted or sponsored by FDA.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Data collected vary with each study/survey. Normal standard information for individuals or household members varies but could include name, age, sex, marital status, address or locale of residence, etc. Nondemographic items relate to experience with, or opinions about, a particular product. Patient medical records may be included in some cases involving specific health problems.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 701(a) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Used to provide data on individuals, specialty groups, e.g., physicians and households participating voluntarily in studies and surveys conducted or sponsored by FDA.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the records of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
</p><p>(a) HHS, or any component thereof; or
</p><p>(b) Any HHS employee in his or her official capacity; or
</p><p>(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
</p><p>is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Disclosure may be made to HHS contractors and their staff in order to accomplish the purpose for which the records are collected. The recipients are required to protect such records from improper disclosure.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Questionnaires and data are filed in standard filing equipment. Some statistical data are stored on magnetic tape.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Accessed by ID number assigned by FDA or contractor during collection process. Individual files are maintained in agency and/or contractor's custody until all collection procedures are completed.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized users: Authorized program personnel.
</p> <p>2. Physical safeguards: Questionnaires and data are maintained in locked containers in secured area. Magnetic tapes are maintained in secured computer facilities. Locked buildings, locked rooms, locked file cabinets and locked tape vaults.
</p> <p>3. Procedural (or technical) safeguards: Access limited by computer password which is changed periodically. Confidentiality safeguards with respect to these records are required to be maintained.
</p> <p>4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf: 45-13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Questionnaires and data are retained until all statistical problems are resolved; then destroyed. The records are destroyed by shredding, burning, or other appropriate means so as to render them illegible.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, Division of Contracts and Procurement Management, 5600 Fishers Lane, Park Building, Room 3-32, Rockville, MD 20857.
</p> <p>Office of Epidemiology and Biostatistics (HFD-700), Rockville, MD 20857
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to:
</p><p>FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedure. Requesters should also reasonably specify the record contents being sought. An individual who requests notification of, or access to, a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the records and inform the subject individual of its contents at the representative's discretion. You may also request an accounting of disclosures that have been made of your record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual on whom the record is maintained or patient's medical records, depending on the type of survey or study.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-10-0010" toc="yes">
<systemNumber>09-10-0010</systemNumber>
<subsection type="systemName">Bioresearch Monitoring Information System, HHS/FDA.
</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This notice applies to clinical investigators who are conducting, or have conducted, clinical investigations of products regulated by FDA.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The purposes of this system are to:
</p><p>1. Support regulatory or procedural controls to ensure that clinical investigators meet requirements of the relevant statutes and regulations governing clinical investigations of FDA-regulated products.
</p> <p>2. Support the effective performance of activities necessary for the conduct of the FDA's bioresearch monitoring program.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Storage:
</p> <p>Files may be maintained in various formats including hard copy paper in manual files, microfilm, magnetic disk or tape, computer disks, hard drives, and file servers and other types of data storage devices.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records may be indexed by name or code number, but can be retrieved by manual or computer search of the case-tracking system using the name of the individual.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. </p><p><i>Authorized users:</i>
</p><p>Records in FDA's system are available to the Commissioner of Food and Drugs, FDA's System Managers, and to other appropriate FDA and HHS officials when there is a need to know in the performance of their duties. All authorized users are informed that the records are confidential and are not to be further disclosed.
</p> <p>2. </p><p><i>Procedural safeguards:</i>
</p><p>Access is strictly controlled by FDA's System Managers in compliance with the Privacy Act and this system notice. Access to the records is limited to ensure confidentiality. All questions and inquiries from any party should be addressed to FDA's Office of Good Clinical Practice.</p>
<p>3. </p><p><i>Physical safeguards:</i>
</p><p>All records (such as diskettes, computer listings, or documents) are kept in a secured area, locked rooms, and locked building. The facility has a 24-hour guard service, and access to the building is further controlled by an operational card key system. Access to the files, which are generally hard copy, are limited to a subset of persons with general access to the building. Access to individual offices is controlled by simplex locks. Records are kept in locked file cabinets in a room that is locked during non-working hours. Access to this room is restricted to specific personnel. Access to computer files is strictly limited through passwords and user-invisible encryption. Special measures commensurate with the sensitivity of the record are taken to prevent unauthorized copying or disclosure of the records.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records are maintained in accordance with FDA's Records Control Schedule, applicable General Records Schedule (accessions), and disposition schedule approved by the National Archives and Records Administration (cases).
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Division of Inspections and Surveillance, Center for Biologics Evaluation and Research, Office of Compliance and Biologics Quality (refer to <i>http://www.fda.gov</i> for address specifics).
</p> <p>Division of Bioresearch Monitoring, Center for Devices and Radiological Health, Office of Compliance (refer to <i>http://www.fda.gov</i> for address specifics).
</p> <p>Division of Scientific Investigations, Center for Drug Evaluation and Research, Office of Compliance (refer to <i>http://www.fda.gov</i> for address specifics).
</p> <p>Office of Food Additive Safety, Center for Food Safety and Applied Nutrition (refer to <i>http://www.fda.gov</i> for address specifics).
</p> <p>Office of Enforcement, Office of Regulatory Affairs (refer to <i>http://www.fda.gov</i> for address specifics), and Regional Field Offices (refer to <i>http://www.fda.gov</i> for address specifics).
</p> <p>Center for Tobacco Products (refer to <i>http://www.fda.gov</i> for address specifics).
</p> <p>Division of Compliance, Center for Veterinary Medicine, Bioresearch Monitoring Program (refer to <i>http://www.fda.gov</i> for address specifics).
</p> <p>Office of Good Clinical Practice, Office of the Commissioner (refer to <i>http://www.fda.gov</i> for address specifics).</p></xhtmlContent></subsection>
    <subsection type="notificationProcedure">
        <xhtmlContent>
            <p>
                In accordance with 21 CFR part 21 subpart D, an individual may submit a request to the FDA Privacy Act Coordinator, with a notarized signature, to confirm whether records exist about that individual. Requests should be directed to the FDA Privacy Act Coordinator (refer to
                <i>http://www.fda.gov</i> for the address specifics). Investigative records are exempt from this provision (see the following sentences: Records Exempted from Certain Provisions of the Act). In addition, some records may be exempt under 5 U.S.C. 552a(d)(5), if they are "compiled in reasonable anticipation of a civil action or proceeding." See also 21 CFR 21.41. Requests may be mailed to the FDA Privacy Act Coordinator (refer to <i>http://www.fda.gov</i> for the address specifics).
            </p>
        </xhtmlContent>
    </subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should specify the record contents being sought. Access to record systems which have been granted an exemption from the Privacy Act access requirement may be made at the discretion of the system manager. If access is denied to requested records, an appeal may be made to the FDA Commissioner. A request can also be made for an accounting of disclosures that have been made of a record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>In accordance with 21 CFR 21.50, contact the FDA Privacy Act Coordinator (refer to <i>http://www.fda.gov</i>), and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant. As stated previously, investigative records are exempt from this provision (see the following paragraphs of this document: Records Exempted from Certain Provisions of the Act). In addition, some records may be exempt under 5 U.S.C. 552a(d)(5) if they are "compiled in reasonable anticipation of a civil action or proceeding." </p><p>Individual on whom the record is maintained. Some material is obtained from third parties (<i>e.g.,</i> a study sponsor, publication, or institutional review board), or is developed by FDA.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>Investigatory records compiled for law enforcement purposes in this system are exempt from the notification, access, correction and amendment provisions of the Privacy Act (21 CFR 21.61).
</p></xhtmlContent></subsection> </section>

<section id="09-10-0013" toc="yes">
<systemNumber>09-10-0013</systemNumber>
<subsection type="systemName"> Employee Conduct Investigative Records, HHS/FDA/OM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Internal Affairs (HF-9), Office of the Commissioner, 1801 Rockville Pike, Suite 405, Rockville, MD 20857.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Employees or former employees, or special Government employees of FDA who are alleged to have violated FDA or Departmental regulations and/or Federal statutes.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system includes records relating to correspondence concerning an individual's employment status or conduct while employed by FDA. Examples of these records include: Correspondence from employees, members of Congress and members of the public alleging misconduct by an official of FDA. It also contains reports of investigations to resolve allegations of misconduct or violations of statutes, with related exhibits of statements, affidavits or records obtained during the investigation; reports of action taken by management; decisions on any misconduct substantiated by the investigation; and reports of legal action resulting from violations of statutes referred for prosecution.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301; Title 18, U.S.C. (e.g., 18 U.S.C. 201, 203, 207, 208, 209, 1905); 21 U.S.C. 331; 28 U.S.C. 535(b); 44 U.S.C. 3101; E.0 10450 and 45 CFR part 73.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To provide management with information needed to take actions against complaints or alleged violations. These complaints may be referred to the Office of Inspector General, Office of the Secretary, HHS.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Records that indicate violation or potential violation of law regulation and/or policy may be: (1) Referred for investigation and possible enforcement action under the applicable Federal, state, or foreign laws to the Department of Justice; an appropriate state food and drug enforcement health agency or licensing authority; or the government of a foreign country; or (2) disclosed in administrative or court proceedings in determining whether a record is relevant to an agency decision concerning documents of investigatory materials.
</p> <p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
</p><p>(a) HHS, or any component thereof; or
</p><p>(b) Any HHS employee in his or her official capacity; or
</p><p>(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
</p><p>is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Paper and automated records, in folders, in file cabinets, and on FDA central computer.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Alphabetically by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized users: Limited access to Division of Ethics and Program Integrity Staff and authorized support staff of the Office of Management and Operations.
</p> <p>2. Physical safeguards: Records are maintained in locked rooms within a locked secured area protected by a 24-hour building guard service.
</p> <p>3. Procedural safeguards: Users of personal information in connection with the performance of their jobs have been instructed to protect such information from public view and from unauthorized personnel. Access is strictly limited to those employees trained in accordance with the Privacy Act. Access to computer records is via user passwords and system access codes.
</p> <p>4. Implementation guidelines: Safeguards are established in accordance with Chapters 45-13 of the Department's General Administration Manual.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained until 5 years after termination of employment of subject individual or when no longer needed for reference. Disposal of records is accomplished by shredding, burning, or other appropriate means so as to render them illegible.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Special Agent in Charge, Office of Internal Affairs (HFD-9), Office of the Commissioner, 1801 Rockville, MD 20852.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to:
</p><p>FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedure. Requesters should also reasonably specify the record contents being sought. Access to record systems which have been granted an exemption from the Privacy Act access requirement may be made at the discretion of the system manager. If access is denied to requested records an appeal may be made to:
</p><p>Commissioner, Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857
</p><p>You may also request an accounting of disclosures that have been made of your record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>If access has been granted, contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records is obtained from FDA personnel and FDA records, subjects of investigations, complaints, witnesses, other Federal agencies, State and local agencies, and personal observations by the investigator.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>This system is exempt from access and contest and certain other provisions of the Privacy Act, (5 U.S.C. 552a(c)(3), (d) (1) to (4), (e)(3), (e)(4) (G) to (H), and (f)), to the extent that it includes investigatory material compiled for law enforcement purposes, including criminal law enforcements.
</p></xhtmlContent></subsection></section>

<section id="09-10-0018" toc="yes">
<systemNumber>09-10-0018</systemNumber>
<subsection type="systemName"> Employee Identification Card Information Record, HHS/FDA/OC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Personal Property Management Section, Services Unit (HFA-227), 5600 Fishers Lane, Rockville, MD 20857
</p><p>Metropolitan Office Services Unit (HFA-216), 200 C Street, SW, Washington, DC 20204
</p><p>Physical Security Staff (HFA-204), 7500 Standish Place, MPN, Rm. N-378, Rockville, MD 20855.
</p> <p>Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10 -0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Approximately 8,000 FDA employees.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Contains name, mail routing code, office telephone number, building, room number, birthdate, sex, identification photograph, height, weight, color of eyes, color of hair, and type of appointment.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>40 U.S.C. 471, et seq; Management and Disposal of Government Property Act.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The system is designed to maintain a record of all holders of FDA identification cards and security card keys, Forms HHS 576 (FDA employees only) FDA 2923, and FDA 3391, for renewal and recovery purposes and to identify numbers of lost or stolen cards. The system may also be used at FDA Headquarters to locate employees whose names have not been entered in the FDA locator system.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a Congressional office from the record of an individual in response to an inquiry from the Congressional office made at the request of that individual.
</p> <p>The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
</p><p>(a) HHS, or any component thereof; or
</p><p>(b) Any HHS employee in his or her official capacity; or
</p><p>(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
</p><p>is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Forms filed in folders in a locked filing cabinet. Computer tapes and discs stored in a locked safe.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information is filed and retrieved by name and date of birth.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized users: Authorized FDA personnel whose official duties require access for issuance, renewal, retrieval, and location purposes.
</p> <p>2. Physical safeguards: Records are kept in locked file cabinets and on minicomputers at Headquarters and are maintained in secured areas. Computer discs and tapes are stored in locked safes.
</p> <p>3. Procedural (or technical) safeguards: Computer software providing restricted commands.
</p> <p>4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained as long as the cards are valid. Computer tapes are erased immediately upon termination of employment and inactive forms are destroyed after 6 months by shredding.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>Chief, Physical Security Staff (HFA-204), 7500 Standish Place, MPN II, Rm. N-378, Rockville, MD 20855.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to:
</p><p>FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedure. Requesters should also reasonably specify the record contents being sought, and provide any other names officially used during period of employment. You may also request an accounting of disclosures that have been made of your record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual on whom the record is maintained.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
        <section id="09-10-0019" toc="yes">
            <systemNumber>09-10-0019</systemNumber>
            <subsection type="systemName">Mammography Quality Standards Act (MQSA) Training Records, HHS/FDA/CDRH.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>Division of Mammography Quality amd Radiation Programs (HFZ-240), Center for Devices and Radiological Health, 1350 Piccard Drive, Rockville, Maryland 20850.  A current list of contractor sites is available by writing to the System manager, indicated below, at this address.</p>
                </xhtmlContent>
            </subsection>
    
    <subsection type="categoriesOfIndividuals"><xhtmlContent><p>All individuals who receive training for the purpose of implementing the Mammography Quality Standards Act of 1992; individuals who successfully complete the training will become certified to conduct inspections and audits of mammograph facilities.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Contains name; date of birth; education; professional experience; employment address; dates of mammography training; participant's test scores, class grades, and an analysis of those scores; dates of certification of the inspector; dates of renewal or withdrawal of certification; and an evaluation of the inspector's field performance (records of complaints received and how the complaints received and how the complaints were resolved).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Pub. L. 102-539, the Mammography Quality Standards Act (MQSA) of 1992 (42 U.S.C. 263b).
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>To provide the Food and Drug Administration (FDA) with information about the training, certification, and recertification of MQSA inspectors for the purpose of implementing the Mammography Quality Standards Act of 1992.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1.  Disclosure may be made to a congressional office from the records of an individuals, in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
</p><p>(a)  HHS, or any component thereof; or
</p><p>(b)  Any HHS employee in his or her official capacity; or
</p><p>(c)  Any HHS employee in his or her official capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d)  The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components.
</p> <p>is a party to litigation or has an interest to such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3.  Disclosure may be made with the individual's supervisor since MQSA inspections will be a significant part of many inspector's jobs; therefore, performance in the training courses is an importance element of information to help the supervisor determine employee assignments as well as the level of supervision needed.
</p> <p>4.  Disclosure may be made to contractors for the purpose of collecting, compiling, aggregating, analyzing, or refining records in the system.  Contractors will be required to maintain Privacy Act safeguards with respect to such records.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Data are maintained in hard copy files and on computer disks, hard drive, and file servers.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Indexed by name, state, specific courses, training dates, grades, date of certification, and date of withdrawal of certification.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized users: Personnel of the Division of Mammography Quality Reporting Program who are engaged in training the individuals who inspect mammography facilities, and personnel in the Division who compile and analyze the test and personal data of the students.
</p> <p>2.  Physical safeguards: All records (such as disketts, computer listings, or documents) are kept in a secured area, locked rooms, and locked building.  The facility has a 24-hour guard service, and access to the building is further controlled by an operational card key system.  Access to the computer room is limited to a subset of persons with general access to the building.  Access to individual offices is controlled by simplex locks.  The building has smoke/fire detectors; the computer room has additional smoke/fire detectors plus water, temperature, and humidity sensors.  The computers room hasan uninterruptible power supply and a power supply and a power conditioning system.
</p> <p>3.Procedural safeguards:  End users and system professionals continue to receive regular training in information systems security and have signed an agreement indicating their cooperation with FDA policies.  Users are further instructed on system security during training sessions for this application and in accordance with the Privacy Act.  Users of personal information in the performance of their duties have been instructed to protect personal information from public views and from unauthorized personnel.
</p> <p>All reports containing confidential data are marked "confidential" and placed in the developer's or system manager's mail slot, which is located in an access-controlled room.  CDRH SOP requires that all reports containing confidential information be shredded before disposal.
</p> <p>4.  Technical safeguards: All users have individual IDS and regularly expiring passwords at least 6 characters long.  All users are assigned specific levels of database control based on their needs and authority.  All users of valid IDs and passwords will be monitored. Upon job change, the user's authorization is reviewed and updated as necessary.
</p> <p>All changes to data, as well as the time of change and the operator's ID are captured in a file as part of the database design. All data entered online is edited checked.
</p> <p>The system's intrusion alarms, which list all logins and their source, are monitored daily by the Information Systems Security Officer.  In addition, CDRH maintains commercial auditing software that permit logging of keystrokes  by individual accounts.
</p> <p>CDRH maintains three audits trails for this system:
</p><p>1.  System-wide intrusion alarms and file access notices.
</p> <p>2.  Application-dependent logging of all data transactions.
</p> <p>3.  Commercial software that permits capturing all keystrokes from suspicious accounts and terminals.
</p> <p>All systems in support of this database are under the control of CDRH and meet the same security standards as the application.
</p> <p>5. Inplementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual and the Department's Automated Information Systems Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained for five years after the certificed MQSA inspector leaves government service.  At the end of five years, in individual's paper records are shredded and automated records are erased.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Mammography Quality and Radiation Programs (HFZ-240), Center for Devices and Radiological Health, 1350 Piccard Drive, Rockville, Maryland 20850.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to:
</p><p>FDA Privacy Act Coordinator (HF1-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedure.  Requests should also reasonably specify the record contents being sought.  You may also request an accounting of disclosures that have been made of your record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individuals on whom the record is maintained and training records pertaining to that individual.  Information about certification renewal or withdrawal is generated in-house by the Division of Mammography Quality and Radiation Programs.  Sources of information about field performance could include the inspector's supervisor, as well as any investigation of an inspector's performance as a result of an inspector's performance as a result of complaints by a mammography facility.
</p></xhtmlContent></subsection></section>
<section id="09-10-0020" toc="yes">
<systemNumber>09-10-0020</systemNumber>
<subsection type="systemName">FDA Records Related to Research Misconduct Proceedings, HHS/FDA/OC.</subsection>
<subsection type="securityClassification"><xhtmlContent> <p>The security classification for the system is: Unclassified.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>System records are located in the Office of the Chief Scientist, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 32, rm 4214, Silver Spring, MD 20993. Some records may reside in the Agency component offices during the time that an allegation is under review.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system includes records related to the processing and reviewing of allegations of research misconduct levied against an individual (the respondent) who is an agent of, or affiliated by contract or agreement with FDA, or an FDA employee involved in intramural research. The records contain personally identifiable information (PII) and non-PII about respondents, complainants, witnesses and other individuals affiliated with entities that are contacted by or provide information to FDA.
</p> <p>Privacy Act notification, access, and amendment rights (described in this document) relative to this system are available to individuals who are subjects of records in the system, that is, respondents. Although records in the system may contain PII related to other individuals, only respondents are considered subjects of records in this system.
</p> <p>"Respondents" is defined as "the person against whom an allegation of research misconduct is directed or who is the subject of a research misconduct proceeding." The term "research misconduct" is defined in 42 CFR 93.103 to mean " fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results." These and other definitions are set out in 42 CFR part 93.
</p> <p>This system notice applies to an allegation of research misconduct involving the following: (1) Applications or proposals for FDA support for biomedical or behavioral extramural or intramural research or research training, or activities related to that research or research training; (2) FDA supported biomedical or behavioral extramural or intramural research; (3) FDA supported extramural or intramural research training programs; (4) FDA supported extramural or intramural activities that are related to biomedical or behavioral research or research training; and (5) plagiarism of research records produced in the course of FDA supported research, research training, or activities related to that research or research training.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The records in the system include information that must be submitted to ORI by FDA under 42 CFR part 93 and information that FDA obtains while conducting research misconduct proceedings. This information may include, but is not limited to:
</p><p>&#149; PII about respondents such as name, date of birth, employment information, educational background, social security number, personal and professional phone numbers, mailing address, and email address;
</p><p>&#149; PII regarding complainants and witnesses such as name, and personal or work contact information;
</p><p>&#149; The nature and substance of allegations;
</p><p>&#149; Data regarding FDA funding related to the research and/or respondent, including grants numbers;
</p><p>&#149; The organization(s) and officials responsible for conducting the action that are part of the research misconduct proceeding;
</p><p>&#149; The documentation used in the inquiry and investigation, including relevant research data and materials, which may include relevant information on study subjects;
</p><p>&#149; Applications, proposals, and documentation related to review and award actions;
</p><p>&#149; Reports, abstracts, manuscripts, and publications by the respondent(s);
</p><p>&#149; Other relevant reports, abstracts, manuscripts, and publications;
</p><p>&#149; Correspondence and memoranda of telephone calls;
</p><p>&#149; Summaries of interviews and transcripts or recordings of interviews;
</p><p>&#149; Statistical, scientific, and forensic analyses;
</p><p>&#149; Interim and final FDA reports; and
</p><p>&#149; Records of Agency findings, administrative actions, and appeal proceedings, if any.
</p> <p>The system also contains general administrative and oversight records regarding ORI actions. This includes information related to the following: (1) ORI reviews of the research misconduct proceedings, ORI findings of research misconduct, and ORI proposals for administrative action or for settlement of the case; (2) a respondent's opportunity to contest ORI findings of research misconduct and proposed HHS administrative actions; (3) final HHS findings of research misconduct and final decisions regarding administrative actions and their implementation; and (4) FDA and ORI coordination with other Federal, State, and local offices or agencies, including the DOJ.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authorities for maintaining this system are: 21 U.S.C. 371, 375, 393(d)(2), 394, 397, and 399a; 42 U.S.C. 216(b), 241, 289b; 5 U.S.C. 301; 44 U.S.C. 3101; and 42 CFR part 93.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent> <p>The purposes of this system are to do the following:
</p><p>1. Enable FDA, ORI, HHS, and the Federal Government to protect the health and safety of the public, to promote the integrity of FDA supported research, and to conserve public funds.
</p> <p>2. Enable FDA to implement its authority relating to research misconduct proceedings as set forth in 42 CFR part 93 and to document FDA activities in implementing that authority.
</p> <p>3. Ensure that research misconduct proceedings, including FDA's implementation of the Agency's and other HHS administrative actions, are carried out in accordance with FDA policy, 42 CFR part 93, and other applicable Federal statutes and regulations.
</p> <p>4. Enable FDA to inform Agency officials and other HHS officials who have a need for the records in the performance of their duties of the status and results of research misconduct proceedings.
</p> <p>5. Enable FDA to notify, consult with, and provide assistance to ORI, and other Federal, State, or local agencies to permit them to take action to protect the health and safety of the public, to promote the integrity of FDA supported research, to conserve public funds, or to pursue potential violations of civil and criminal statutes.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The Privacy Act lists the conditions for disclosure under 5 U.S.C. 552a(b). Among the permitted disclosures is disclosure "to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties" (5 U.S.C. 552a(b)(1)). For this system of records, this condition would include disclosure to the appropriate FDA, ORI, and other HHS officers and employees.
</p> <p>Permitted disclosures also include routine uses that are listed in the notice of the system of records (5 U.S.C. 552a(b)(3)). The Privacy Act defines "routine use" as "with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected." See also FDA's Privacy Act regulations, defining "routine use" as "use outside the Department of Health and Human Services that is compatible with the purpose for which the records were collected and described in the [System of Records] notice)" (21 CFR 21.20(b)(5)).
</p> <p>Records in this system that contain information about record subjects (respondents) and nonsubjects (witnesses, complainants, and other individuals affiliated with entities that are contacted by or provide information to FDA) may be disclosed to recipients outside HHS in accordance with the following routine uses:
</p><p>1. Disclosure may be made to any individual or entity able to obtain information or provide information or assistance in a research misconduct proceeding or related proceeding. Recipients of disclosures under this routine use may include experts asked to perform statistical, forensic, or other analyses; the relevant FDA supported institution(s); institutions with which the respondent(s) was previously affiliated; Federal, State and local agencies; the respondent(s); the complainant(s); witnesses; and organizations or individuals acting on behalf of those agencies, institutions, and individuals; provided, however, that in each case FDA determines whether limited disclosures or confidentiality agreements are needed to protect the privacy of respondent(s), complainant(s), witnesses, research subjects, or others who may be identified in the records to be disclosed.</p>
<p>2. Disclosure may be made to other Federal, State, or local agencies and offices, if FDA has reason to believe that a research misconduct proceeding may involve that agency or office.
</p> <p>3. Disclosure may be made to appropriate Federal Agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p> <p>4. Disclosure may be made to Institutional Review Boards, collaborating institutions, and individual research subjects, regarding information obtained or developed through a research misconduct proceeding that, in FDA's judgment, may have implications for individuals' health or for their participation in a research study.
</p> <p>5. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, disclosure may be made to the appropriate agency, whether Federal, foreign, State, local, or tribal, or other public authority responsible for enforcing, investigating, or prosecuting such violation, if the information disclosed is relevant to the responsibilities of the agency or public authority.
</p> <p>6. After FDA makes a finding of research misconduct and has informed ORI of this finding, disclosure may be made to responsible officials of FDA supported institutions or organizations, when in connection with a research misconduct proceeding concerning a respondent previously or currently employed by, or affiliated with the institution or organization, or when FDA, ORI, or HHS makes a finding or takes an action potentially affecting the agency or organization or its FDA support for research, research training, or related activities.
</p> <p>7. After FDA makes a finding of research misconduct and has informed ORI of this finding, disclosure may be made to the respondent's supervisor because research will be a significant part of many employee jobs, and performance is an important element of information to help the supervisor determine employee assignments as well as the level of supervision needed. If an individual moves to another job or contract, FDA may notify the other entity that we have relevant information with regard to that individual.
</p> <p>8. After FDA makes a finding of research misconduct and has informed ORI of this finding, disclosure may be made to a Federal Agency in connection with the hiring or retention of the respondent, the issuance of a security clearance, the reporting of an investigation of an employee, or the issuance of a license or other benefit by the Agency, to the extent that the record is relevant to the Agency's decision on the matter.
</p> <p>9. After FDA makes a finding of research misconduct and has informed ORI of this finding, disclosure may be made to professional journals, other publications, news media, and the public concerning research misconduct findings and the need to correct or retract research results or reports that have been affected by research misconduct, unless it is determined that release of the specific information in the context of a particular case would constitute a clearly unwarranted invasion of personal privacy. No information will be released that would reveal a confidential source.
</p> <p>10. After FDA makes a finding of research misconduct and has informed ORI of this finding, disclosure may be made to a State licensing board, certifying body, or other similar entity conducting a review of the respondent to aid the entity in meeting its responsibility to protect the health of the population in its jurisdiction or the integrity of the profession.
</p> <p>11. Disclosure may be made to contractors and other individuals or entities who perform services for the Agency related to this system of records and who have access to the records in order to perform such services, including individuals appointed to serve on FDA research misconduct inquiry committees or investigation committees if such individuals need access to the records to perform their assigned task. Provided, however, in each case FDA determines whether limited disclosures or confidentiality agreements are needed to protect the privacy of respondent(s), complainants(s), witnesses, research subjects, or others who may be identified in the records to be disclosed; and FDA determines that the disclosure is for a purpose compatible with the purpose for which the Agency collected the records.
</p> <p>12. When FDA closes a case without a settlement or finding of research misconduct, disclosure may be made to the respondent, relevant institution, and complainant(s); provided, however, that in each case FDA determines whether limited disclosures or confidentiality agreements are needed to protect the privacy of respondent(s), complainant(s), witnesses, research subjects, or others who may be identified in the records to be disclosed.
</p> <p>13. Disclosure may be made to the DOJ when: (1) The Agency or any component thereof; or (2) any employee of the Agency in his or her official capacity; or (3) any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or (4) the U.S. Government is a party to litigation or has an interest in such litigation, and by careful review, the Agency determines that the records are both relevant and necessary to the litigation and the use of such records by the DOJ is therefore deemed by the Agency to be for a purpose that is compatible with the purpose for which the Agency collected the records.
</p> <p>14. Disclosure may be made to a court or other tribunal when: (1) The Agency or any component thereof; or (2) any employee of the Agency in his or her official capacity; or (3) any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or (4) the U.S. Government is a party to the proceeding or has an interest in such proceeding, and by careful review, the Agency determines that the records are both relevant and necessary to the proceeding and the use of such records is therefore deemed by the Agency to be for a purpose that is compatible with the purpose for which the Agency collected the records.
</p> <p>15. <i>Einstein 2 Cyber Security Monitoring:</i> Records may become accessible to U.S. Department of Homeland Security (DHS) cyber security personnel, if captured in an intrusion detection system used by HHS and DHS pursuant to the Einstein 2 program. Under Einstein 2, DHS uses intrusion detection systems to monitor Internet traffic to and from federal computer networks to prevent malicious computer code from reaching the networks. According to DHS' Privacy Impact Assessment for Einstein 2 (available on the DHS Cybersecurity privacy Web site, <i> http://www.dhs.gov</i>), only PII that is directly related to a malicious code security incident is captured by and accessible to DHS, and DHS does not access PII unless the PII is part of the malicious code.
</p> <p>16. Disclosure may be made to the National Archives and Records Administration and/or the General Services Administration for the purpose of records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records may be maintained in hard copy files and on computer disks, hard drive, and file servers, and other types of data storage devices.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records may be retrieved by manual or computer search of the case-tracking system using the name of the respondent(s).</p>
</xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p><i>a. Authorized users.</i> Records in FDA's system are available to the Commissioner of Food and Drugs, the Agency's Chief Scientist and Deputy Commissioner for Science and Public Health, the Agency's Research Integrity Officer (System Manager), and to other appropriate FDA staff when they have a need for the records in the performance of their duties. Records are also available to the Director of ORI and other appropriate ORI staff, and to other appropriate HHS officials that are involved in the research misconduct proceeding, when there is a need to know in the performance of their duties. All authorized users are informed that the records are confidential and are not to be further disclosed.
</p> <p><i>b. Procedural safeguards.</i> Access is strictly controlled by the Research Integrity Officer (System Manager) in compliance with the Privacy Act and this system notice. Access to the records is limited to ensure confidentiality. All questions and inquiries from any party should be addressed to the Research Integrity Officer (System Manager).
</p> <p><i>c. Physical safeguards.</i> All records (such as diskettes, computer listings, or documents) are kept in a secured area, locked rooms, and locked building. The facility has a 24-hour guard service, and access to the building is further controlled by an operational card key system. Access to the files, which are generally hard copy, is limited to a subset of individuals with general access to the building.
</p> <p>Access to individual offices is controlled by simplex locks. Records are kept in locked file cabinets in a room that is locked during non- working hours. Access to this room is restricted to specific personnel. Access to computer files is strictly limited through passwords and user-invisible encryption. Special measures commensurate with the sensitivity of the record are taken to prevent unauthorized copying or disclosure of the records.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records are maintained for 7 years in accordance with 42 CFR part 93, FDA's Records Control Schedule, and with the applicable General Records Schedule and disposition schedule approved by the National Archives and Records Administration.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>FDA Research Integrity Officer, Office of the Chief Scientist, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 32, Rm 4214, Silver Spring, MD 20993.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>In accordance with 21 CFR part 21, subpart D, an individual may find out whether a record exists about him or her by submitting a written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to: FDA Privacy Act Coordinator, Division of Freedom of Information (ELEM-1029), Food and Drug Administration, 12420 Parklawn Dr., Element Building, Rockville, MD 20857. HHS/FDA is exempting all records related to research misconduct proceedings from this provision (see section I.S of this document <i>Records Exempted from Certain Provisions of the Privacy Act</i>). However, consideration will be given to requests addressed to the Privacy Act Coordinator as described previously in this document. In addition, some records may be exempt under 5 U.S.C 552a(d)(5), if they are "compiled in reasonable anticipation of a civil action or proceeding." See also 21 CFR 21.41(e).</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Procedures are the same as those in section I.O of this document (<i>Notification Procedure).</i> Requests should also reasonably specify the record contents being sought and may also request an accounting of disclosures that have been made of the record, if any. As stated previously in this document, HHS/FDA is exempting all records related to research misconduct proceedings from this provision (see section I.S of this document, <i>Records Exempted from Certain Provisions of the Privacy Act</i>), and some records may be exempt under 5 U.S.C. 552a(d)(5). However, consideration will be given to access requests addressed to the Privacy Act Coordinator as described in section I.O of this document (<i>Notification Procedure</i>).</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>In accordance with 21 CFR 21.50, contact the Privacy Act Coordinator, Food and Drug Administration (see
section I.O of this document). Reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant. As stated previously in this document, HHS/FDA is exempting all records related to research misconduct proceedings from this provision (see section I.S of this document, <i>Records Exempted from Certain Provisions of the Privacy Act </i>), and some records may be exempt under 5 U.S.C. 552a(d)(5).</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories">
    <xhtmlContent>
        <p>Information in this system is obtained from many sources, including the following: (1) Directly from the respondent or complainant or his/her representative; (2) derived from materials supplied by the respondent or complainant or his/her representative; (3) from information supplied by the institutions, witnesses, scientific publications, and other nongovernmental sources; (4) from observation and analysis made by FDA and ORI staff and scientific experts; (5) from departmental and other Federal, State, and local government records; (6) from hearings and other administrative proceedings; and (7) from any other relevant source.</p>
    </xhtmlContent>
</subsection>
    <subsection type="exemptionsClaimed"><xhtmlContent><p>FDA records related to research misconduct proceedings will be exempt from the Privacy Act requirements pertaining to providing an accounting of disclosures, access and amendment, notification, and Agency procedures and rules under sections 552a(k)(2) and (k)(5) of the Privacy Act.
</p> <p>Elsewhere in this issue of the <i>Federal Register</i>, FDA is publishing a notice of proposed rulemaking and direct final rule to apply these exemptions to records in this system related to ongoing investigations or that would reveal a confidential source. These exemptions are necessary to safeguard the integrity of the research misconduct proceedings and to ensure that FDA's efforts to obtain accurate and objective information will not be hindered. In the course of investigations of allegations of research misconduct, it is often necessary to give an express promise to withhold the identity of an individual who has provided relevant information. Sources of information necessary to complete an effective investigation may be reluctant to provide sensitive information unless they can be assured that their identities will not be revealed. The proposed exemptions will ensure that the records related to ongoing investigations will not be disclosed inappropriately and that the identities of confidential sources will be protected.
</p> <p>The notice of proposed rulemaking and direct final rule provide additional detail regarding the bases for these exemptions.
</p></xhtmlContent></subsection></section>
<section id="09-10-0021" toc="yes">
        <systemNumber>09-10-0021</systemNumber>
        <subsection type="systemName">FDA User Fee System, HHS/FDA.</subsection>
        <subsection type="securityClassification">
            <xhtmlContent>
                <p>
                    Unclassified.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemLocation">
            <xhtmlContent>
                <p>
                    This system is located at FDA's Data Center in Ashburn, VA.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfIndividuals">
            <xhtmlContent>
                <p>
                    This system contains records about individuals and companies that are required to submit user fee payments to the FDA. This includes organizations registered in the UFS, those billed through the system, as well as those submitting applications for review or otherwise assessed fees under the User Fee Program.
                </p>
                <p>Privacy Act notification, access, and amendment rights relative to the UFS are available only to individuals who are the subject of records in this system. User fee record subjects are individuals required to pay a user fee, including individual FOIA requestors and individuals who are sole proprietors of an entity required to pay a user fee. Although records in the system may contain personally identifiable information (PII) related to other individuals, only the specified fee submitters are considered subjects of records in this system.</p>
            </xhtmlContent>
        </subsection>
        <subsection type="categoriesOfRecords">
            <xhtmlContent>
                <p>
                    1. The UFS maintains information about individuals, companies and organizations that pay user fees. This includes: (a) For an entity remitter, a FEIN, and for an individual remitter, a TIN; (b) company or organization name and address; (c) DUNS number; and (d) contact person's name, phone number, Fax number, and email address.
                </p>
                <p>
                    2. The UFS also stores application information collected when the fee remitter (submitter) creates coversheets in order to pay user fees. This information includes the type of application, waiver and exemption status, and SBD number.
                </p>
                <p>
                    3. The UFS stores fee processing information including: Billing details; adjustments to invoices including credit and debit memos; and receipt information including date, mode, and amount of payment.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="authorityForMaintenance">
            <xhtmlContent>
                <p>
                    21 U.S.C. 371, 379, 379e, 379h, 379h-1, 379j, 379j-12, 379j-21, 379j-31, 387s, and 393(d)(2); 42 U.S.C 263b(r)(1); 5 U.S.C. 301, 552; and 44 U.S.C. 3101.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="purpose">
            <xhtmlContent>
                <p>
                    FDA personnel and any contractors assisting them will use information in the system, on a need-to-know basis, for the following purposes:
                </p>
                <p>
                    1. To assess and collect user fees.
                </p>
                <p>
                    2. To provide an electronic payment and receipt mechanism that is integrated with the U.S. Department of Treasury's <i>http://www.Pay.gov </i> Web site and the various FDA Centers.
                </p>
                <p>
                    3. To provide Web-based capabilities including transactional inquiries and information on payment status.
                </p>
                <p>
                    4. To facilitate debt collection activities in accordance with the Debt Collection Improvement Act of 1996 and the HHS regulations for claims collections (45 CFR Part 30).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="routineUsesOfRecords">
            <xhtmlContent>
                <p>
                    Permitted disclosures include those made in accordance with routine uses that are listed in the notice of the system of records. 5 U.S.C. 552a(b)(3). The Privacy Act defines "routine use" as "with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected." See also FDA's Privacy Act regulations, defining "routine use" as "use outside the Department of Health and Human Services that is compatible with the purpose for which the records were collected and described in the [System of Records] notice * * *" 21 CFR 21.20(b)(5).
                </p>
                <p>
                    Records in this system that contain information about record subjects and nonsubjects (such as FDA employees who operate the system) may be disclosed to recipients outside HHS in accordance with the following routine uses:
                </p>
                <p>
                    1. Records may be disclosed to appropriate Federal Agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records.
                </p>
                <p>
                    2. In the event HHS deems it desirable or necessary, in determining whether particular records are required to be disclosed under the FOIA, disclosure may be made to the DOJ for the purpose of obtaining its advice.
                </p>
                <p>
                    3. Where Federal Agencies having the power to subpoena other Federal Agencies' records, such as the Internal Revenue Service, issue a subpoena to HHS for records in this system of records, HHS will make such records available, provided however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                </p>
                <p>
                    4. A record from this system may be disclosed to entities as provided for in the Debt Collection Improvement Act of 1996 (Pub. L. 104 -134).
                </p>
                <p>
                    5. A record may be disclosed to banks enrolled in the Treasury Credit Card Network to collect a payment or debt when the person has given his/her credit card number for this purpose.
                </p>
                <p>
                    6. UFS submitter data (name, address, DUNS number) may be provided to Dun and Bradstreet for validation for the purpose of maintaining database integrity.
                </p>
                <p>
                    7. Disclosure may be made to the Department of Justice (DOJ) when: (a) The Agency or any component thereof; (b) any employee of the Agency in his or her official capacity; (c) any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or (d) the U.S. Government is a party to litigation or has an interest in such litigation, and by careful review, the Agency determines that the records are both relevant and necessary to the litigation and the use of such records by the DOJ is therefore deemed by the Agency to be for a purpose that is compatible with the purpose for which the Agency collected the records.
                </p>
                <p>
                    8. Disclosure may be made to a court or other tribunal, when: (a) The Agency or any component thereof; (b) any employee of the Agency in his or her official capacity; (c) any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee; or (d) the U.S. Government is a party to the proceeding or has an interest in such proceeding, and by careful review, the Agency determines that the records are both relevant and necessary to the proceeding and the use of such records is therefore deemed by the Agency to be for a purpose that is compatible with the purpose for which the Agency collected the records.
                </p>
                <p>
                    9. Disclosure may be made to contractors and other individuals who perform services for the Agency related to this system of records, and who need access to the records in order to perform such services. Recipients shall be required to comply with the requirements of the Privacy Act of 1974, as amended, 5 U.S.C. 552a.
                </p>
                <p>
                    10. Disclosure may be made to NARA and/or the General Services Administration for the purpose of records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.
                </p>
                <p>
                    11. Records may become accessible to U.S. Department of Homeland Security (DHS) cyber security personnel, if captured in an intrusion detection system used by HHS/FDA and DHS pursuant to the DHS Einstein 2 program. Under Einstein 2, DHS uses intrusion detection systems to monitor Internet traffic to and from Federal computer networks to prevent malicious computer code from reaching the networks. According to DHS' Privacy Impact Assessment for Einstein 2 (available on the DHS Cybersecurity privacy Web site, <i>http://www.dhs.gov</i>), only PII that is directly related to a malicious code security incident is captured by and accessible to DHS, and DHS does not access PII unless the PII is part of the malicious code.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="policiesAndPractices">
            <xhtmlContent>
                <p>
                    Storage:
                </p>
                <p>Records may be maintained in hard copy files and on computer disks, hard drives, file servers, and other types of data storage devices.</p>
            </xhtmlContent>
        </subsection>
        <subsection type="retrievability">
            <xhtmlContent>
                <p>
                    Records may be retrieved by computer search using name, address, contact information, system identifiable numbers (party/organization, submitter numbers), DUNS Number, and payment information (for refunds).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="safeguards">
            <xhtmlContent>
                <p>
                    1. <i>Authorized users:</i> Access is restricted to FDA employees and contractors with a Level 5 or higher clearance who have a need for the records in the performance of their duties.
                </p>
                <p>
                    2.  <i>Procedural and technical safeguards:</i> Technical controls include identification and authentication, access control, audit and accountability, system and communication protection, timely account disablement/deletion, configuration management, maintenance, system and information integrity, media protection, and incident response. These controls extend to remote users as well. Additionally, when a remitter (submitter) generates a coversheet the UFS will only print the last four characters of the FEIN/TIN along with the Organization name and address.
                </p>
                <p>
                    3.  <i>Physical safeguards:</i> Physical security safeguards include controlled-access buildings where all records (CDs, computer listings, and paper documents) are maintained in secured areas, locked buildings, locked rooms, and locked cabinets.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="retentionAndDisposal">
            <xhtmlContent>
                <p>
                    UFS records are maintained in accordance with FDA's Records Control Schedule, and with the applicable General Records Schedule (GRS) and disposition schedule approved by NARA. UFS records fall under GRS 20, Items 2a(4) (hard copy input records), 12 and 16 (Output records and reports), and NARA approved citation N1-088-09-11, Items 1.1 (files maintained in the Office of Financial Management), 1.2 (data maintained by FDA Centers), and 1.3.2 (database records).
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="systemManager">
            <xhtmlContent>
                <p>
                    George Brindza, Division of Systems, FDA Office of Information Management (OIM), 2094 Gaither Rd., rm. 131, Rockville, MD 20850; 301 -796-7845.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="notificationProcedure">
            <xhtmlContent>
                <p>
                    In accordance with 21 CFR part 21, subpart D, an individual may submit a request to the FDA Privacy Act Coordinator, with a notarized signature, to confirm whether records exist about him or her. Requests should be directed to the FDA Privacy Act Coordinator, Division of Freedom of Information, 12420 Parklawn Dr., ELEM-1036, Rockville, MD 20857. An individual requesting notification via mail should certify in his or her request that he or she is the individual who he or she claims to be and that he or she understands that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act subject to a $5,000 fine, and indicate on the envelope and in a prominent manner in the request letter that he or she is making a "Privacy Act Request." Additional details regarding notification request procedures appear in 21 CFR part 21, subpart D.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordAccessProcedures">
            <xhtmlContent>
                <p>
                    Procedures are the same as above, in Notification Procedures. Requesters should also reasonably specify the record contents being sought. Some records may be exempt from access under 5 U.S.C. 552a(d)(5), if they are "compiled in reasonable anticipation of a civil action or proceeding." If access to requested records is denied, the requester may appeal the denial to the FDA Commissioner. Additional details regarding record access procedures and identity verification requirements appear in 21 CFR part 21, subpart D.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="contestingRecordProcedures">
            <xhtmlContent>
                <p>
                    In addition to the procedures described above, requesters should reasonably identify the record, specify the information they are contesting, state the corrective action sought and the reasons for the correction, and provide justifying information showing why the record is not accurate, complete, timely, or relevant. Rules and procedures regarding amendment of Privacy Act records appear in 21 CFR part 21, subpart E.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="recordSourceCategories">
            <xhtmlContent>
                <p>
                    Information in this system is obtained from many sources, including: (1) Directly from the individual, company or organization that is required to submit user fees to FDA; (2) from materials supplied by the submitter or individual acting on his/her behalf; (3) from FDA Centers such as the Center for Drug Evaluation and Research, Center for Devices and Radiological Health, Center for Biologics Evaluation and Research, Center for Veterinary Medicine, Center for Tobacco Products, Center for Food Safety and Applied Nutrition, and the Office of Financial Management; and (4) from any other relevant source.
                </p>
            </xhtmlContent>
        </subsection>
        <subsection type="exemptionsClaimed">
            <xhtmlContent>
                <p>None.</p>
            </xhtmlContent>
        </subsection>
    </section>
    
    <section id="09-10-0022" toc="yes">
            <systemNumber>09-10-0022</systemNumber>
    <subsection type="systemName">
    FDA Commissioning of State and Local Officials, HHS/FDA/ORA.
    </subsection>
    <subsection type="securityClassification"><xhtmlContent>
    <p>Unclassified.</p></xhtmlContent></subsection>
    <subsection type="systemLocation"><xhtmlContent>
    <p>Records are maintained at several FDA Headquarters locations and in component offices of the FDA, in both Montgomery County, MD and field locations across the United States. </p></xhtmlContent></subsection>
    <subsection type="categoriesOfIndividuals"><xhtmlContent>
    <p>The records in this system will contain data collected from the FDA commissioning applications of individuals who are State and local officials who wish to be commissioned under section 702(a)(1)(A) of the FD&amp;C Act.  This information is gathered for the purpose of processing and validating each individual's qualifications for commissioning, to initiate the mandatory background investigation, and to track the status of commissioned officials.  </p>
    <p>Privacy Act notification, access, and amendment rights relative to the records maintained in this system are available only to individuals who are the subject of records in this system.  The individuals who are the subjects of the records stored in this system are the State or local officials who are currently commissioned, have applied for a commission, and/or were commissioned or rejected in the past.  Although records in the system may contain personally identifiable information related to other individuals, only the specified commissioned or commission-seeking individuals are considered subjects of records in this system.</p></xhtmlContent></subsection>
    <subsection type="categoriesOfRecords"><xhtmlContent>
    <p>The records in this system will include:  Full name, aliases, date of birth, home address, work address, telephone number, work or personal email address, photograph, educational history, job title, agency, division, area of expertise, employment history, supervisor's name, signature, and the outcome of the background investigation of individuals who apply for a commission.  Should a commissioned individual with pocket credentials lose their credentials, he or she will typically file a police report and provide a copy of the report to FDA where it is kept in the individual's commissioning file.  In addition, the records in the system will describe the nature of the authority granted to a commissioned individual, the relevant regulatory program area, the date the commission was issued, and date of expiration.</p></xhtmlContent></subsection>
    <subsection type="authorityForMaintenance"><xhtmlContent>
    <p>The authorities for maintaining this system are:  Section 702(a) of the FD&amp;C Act, 44 U.S.C. 3101, and 5 U.S.C. 301.</p></xhtmlContent></subsection>
    <subsection type="purpose"><xhtmlContent>
    <p>Relevant Agency personnel will use records from this system on a need-to-know basis to:</p>
    <p>    Centrally gather data enabling FDA to determine the suitability, eligibility, and qualifications of State and local officials to whom FDA might offer commissions;</p>
    <p> enable FDA to securely commission and credential State and local officials who are particularly qualified to assist FDA in a special manner for which FDA credentials are required;</p>
    <p>   ensure the safety and security of FDA facilities, systems, information, and of facility occupants and users;</p>
    <p>    provide appropriate access to FDA information systems, networks, and resources;</p>
    <p>    enhance FDA's ability to ensure the safety of FDA-regulated products through a secure commissioning process; and</p>
    <p>    centrally gather data on commissioned officials, thereby enabling FDA to efficiently maintain the commissioning program and to support activities, such as quickly ascertaining which officials are particularly qualified to carry out official responsibilities and providing this information as necessary to our State and local counterparts.</p></xhtmlContent></subsection>
    <subsection type="routineUsesOfRecords"><xhtmlContent>
    <p>These routine uses specify circumstances, in addition to those provided by the Privacy Act at 5 U.S.C. 552a(b), under which records may be disclosed to recipients outside HHS, without the individual record subject's prior written consent:</p>
    <p> Public disclosures may be made (for example, on FDA's Web site) of the names of commissioned officials, and other basic information, including the identification of their State or local agency, their job titles, the type of commission, any specific commissioned areas, and the date of their commission, to the extent disclosure is not an unwarranted invasion of personal privacy.</p>
    <p>    Disclosure may be made to appropriate Federal Agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.</p>
    <p>    Disclosure may be made to a Federal, State, local, territorial, tribal, foreign, or other public authority, on request, in connection with the hiring or retention of an employee, the issuance or retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit, to the extent that the information is relevant and necessary to the requesting Agency's decision.  No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the Agency or to another Federal Agency for criminal, civil, administrative, personnel, or regulatory action.</p>
    <p>    Disclosure of system information may be made to a State, local, territorial, and tribal agencies or governments to provide copies of records that were originally provided to the Agency by that entity. </p>
    <p>    Disclosure may be made to Federal Agencies, contractors, and other individuals or entities who perform services for the Agency related to this system of records and who need access to the records to perform those services.  Recipients shall be required to comply with the requirements of the Privacy Act of 1974, as amended, 5 U.S.C. 552a.</p>
    <p>    When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, disclosure may be made to the appropriate public authority, whether Federal, foreign, State, local, or tribal, or otherwise, responsible for enforcing, investigating, or prosecuting such violation, if the information disclosed is relevant to the responsibilities of the Agency or public authority. </p>
    <p>    Disclosure may be made to a court or other tribunal or adjudicative body in a proceeding, when:  </p>
    <p>    The Agency or any component thereof; or </p>
    <p>    any employee of the Agency in his or her official capacity; or </p>
    <p>    any employee of the Agency in his or her individual capacity where the Department of Justice (DOJ) has agreed to represent the employee; or </p>
    <p>    the U.S. Government, </p>
    <p>is a party to the proceeding or has an interest in such proceeding and, by careful review, the Agency determines that the records are both relevant and necessary to the proceeding and the use of such records is therefore deemed by the Agency to be for a purpose that is compatible with the purpose for which the Agency collected the records.</p>
    <p>    Disclosure may be made to the National Archives and Records Administration (NARA) and/or the General Services Administration for the purpose of records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.</p>
    <p>    Disclosure may be made to the DOJ when:  </p>
    <p>    The Agency or any component thereof; or </p>
    <p>    any employee of the Agency in his or her official capacity; or </p>
    <p>    any employee of the Agency in his or her individual capacity where the Agency or the DOJ has agreed to represent the employee; or </p>
    <p>    the U.S. Government, </p>
    <p>is a party to litigation or has an interest in such litigation and, by careful review, the Agency determines that the records are both relevant and necessary to the litigation and the use of such records by the DOJ is therefore deemed by the Agency to be for a purpose that is compatible with the purpose for which the Agency collected the records. </p>
    <p>     In the event HHS/FDA deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the DOJ for the purpose of obtaining its advice.</p></xhtmlContent></subsection>
    <subsection type="policiesAndPractices"><xhtmlContent>
    <p> Storage:</p>
    <p>Records are maintained in hard copy files, image files, electronic hard drive, file servers, and other electronic data storage devices.</p></xhtmlContent></subsection>
    <subsection type="retrievability"><xhtmlContent>
    <p>To retrieve information, the system database is typically queried using any of the internal data fields.  The data fields encompass any data criterion that is entered into the system including, but not limited to, name, FDA region, credential number (if issued pocket credentials), certificate expiration date, State, program area, or authority. </p></xhtmlContent></subsection>
    <subsection type="safeguards"><xhtmlContent>
    <p>a.  Authorized users.  Access is restricted to FDA employees and contractors with a Level 5 or higher clearance who have a need for the records in the performance of their duties. </p>
    <p>b.  Procedural and technical safeguards.  Technical controls include identification and authentication of the authorized user, access control, audit and accountability, system and communication protection, timely account disablement/deletion, configuration management, maintenance, system and information integrity, media protection, and incident response.  These controls extend to remote users as well. </p>
    <p>c.  Physical safeguards.  Physical safeguards include controlled-access buildings where all records (such as diskettes, computer listings, and paper documents) are maintained in secured areas, locked buildings, locked rooms, and locked cabinets.</p></xhtmlContent></subsection>
    <subsection type="retentionAndDisposal"><xhtmlContent>
    <p>Commissioning records are maintained in accordance with FDA's Records Control Schedule and the applicable General Records Schedule and disposition schedules approved by NARA.  Commissioning records fall under NARA approved citation N1-088-09-02 for Commissioning Documents, the Nationwide List of FDA Commissions, and Summary Reports of FDA Commissions.  Commissioning documents are deleted/destroyed 5 years after the end of the fiscal year in which a commission is revoked or expires.  Records within the nationwide list of FDA commissions are deleted/destroyed 5 years after the fiscal year when they become obsolete or are superseded.  Summary reports of FDA commissions are deleted/destroyed after the nationwide list of FDA Commissions has been updated.</p></xhtmlContent></subsection>
    <subsection type="systemManager"><xhtmlContent>
    <p>Ryan Cates, Food and Drug Administration, Office of Partnerships, Element Building, 12420 Parklawn Dr., Rockville, MD  20857, 301-796-5390, FAX: 301-827-3588, OP-ORA@fda.hhs.gov. </p></xhtmlContent></subsection>
    <subsection type="notificationProcedure"><xhtmlContent>
    <p>In accordance with 21 CFR Part 21 Subpart D, an individual may submit a request to the FDA Privacy Act Coordinator, with a notarized signature, to confirm whether records exist about him or her.  Requests should be directed to the FDA Privacy Act Coordinator, Division of Freedom of Information, 12420 Parklawn Dr., ELEM-1029, Rockville, MD  20857.  An individual requesting notification via mail should certify in his or her request that he or she is the individual who he or she claims to be and that he or she understands that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a $5,000 fine, and indicate on the envelope and in a prominent manner in the request letter that he or she is making a "Privacy Act Request."  Additional details regarding notification request procedures appear in 21 CFR Part 21, Subpart D.  A commission holder may also request an opportunity to review his or her own file by contacting the appropriate Regional Food and Drug Director.</p></xhtmlContent></subsection>
    <subsection type="recordAccessProcedures"><xhtmlContent>
    <p>Procedures are the same as above, in the Notification Procedure section.  Requesters should also reasonably specify the record contents being sought.  Some records may be exempt from access under 5 U.S.C. 552a(d)(5), if they are "compiled in reasonable anticipation of a civil action or proceeding."  If access to requested records is denied, the requester may appeal the denial to the FDA Commissioner.  Additional details regarding record access procedures and identity verification requirements appear in 21 CFR Part 21, Subpart D.</p></xhtmlContent></subsection>
    <subsection type="contestingRecordProcedures"><xhtmlContent>
    <p>In addition to the procedures described above, requesters should reasonably identify the record, specify the information they are contesting, state the corrective action sought and the reasons for the correction, and provide information justifying why the record is not accurate, complete, timely, or relevant to an FDA purpose.  Rules and procedures regarding amendment of Privacy Act records appear in 21 CFR Part 21, Subpart E.</p></xhtmlContent></subsection>
    <subsection type="recordSourceCategories"><xhtmlContent>
    <p>Information in this system is obtained from the following sources:  Directly from a commissioned individual or individual under consideration for commissioning; FDA employee; FDA contractor; sponsoring State, local or Federal agency; former sponsoring, employing or commissioning agency; other State, local or Federal agencies; contract employer; and the subject individual's former employer.</p></xhtmlContent></subsection>
    <subsection type="exemptionsClaimed"><xhtmlContent>
    <p>None.  </p>
</xhtmlContent></subsection></section>
    
        <section id="09-80-0009" toc="yes">
            <systemNumber>09-80-0009</systemNumber>
            <subsection type="systemName"> ACYF Mailing List, HHS/HDS/ACYF.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        Administration for Children, Youth &amp; Families, Room 5130, Donohoe Building, 400 6th Street, SW, Washington, DC 20201.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>
                        Head Start grantees.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        Mailing key contains grantees' names and addresses only.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>
                        Omnibus Budget Reconciliation Act of 1981 (Pub. L. 97-35).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>
                        To assist ACYF in carrying out its responsibilities to grantees under the Act.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>
                        (1) Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual
                    </p>
                    <p>
                        (2) In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p>
                    <p>
                        Computer tape.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        Indexed by code using letters and numbers; used for correspondence, to distribute program information. Addresses will be retrieved by matching of identifier codes with the grantees' names.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        Access by authorized personnel only.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        List is continually updated. Information is kept as long as accurate.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        Director, Head Start Bureau, ACYF, PO Box 1182, Washington, DC 20013.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        Any inquiry regarding these systems of records should be in writing and should be addressed to the System Manager.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>
                        Same as notification procedures. Requesters should also reasonably specify the record contents being sought.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>
                        Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reason(s) for the correction with supporting justification.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        Source of information is directly from grantees.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemsExempted">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                </xhtmlContent>
            </subsection>
        </section>
        <section id="09-80-0020" toc="yes">
            <systemNumber>09-80-0020</systemNumber>
            <subsection type="systemName"> HDS Publications Distribution Mailing List, HHS/HDS/OPA.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        Room 358G, Hubert Humphrey Bldg., Washington, DC 20201.
                    </p>
                </xhtmlContent>
            </subsection>
                        <subsection type="categoriesOfIndividuals">
                            <xhtmlContent>
                                <p>
                                    State and local governmental units, organizations, individuals and grantees who ask to receive HDS publications.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="categoriesOfRecords">
                            <xhtmlContent>
                                <p>
                                    Name, title, address interest in HDS programs, addressee's field of activity, type of organization, scope of organization, whether provide information or services or both, and media affiliation, if applicable.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="authorityForMaintenance">
                            <xhtmlContent>
                                <p>
                                    Titles IV-B, IV-E, and XX of the Social Security Act; Developmental Disabilities Assistance and Bill of Rights Act, Pub. L. 94-103, as amended by Pub. L. 95-602; Title VIII of Pub. L. 93-644, as amended, Native American Programs; Pub. L. 95 -266, The Child Abuse Prevention and Treatment Act; Children's Bureau Act of 1912; Pub. L. 93-644, as amended, Headstart-- Follow Through Act; Pub. L. 97-35, Omnibus Budget Reconciliation Act; 42 U.S.C. 5701, Runaway and Homeless Youth Act; and Older Americans Act of 1965, as amended.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="purpose">
                            <xhtmlContent>
                                <p>
                                    To assist HDS programs in carrying out their responsibilities to disseminate program information.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="routineUsesOfRecords">
                            <xhtmlContent>
                                <p>
                                    1. Disclosure may be made to a Congressional office from the record of an individual in response to a verified inquiry from the Congressional office made at the written request of that individual.
                                </p>
                                <p>
                                    2. Disclosure may be made to the Department of Justice, to a court or other tribunal, or to another party before such tribunal, when:
                                </p>
                                <p>
                                    (a) HHS or any component thereof; or
                                </p>
                                <p>
                                    (b) Any HHS employee in his or her official capacity; or
                                </p>
                                <p>
                                    (c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
                                </p>
                                <p>
                                    (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
                                </p>
                                <p>
                                    is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the tribunal, or other party is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="policiesAndPractices">
                            <xhtmlContent>
                                <p>
                                    Storage:
                                </p>
                                <p>
                                    Computer tape.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="retrievability">
                            <xhtmlContent>
                                <p>
                                    Addresses will be retrieved by name, interest in HDS programs, field of activity, type of organization or level of government, scope of organization, whether the addresses provide information or services or both, or type of media.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="safeguards">
                            <xhtmlContent>
                                <p>
                                    1. Authorized Uses: Only authorized personnel within the Department may access the HUD mailing list.
                                </p>
                                <p>
                                    2. Physical Safeguards: Computer tapes are stored in locked files in secured areas. Computer terminals are in secured areas.
                                </p>
                                <p>
                                    3. Procedural Safeguards: Employees who maintain the tapes in this system are instructed to grant regular access only to authorized users. Data stored in computers are accessed through the use of passwords/keywords known to authorized personnel. These passwords/keywords are changed frequently.
                                </p>
                                <p>
                                    4. Implementation Guidelines: Part 6, Ã¢â‚¬ËœAutomated Information System Security` of the HHS Information Resources Management Manual.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="retentionAndDisposal">
                            <xhtmlContent>
                                <p>
                                    List is annually circularized as required by the Joint Committee on Printing and those not responding are dropped from the list.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="systemManager">
                            <xhtmlContent>
                                <p>
                                    Director, Division of Publication and Graphic Services, Office of Public Affairs, HDS, 329D, Hubert Humphrey Bldg., Washington, DC 20201.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="notificationProcedure">
                            <xhtmlContent>
                                <p>
                                    Any inquiries regarding this system of records should be in writing and should be addresses to the System Manager.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="recordAccessProcedures">
                            <xhtmlContent>
                                <p>
                                    Same as notification procedure. Requesters should also reasonably specify the record contents being sought.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="contestingRecordProcedures">
                            <xhtmlContent>
                                <p>
                                    Contact the official at the address specified under notification procedure above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and your reason(s) for requesting the correction with supporting evidence to justify it.
                                </p>
                            </xhtmlContent>
                        </subsection>
                        <subsection type="systemsExempted">
                            <xhtmlContent>
                                <p>
                                    None.
                                </p>
                            </xhtmlContent>
                        </subsection>
                    </section>
                
                <section id="09-80-0202" toc="yes">
                    <systemNumber>09-80-0202</systemNumber>
                    <subsection type="systemName">
                        OCSE Federal Case Registry of Child Support Orders (FCR) HHS/ACF/OCSE.
                    </subsection>
                    <subsection type="securityClassification">
                        <xhtmlContent>
                            <p>
                                None.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="systemLocation">
                        <xhtmlContent>
                            <p>
                                National Computer Center, Social Security Administration, Baltimore, Maryland 21235.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="categoriesOfIndividuals">
                        <xhtmlContent>
                            <p>
                                Individuals involved in child support cases in which services are being provided by the State IV-D child support agencies, and/or individuals who are subject to child support orders established or modified on or after October 1, 1998, and the children of such individuals.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="categoriesOfRecords">
                        <xhtmlContent>
                            <p>
                                The FCR collects and maintains records provided by State child support registries. These records include abstracts of support orders and information from child support cases. The records may include the following information: name, Social Security number (SSN), State case identification number, State Federal Information Processing Standard (FIPS) code, county code, case type (cases in which services are being provided by the State child support agencies under Title IV-D of the Social Security Act and those cases in which services are not being provided by the State child support agencies), sex, date of birth, mother's maiden name, father's name, participant type (custodial party, noncustodial parent, putative father, child), family violence indicator (domestic violence or child abuse), indication of whether a child support or paternity order is in effect, purpose of request, source of location information. These records are maintained within the FCR and are regularly compared (matched) to the National Directory of New Hires (NDNH) and other Federal agencies' databases to locate information for the State child support agencies or other authorized persons.
                            </p>
                            <p>
                                The records disseminated, depending upon the requestor's specific authority, may include information retrieved from the FCR, from the NDNH, or from other Federal agencies. Records from the NDNH and other agencies disseminated through the FCR may include categories of information such as name, SSN, address, phone number, employer, employment status and wages, retirement status and pay, assets, military status and pay, Federal benefits status and amount, representative payees, unemployment status and amount, children's health insurance, incarceration status, financial institution accounts, assets, and date of death. The FCR also contains information related to those categories of records; for example, the date of receipt of Federal benefits.
                            </p>
                            <p>
                                The FCR also maintains: (1) Records (logs) of transactions involving the receipt of locate requests and the dissemination of requested information; (2) copies of the disseminated information for audit purposes; and (3) copies of certain disseminated locate information for the purpose of electronically filtering and suppressing the transmission of redundant locate information.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="authorityForMaintenance">
                        <xhtmlContent>
                            <p>
                                42 U.S.C. 653(h), 652(a)(9), 653(a)(1).
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="purpose">
                        <xhtmlContent>
                            <p>
                                The Office of Child Support Enforcement (OCSE) uses the FCR primarily to assist States in administering programs under 42 U.S.C. 651 to 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity) to improve States' abilities to locate parents and collect child support. OCSE is required to compare records transmitted to or maintained within the FCR to records maintained within the NDNH and other Federal agencies' databases and discloses information about the individuals within the records to State child support agencies or other authorized persons. The information assists State child support agencies or other authorized persons by locating individuals and their employment and asset information who are involved in child support cases. The FCR also conducts FCR to FCR comparisons to locate information about individuals who are involved in child support cases in more than one State and provides the information to those States. Additional purposes of the FCR are specified in sections 453 and 463 of the Social Security Act (42 U.S.C. 653, 663 and include assisting States in administering programs under 42 U.S.C. 601 to 619 (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families); assisting States in carrying out their responsibilities under child and family services programs operated under 42 U.S.C. 621 through 639 (Title IV-B of the Social Security Act), Foster Care and Adoption Assistance programs operated under 42 U.S.C. 670 through 679A (Title IV-E of the Social Security Act); providing locate information (State of residence) pertaining to individuals sought pursuant to the Convention on the Civil Aspects of International Child Abduction to authorized persons in a Central Authority; to assist the Attorney General of the United States in locating any parent or child for the purpose of enforcing State or Federal law with respect to the unlawful taking or restraint of a child, or making or enforcing a child custody or visitation determination; and to assist the Secretary of the Treasury in administering the sections of the Internal Revenue Code of 1986 which grant tax benefits based on support or residence of children. FCR records may also be disclosed for research purposes likely to contribute to achieving the purposes of the Temporary Assistance for Needy Families (TANF) or the Federal/State child support program.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="routineUsesOfRecords">
                        <xhtmlContent>
                            <p>
                                These routine uses specify circumstances under which ACF may disclose information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.
                            </p>
                            <p>
                                If any record contains a "family violence indicator" associated to the record by State child support agencies if there is reasonable evidence of domestic violence or child abuse, and that disclosure could be harmful to the party or the child, the record may only be disclosed as determined by a court as provided in 42 U.S.C. 653(b)(2).
                            </p>
                            <p>Any information defined as "return" or "return information" under 26 U.S.C. 6103 (Internal Revenue Code) will not be disclosed unless authorized by a statute, the Internal Revenue Service (IRS) or IRS regulations.</p>
                            <p>
                                1. Disclosure for Child Support Purposes
                            </p>
                            <p>
                                Pursuant to 42 U.S.C. 653(a)(2), 653(b)(1)(A), and 653 (c), information about the location of an individual or information that would facilitate the discovery of the location of an individual may be disclosed, upon request filed in accordance with law, to an "authorized person" for the purpose of establishing parentage or establishing, setting the amount of, modifying or enforcing child support obligations. Information disclosed may include information about an individual's wages (or other income) from, and benefits of, employment, and information on the type, status, location, and amount of any assets of, or debts owed by or to, the individual. An "authorized person" is defined under 42 U.S.C. 653(c) as follows: (1) Any agent or attorney of a State who has a duty or authority to seek or recover any amounts owed as child and spousal support or to seek to enforce orders providing child custody or visitation rights; (2) a court which has authority to issue an order against a noncustodial parent for support of a child, or to issue an order against a resident parent for child custody or visitation rights, or any agent of such court; (3) the resident parent, legal guardian, attorney, or agent of a child that is not receiving assistance under a State program funded under title IV-A of the Social Security Act (Temporary Assistance to/for Needy Families); and (4) a State agency that is administering a program operated under title IV-B (child and family services programs) or IV -E (Foster Care and Adoption Assistance programs) of the Social Security Act.
                            </p>
                            <p>
                                2. Disclosure to any Department, Agency, or Instrumentality of the United States or of any State to Locate an Individual or Information Pertaining to an Individual
                            </p>
                            <p>
                                Pursuant to 42 U.S.C. 653(e)(1), information from the FCR (names and SSNs) may be disclosed to any department, agency, or instrumentality of the United States or of any State in order to obtain information for an "authorized person" as defined in 42 U.S.C. 653(c) which pertains to an individual's location, wages (or other income) from, and benefits of, employment (including rights to or enrollment in group health care coverage); on the type, status, location, and amount of any assets of, or debts owed by or to, the individual. An " authorized person" is defined under 42 U.S.C. 653(c) as follows: (1) Any agent or attorney of a State who has a duty or authority to seek or recover any amounts owed as child and spousal support or to seek to enforce orders providing child custody or visitation rights; (2) a court which has authority to issue an order against a noncustodial parent for support of a child, or to issue an order against a resident parent for child custody or visitation rights, or any agent of such court; (3) the resident parent, legal guardian, attorney, or agent of a child that is not receiving assistance under a State program funded under title IV-A of the Social Security Act (Temporary Assistance to for Needy Families); and (4) a State agency that is administering a program operated under title IV-B (child and family services programs) or IV-E (Foster Care and Adoption Assistance programs) of the Social Security Act.
                            </p>
                            <p>
                                3. Disclosure for Purposes Related to the Unlawful Taking or Restraint of a Child or Child Custody or Visitation
                            </p>
                            <p>
                                Pursuant to 42 U.S.C. 653(b)(1)(A), upon request of an "authorized person," as defined in 42 U.S.C. 663(d)(2), or upon request of the Department of Justice, Office of Juvenile Justice and Delinquency Prevention, pursuant to 42 U.S.C. 663(f), information as to the most recent address and place of employment of a parent or child may be disclosed for the purpose of enforcing any State or Federal law with respect to the unlawful taking or restraint of a child or making or enforcing a child custody or visitation determination. "Authorized person" is defined in 42 U.S.C. 663(d)(2) as (A) any agent or attorney of any State having an agreement under this section, who has the duty or authority under the law of such State to enforce a child custody or visitation determination; (B) any court having jurisdiction to make or enforce such a child custody or visitation determination, or any agent of such court; and (C) any agent or attorney of the United States, or of a State having an agreement under this section, who has the duty or authority to investigate, enforce, or bring a prosecution with respect to the unlawful taking or restraint of a child.
                            </p>
                            <p>
                                4. Disclosure to the Social Security Administration for Verification
                            </p>
                            <p>
                                Pursuant to 42 U.S.C. 653(j)(1), the names, SSNs, and birth dates of individuals about whom information is maintained may be disclosed to the Social Security Administration to the extent necessary for verification of the information by the Social Security Administration.
                            </p>
                            <p>
                                5. Disclosure for Locating an Individual for Paternity Establishment or in Connection with a Support Order
                            </p>
                            <p>
                                Pursuant to 42 U.S.C. 653(j)(2)(B), the results of a comparison between records in this system and the National Directory of New Hires may be disclosed to the State IV-D child support enforcement agency responsible for the case for the purpose of locating an individual in a paternity establishment case or a case involving the establishment, modification, or enforcement of a support order.
                            </p>
                            <p>
                                6. Disclosure to State Agencies Operating Specified Programs
                            </p>
                            <p>
                                Pursuant to 42 U.S.C. 653(j)(3), information may be disclosed to a State to the extent and with the frequency that the Secretary determines to be effective in assisting the State to carry out its responsibilities under child support programs operated under 42 U.S.C. 651 through 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity), child and family services programs operated under 42 U.S.C. 621 through 639 (Title IV-B of the Social Security Act), Foster Care and Adoption Assistance programs operated under 42 U.S.C. 670 through 679A (Title IV-E of the Social Security Act) and assistance programs funded under 42 U.S.C. 601 through 619 (Title IV -A of the Social Security Act, Temporary Assistance for Needy Families).
                            </p>
                            <p>
                                7. Disclosure to Department of State under International Child Abduction Remedies Act
                            </p>
                            <p>
                                Pursuant to 42 U.S.C. 663(e), the most recent address and place of employment of a parent or child may be disclosed upon request to the Department of State, in its capacity as the Central Authority designated in accordance with Section 7 of the International Child Abduction Remedies Act, 42 U.S.C. 11601 <i>et seq.,</i> for the purpose of locating the parent or child on behalf of an applicant.
                            </p>
                            <p>
                                8. Disclosure to Secretary of the Treasury for Certain Tax Purposes
                            </p>
                            <p>
                                Pursuant to 42 U.S.C. 653(h)(3), information may be disclosed to the Secretary of Treasury for the purpose of administering sections of the Internal Revenue Code which grant tax benefits based on support or residence of children.
                            </p>
                            <p>
                                9. Disclosure for Authorized Research Purposes
                            </p>
                            <p>
                                Pursuant to 42 U.S.C. 653(j)(5), data in the FCR may be disclosed, without personal identifiers, for research purposes found by the Secretary to be likely to contribute to achieving the purposes of 42 U.S.C. 651 through 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity) and 42 U.S.C. 601 through 619 (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families).
                            </p>
                            <p>
                                10. Disclosure to a Foreign Reciprocating Country for Child Support Purposes
                            </p>
                            <p>Pursuant to 42 U.S.C. 659a(c)(2), information on the State of residence of an individual sought for support enforcement purposes in cases involving residents of the United States and residents of foreign countries that are the subject of a declaration may be disclosed to a foreign reciprocating country.</p>
                            <p>
                                11. Disclosure for Law Enforcement Purpose
                            </p>
                            <p>
                                Records may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for identifying, investigating, prosecuting, enforcing or implementing a statute, rule, regulation or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.
                            </p>
                            <p>
                                12. Disclosure to Department of Justice
                            </p>
                            <p>
                                Records may be disclosed to support the Department of Justice when: (1) HHS, or any component thereof; or (2) any employee of HHS in his or her official capacity; or (3) any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or (4) the United States is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice is deemed by HHS to be relevant and necessary to the litigation; provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.
                            </p>
                            <p>
                                13. Disclosure to Court or Adjudicative Body
                            </p>
                            <p>
                                Records may be disclosed to a court or adjudicative body when: (1) HHS, or any component thereof; or (2) any employee of HHS in his or her official capacity; or (3) any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or (4) the United States is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice is deemed by HHS to be relevant and necessary to the litigation; provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.
                            </p>
                            <p>
                                14. Disclosure to Contractor to Perform Duties
                            </p>
                            <p>
                                Records may be disclosed to a contractor performing or working on a contract for HHS and who has a need to have access to the information in the performance of its duties or activities for HHS in accordance with law and with the contract.
                            </p>
                            <p>
                                15. Disclosure in the Event of a Security Breach
                            </p>
                            <p>
                                Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records and the information disclosed is relevant and necessary for that assistance.
                            </p>
                            <p> Disclosures to Consumer Reporting Agencies: </p>
                            <p>
                                None.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="policiesAndPractices">
                        <xhtmlContent>
                            <p>
                                Storage:
                            </p>
                            <p>
                                Records are stored electronically at the Social Security Administration's National Computer Center. Historical logs and system backups are stored off-site at an alternate location.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="retrievability">
                        <xhtmlContent>
                            <p>
                                Records can be retrieved by an identification number assigned to a child support case by the State child support agency or an SSN of an individual.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="safeguards">
                        <xhtmlContent>
                            <p>
                                Specific administrative, technical and physical controls are in place to ensure that the records collected and maintained in the FCR are secure from unauthorized access. Access to the records is restricted to authorized personnel who are advised of the confidentiality of the records and the civil and criminal penalties for misuse and who sign a nondisclosure oath to that effect. Personnel are provided privacy and security training before being granted access to the records and annually thereafter.
                            </p>
                            <p>
                                Logical access controls are in place to limit access to the records to authorized personnel and to prevent browsing. The records are processed and stored in a secure environment.
                            </p>
                            <p>
                                All records are stored in an area that is physically safe from access by unauthorized persons at all times.
                            </p>
                            <p>
                                Safeguards conform to the HHS Information Security Program, <i>http://www.hhs.gov/ocio/securityprivacy/index.html.</i>
                            </p>
                       
                        </xhtmlContent>
                    </subsection>
                    <subsection type="retentionAndDisposal">
                        <xhtmlContent>
                        
                            <p>
                                (1) Records provided from State child support agencies. (a) Electronic records furnished by the State child support agency containing child support case and order information (input files) are retained for 60 days and then deleted. (b) State agency records (as posted to the FCR) remain within the FCR until removed, upon notification by the State agency that the case is closed and notifies OCSE to remove it from the FCR, provided that, upon request, a sample may be retained for research purposes found by OCSE to be likely to contribute to achieving the purposes of child support programs or the TANF program, but without personal identifiers. (c) Records pertaining to closed cases are archived on the fiscal year basis and retained for two years. Family violence indicators are removed from the individual's record, upon request by the State that initiated the indicator. (2) Locate requests and match results. (a) Locate requests submitted by State child support agencies and other authorized persons are retained for 60 days and are then deleted. (b) Audit trail records of locate requests and disclosures of match results pursuant to those requests, which include indications of which Federal agencies were contacted for locate information, whether information was located, and the type(s) of information returned to the requesting entity are archived once a year based on the fiscal year. The records are retained for two completed fiscal years and then destroyed. These records indicate the type of information located for the authorized user, not the information itself. (c) Records containing information from the NDNH or from other agencies obtained pursuant to locate requests are provided to authorized persons through the FCR. Copies of records provided are then retained within the FCR for the purpose of electronically filtering and suppressing redundant information from being provided. NDNH information is retained within the FCR for one year and information from other agencies is retained for up to three years. Thereafter such information is deleted. (3) Match results generated as a result of FCR to FCR comparisons which locate individuals who are participants in child support cases or orders in more than one State are transmitted to the relevant States. Copies of FCR to FCR match results are retained for 60 days and then deleted. (4) Any record relating or potentially relating to a fraud or abuse investigation or a pending or ongoing legal action including a class action, is retained until conclusion of the investigation or legal action. (5) Copies of the FCR records transmitted annually to the IRS for the purpose of administering the earned income tax credit (routine use 12) are retained for one year and then deleted.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="systemManager">
                        <xhtmlContent>
                            <p>
                                Director, Division of Federal Systems, Office of Automation and Program Operations, Office of Child Support Enforcement, Administration for Children and Families, Department of Health and Human Services, 370 L'Enfant Promenade, SW., 4th Floor East, Washington, DC 20447.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="notificationProcedure">
                        <xhtmlContent>
                            <p>
                                Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed by the individual to whom such information pertains. The requester's letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS's Privacy Act regulations may be required. 45 CFR 5b.5.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="recordAccessProcedures">
                        <xhtmlContent>
                            <p>
                                Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed by the individual to whom such information pertains. The requester's letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS's Privacy Act regulations may be required. 45 CFR 5b.5.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="contestingRecordProcedures">
                        <xhtmlContent>
                            <p>
                                Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed by the individual to whom such information pertains; (2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual's record; (3) identify the information that the individual believes is not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS's Privacy Act regulations may be required. 45 CFR 5b.5.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="recordSourceCategories">
                        <xhtmlContent>
                            <p>
                                Records maintained within the FCR are furnished by State child support agencies. Records disseminated from the FCR for the purpose of providing locate information from the NDNH and other Federal agencies are furnished by departments, agencies, or instrumentalities of the United States or any State, employers, financial institutions, and insurers or their agents. Records maintained for the purpose of filtering redundant data are also furnished by these sources.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="exemptionsClaimed">
                        <xhtmlContent>
                            <p>
                                The portions of this system consisting of investigatory material compiled for law enforcement purposes have been exempted pursuant to 5 U.S.C. 552a(k)(2) from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection and to the limitation in 42 U.S.C. 653(b)(2): 5 U.S.C. 552a(c)(3) and (d).
                            </p>
                        </xhtmlContent>
                    </subsection>
                </section>


        <section id="09-80-0321" toc="yes">
            <systemNumber>09-80-0321</systemNumber>
            <subsection type="systemName">ORR Division of Children’s Services Records</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        Unclassified
                    </p></xhtmlContent></subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>Division of Children’s Services (DCS), Office of Refugee Resettlement (ORR), Administration for Children and Families (ACF), Department of Health and Human Services (HHS), Mary E. Switzer Building, 330 C. Street, Washington, DC.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>Unaccompanied children under ORR’s care, unaccompanied children who receive an adjustment of status or become U.S. citizens, children of unaccompanied children, potential sponsors of the unaccompanied children, and members of potential sponsor’s household, including both U.S. and non-U.S. citizens.</p>
                    <p>Unaccompanied children (UC) are children who have no lawful immigration status in the United States; have not attained 18 years of age; and with respect to whom (i) there is no parent or legal guardian in the United States; or (ii) no parent or legal guardian in the United States is available to provide care and physical custody.</p>
                    <p>The Privacy Act applies only to U.S. persons (citizens of the United States or aliens lawfully admitted for permanent residence in the United States). As a matter of discretion, ORR will treat information that it maintains in its mixed systems of records as being subject to the provisions of the Privacy Act, regardless of whether or not the information relates to U.S. persons covered by the Privacy Act. This implements a 1975 Office of Management and Budget (OMB) recommendation to apply, as a matter of policy, the administrative provisions of the Privacy Act to records about non-U.S. persons in mixed systems of records (referred to as the non-U.S. persons policy).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>Records consist of computerized indexing system data and case files:</p>
                    <p>&#8226;•The computerized indexing system contains personal identification data, such as Alien Registration Number, Fingerprint Identification Number ("FINS" number), and Social Security Number (SSN); date and place of birth; date and port of entry; apprehension date and location; manner of entry; apprehension field office; individual(s) apprehended with the unaccompanied child; attorney of record; juvenile/criminal history records; case disposition; significant incident reports; sponsor’s biographical, financial and immigration status information; sponsor’s household members’ biographical information; and personal identification data of an unaccompanied child’s potential sponsor, including the sponsor’s biographical information (e.g., name, date of birth, place of birth), financial information, immigration status information, household members’ biographical information, SSN, phone number, address, criminal background and case disposition, and results of child abuse and neglect checks.</p>
                    <p>&#8226;•The case file contains information that is pertinent to the care and placement of unaccompanied children, including biographical information on each unaccompanied child, such as birth and marriage certificates; various ORR forms and supporting documents (and attachments, e.g. photographs); incident reports; medical and dental records; mental health evaluations; case notes and records; clinical notes and records; immigration forms and notifications; attorney of record and legal papers; home studies and/or post-release service records on a sponsor of an unaccompanied child; family reunification information including the sponsors’ individual and financial data; case disposition; correspondence; and SSN; and juvenile/criminal history records.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>6 U.S.C. § 279; 8 U.S.C. § 1232.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>Records are used within HHS/ACF/ORR by DCS to provide a safe and appropriate environment for each unaccompanied child placed into ORR custody through his/her release to a family member or sponsor in the U.S., until he/she is removed to his/her home country by DHS immigration officials, until the child turns 18 years of age, or until the minor receives lawful immigration status.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, 5 U.S.C. § 552a(b), under which ACF may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.</p>
                    <p>1. Disclosure to an Attorney or Representative.  Information may be disclosed to an attorney or representative (as defined in 8 CFR 1.2) who is acting on behalf of an individual covered by this system of records in connection with any proceeding before the Department of Homeland Security or the Executive Office for Immigration Review; an attorney representing an unaccompanied child in a state court in a dependency hearing that may determine or alter the unaccompanied child’s custody status or placement; or an attorney representing an unaccompanied child in a juvenile or criminal court in relation to criminal charges.</p>
                    <p>2. Disclosure for Health and Safety.  Information such as health records related to communicable diseases or other illnesses that have the potential to affect public health and safety may be disclosed to any state or local health authorities, to ensure that all health issues potentially affecting public health and safety in the United States are being or have been, adequately addressed. Private health information not related to illnesses that affect public health and safety will remain confidential.  This information may be disclosed for the purposes of coordinating medical and mental health evaluations, services, and care for unaccompanied alien children while in ORR care and custody. Information may be shared with a health provider to make age determinations for unaccompanied children.</p>
                    <p>3. Disclosure to Protection and Advocacy Organization.  Information may be disclosed to a Protection or Advocacy organization when access is authorized and the request is appropriately made under the Protection and Advocacy for Individuals with Mental Illness Act, 42 U.S.C. § 10801 et seq. Information may be disclosed to an HHS-appointed child advocate for the purpose of effectively advocating for the best interest of the child. Child advocates are granted access to this information under the William Wilberforce Trafficking Victims Protection Reauthorization Act of 2008 section 235(c)(6), 8 U.S.C. § 1232(c)(6).</p>
                    <p>4. Disclosure to Plaintiffs’ Counsel.  Information may be disclosed to plaintiffs' counsel as required under the settlement agreement in Flores v. Reno, Case No. CV85-4544-RJK (C.D. Cal. 1996); and Perez-Olano v. Holder, Case No. CV 5-3604 (C.D. Cal. 2010).</p>
                    <p>5. Disclosure to Department of Homeland Security.  Information may be disclosed to the Department of Homeland Security for the purpose of adjudicating or deciding immigration relief, notification of admission/discharge information and forms, and reported escapes of an unaccompanied child from ORR custody; and for background check purposes to ensure safe releases.</p>
                    <p>6. Disclosure for Law Enforcement or Child Welfare Purpose.  Information may be disclosed to the appropriate federal, state, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity; and for background check purposes to ensure safe releases. Information may be shared with certain state and local agencies that provide child welfare services such as state licensing agencies, Child Protective Services, and education agencies such as state, county, or municipal schools for the purpose of protecting an unaccompanied child’s health and welfare and background check purposes to ensure safe releases, as well as enrollment of an unaccompanied child in a school or educational program.</p>
                    <p>7. Disclosure for Private Relief Legislation.  Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A 19.</p>
                    <p>8. Disclosure to Congressional Office.  Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of the individual.</p>
                    <p>9. Disclosure to Department of Justice or in Proceedings.  Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
                    <p>&#8226;•HHS, or any component thereof; or</p>
                    <p>&#8226;•any employee of HHS in his or her official capacity; or</p>
                    <p>&#8226;•any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
                    <p>&#8226;•the United States, if HHS determines that litigation is likely to affect HHS or any of its components,</p>
                    <p>is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
                    <p>10. Disclosure to Department of Justice for LOPC Facilitation.  Information may be disclosed to the Department of Justice, Executive Office for Immigration Review for purposes of collaboration in facilitating sponsors’ participation in Legal Orientation Programs for Custodians (LOPCs) under the William Wilberforce Trafficking Victims Protection Reauthorization Act of 2008 section 235(c)(4), 8 U.S.C. § 1232(c)(4).</p>
                    <p>11. Disclosure to the National Archives.   Information may be disclosed to the National Archives and Records Administration in records management inspections.</p>
                    <p>12. Disclosure to Contractors, Grantees, and Others.  Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or memorandum of understanding, or other activity for HHS and who have a need to have access to the information in the performance of their duties or activities for HHS.</p>
                    <p>13. Disclosure to Office of Personnel Management.  Information may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of federal personnel management.</p>
                    <p>14. Disclosure in Connection with Litigation.  Information may be disclosed in connection with litigation or settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions.</p>
                    <p>15. Disclosure Incident to Requesting Information.  Information may be disclosed (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested), to any source from which additional information is requested when necessary to obtain information relevant to an agency decision concerning benefits.</p>
                    <p>16. Disclosure for Administrative Claims, Complaints, and Appeals.  Information may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.</p>
                    <p>17. Disclosure to State Refugee Coordinators.  Information may be shared with State Refugee Coordinators for children in ORR care who are being transferred into the ORR’s Unaccompanied Refugee Minors program for purposes of coordinating appropriate placement and services for the child. The State Refugee Coordinator refers to the individuals designated by a Governor or a State to be responsible for, and who is authorized to, ensure coordination of public and private resources in refugee resettlement.</p>
                    <p>18. Disclosure to other Federal Departments and Nongovernmental Organizations and Foreign Governments for Safe Repatriation of UC.  Information may be disclosed to other federal agencies (such as the Department of State, Department of Justice, Department of Homeland Security), nongovernmental organizations and foreign governments as it relates to the safe repatriation of UC to their country of origin as directed under the William Wilberforce Trafficking Victims Protection Reauthorization Act of 2008 section 235(a)(5), 8 U.S.C. § 1232(a)(5).</p>
                    <p>19. Disclosure in the Event of a Security Breach.  Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.</p>
                    <p>20. Disclosure for Cybersecurity Monitoring Purposes.  Records may be disclosed to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.</p>
                    <p>Disclosure to Consumer Reporting Agencies:</p>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>Storage:</p> 
                    <p>Computer records are stored on a computer network. Paper records are stored in file folders.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>Records are retrieved by name or Alien Registration Number of the unaccompanied child; records are electronically retrieved from the web-based data management system using name, Alien Registration Number, or SSN of the party involved.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>Computerized indexing system records are retained permanently; they are offered to the National Archives every five years (see N1-292-90-04, item 15).  Case files are retained for five years following receipt of the final progress report (see N1-292-90-4, item 34).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>Director, Division of Children Services, Office of Refugee Resettlement, Administration for Children and Families, Mary E. Switzer Building, 330 C Street, SW, Washington, DC 20201.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN or Alien Registration Number, and address of the individual, and the request must be signed. The requester’s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5 </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN or Alien Registration Number, and address of the individual, and should be signed. The requester’s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should 1) include the name, telephone number and/or email address, SSN or Alien Registration Number, and address of the individual, and should be signed; 2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual’s record;  3) identify the information that the individual believes in not accurate, relevant, timely, or complete; 4) indicate what corrective action is sought; and 5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5. </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>Record subjects, family members, private individuals, private and public hospitals, doctors, law enforcement agencies and officials, private attorneys, facilities reports, third parties, foreign governments, other federal agencies, state and local governments, agencies and instrumentalities.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="exemptionsClaimed">
                <xhtmlContent>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
        </section>


        <section id="09-80-0325" toc="yes">
            <systemNumber>09-80-0325</systemNumber>
            <subsection type="systemName">ORR Internet Refugee Arrivals Data System (iRADS)</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>Unclassified.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>Office of Refugee Resettlement (ORR), Administration for Children and Families (ACF), Department of Health and Human Services (HHS), Mary E. Switzer Building, 330 C. Street, SW, Washington, DC. A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>Records pertain to the following individuals:</p>
                    <p>&#8226;•Individuals who are paroled as a refugee or asylee under 8 U.S.C. § 1182(d)(5) [section 212(d)(5) of the Immigration and Nationality Act (INA)].</p>
                    <p>&#8226;•Individuals admitted as a refugee under 8 U.S.C. § 1157 (section 207 of INA).</p>
                    <p>&#8226;•Individuals granted asylum under 8 U.S.C. § 1158 (section 208 of INA).</p>
                    <p>&#8226;•Cuban and Haitian entrants, in accordance with requirements in Public Law 97–35, title V, §§ 543(a)(2), 547 [8 U.S.C. § 1522 (note)] and 45 CFR part 401.</p>
                    <p>&#8226;•Certain Amerasians from Vietnam who are admitted to the U.S. as immigrants pursuant to 8 U.S.C. § 1101 note (Amerasian Immigration).</p>
                    <p>&#8226;•Iraqi or Afghan Special Immigrant Visa-holders admitted under the Consolidated Appropriations Act of 2008 (Public Law 110-161, Division G, Title V, Section 525) or the National Defense Authorization Act for FY 2008 (Public Law 110-181, Division A, Title XII, Section 1244).</p>
                    <p>&#8226;•Certified victims of a severe form of human trafficking as defined under 22 U.S.C. § 7105(b)(1)(c) (Trafficking Victims Protection Act of 2000).</p>
                    <p>&#8226;•Individuals admitted for permanent residence, provided the individual previously held one of the statuses identified above.</p>
                    <p>The Privacy Act applies only to U.S. persons (citizens of the United States or aliens lawfully admitted for permanent residence in the United States). As a matter of discretion, ORR will treat information that it maintains in its mixed systems of records as being subject to the provisions of the Privacy Act, regardless of whether or not the information relates to U.S. persons covered by the Privacy Act. This implements a 1975 Office of Management and Budget (OMB) recommendation to apply, as a matter of policy, the administrative provisions of the Privacy Act to records about non-U.S. persons in mixed systems of records (referred to as the non-U.S. persons policy).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>Records consist of automated database records; data elements include but are not limited to: Alien Number, Full Name, Birth Date, Arrival Date or Date of Grant of Asylum, Immigration Status (Refugee, Asylee, etc), Marital Status, Age,  Gender, Ethnicity (for populations other than Asylees), Full Address (City, State, Zip Code), County, Birth Country, Citizenship Country, Country of Origin, English Ability, Occupational Skills, Health Status, Administrative Data (e.g., voluntary resettlement agency).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>8 U.S.C. § 1521 et seq.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>Records are used by HHS/ACF/ORR to generate data needed to allocate funds for Formula Social Services and Targeted Assistance grants according to statutory formulas established under 8 U.S.C. §§ 1522(c)(1)(B) &amp; (c)(2)(B); extract samples for the Annual Survey of Refugees, which collects information on the economic adjustment of refugees; and support other budget and grant requirements and data requests from within and outside ORR. This system of records does not collect new information but consolidates information on eligible populations obtained from other agencies.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, 5 U.S.C. § 552a(b), under which ACF may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.</p>
                    <p>1. Disclosure for Law Enforcement Purpose. Information may be disclosed to the appropriate federal, state, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.</p>
                    <p>2. Disclosure for Private Relief Legislation. Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A 19.</p>
                    <p>3. Disclosure to Congressional Office.  Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of the individual.</p>
                    <p>4. Disclosure to Department of Justice or in Proceedings.  Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
                    <p>&#8226;•HHS, or any component thereof; or</p>
                    <p>&#8226;•any employee of HHS in his or her official capacity; or</p>
                    <p>&#8226;•any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
                    <p>&#8226;•the United States, if HHS determines that litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
                    <p>5. Disclosure to the National Archives.  Information may be disclosed to the National Archives and Records Administration in records management inspections.</p>
                    <p>6. Disclosure to Contractor.  Information may be disclosed to a contractor performing or working on a contract for HHS and who has a need to have access to the information in the performance of its duties or activities for HHS.</p>
                    <p>7. Disclosure for Administrative Claim, Complaint, and Appeal.  Information may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.</p>
                    <p>8. Disclosure in Connection with Litigation.  Information may be disclosed in connection with litigation or settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions.</p>
                    <p>9. Disclosure Incident to Requesting Information.  Information may be disclosed (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested), to any source from which additional information is requested when necessary to obtain information relevant to an agency decision concerning benefits.</p>
                    <p>10. Disclosure in the Event of a Security Breach.  Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.</p>
                    <p>11. Disclosure for Cybersecurity Monitoring Purposes.  Records may be disclosed to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.</p>
                    <p>Information may also be disclosed from this system of records to parties outside HHS for any of the uses authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(11).</p>
                    <p>Disclosure to Consumer Reporting Agencies:</p>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>Storage:</p>
                    <p>Records are stored in a computer database operated by a contractor.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>Records are retrieved by "A" (alien) number or by name, date of birth, or date of entry.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>Records are retained permanently; they are offered to the National Archives every five years (see N1-292-90-04, item 15).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>Division Director, Division of Budget Policy and Data Analysis, Office of Refugee Resettlement, Administration for Children and Families, Department of Health and Human Services, Mary E. Switzer Building, 330 C. Street, SW, Washington, DC 20201.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, Alien Number, and address of the individual, and the request must be signed. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5</p>
                    <p>The requestor’s letter must also provide sufficient particulars to enable ACF to distinguish between records on subject individuals with the same name.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, Alien Number, and address of the individual, and should be signed. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5</p>
                    <p>The requestor’s letter must also provide sufficient particulars to enable ACF to distinguish between records on subject individuals with the same name.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should 1) include the name, telephone number and/or email address, Alien Number, and address of the individual, and should be signed; 2) provide the name or other information about the project that the individual believes contains his or her records; 3) identify the information that the individual believes in not accurate, relevant, timely, or complete; 4) indicate what corrective action is sought; and 5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5. </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>Record subjects, Department grantees, and social service agencies. Refugee arrival data from the Department of State’s Worldwide Refugee Arrivals Processing System (WRAPS); legacy refugee arrival data from the Department of State’s Refugee Data Center; Department of Homeland Security (DHS) U.S. Citizenship and Immigration Services (USCIS) asylum corps grant data and I-730 asylee derivative data with some data elements provided by Customs and Border Protection; DHS/Customs and Border Protection (CBP) data regarding Cubans and Haitians entering the U.S. at land borders or Ports of Entry other than Miami, FL, as well as Iraqi and Afghan Special Immigrants (starting in FY 2008); the Department of Justice (DOJ) Executive Office of Immigration Review (EOIR) asylum grant data; the United States Conference of Catholic Bishops (USCCB) and Church World Services in Miami, FL data for Cuban and Haitian entrants and Havana parolees (including data on Cuban Medical Parolees) entering the U.S. through the Port of Miami; the I-643 form  (OMB No. 1615-0070), completed by refugees and asylees, Cuban and Haitian entrants, and Amerasians and submitted to USCIS or ORR when filing an application for adjustment of status.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="exemptionsClaimed">
                <xhtmlContent>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
        </section>


        <section id="09-80-0327" toc="yes">
            <systemNumber>09-80-0327</systemNumber>
            <subsection type="systemName">ORR Repatriation Program Records</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>Unclassified.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>Office of Refugee Resettlement (ORR), Administration for Children and Families (ACF), Department of Health and Human Services (HHS), Mary E. Switzer Building, 330 C. Street, SW, Washington, DC.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>U.S. citizens and their dependents receiving temporary assistance who have been identified by the Department of State as having returned, or been brought from a foreign country to the U.S. because of destitution, illness, war, threat of war, or a similar crisis.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>Records consist of case files, containing:</p>
                    <p>&#8226;•identifying information including but not limited to name, date of birth, place of birth, gender, Social Security Number (SSN), passport number, case number, citizenship, address;</p>
                    <p>&#8226;•service information, including but not limited to type of case (settlement or exception), resettlement state, case activity (dates and notes);</p>
                    <p>&#8226;•types of assistance requested, including but not limited to financial, food, travel, clothing, medical, other;</p>
                    <p>&#8226;•types of assistance provided, including but not limited to identification numbers, service providers, cost information;</p>
                    <p>&#8226;•medical information, including but not limited to diagnosis, prognosis, mental health status, hospitalization;</p>
                    <p>&#8226;•next-of-kin information, including next of kin name, identification number, address, relationship, telephone numbers;</p>
                    <p>&#8226;•repayment information, including but not limited to deferrals, extensions, referrals to collection agencies and Internal Revenue Service, payments; and</p>
                    <p>&#8226;•travel plans, including but not limited to name of escort, destinations, flight numbers, dates of travel.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>Section 1113 of the Social Security Act, 42 U.S.C. § 1313 (Assistance for U.S. Citizens Returned from Foreign Countries) and 24 U.S.C. §§ 321-329 (Hospitalization of mentally ill nationals returned from foreign countries).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>Records are used by HHS/ACF/ORR to administer the United States Repatriation Program, which provides temporary assistance to U.S. citizens and their dependents who have been identified by the Department of State as having returned, or been brought from a foreign country to the U.S. because of destitution, illness, war, threat of war, or a similar crisis. Temporary assistance may include money payments, medical care, temporary billeting, transportation, and other goods and services necessary for the health or welfare of individuals (including guidance, counseling, and other welfare services), furnished to United States citizens and their dependents who are without available resources in the U.S. upon their arrival from abroad and for up to 90 days after their arrival, not exceeding 90 days as may be provided in regulations of the Secretary of HHS. All temporary assistance provided under the Program and allocable to individual recipients is repayable to the federal government. HHS’ Program Support Center administers debt collection for these repayments.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, 5 U.S.C. § 552a(b),  under which ACF may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.</p>
                    <p>1. Disclosure to Department of State.  Information may be disclosed to the Department of State in connection with determinations of eligibility, referral, planning, and provision of temporary assistance of or in cases referred to HHS.</p>
                    <p>2. Disclosure to States.  Information may be disclosed to the states in connection with coordination and/or provision of temporary services for eligible repatriates.</p>
                    <p>3. Disclosure to Service Provider.  Information may be disclosed to providers of services (e.g. community-based organizations, hospitals) and to local state institutions (e.g., courts and social service agencies) that assist in coordination and/or the provision of temporary services.</p>
                    <p>4. Disclosure to Agency for Temporary Services.  Information may be disclosed to other federal agencies and non-governmental agencies for planning or provision of temporary services to eligible repatriates.</p>
                    <p> Federal agencies include but are not limited to Department of State, Department of Defense, Department of Justice, Department of Homeland Security, Department of Housing and Urban Development, Federal Emergency Management Agency, Department of Agriculture, and United States Department of Transportation. Non-governmental agencies include but are not limited to American Red Cross and Salvation Army.</p>
                    <p>5. Disclosure for Law Enforcement Purpose.  Information may be disclosed to the appropriate federal, state, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.</p>
                    <p>6. Disclosure Incident to Requesting Information. Information may be disclosed (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested), to any source from which additional information is requested when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring), retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.</p>
                    <p>7. Disclosure for Employee Retention, Security Clearance, Contract, or Other Benefit.  Disclosure may be made to a federal, state, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within HHS or to another federal agency for criminal, civil, administrative, personnel, or regulatory action.</p>
                    <p>8. Disclosure for Private Relief Legislation. Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A 19.</p>
                    <p>9. Disclosure to Congressional Office.  Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of the individual.</p>
                    <p>10. Disclosure to Department of Justice or in Proceedings. Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
                    <p>&#8226;•HHS, or any component thereof; or</p>
                    <p>&#8226;•any employee of HHS in his or her official capacity; or</p>
                    <p>&#8226;•any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
                    <p>&#8226;•the United States, if HHS determines that litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
                    <p>11. Disclosure to the National Archives.  Information may be disclosed to the National Archives and Records Administration in records management inspections.</p>
                    <p>12. Disclosure to Contractors, Grantees, and Others.  Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for HHS and who have a need to have access to the information in the performance of their duties or activities for HHS.</p>
                    <p>13. Disclosure for Administrative Claim, Complaint, and Appeal.   Information may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.</p>
                    <p>14. Disclosure to Office of Personnel Management.  Information may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of federal personnel management.</p>
                    <p>15. Disclosure in Connection with Litigation. Information may be disclosed in connection with litigation or settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions.</p>
                    <p>16. Disclosure in the Event of a Security Breach.  Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.</p>
                    <p>17. Disclosure for Cybersecurity Monitoring Purposes.  Records may be disclosed to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.</p>
                    <p>Information may also be disclosed from this system of records to parties outside HHS for any of the uses authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(12).</p>
                    <p>Disclosure to Consumer Reporting Agencies:</p>
                    <p>The HHS Program Support Center may make disclosures to consumer reporting agencies regarding debts referred from repatriation activities.  See System of Records 09-40-0012 Debt Management and Collection System.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p> Storage:</p>
                    <p>Records are stored on grantee’s computer network and safe/file cabinet.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>Records are retrieved by name of recipient, case file, or SSN.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>Files are transferred to a Federal Records Center one year after termination of collection efforts, and are destroyed five years after termination of collection efforts (see N1-292-93-1).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>Manager, Repatriation Program, Office of Refugee Resettlement, Administration for Children and Families, Department of Health and Human Services, Mary E. Switzer Building, 330 C. Street, SW, Washington, DC 20201.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed. The requester’s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed. The requester’s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5. </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should 1) include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed; 2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual’s record; 3) identify the information that the individual believes in not accurate, relevant, timely, or complete; 4) indicate what corrective action is sought; and 5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>Information may be obtained from a wide variety of institutions and individuals involved who may be in the process or repatriation and/or deportation. Sources include the record subject; representatives and relatives of the record subject; Department of State and other federal agencies; international agencies; foreign governments; social service organizations; employers; state agencies; health care institutions; and other sources including public information.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="exemptionsClaimed">
                <xhtmlContent>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
        </section>



        <section id="09-80-0329" toc="yes">
            <systemNumber>09-80-0329</systemNumber>
            <subsection type="systemName">ORR Unaccompanied Refugee Minors Records</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>Unclassified.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>Office of Refugee Resettlement (ORR), Administration for Children and Families (ACF), Department of Health and Human Services (HHS), Mary E. Switzer Building, 330 C. Street, SW, Washington, DC.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>Refugee unaccompanied children who are admitted from refugee camps overseas or determined eligible after arrival in the United States and do not have a parent or a relative available and committed to providing for their long term care; children eligible for benefits as victims of a severe form of trafficking; entrant children with Cuban-Haitian Entrant designation; and unaccompanied minor children granted asylum in the United States, Special Immigrant Juvenile Status, or U status.</p>
                    <p>The Privacy Act applies only to U.S. persons (citizens of the United States or aliens lawfully admitted for permanent residence in the United States). As a matter of discretion, ORR will treat information that it maintains in its mixed systems of records as being subject to the provisions of the Privacy Act, regardless of whether or not the information relates to U.S. persons covered by the Privacy Act. This implements a 1975 Office of Management and Budget (OMB) recommendation to apply, as a matter of policy, the administrative provisions of the Privacy Act to records about non-U.S. persons in mixed systems of records (referred to as the non-U.S. persons policy).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>Records consist of database records and hard copy case files:</p>
                    <p>&#8226;•The database includes information reported on ORR Forms 3 and 4 (name, address, alien number, country of origin, immigration classification, parents’ names, national and local refugee resettlement agency, child welfare agency, school progress, English language acquisition, education progress, social adjustment, health conditions, family reunion, emancipation information, etc.), eligibility determinations, identifying information, placement, and progress summaries are recorded.</p>
                    <p>&#8226;•Hard copy case files include letters and forms documenting the reclassification and designation of individuals covered by the systems, tracking documents, and case notes. Electronic files include messages used for determining placements.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>8 U.S.C. §§ 1521, 1522; Title V of the Refugee Education Assistance Act of 1980, 8 U.S.C. § 1522 note.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>Records are used by HHS/ACF/ORR to establish legal responsibility, under state law, to ensure that unaccompanied minor refugees and entrants receive the full range of assistance, care, and services which are available to all foster children in the state; a legal authority is designated to act in place of the child’s unavailable parent(s). Reunification of children with their parents or other appropriate adult relatives is encouraged, through family tracing and coordination with local refugee resettlement agencies. Additional services provided include: indirect financial support for housing, food, clothing, medical care and other necessities; intensive case management by social workers; independent living skills training; educational supports; English language training; career/college counseling and training; mental health services; assistance adjusting immigration status; cultural activities; recreational opportunities; support for social integration; and cultural and religious preservation.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, 5 U.S.C. § 552a(b), under which ACF may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.</p>
                    <p>1. Disclosure to Attorney. Information may be disclosed to an attorney or representative (as defined in 8 CFR 1.2) who is acting on behalf of an individual covered by this system of records in connection with any proceeding before the Department of Homeland Security or the Executive Office for Immigration Review.</p>
                    <p>2. Disclosure to a Protection or Advocacy Organization. Information may be disclosed to a protection or advocacy organization when access is authorized and the request is appropriately made under the Protection and Advocacy for Individuals with Mental Illness Act, 42 U.S.C. § 10801 et seq.</p>
                    <p>3. Disclosure to Department of Homeland Security for Immigration Relief.  Information may be disclosed to the Department of Homeland Security for the purpose of adjudicating or deciding immigration relief.</p>
                    <p>4. Disclosure to Service Provider.  Information may be disclosed to a provider of services to refugee minors, foster care agency, national voluntary refugee resettlement agency, or to a local, county or State institution (e.g., State refugee coordinator, child welfare agency, court, or social service agency) involved in resettlement activities.</p>
                    <p>5. Disclosure for Law Enforcement Purpose.  Information may be disclosed to the appropriate federal, state, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.</p>
                    <p>6. Disclosure for Private Relief Legislation.  Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A 19.</p>
                    <p>7. Disclosure to Congressional Office.  Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of the individual.</p>
                    <p>8. Disclosure to Department of Justice or in Proceedings.  Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
                    <p>&#8226;•HHS, or any component thereof; or</p>
                    <p>&#8226;•any employee of HHS in his or her official capacity; or</p>
                    <p>&#8226;•any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
                    <p>&#8226;•the United States, if HHS determines that litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
                    <p>9. Disclosure to the National Archives.  Information may be disclosed to the National Archives and Records Administration in records management inspections.</p>
                    <p>10. Disclosure to Contractors, Grantees, and Others.  Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for HHS and who have a need to have access to the information in the performance of their duties or activities for HHS.</p>
                    <p>11. Disclosure for Administrative Claim, Complaint, and Appeal.  Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.</p>
                    <p>12. Disclosure to Office of Personnel Management.  Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of federal personnel management.</p>
                    <p>13. Disclosure in Connection with Litigation.  Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions.</p>
                    <p>14. Disclosure in the Event of a Security Breach.  Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.</p>
                    <p>15. Disclosure for Cybersecurity Monitoring Purposes.  Records may be disclosed to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.</p>
                    <p>Information may also be disclosed from this system of records to parties outside HHS for any of the uses authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(11). </p>
                    <p>Disclosure to Consumer Reporting Agencies:</p>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>Storage:</p>
                    <p>Computer records are stored on a computer network. Paper records are stored in file folders.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>Records of refugee unaccompanied minors, reclassified refugee unaccompanied minors, children who are eligible for benefits as victims of a severe form of trafficking, entrant minor children of the Cuban-Haitian Entrant programs and minor children granted asylum, Special Immigrant Juvenile Status or U status are retrieved by name and alien numbers from the ORR database.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>Database records are retained permanently; they are offered to the National Archives every five years (see N1-292-90-04, item 15).  Case files are retained for five years following receipt of the final progress report (see N1-292-90-4, item 34).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>Director, Division of Children’s Services, Office of Refugee Resettlement, Administration for Children and Families, Department of Health and Human Services, Mary E. Switzer Building, 330 C. Street, SW, Washington, DC 20201</p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, Alien Number, and address of the individual, and the request must be signed. The requester’s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5. </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, Alien Number, and address of the individual, and should be signed. The requester’s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should 1) include the name, telephone number and/or email address, Alien Number, and address of the individual, and should be signed; 2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual’s record; 3) identify the information that the individual believes in not accurate, relevant, timely, or complete; 4) indicate what corrective action is sought; and 5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS’s Privacy Act regulations may be required. 45 CFR § 5b.5.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>Record subject, national and local voluntary refugee resettlement agencies, child welfare agencies, family members, private individuals, private and public hospitals, doctors, law enforcement agencies and officials, private attorneys, facilities reports, third parties, other Federal agencies, State and local governments, agencies and instrumentalities.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="exemptionsClaimed">
                <xhtmlContent>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
        </section>



        <section id="09-80-0341" toc="yes">
		<systemNumber>09-80-0341</systemNumber>
		<subsection type="systemName"> FYSB Research and Evaluation Project Records, HHS/ACF/FYSB.</subsection>
		<subsection type="securityClassification"><xhtmlContent>
		<p>Unclassified</p></xhtmlContent></subsection>
		<subsection type="systemLocation"><xhtmlContent>
		<p>Research and Evaluation Division, Family and Youth Services Bureau (FYSB), Administration for Children and Families (ACF), Department of Health and Human Services (HHS), Portals Building, Suite 800, 1250 Maryland Avenue, SW, Washington, DC. A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager. </p></xhtmlContent></subsection>
		<subsection type="categoriesOfIndividuals"><xhtmlContent>
		<p>FYSB research and evaluation projects may cover any program, activity, or function of FYSB, including but not limited to Runaway and Homeless Youth Programs, Transitional Living Program, Maternity Group Homes Program, Street Outreach Program, Mentoring Children of Prisoners Program, Family Violence Programs, Abstinence Education Programs, and other existing and future programs. Records in this system may be about any individual who participates in a FYSB-sponsored program as a service recipient or service provider. For some programs, the records may include information about family members of program participants.</p></xhtmlContent></subsection>
		<subsection type="categoriesOfRecords"><xhtmlContent>
		<p>Information about program participants including their identities, addresses, occupations, professions, school or job performances, health status, test scores, and other categories of information relevant to the evaluation of a particular program.</p></xhtmlContent></subsection>
		<subsection type="authorityForMaintenance"><xhtmlContent>
		<p>Runaway and Homeless Youth Act (42 U.S.C. 5701 et seq.); Child and Family Services Improvement Act (Pub. L.109"288); Promoting Safe and Stable Families Act (42 U.S.C. 629 et seq.); Program for Abstinence Education (42 U.S.C. 710); Keeping Children and Families Safe Act (42 U.S.C. 5101).</p>
		</xhtmlContent></subsection>
		<subsection type="purpose"><xhtmlContent>
		<p>The Family and Youth Services Bureau in the Administration for Children and Families (ACF) is responsible for advising the Commissioner on Administration on Children, Youth, and Families on increasing the effectiveness and efficiency of FYSB programs. This system of records may contain personal information subject to the Privacy Act of 1974 that is produced by FYSB research and evaluation projects. Only projects that involve the retrieval of records by personal identifier are subject to the Privacy Act of 1974 and are covered by this system. The procedures for the collection of information about research subjects in FYSB"s evaluation projects are reviewed, as appropriate, by Institutional Review Boards, are subject to HHS regulations on research with human subjects, including requirements for informed consent. </p>
		</xhtmlContent></subsection>
		<subsection type="routineUsesOfRecords"><xhtmlContent>
		<p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, 5 U.S.C. 552a(b), under which HHS may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. For any project that has received a certificate of confidentiality, none of these routine uses shall be read to authorize a disclosure that would not be allowed by the terms of the certificate of confidentiality. In addition, contractors may be restricted by contract from making a disclosure allowed as a routine use or by law without the consent of HHS, of the data subject, or both, unless the disclosure is required by law. </p>
		<p>(1) Disclosure for Law Enforcement Purposes</p>
		<p>Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity. However, because this is a research and evaluation system, no information will be disclosed for use in any investigation, prosecution, or other action targeted against any individual who is the subject of the record.</p>
		<p>(2) Disclosure Incident to Requesting Information</p>
		<p>Information may be disclosed (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested), to any source from which additional information is requested when necessary to obtain information relevant to the research or evaluation being conducted. </p>
		<p>(3) Disclosure to Congressional Office</p>
		<p>Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual. </p>
		<p>(4) Disclosure to Department of Justice or in Proceedings</p>
		<p>Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
		<p>HHS, or any component thereof; or</p>
		<p>Any employee of HHS in his or her official capacity; or</p>
		<p>Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
		<p>The United States, if HHS determines that litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation, provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected. </p>
		<p>(5) Disclosure to Contractor</p>
		<p>Information may be disclosed to a contractor performing or working on a contract for HHS and who have a need to have access to the information in the performance of their duties or activities for HHS. </p>
		<p>(6) Disclosures for Administrative Claims, Complaints, and Appeals</p>
		<p>Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.</p>
		<p>(7) Disclosure in Connection with Litigation</p>
		<p>Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).</p>
		<p>(8) Disclosure in the Event of a Security Breach</p>
		<p>Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.   </p>
		<p>Disclosure to consumer reporting agencies: </p>
		<p>None.</p></xhtmlContent></subsection>
		<subsection type="policiesAndPractices"><xhtmlContent>
		<p>Storage:</p>
		<p>Depending on the project, records may be stored on paper or other hard copy, computers, and networks. </p>
		</xhtmlContent></subsection>
		<subsection type="retrievability"><xhtmlContent>
		<p>Depending on the project, records may be retrieved by name, code, or other unique identifier. In some cases, individuals may be assigned identifiers specific to a project or series of projects.</p>
		</xhtmlContent></subsection>
		<subsection type="safeguards"><xhtmlContent>
		<p>All contractors or other record keepers are required to maintain appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records. Records are secured in compliance with Federal requirements, including the Federal Information Security Management Act, HHS Security Program Policy, and any applicable requirements for the encryption of personal data. </p></xhtmlContent></subsection>
		<subsection type="retentionAndDisposal"><xhtmlContent>
		<p>Identifiers are removed once the evaluation is complete.</p></xhtmlContent></subsection>
		<subsection type="systemManager"><xhtmlContent>
		<p>Director, Research and Evaluation Division, Family and Youth Services Bureau, Administration for Children and Families, Department of Health and Human Services, Portals Building, Suite 800, 1250 Maryland Avenue, SW, Washington, DC 20024. </p>
		</xhtmlContent></subsection>
		<subsection type="notificationProcedure"><xhtmlContent>
		<p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, and address of the individual, and the request must be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name since FYSB does not maintain Social Security Numbers (SSN) or other standard unique identifiers. The requester should try to name or describe the project that maintains the information being requested. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5. </p></xhtmlContent></subsection>
		<subsection type="recordAccessProcedures"><xhtmlContent>
		<p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, and address of the individual, and the request must be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name since FYSB does not maintain SSNs or other standard unique identifiers. The requester should try to name or describe the project that maintains the information being requested. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5.</p></xhtmlContent></subsection>
		<subsection type="contestingRecordProcedures"><xhtmlContent>
		<p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, and address of the individual, and should be signed; (2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual"s record; (3) identify the information that the individual believes in not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment.  The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name since FYSB does not maintain SSNs or other standard unique identifiers. The requester should try to name or describe the project that maintains the information being requested. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5</p></xhtmlContent></subsection>
		<subsection type="recordSourceCategories"><xhtmlContent>
		<p>Records in this system may be obtained from the record subject; programs funded by FYSB; existing programs operated by federal and state agencies; third party information sources that may include a record subject"s relatives, neighbors, friends, employers, and health care providers; and available commercial and governmental data sources.</p></xhtmlContent></subsection>
		<subsection type="exemptionsClaimed"><xhtmlContent>
		<p>None. </p></xhtmlContent></subsection></section>
<section id="09-80-0361" toc="yes">
<systemNumber>09-80-0361</systemNumber>
<subsection type="systemName">OPRE Research and Evaluation Project Records, HHS/ACF/OPRE.</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>Office of Planning, Research and Evaluation (OPRE), Administration for Children and Families (ACF), Department of Health and Human Services (HHS), 370 L'Enfant Promenade, SW, Washington, DC. A list of contractor sites where records under this system are maintained is available upon request to the system manager.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>OPRE research and evaluation projects may cover any program, activity, or function of ACF. ACF programs aim to achieve the following: to support and assist low-income families and individuals to increase their own economic independence and self-sufficiency; to increase strong, healthy, supportive communities that have a positive impact on the quality of life and the development of children; and  to enter into partnerships with states, communities, American Indian tribes, Native communities, and social service entities that support the development of low-income families and children. These partnerships include services to improve support to people with developmental disabilities, refugees, and migrants to address their needs, strengths, and abilities. </p>
<p>Records in this system may be about any individual who participates in an ACF/OPRE-sponsored research demonstration. For some projects, the records may include information about family members of service recipients and program participants. </p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>The specific types of records collected and maintained are determined by the needs of each research and evaluation project. Typical projects will collect some or all of these records: name; address; telephone number and other contact information; Social Security Number (SSN); demographic information, including race and ethnicity; date of birth; income; pre-school/Head Start participation; child care utilization; marriage and family status information; health information; income; employment information; child welfare system experiences; citizenship, etc.</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>Section 413 of the Social Security Act (42 U.S.C. 613); Section 1110 of the Social Security Act (42 U.S.C. 1310); Improving Head Start for School Readiness Act of 2007 (42 U.S.C. 9836) [Pub. L. 110"134, Section 641(c)(2)]; Child Care and Development Block Grant Act of 1990 (42 U.S.C. 9858 et seq.)  and Consolidated Appropriations Act of 2008 (Pub. L. 110-161, Division G, Title II, Payments to States for the Child Care and Development Block Grant); Section 429A of the Social Security Act (42 U.S.C. 628b), as added by the Personal Responsibility and Work Opportunities Reconciliation Act.</p>
</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>The Office of Planning, Research and Evaluation (OPRE) in the Administration for Children and Families (ACF) is responsible for advising the Assistant Secretary for Children and Families on increasing the effectiveness and efficiency of programs to improve the economic and social well-being of children and families. In collaboration with ACF program offices and others, OPRE is responsible for performance management for ACF, conducts research and policy analyses, and develops and oversees research and evaluation projects to assess program performance and inform policy and practice. This system of records contains personal information subject to the Privacy Act of 1974 that is used in OPRE research and evaluation projects. Only projects that involve the retrieval of records by personal identifier are subject to the Privacy Act of 1974 and are covered by this system. The procedures for the collection of information about research subjects in OPRE"s evaluation projects are reviewed, as appropriate, by Institutional Review Boards, are subject to HHS regulations on research with human subjects, including requirements for informed consent. </p>
</xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which ACF may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. For any project that has received a certificate of confidentiality, none of these routine uses shall be read to authorize a disclosure that would not be allowed by the terms of the certificate of confidentiality. In addition, contractors may be restricted by contract from making a disclosure allowed as a routine use or by law without the consent of HHS, of the data subject, or both, unless the disclosure is required by law.</p>
<p>(1) Disclosure for Law Enforcement Purpose</p>
<p>Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity. However, because this is a research and evaluation system, no information will be disclosed for use in any investigation, prosecution, or other action targeted against any individual who is the subject of the record.</p>
<p>(2) Disclosure Incident to Requesting Information</p>
<p>Information may be disclosed (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested), to any source from which additional information is requested when necessary to obtain information relevant to the research or evaluation being conducted. </p>
<p>(3) Disclosure to Congressional Office</p>
<p>Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual. </p>
<p>(4) Disclosure to Department of Justice or in Proceedings</p>
<p>Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
<p>HHS, or any component thereof; or</p>
<p>Any employee of HHS in his or her official capacity; or</p>
<p>Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
<p>The United States, </p>
<p>if HHS determines that litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation, provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
<p>(5) Disclosure to Contractor</p>
<p>Information may be disclosed to a contractor performing or working on a contract for HHS and who have a need to have access to the information in the performance of their duties or activities for HHS. </p>
<p>(6) Disclosure for Administrative Claim, Complaint, and Appeal</p>
<p>Information may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.</p>
<p>(7) Disclosure in Connection with Litigation</p>
<p>Information may be disclosed in connection with litigation or settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).</p>
<p>(8) Disclosure in the Event of a Security Breach</p>
<p>Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.   </p>
<p>Disclosure to consumer reporting agencies: </p>
<p>None.</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p>
<p>Depending on the project, records may be stored on paper or other hard copy, computers, and networks. </p>
</xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Depending on the project, records may be retrieved by name, SSN, or other personal identifier. In some cases, individuals may be assigned identifiers specific to a project or series of projects.</p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>All contractors or other record keepers are required to maintain appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records. Records are secured in compliance with Federal requirements, including the Federal Information Security Management Act, HHS Security Program Policy, and any applicable requirements for the encryption of personal data . </p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>Identifiers are removed once the analysis is complete.</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Executive Officer, Office of Planning, Research and Evaluation, Administration for Children and Families, Department of Health and Human Services, 370 L"Enfant Promenade, SW, Washington, DC 20447.</p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in the Department"s Privacy Act regulations may be required. 45 CFR 5b.5.</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in the Department"s Privacy Act regulations may be required. 45 CFR 5b.5.</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed; (2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual"s record; (3) identify the information that the individual believes in not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in the Department"s Privacy Act regulations may be required. 45 CFR 5b.5.</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>Records in this system may be obtained from the record subject; existing programs operated by federal and state agencies; third party information sources that may include a record subject"s relatives, neighbors, friends, employers, and health care providers; and available commercial and governmental data sources. </p>
</xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-80-0371" toc="yes">
<systemNumber>09-80-0371</systemNumber>
<subsection type="systemName"> OCC Federal Child Care Monthly Case Records, HHS/ACF/OCC.</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified.</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p> Office of Child Care, Administration for Children and Families (ACF), Department of Health and Human Services (HHS), 370 L'Enfant Promenade, SW, Washington, DC.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>Family members from low-income working families receiving child care financial assistance through the Child Care and Development Fund whose information is reported by the states and territories on ACF Form 801.</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>No names are collected. Social Security Numbers (SSN) are collected when voluntarily provided by families, or a unique state identifier provided by the states is included in lieu of SSNs. Other data fields include state and county, reason for receiving care, total monthly copayment, total monthly income, sources of income, date assistance began. For children, data fields include race/ethnicity, month/year of birth, type of child care, total monthly amount paid to child care provider, total hours of care provided.</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>42 U.S.C. 9858i, 9858j</p>
</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>When Congress created the Child Care and Development Fund (CCDF) in the Personal Responsibility and Work Opportunity Reconciliation Act, it also created the requirement that case-level data on families receiving CCDF services be collected on a regular basis. States and territories were charged with submitting specific information so that Congress would have some empirical basis for assessing the program. Non-identifiable records are also made available to researchers and the public.</p>
</xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, 5 U.S.C. 552a(b), under which ACF may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. </p>
<p>(1) Disclosure for Law Enforcement Purpose</p>
<p> Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity. </p>
<p>(2) Disclosure for Private Relief Legislation</p>
<p>Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A 19.</p>
<p>(3) Disclosure to Congressional Office</p>
<p>Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual. </p>
<p>(4) Disclosure to Department of Justice or in Proceedings</p>
<p>Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
<p>HHS, or any component thereof; or</p>
<p>Any employee of HHS in his or her official capacity; or</p>
<p>Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
<p>The United States, </p>
<p>if HHS determines that litigation is likely to affect HHS or any of its components,is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
<p>(5) Disclosure to the National Archives</p>
<p>Information may be disclosed to the National Archives and Records Administration in records management inspections. </p>
<p>(6) Disclosure to Contractors, Grantees, and Others</p>
<p>Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for HHS and who have a need to have access to the information in the performance of their duties or activities for HHS. </p>
<p>(7) Disclosure for Administrative Claim, Complaint, and Appeal</p>
<p>Information may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.</p>
<p>(8) Disclosure to Office of Personnel Management</p>
<p>Information may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of Federal personnel management.</p>
<p>(9) Disclosure in Connection with Litigation</p>
<p>Information may be disclosed in connection with litigation or settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).</p>
<p>(10) Disclosure in the Event of a Security Breach</p>
<p>Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.    </p>
<p>(11) Disclosure to consumer reporting agencies: None.</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p>
<p>Current records are stored on a computer network/database. Older records are stored on tapes and disks.</p>
</xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Records may be retrieved by state-defined unique identifier (which may be an SSN).</p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html. </p>
</xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>Records are maintained indefinitely. </p>
</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Associate Director, Office of Child Care, Administration for Children and Families, Department of Health and Human Services, 370 L'Enfant Promenade, SW, Washington, DC 20447.</p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5    </p>
</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5  </p>
</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed; (2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual"s record; (3) identify the information that the individual believes in not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5</p>
</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>States and territories receiving funds from the Child Care and Development Fund.</p>
</xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.
</p></xhtmlContent></subsection></section>
<section id="09-80-0373" toc="yes">
<systemNumber>09-80-0373</systemNumber>
<subsection type="systemName">OFA Tribal Temporary Assistance for Needy Families (Tribal TANF) Data System, HHS/ACF/OFA.</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>None.</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>TANFB.HQ, Office of Family Assistance (OFA), Administration for Children and Families (ACF), Department of Health and Human Services (HHS), 370 L"Enfant Promenade, SW, Washington, DC. A list of contractor sites where system records are currently located is available upon request to the system manager. </p>
</xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>Members of families (as defined at 45 CFR 286.5) who received assistance under the TANF program in any month.</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>There are three distinct groups of data in the system: family-level data; adult-level or minor-child-head-of-household data; and child data.</p>
<p>(1) Family level data may include the following items of information: Tribal TANF Database code, report year and month; stratum code; case identification number; Zip code; funding stream; disposition status; new applicant status; number of family members; type of family for work participation; receipt of subsidized housing; receipt of medical assistance; receipt of food stamp assistance; amount of food stamp assistance; receipt of subsidized child care; amount of subsidized child care; amount of child support; amount of family"s cash resources; cash, or cash equivalent, amount of assistance and number of months of that assistance; TANF child care (amount, number of children covered, and number of months of assistance); transportation assistance (amount and number of months of assistance); transitional services (amount and number of months of assistance); other assistance (amount and number of months of assistance); amount of reductions in assistance; reason for assistance reductions (sanctions, recoupment of prior overpayment, and other); waiver evaluation experimental and control group status; exemption status from the federal time-limit provisions; and new child-only-family status. </p>
<p>(2) Adult-level or minor child-head-of-household data may include: family affiliation; non-custodial parent indicator; date of birth; Social Security Number (SSN); race and ethnicity; gender; receipt of disability benefits; marital status; relationship to head of household; parent-with-minor-child-in-the-family status; needs of a pregnant woman; education level; citizenship; cooperation with child support; number of months countable towards Federal time-limit; number of countable months remaining under Tribe"s negotiated time-limit; exemption status of the reporting month from the Tribe"s negotiated time-limit; employment status; work participation status; unsubsidized employment hours; subsidized private and public sector employment hours; work experience hours; on-the-job training hours; job search and job readiness assistance hours; community service program hours; vocational educational training hours; hours of job skills training directly related to employment; hours of education directly related to employment for individuals with no high school diploma or certificate of high school equivalency; hours of satisfactory school attendance for individuals with no high school diploma or certificate of high school equivalency; hours of providing child care services to an individual who is participating in a community service program; hours of additional work activities permitted under a Waiver demonstration; hours of other work activities; required hours of work under a Waiver demonstration; amount of earned income; and amount of unearned income (earned income tax credit, Social Security benefit, Supplemental Security Income (SSI), worker"s compensation, and other unearned income). </p>
<p>(3) Child data (i.e., data pertaining to every child in a recipient TANF family) may include: family affiliation; date of birth; SSN; race and ethnicity; gender; receipt of disability benefits; relationship to head of household; parent-with-minor-child-in-the- family status; education level; citizenship; amount of unearned income (SSI and other).</p>
</xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>42 U.S.C. 612 (Section 412 of the Social Security Act). Tribal TANF data collection and reporting regulations are found in 45 CFR Part 286. </p>
</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>The purposes of the Tribal TANF Data System are: (1) To determine whether Tribes are meeting certain requirements negotiated under the Act, including negotiated work and time-limit requirements; (2) to compile information used to report to Congress on the Tribal TANF program. The TANF data are reported by the Tribes for each calendar quarter. Some records in the system may be provided to Office of Child Support Enforcement for matching with records of individual employment information contained in the National Directory of New Hires. Match results are transmitted back in a form that is not individually identifiable.</p>
</xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, 5 U.S.C. 552a(b), under which ACF may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. </p>
<p>(1) Disclosure of Identifiable Data for Research</p>
<p>Information may be disclosed in response to specific requests from public or private entities, where the requester"s proposed use of data from the Tribal TANF Data System is found compatible with the purposes for which this data was collected, to supply untabulated data, which may include personal identifiers for individuals whose information is included in the data. No data that may include personal identifiers will be disclosed until the requester has agreed in writing not to use such data to identify any individuals and has provided advance adequate written assurance that the records will be used solely as statistical research or reporting records.</p>
<p>(2) Disclosure for Law Enforcement Purpose</p>
<p>Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity. </p>
<p>(3) Disclosure Incident to Requesting Information</p>
<p>Information may be disclosed (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested), to any source from which additional information is requested when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring), retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.</p>
<p>(4) Disclosure for Employee Retention, Security Clearance, Contract, or Other Benefit</p>
<p>Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within HHS or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.</p>
<p>(5) Disclosure for Private Relief Legislation</p>
<p>Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A 19.</p>
<p>(6) Disclosure to Congressional Office</p>
<p>Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual. </p>
<p>(7) Disclosure to Department of Justice or in Proceedings</p>
<p>Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
<p>HHS, or any component thereof; or</p>
<p>Any employee of HHS in his or her official capacity; or</p>
<p>Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
<p>The United States, </p>
<p>if HHS determines that litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
<p>(8) Disclosure to the National Archives</p>
<p>Information may be disclosed to the National Archives and Records Administration in records management inspections. </p>
<p>(9) Disclosure to Contractors, Grantees, and Others</p>
<p>Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for HHS and who have a need to have access to the information in the performance of their duties or activities for HHS. </p>
<p>(10) Disclosure for Administrative Claim, Complaint, and Appeal</p>
<p> Information may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.</p>
<p>(11) Disclosure to Office of Personnel Management</p>
<p>Information may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of Federal personnel management.</p>
<p>(12) Disclosure in Connection with Litigation</p>
<p>Information may be disclosed in connection with litigation or settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).</p>
<p>(13) Disclosure in the Event of a Security Breach</p>
<p>Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.  </p>
<p>(14) Disclosure to consumer reporting agencies: None.</p>
<p><i>Note:</i> Data produced by matching Tribe-provided data with data from the Office of Child Support Enforcement"s National Directory of New Hires will only be disclosed in accordance applicable routine use disclosures set forth in the Office of Child Support Enforcement"s systems of records for OCSE Debtor File and OCSE National Directory of New Hires.</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:  </p>
<p>Records may be transmitted electronically and stored on computer tapes, disks, and networks. </p>
</xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Records may be retrieved by state-defined unique identifier (which may be an SSN), or assigned case number.</p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html. </p>
</xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>Data is retained indefinitely.</p>
</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Director, TANFB.HQ, Administration for Children and Families, Department of Health and Human Services, 370 L"Enfant Promenade, SW, Washington, DC 20447.</p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5    </p>
</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5  </p>
</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed; (2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual"s record; (3) identify the information that the individual believes in not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5</p>
</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>All information is obtained from participating Tribes.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>No.</p>
</xhtmlContent></subsection></section>
<section id="09-80-0375" toc="yes">
<systemNumber>09-80-0375</systemNumber>
<subsection type="systemName">
OFA Temporary Assistance for Needy Families (TANF) Data System, HHS/ACF/OFA.</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>(1) Office of Information Systems, Office of Administration, Administration for Children and Families (ACF), Department of Health and Human Services (HHS), 370 L"Enfant Promenade, SW, Washington, DC; and (2) Office of Family Assistance (OFA), ACF, HHS, 370 L"Enfant Promenade, SW, Washington, DC. A list of contractor sites where system records are currently located is available upon request to the system manager. </p>
</xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>(1) Members of families (as defined at 45 CFR 265.2) who received assistance under the TANF program in any month. For data collection and reporting purposes only, family means:</p>
<p>All individuals receiving assistance as part of a family under the State's TANF or separate State program (including noncustodial parents, where required under 45 CFR 265.3(f)); and</p>
<p>The following additional persons living in the household, if not otherwise included: </p>
<p>Parent(s) or caretaker relative(s) of any minor child receiving assistance; </p>
<p>Minor siblings of any child receiving assistance; and </p>
<p>Any person whose income or resources would be counted in determining the family's eligibility for or amount of assistance.</p>
<p>(2) Members of families no longer receiving assistance under the TANF program.</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>There are three distinct groups of data in the TDS (TANF Data Reporting System): family-level data; adult-level or minor-child-head-of-household data; and child data.</p>
<p>States must use for all families, adult-level or minor child-head-of-household, and child data reported each month and must use for all months in the fiscal year: State FIPS Code; County FIPS Code;  Tribal code; Reporting Month; Stratum.</p>
<p>(1) Family level data maintained in the TDS may include the following items of information on every family that received assistance during one or more months: case number - TANF; Zip code; funding stream; disposition; new applicant; number of family members; type of family for work participation; receives subsidized housing; receives medical assistance; receives food stamp; amount of food stamp assistance; receives subsidized child care; amount of subsidized child care; amount of child support; amount of family"s cash resources; cash and cash equivalents (amount of assistance and number of months); TANF child care (amount, number of children covered, and number of months); transportation (amount and number of months); transitional services (amount and number of months); other (amount and number of months); reason for and amount of reductions in assistance (sanctions, recoupment of prior overpayment,); waiver evaluation experimental and control group; is the TANF Family exempt from the Federal time-limit provisions; is the TANF family a new child-only family. </p>
<p>(2) Adult-level or minor child-head-of-household data maintained in the TDS may include: family affiliation; noncustodial parent indicator; date of birth; Social Security Number (SSN); race/ethnicity; gender; receives disability benefits; marital status; relationship to head of household; parent-with-minor-child-in-the-family; needs of a pregnant woman; educational level; citizenship/alienage; cooperation with child support; number of months countable towards Federal time-limit; number of countable months remaining under State"s (Tribe"s) time-limit; Is current month exempt from the State"s (Tribe"s)time-limit; employment status; work-eligible individual indicator; work participation status; unsubsidized employment; subsidized private-sector employment hours; subsidized public-sector employment; work experience; on-the-job training; job search and job readiness assistance; community service program; vocational educational training; job skills training directly related to employment; education directly related to employment for individuals with no high school diploma or certificate of high school equivalency; satisfactory school attendance for individuals with no high school diploma or certificate of high school equivalency; providing child care services to an individual who is participating in a community service program; other work activities; number of deemed core hours for overall rate; number of deemed core hours for the two-parent rate; amount of earned income; amount of unearned income (earned income tax credit (EITC), Social Security, Supplemental Security Income (SSI), Worker"s Compensation, Other Unearned Income) </p>
<p>(3) Child data (i.e., data pertaining to every child in a recipient TANF family) may include: family affiliation; date of birth; SSN; race and ethnicity; gender; receives disability benefits; relationship to head of household; parent-with-minor-child-in-the- family status; educational level; citizenship/alienage; amount of unearned income (SSI and other unearned income).</p>
</xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>42 U.S.C. 601"619 (Title IV-A of the Social Security Act); 45 CFR Part 265 (TANF data collection and reporting regulations); 42 U.S.C. 603(a)(4), 613(d) (Sections 403 and 413 of the Social Security Act); 45 CFR Part 270 (collection of information for performance measures).</p>
</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>The purposes of the TANF Data Reporting System are: (1) To determine whether States are meeting certain requirements prescribed by the Act, including prescribed work and time-limit requirements; (2) to compile information used to report to Congress on the TANF program; and, (3) to compute State scores on work measures and rank States on their performance in assisting TANF recipients to obtain and retain employment. The monthly TANF data are reported by the individual States for each (Federal) fiscal quarter. (The term State is used in this notice to refer to the 50 States, the District of Columbia, and the jurisdictions of Puerto Rico, the U.S. Virgin Islands, and Guam). The State data are pooled to create a national database for each quarter. Some records in the system may be provided to Office of Child Support Enforcement for matching with records of individual employment information contained in the National Directory of New Hires. Match results are transmitted back to OFA in a form that is not individually identifiable.</p>
</xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, 5 U.S.C. 552a(b), under which ACF may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. </p>
<p>(1) Disclosure of Identifiable Data for Research</p>
<p>Information from this system of records may be disclosed in response to specific requests from public or private entities, where the requester"s proposed use of data from the TANF Data System is found compatible with the purposes for which this data was collected, supply untabulated data, which may include personal identifiers for individuals whose information is included in the data. No data that may include personal identifiers will be disclosed until the requester has agreed in writing not to use such data to identify any individuals and has provided advance adequate written assurance that the records will be used solely as statistical research or reporting records.</p>
<p>(2) Disclosure for Law Enforcement Purpose</p>
<p>Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity. </p>
<p>(3) Disclosure for Private Relief Legislation</p>
<p>Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A 19.</p>
<p>(4) Disclosure to Congressional Office</p>
<p>Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual. </p>
<p>(5) Disclosure to Department of Justice or in Proceedings</p>
<p>Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
<p>HHS, or any component thereof; or</p>
<p>Any employee of HHS in his or her official capacity; or</p>
<p>Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
<p>The United States, </p>
<p>if HHS determines that litigation is likely to affect HHS or any of its components,is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
<p>(6) Disclosure to the National Archives</p>
<p>Information may be disclosed to the National Archives and Records Administration in records management inspections. </p>
<p>(7) Disclosure to Contractors, Grantees, and Others</p>
<p>Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for HHS and who have a need to have access to the information in the performance of their duties or activities for HHS. </p>
<p>(8) Disclosure for Administrative Claim, Complaint, and Appeal</p>
<p>Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.</p>
<p>(9) Disclosure to Office of Personnel Management</p>
<p>Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of Federal personnel management.</p>
<p>(10) Disclosure in Connection with Litigation</p>
<p>Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).</p>
<p>(11) Disclosure in the Event of a Security Breach</p>
<p>Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance. </p>
<p>(12) Disclosure to consumer reporting agencies: None.</p>
<p><i>Note:</i> Data produced by matching State provided data with data from the Office of Child Support Enforcement"s National Directory of New Hires will only be disclosed in accordance with applicable routine use disclosures set forth in the Office of Child Support Enforcement"s systems of records for OCSE Debtor File and OCSE National Directory of New Hires.</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p>
<p>Records may be transmitted electronically and stored on computer tapes, disks, and networks. </p>
</xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Records may be retrieved by name, state-defined unique identifier (which may be an SSN), or assigned case or family identification numbers.</p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>The data transmitted by a State for a fiscal quarter are backed up after the initial processing of the data. The backed-up version of the data is kept only for a period of 30 days. The data transmitted by the States for a fiscal quarter, after processing and acceptance, are pooled to create a national database for the quarter. The national database is stored for up to 24 months after the end of the fiscal year. Afterwards, the database is copied to a compact disc, and the original data are erased. The data on the compact disc is securely maintained by ACF for up to 20 years in order to facilitate research on caseload trends, changes in the characteristics of TANF recipients, or other pertinent research. The eventual disposal of the data will be by means of physical destruction of the CD"s containing the data. The Office of Information Systems of the Office of Administration and OFA, ACF, are responsible for the retention and disposal of the data system. The SSNs obtained for the work performance measures for a performance year, although initially kept in an electronic file, are erased after calculation of the work measures for the performance year. The erasing of this SSN data file is done within two years after the performance measures are actually published for a performance year (which precedes the year in which they are calculated). Aggregate data files based on information provided for the work measures are also erased at the same time.</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Director, Division of Applications Development Services, Office of Information Services, Office of Administration, Administration for Children and Families, Department of Health and Human Services, 370 L"Enfant Promenade, SW, Washington, DC 20447.</p>
<p>Director, Division of Data Collection and Analysis, TANF Bureau, Office of Family Assistance, Administration for Children and Families, Department of Health and Human Services, 370 L"Enfant Promenade, SW, Washington, DC 20447.</p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5.</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5.</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed; (2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual"s record; (3) identify the information that the individual believes in not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5</p>
</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>All information is obtained from the states.</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.</p></xhtmlContent></subsection></section>

                <section id="09-80-0381" toc="yes">
		<systemNumber>09-80-0381</systemNumber>
		<subsection type="systemName">OCSE National Directory of New Hires, HHS/ACF/OCSE.</subsection>
		<subsection type="securityClassification"><xhtmlContent>
		<p>Unclassified </p></xhtmlContent></subsection>
		<subsection type="systemLocation"><xhtmlContent>
		<p>National Computer Center, Social Security Administration, Baltimore, Maryland; OCSE Data Facility, Manassas, Virginia.</p>
		</xhtmlContent></subsection>
		<subsection type="categoriesOfIndividuals"><xhtmlContent>
		<p>(1) Individuals who are newly hired "employees" within the meaning of chapter 24 of the Internal Revenue Code of 1986, 26 U.S.C. 3401, whose employers have furnished specified information to a State Directory of New Hires which, in turn, has furnished such information to the National Directory of New Hires pursuant to 42 U.S.C. 653a(g)(2)(A); </p>
		<p>(2) Individuals who are federal government employees whose employers have furnished specified information to the National Directory of New Hires pursuant to 42 U.S.C. 653(n) and 653a(b)(1)(c). This category does not include individuals who are employees of a department, agency, or instrumentality performing intelligence or counterintelligence functions, if the head of such department, agency, or instrumentality has determined that filing such a report could endanger the safety of the employee or compromise an ongoing investigation or intelligence mission; and </p>
		<p>(3) Individuals to whom unemployment compensation or wages have been paid and about whom the State Directory of New Hires has furnished such information to the National Directory of New Hires pursuant to 42 U.S.C. 653(e)(3) and 653a(g)(2)(B).</p>
		<p>(4) Individuals whose information is contained within input records furnished by an authorized state or federal agency for matching to obtain employment, wage, or unemployment compensation information pertaining to those individuals for purposes of establishing or verifying eligibility of applicants for, or beneficiaries of, federal or state benefit programs, such as those funded under 42 U.S.C. 601 through 619 (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families). Other individuals whose information is contained within input records furnished for authorized matching are listed in the routine uses to this system of records notice</p>
		<p>(5) Individuals involved in child support cases whose information is collected and disseminated to and from employers (and other payers of income) and state IV-D child support enforcement agencies, courts, and other authorized entities for enforcement of child support orders by withholding of income. </p>
		<p>(1) Records pertaining to newly hired employees furnished by a State Directory of New Hires pursuant to 42 U.S.C. 653a(g)(2)(A). Records in the system are the name, address, and Social Security Number (SSN) or Taxpayer Identification Number (TIN) and date of hire of the employee, the name, address and federal identification number of the employer of such employee and, at the option of the state, the date of birth or state of hire of the employee.</p>
		<p>(2) Records pertaining to newly hired employees furnished by a federal department, agency or instrumentality pursuant to 42 U.S.C. 653a(b)(1)(C), including the name, address, SSN (or TIN) and date of hire of the employee and the name, address and employer identification number of the employer. A Department of Defense status code, if available, is also included in the records.</p>
		<p>(3) Records furnished by a State Directory of New Hires pertaining to wages and unemployment compensation paid to individuals pursuant to 42 U.S.C. 653a(g)(2)(B).</p>
		<p>(4) Records furnished by a federal department, agency, or instrumentality pertaining to wages paid to individuals pursuant to 42 U.S.C. 653(n) and wage and unemployment compensation records obtained pursuant to an agreement with the Department of Labor pursuant to 42 U.S.C. 653(e)(3). </p>
		<p>(5) Input records furnished by a state or federal agency or other entity for authorized matching with the NDNH.</p>
		<p>(6) Records collected and disseminated to and from employers (and other income sources) and state IV-D child support enforcement agencies and other authorized entities pertaining to income withholding, including additional information, such as termination date, final payment date and amount, contact information, children"s names, lump sum income information, order information, past-due support information, amounts to withhold, and instructions for withholding. </p></xhtmlContent></subsection>
		<subsection type="authorityForMaintenance"><xhtmlContent>
		<p>42 U.S.C. 653(i), 652(a)(9) and 653(a)(1).</p>
		</xhtmlContent></subsection>
		<subsection type="purpose"><xhtmlContent>
		<p>The Office of Child Support Enforcement (OCSE) uses the NDNH primarily to assist states administering programs that improve states" abilities to locate parents, establish paternity, and collect child support. The NDNH is also used to support other programs as specified in sections 453 and 463 of the Social Security Act (42 U.S.C. 653, 663): Temporary Assistance for Needy Families; child and family services; foster care and adoption assistance; establishing or verifying eligibility of applicants for, or beneficiaries of benefit programs; recouping payments or delinquent debts under benefit programs; and for certain research purposes likely to contribute to achieving the purposes of the Temporary Assistance for Needy Families (TANF) or the federal/state child support program.  </p>
		</xhtmlContent></subsection>
		<subsection type="routineUsesOfRecords"><xhtmlContent>
		<p>These routine uses specify circumstances under which ACF may disclose information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. </p>
		<p>Any information defined as "return" or "return information" under 26 U.S.C. 6103 (Internal Revenue Code) will not be disclosed unless authorized by a statute, the Internal Revenue Service (IRS) or IRS regulations. </p>
		<p>(1) Disclosure for Child Support Purposes</p>
		<p>Pursuant to 42 U.S.C. 653(a)(2), 653(b)(1)(A) and 653(c), information about the location of an individual or information that would facilitate the discovery of the location of an individual or identifying information about the individual may be disclosed, upon request filed in accordance with law, to an "authorized person" for the purpose of establishing parentage or establishing, setting the amount of, modifying or enforcing child support obligations. Other information that may be disclosed is information about an individual"s wages (or other income) from, and benefits of, employment, and information on the type, status, location, and amount of any assets of, or debts owed by or to, the individual. An "authorized person" is defined under 42 U.S.C. 653(c) as follows: (1) Any agent or attorney of a state who has a duty or authority to seek or recover any amounts owed as child and spousal support or to seek to enforce orders providing child custody or visitation rights; (2) a court which has authority to issue an order against a noncustodial parent for support of a child, or to issue an order against a resident parent for child custody or visitation rights, or any agent of such court; (3) the resident parent, legal guardian, attorney, or agent of a child that is not receiving assistance under a state program funded under title IV-A of the Social Security Act (Temporary Assistance for Needy Families); and (4) a state agency that is administering a program operated under title IV-B (child and family services programs) or IV-E (Foster Care and Adoption Assistance programs) of the Social Security Act.</p>
		<p>(2) Disclosure for Purposes Related to the Unlawful Taking or Restraint of a Child or Child Custody or Visitation </p>
		<p>Pursuant to 42 U.S.C. 653(b)(1), upon request of an "authorized person," as defined in 42 U.S.C. 663(d)(2), information as to the most recent address and place of employment of a parent or child may be disclosed for the purpose of enforcing any state or federal law with respect to the unlawful taking or restraint of a child or making or enforcing a child custody or visitation determination.  </p>
		<p>(3) Disclosure to Department of State under International Child Abduction Remedies Act</p>
		<p>Pursuant to 42 U.S.C. 653(b)(1) and 663(e), the most recent address and place of employment of a parent or child may be disclosed upon request to the Department of State, in its capacity as the Central Authority designated in accordance with section 7 of the International Child Abduction Remedies Act, 42 U.S.C. 11601 et seq., for the purpose of locating the parent or child on behalf of an applicant.</p>
		<p>(4) Disclosure to a Foreign Reciprocating Country for Child Support Purposes</p>
		<p>Pursuant to 42 U.S.C. 653(a)(2) and 659a(c)(2), information on the state of residence of an individual sought for support enforcement purposes in cases involving residents of the United States and residents of foreign countries that are the subject of a declaration may be disclosed to a foreign reciprocating country. </p>
		<p>(5) Disclosure to the Treasury for Tax Administration Purposes</p>
		<p>Pursuant to 42 U.S.C. 653(i)(3), information may be disclosed to the Secretary of the Treasury for purposes of administering 26 U.S.C. 32 (earned income tax credit), administering  26 U.S.C. 3507 (advance payment of earned income tax credit) and verifying a claim with respect to employment in a tax return. </p>
		<p>(6) Disclosure to the Social Security Administration for Verification</p>
		<p>Pursuant to 42 U.S.C. 653(j)(1), the names, SSNs, and birth dates of individuals about whom information is maintained may be disclosed to the Social Security Administration to the extent necessary for verification of the information by the Social Security Administration. </p>
		<p>(7) Disclosure for Locating an Individual for Paternity Establishment or in Connection with a Support Order</p>
		<p>Pursuant to 42 U.S.C. 653(j)(2), the results of a comparison between records in this system and the Federal Case Registry of Child Support Orders may be disclosed to the state IV-D child support enforcement agency responsible for the case for the purpose of locating an individual in a paternity establishment case or a case involving the establishment, modification or enforcement of a support order. </p>
		<p>(8) Disclosure to State Agencies Operating Specified Programs</p>
		<p>Pursuant to 42 U.S.C. 653(j)(3), information may be disclosed to a state to the extent and with the frequency that the Secretary determines to be effective in assisting the state to carry out its responsibilities under child support programs operated under 42 U.S.C. 651 through 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity), child and family services programs operated under 42 U.S.C. 621 through 629m (Title IV-B of the Social Security Act), Foster Care and Adoption Assistance programs operated under 42 U.S.C. 670 through 679c (Title IV-E of the Social Security Act) and assistance programs funded under 42 U.S.C. 601 through 619  (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families). </p>
		<p>(9) Disclosure to the Commissioner of Social Security </p>
		<p>Pursuant to 42 U.S.C. 653(j)(4), information may be disclosed to the Commissioner of Social Security for the purpose of verifying eligibility for Social Security Administration programs and administering such programs. </p>
		<p>(10) Disclosure for Authorized Research Purposes</p>
		<p>Pursuant to 42 U.S.C. 653(j)(5), data in the NDNH, including information reported by employers pursuant to 42 U.S.C. 653a(b), may be disclosed, without personal identifiers, for research purposes found by the Secretary to be likely to contribute to achieving the purposes of 42 U.S.C. 651 through 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity) and 42 U.S.C. 601 through 619  (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families). </p>
		<p>(11) Disclosure to Secretary of Education for Collection of Defaulted Student Loans </p>
		<p>Pursuant to 42 U.S.C. 653(j)(6), the results of a comparison of information in this system with information in the custody of the Secretary of Education may be disclosed to the Secretary of Education for the purpose of collection of debts owed on defaulted student loans, or refunds on overpayments of grants, made under title IV of the Higher Education Act of 1965 (20 U.S.C. 1070 et seq. and 42 U.S.C. 2751 et seq.) and, after removal of personal identifiers, for the purpose of conducting analyses of student loan defaults. </p>
		<p>(12) Disclosure to Secretary of Housing and Urban Development for Verification Purposes</p>
		<p>Pursuant to 42 U.S.C. 653(j)(7), information regarding an individual participating in a housing assistance program (United States Housing Act of 1937 (42 U.S.C. 1437 et seq.); 12 U.S.C. 1701s, 1701q,  1715l(d)(3), 1715l(d)(5), 1715z"1; or 42 U.S.C. 8013) may be disclosed to the Secretary of Housing and Urban Development for the purpose of verifying the employment and income of the individual and, after removal of personal identifiers, for the purpose of conducting analyses of the employment and income reporting of such individuals. </p>
		<p>(13) Disclosure to State Unemployment Compensation Agency for Program Purposes</p>
		<p>Pursuant to 42 U.S.C. 653(j)(8), information on an individual for whom a state agency administering an unemployment compensation program under federal or state law has furnished the name and Social Security number, and information on such individual"s employer, may be disclosed to the state agency for the purposes of administering the unemployment compensation program. </p>
		<p>(14) Disclosure to Secretary of the Treasury for Debt Collection Purposes</p>
		<p>Pursuant to 42 U.S.C. 653(j)(9), information pertaining to a person who owes the United States delinquent nontax debt and whose debt has been referred to the Secretary of the Treasury in accordance with 31 U.S.C. 3711(g), may be disclosed to the Secretary of the Treasury for purposes of collecting the debt. </p>
		<p>(15) Disclosure to State Agency for Food Stamp Program Purposes</p>
		<p>Pursuant to 42 U.S.C. 653(j)(10), information on an individual and the individual"s  employer may be disclosed to a state agency responsible for administering a supplemental nutrition assistance program under the Food and Nutrition Act of 2008 (7 U.S.C. 2011 et seq.) for the purposes of administering the program.</p>
		<p>(16) Disclosure to the Secretary of Veterans Affairs for Verification Purposes</p>
		<p>Pursuant to 42 U.S.C. 653(j)(11), information about an individual applying for or receiving the following benefits, compensation or services may be disclosed to the Secretary of Veterans Affairs for the purpose of verifying the employment and income of the individual and, after removal of personal identifiers, to conduct analyses of the employment and income reporting of such individuals: (i) needs-based pension benefits provided under 38 U.S.C. chapter 15, or under any other law administered by the Secretary of Veterans Affairs; (ii) parents' dependency and indemnity compensation provided under 38 U.S.C. 1315; (iii) health care services furnished under subsections 38 U.S.C. 1710(a)(2)(G), (a)(3), (b); or (iv) compensation paid under 38 U.S.C. chapter 11, at the 100 percent rate based solely on unemployability and without regard to the fact that the disability or disabilities are not rated as 100 percent disabling under the rating schedule. </p>
		<p>(17) Disclosure for Law Enforcement Purpose</p>
		<p>Information may be disclosed to the appropriate federal, state, local, tribal, or foreign agency responsible for identifying, investigating, and prosecuting, noncustodial parents who knowingly fail to pay their support obligations and meet the criteria for Federal prosecution under 18 U.S.C. 228. The information must be relevant to the violation of criminal nonsupport, as stated in the Deadbeat Parents Punishment Act, 18 U.S.C. 228 and the disclosure must be compatible with the purpose for which the records were collected.</p>
		<p>(18) Disclosure to Department of Justice or in Proceedings</p>
		<p>Records may be disclosed to support the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
		<p> HHS, or any component thereof; or</p>
		<p> Any employee of HHS in his or her official capacity; or</p>
		<p> Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
		<p> The United States,</p>
		<p>is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the court or adjudicative body is deemed by HHS to be relevant and necessary to the litigation; provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
		<p>(19)Disclosure to Congressional Office</p>
		<p>Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual. </p>
		<p>(20) Disclosure to Contractor to Perform Duties</p>
		<p>Records may be disclosed to a contractor performing or working on a contract for HHS and who has a need to have access to the information in the performance of its duties or activities for HHS in accordance with law and with the contract. </p>
		<p>(21) Disclosure in the Event of a Security Breach</p>
		<p>Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.  </p>
		<p>Disclosure to consumer reporting agencies:</p>
		<p> None. </p>
		</xhtmlContent></subsection>
		<subsection type="policiesAndPractices"><xhtmlContent>
		<p>Storage:</p>
		<p>Records in the NDNH are stored electronically at the Social Security Administration"s National Computer Center and the OCSE Data Facility. Historical logs and system backups are stored off-site at an alternate location.</p></xhtmlContent></subsection>
		<subsection type="retrievability"><xhtmlContent>
		<p>Records maintained in the NDNH are retrieved by the SSN (or TIN) of the individual to whom the record pertains. Records collected and disseminated from employers and other income sources are retrieved by state FIPS codes and employer identification numbers, and records collected and disseminated from state IV-D child support enforcement agencies are retrieved by state FIPS codes.</p>
		</xhtmlContent></subsection>
		<subsection type="safeguards"><xhtmlContent>
		<p>Specific administrative, technical and physical controls are in place to ensure that the records collected and maintained in the NDNH are secure from unauthorized access. Access to the records is restricted to authorized personnel who are advised of the confidentiality of the records and the civil and criminal penalties for misuse and who sign a nondisclosure oath to that effect. Personnel are provided privacy and security training before being granted access to the records and annually thereafter.</p>
		<p>Logical access controls are in place to limit access to the records to authorized personnel and to prevent browsing. The records are processed and stored in a secure environment. All records are stored in an area that is physically safe from access by unauthorized persons at all times.</p>
		<p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p></xhtmlContent></subsection>
		<subsection type="retentionAndDisposal"><xhtmlContent>
		<p>Records maintained in the NDNH are retained for 24 months after the date of entry and then deleted from the database pursuant to 42 U.S.C. 653(i)(2)(A). In accordance with 42 U.S.C. 653(i)(2)(B), OCSE shall not have access for child support enforcement purposes to quarterly wage and unemployment insurance information in the NDNH if 12 months have elapsed since the information is provided by a State Directory of New Hires pursuant to 42 U.S.C. 653A(g)(2)(B) and there has not been a match resulting from the use of such information in any information comparison. Notwithstanding these retention and disposal requirements, OCSE may retain such samples of data entered into the NDNH as OCSE may find necessary to assist in carrying out its responsibility to provide access to data in the NDNH for research purposes found by OCSE to be likely to contribute to achieving the purposes of Part A or Part D of title IV of the Act, but without personal identifiers, pursuant to 42 U.S.C. 653(i)(2)(C), (j)(5). Samples are retained only so long as necessary to complete such research. (1) Input records for authorized matching to obtain NDNH information and (2) records pertaining to income withholding collected and disseminated by OCSE are retained for 60 days. Audit logs including information such as employer identification numbers, FIPS code numbers, document tracking numbers, case identification numbers and order identifier are retained up to 5 years.</p>
		</xhtmlContent></subsection>
		<subsection type="systemManager"><xhtmlContent>
		<p>Director, Division of Federal Systems, Office of Automation and Program Operations, Office of Child Support Enforcement, Administration for Children and Families, 370 L"Enfant Promenade, 4th Floor East, S.W., Washington, DC 20447.</p>
		</xhtmlContent></subsection>
		<subsection type="notificationProcedure"><xhtmlContent>
		<p>Individuals seeking to determine whether this system of records contains information about them should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed by the individual to whom such information pertains. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5.   </p>
		</xhtmlContent></subsection>
		<subsection type="recordAccessProcedures"><xhtmlContent>
		<p>Individuals seeking access to a record about them in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed by the individual to whom such information pertains. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5. </p>
		</xhtmlContent></subsection>
		<subsection type="contestingRecordProcedures"><xhtmlContent>
		<p>Individuals seeking to amend a record about them in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed; (2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual"s record; (3) identify the information that the individual believes is not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5.</p></xhtmlContent></subsection>
		<subsection type="recordSourceCategories"><xhtmlContent>
		<p>Information is obtained from departments, agencies, or instrumentalities of the United States or any state, from entities authorized to match to receive NDNH information, and from employers and other income sources.</p>
		</xhtmlContent></subsection>
		<subsection type="exemptionsClaimed"><xhtmlContent>
		<p>None. </p>
		</xhtmlContent></subsection></section>

<section id="09-80-0383" toc="yes">
<systemNumber>09-80-0383</systemNumber>
<subsection type="systemName">OCSE Debtor File, HHS/ACF/OCSE .</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified </p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>National Computer Center, Social Security Administration, Baltimore, Maryland</p>
</xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>Individuals owing past-due child support, as indicated by a state agency administering a child support enforcement program pursuant to 42 U.S.C. 651 through 669b (Title IV, Part D, of the Social Security Act) are covered by this system. </p>
<p>Additional individuals whose records are contained in input files for authorized matching with records in this system are also covered by this system. These additional individuals include those claiming or receiving income or benefits, such as workers" compensation or insurance claims, settlements, awards, and payments.</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>(1) Records pertaining to individuals owing past-due child support, as indicated by a state agency administering a child support enforcement program, including the name, Social Security Number (SSN) or Taxpayer Identification Number (TIN),  of such individual, the amount of past-due child support owed by the individual, adjustments to such amount, information on each enforcement remedy applicable to the individual to whom the record pertains, as indicated by a state IV-D child support enforcement agency; the amount of past-due support collected as a result of each such remedy; and a history of updates by the state agency to the records. </p>
<p>(2) Records of the results of a comparison between records in the Debtor File pertaining to individuals owing past-due child support and information maintained by the Secretary of the Treasury concerning the following amounts payable to such individuals: refunds of federal taxes; salary, wage and retirement benefits; income and benefits information; vendor payments and expense reimbursement payments and travel payments; and information pertaining to the collection of those amounts by state child support enforcement agencies.</p>
<p>(3) Records of the results of a comparison between records in the Debtor File pertaining to individuals owing past-due child support and information provided by a financial institution doing business in two or more states, including the name, record address, SSN (or TIN), or other identifying number of each such individual and information about any account, held by the individual and maintained at such institution, including the amounts to withhold from the account, date of withholding of the amounts, and other information pertaining to the placement of a lien or levy by a state child support enforcement agency on the account.</p>
<p>(4) Records pertaining to individuals claiming or receiving periodic or lump-sum workers" compensation payments (including name, record address, SSN (or TIN), claim numbers, and workers" compensation insurers) which are furnished by a workers" compensation agency and records of the results of a comparison between those records and records in the Debtor File pertaining to individuals owing past-due child support.</p>
<p>(5) Records pertaining to individuals whose information is maintained by an insurer (or its agent) concerning insurance claims, settlements, awards, and payments and the results of a comparison between records in the Debtor File pertaining to individuals owing past-due child support and income and benefits information, including lump sum payment information and information maintained by insurers (or their agents) concerning insurance claims, settlements, awards, and payments and information pertaining to state child support enforcement agency withholding of these amounts.</p>
<p>(6) Records pertaining to individuals claiming or receiving other periodic or lump-sum state or federal benefits or other income and match results between those individuals and individuals owing past-due support. </p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>42 U.S.C. 652, 653, 664, and 666.</p>
</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>The primary purpose of the Debtor File is to improve states" abilities to collect past-due child support. The Debtor File facilitates OCSE"s execution of its responsibility to perform the following duties: transmit to the Secretary of State a certification by a state IV-D child support agency that an individual owes arrearages of child support in an amount exceeding $2,500 for action (with respect to denial, revocation or limitation of passports) pursuant to 42 U.S.C. 652(k)(1); through the Federal Parent Locator Service (FPLS), to aid state IV-D agencies and financial institutions doing business in two or more states in operating a data match system pursuant to 42 U.S.C. 652(l) (see also 42 U.S.C. 666(a)(17)(A)(i)) and to aid in the transmission of information pertaining to a lien or levy of financial institution accounts located as a result of that data match system authorized under 42 U.S.C. 652(a)(7), 666(c)(1)(G), and 666(c)(1)(G)(ii); through the FLPS, to compare information regarding individuals owing past-due support with income and benefits information of such individuals, including lump sum payment information, and furnish information resulting from the data matches to the state agencies responsible for collecting child support from the individuals pursuant to 42 U.S.C. 652(a)(7), 653(a)(2), 666(a)(4) and 666(c)(1)(G); through the FPLS, to compare information regarding individuals owing past-due support with specified information maintained by insurers (or their agents) and furnish information resulting from the data matches to the state agencies responsible for collecting child support from the individuals pursuant to 42 U.S.C. 652(l) (to be redesignated " 652(m)); to assist the Secretary of the Treasury in withholding from refunds of federal taxes paid an amount owed by an individual owing past-due child support pursuant to 42 U.S.C. 664; and to assist state IV-D child support enforcement agencies in the collection of past-due child support through the administrative offset of certain federal payments pursuant to the Debt Collection Improvement Act of 1996 (Pub. L. 104-134), Executive Order 13019, and 31 CFR  part 285; and to improve states" abilities to collect past-due and current support from individuals who are owed workers" compensation benefits pursuant to 42 U.S.C. 653(e)(1); 666(a)(1)(A), (b)(1) and (8), and (c)(1)(F) and (G); and 653(b)(1)(B). OCSE operates the FPLS pursuant to 42 U.S.C. 652(a)(9) and 42 U.S.C. 653(a)(1). </p>
</xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>These routine uses specify circumstances under which ACF may disclose information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. </p>
<p>Any information defined as "return" or "return information" under 26 U.S.C. 6103 (Internal Revenue Code) will not be disclosed unless authorized by a statute, the Internal Revenue Service (IRS) or IRS regulations.</p>
<p>(1) Disclosure to the Treasury to Withhold Past-Due Support</p>
<p>Pursuant to 42 U.S.C. 664 and the Debt Collection Improvement Act of 1996 (Pub. L. 104-134), information pertaining to an individual owing past-due child support may be disclosed to the Secretary of the Treasury for the purpose of withholding the past-due support from amounts payable as refunds of federal taxes; salary, wage and retirement payments; vendor payments; and expense reimbursement payments and travel payments. </p>
<p>(2) Disclosure to State Department for Passport Purposes  </p>
<p>Pursuant to 42 U.S.C. 652(k), information pertaining to an individual owing past-due child support in a specified amount, as certified by a state child support enforcement agency, may be disclosed to the Secretary of State for the purpose of revoking, restricting, limiting, or denying a passport to the individual. </p>
<p>(3)  Disclosure to Financial Institution to Collect Past-Due Support</p>
<p>Pursuant to 42 U.S.C. 652(l), information pertaining to an individual owing past-due child support may be disclosed to a financial institution doing business in two or more states to identify an individual who maintains an account at the institution for the purpose of collecting past-due support. Information pertaining to requests by the state child support enforcement agencies for the placement of a lien or levy of such accounts may also be disclosed.</p>
<p>(4) Disclosure to Insurer to Collect Past-Due Support</p>
<p>Pursuant to 42 U.S.C. 652(l) (to be redesignated (m)), information pertaining to an individual owing past-due child support may be disclosed to an insurer (or its agent) to identify an individual with an insurance claim, settlement, award or payment for the purpose of collecting past-due support. </p>
<p>(5) Disclosure to Workers" Compensation Agencies to Collect Current and Past-Due Support</p>
<p>Pursuant to 42 U.S.C. 653(e)(1); 666(a)(1)(A), (b)(1) and (8), and (c)(1)(F) and (G), information pertaining to an individual owing past-due child support may be disclosed to a workers" compensation agency to identify an individual who is applying for or receiving periodic or lump-sum workers" compensation for the purpose of collecting current and past-due support.</p>
<p>(6) Disclosure of Treasury Information to State Child Support Enforcement Agency of Comparison Information for Assistance in Collecting Past-Due Support</p>
<p>Pursuant to 42 U.S.C. 664 and the Debt Collection Improvement Act 1996 (Pub. L. 104-134), the results of a comparison of information pertaining to an individual owing past-due child support and information maintained by the Secretary of Treasury pertaining to amounts payable to the individual for refunds of federal taxes; salary, wage and retirement benefits; vendor payments; expense reimbursement payments; or travel payments may be disclosed to a state  IV-D child support agency for the purpose of assisting state agencies in collecting past-due support.</p>
<p>(7) Disclosure of Financial Institution Information to State Child Support Enforcement Agency of Comparison Information for Assistance in Collecting Past-Due Support</p>
<p>Pursuant to 42 U.S.C. 652(l), the results of a comparison between information pertaining to an individual owing past-due child support and information provided by multistate financial institutions may be disclosed to a state child support enforcement agency for the purpose of assisting state agencies in collecting past-due support. Information pertaining to responses to requests by the state child support enforcement agencies for the placement of a lien or levy of such accounts may also be disclosed.</p>
<p>(8) Disclosure of Insurance Information to State Child Support Enforcement Agency for Assistance in Collecting Past-Due Support</p>
<p>Pursuant to 42 U.S.C. 652(l) (to be redesignated subsection (m)), the results of a comparison between information pertaining to an individual owing past-due child support and information maintained by an insurer (or its agent) concerning insurance claims, settlements, awards, and payments may be disclosed to a state IV-D child support enforcement agency for the purpose of assisting state agencies in collecting past-due support. </p>
<p>(9) Disclosure of Workers" Compensation Information to State Child Support Enforcement Agency for Assistance in Collecting Past-Due and Current Support</p>
<p>Pursuant to 42 U.S.C. 653(b)(1)(B), the results of a comparison between the information pertaining to an individual owing past-due child support and information maintained by a  workers" compensation agency concerning workers" compensation payments may be disclosed to a state IV-D child support enforcement agency for the purpose of assisting states in collecting past-due support and any current support owed by the individual.</p>
<p>(10) Disclosure of Income and Benefits Information to State Child Support Enforcement Agency for Assistance in Collecting Past-Due and Current Support</p>
<p>Pursuant to 42 U.S.C. 652(a)(7), 653(a)(2), 666(a)(4) and 666(c)(1)(G), the results of a comparison between the information pertaining to an individual owing past-due child support and income and benefits information of such individuals, including lump sum payment information, may be disclosed for the purpose of assisting states in collecting past-due support and any current support owed by the individual.</p>
<p>(11) Disclosure for Law Enforcement Purpose</p>
<p>Information may be disclosed to the appropriate federal, state, local, tribal, or foreign agency responsible for identifying, investigating, and prosecuting noncustodial parents who knowingly fail to pay their support obligations and meet the criteria for federal prosecution under 18 U.S.C. 228. The information must be relevant to the violation of criminal nonsupport, as stated in the Deadbeat Parents Punishment Act, 18 U.S.C. 228 and the disclosure must be compatible with the purpose for which the records were collected.</p>
<p>(12) Disclosure to Department of Justice or in Proceedings</p>
<p>Information may be disclosed to support the Department of Justice, or in a proceeding before a court, or adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
<p>HHS, or any component thereof; or</p>
<p> Any employee of HHS in his or her official capacity; or</p>
<p> Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
<p>The United States, </p>
<p>if HHS determines that litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the court or other adjudicative body is deemed by HHS to be relevant and necessary to the litigation; provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
<p>(13) Disclosure to Contractor to Perform Duties</p>
<p>Information may be disclosed to a contractor performing or working on a contract for HHS and who has a need to have access to the information in the performance of its duties or activities for HHS in accordance with law and with the contract. </p>
<p>(14) Disclosure to Congressional Office</p>
<p>Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual. </p>
<p>(15) Disclosure in the Event of a Security Breach</p>
<p>Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.   </p>
<p>Disclosure to consumer reporting agencies:</p>
<p>None. </p>
</xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p>
<p>Records in the Debtor File are stored electronically at the Social Security Administration"s National Computer Center. Historical logs and system backups are stored offsite at an alternate location.</p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p> Records maintained in the Debtor File are retrieved by the SSN or TIN of the individual to whom the record pertains; provided, however, that for the purpose of comparing information in the Debtor File with information provided by workers" compensation agencies or insurers (or their agents), records in the Debtor File may be retrieved by the name of the individual and either the date of birth or the address of the individual. For the purpose of collecting and disseminating information provided by state child support agencies and financial institutions, information is retrieved by the FEIN of the financial institution and the state FIPS code of the state child support agency and, where requested, by the state child support case identification number.</p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p> Specific administrative, technical and physical controls are in place to ensure that the records collected and maintained in the Debtor File are secure from unauthorized access. Access to the records is restricted to authorized personnel who are advised of the confidentiality of the records and the civil and criminal penalties for misuse and who sign a nondisclosure oath to that effect. Personnel are provided privacy and security training before being granted access to the records and annually thereafter. </p>
<p>Logical access controls are in place to limit access to the records to authorized personnel and to prevent browsing. The records are processed and stored in a secure environment. All records are stored in an area that is physically safe from access by unauthorized persons at all times.</p>
<p>Safeguards conform to the HHS Information Security Program, <i>http://www.hhs.gov/ocio/securityprivacy/index.html.</i></p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p> Records maintained in the Debtor File are retained until the IV-D child support case is in deleted status and there has been no activity on the case for seven years and are then deleted. Records pertaining to a financial institution or an insurer (or its agent) are retained for 60 days and are then deleted; provided, however, that after removal of personal identifiers, the results of a comparison may be retained for such period necessary to conduct analyses for the purpose of estimating potential collections of past-due support by state child support enforcement agencies and are then deleted. OCSE retains information furnished by workers" compensation agencies for only a period necessary to complete the processing of the file, not to exceed 60 days from the date OCSE received the file. A copy of response file records provided to state child support enforcement agencies is retained by OCSE for 60 days and is then deleted. A copy of records matched is retained by OCSE for the purpose of electronically filtering and suppressing the transmission of redundant information for one year and is then deleted.</p>
</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Director, Division of Federal Systems, Office of Automation and Program Operations, Office of Child Support Enforcement, Administration for Children and Families, Department of Health and Human Services, 370 L"Enfant Promenade, 4th Floor East, SW, Washington, DC 20447.</p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>Individuals seeking to determine whether this system of records contains information about them should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5    </p>
</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Individuals seeking access to a record about them in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5  </p>
</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed; (2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual"s record; (3) identify the information that the individual believes is not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5.</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>Information is obtained from departments, agencies, or instrumentalities of the United States or any state and from multistate financial institutions and insurers (or their agents).</p>
</xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.</p>
</xhtmlContent></subsection></section>
<section id="09-80-0385" toc="yes">
<systemNumber>09-80-0385</systemNumber>
<subsection type="systemName">OCSE Federal Case Registry of Child Support Orders (FCR), HHS/ACF/OCSE.</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>National Computer Center, Social Security Administration, Baltimore, Maryland; OCSE Data Facility, Manassas, Virginia</p>
</xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>Individuals involved in child support cases in which services are being provided by the state IV-D child support agencies, and/or individuals who are subject to child support orders established or modified on or after October 1, 1998, and the children of such individuals. Individuals whose information is collected and/or disseminated through the system, as part of authorized technical assistance or matching, including but not limited to individuals involved in a child and family services" program provided by the state IV-B agency, and individuals involved in a state IV-E foster care and adoption assistance program and programs administered by other authorized agencies and entities specified in the routine uses of records maintained in this system.    </p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>The FCR maintains, collects, and disseminates several categories of records. The FCR collects and maintains records provided by state child support registries. These records include abstracts of support orders and information from child support cases. The records may include the following information: name, Social Security number (SSN), state case identification number, state Federal Information Processing Standard (FIPS) code, county code, case type (cases in which services are being provided by the state child support agencies under Title IV-D of the Social Security Act and those cases in which services are not being provided by the state child support agencies), sex, date of birth, mother"s maiden name, father"s name, participant type (custodial party, non-custodial parent, putative father, child), family violence indicator (domestic violence or child abuse), order indicator, locate request type, and requested locate source. These records are maintained within the FCR and are regularly compared (matched) to the National Directory of New Hires (NDNH) and other federal agencies" databases to locate information for the state child support agencies or other authorized persons. </p>
<p>State child support agencies and other authorized persons can directly request information (referred to as locate requests) from the FPLS, which includes the FCR system of records, and the National Directory of New Hires system of records. The FPLS must seek the requested information from other federal agencies. When state child support agencies or other authorized persons request information from the FPLS, the request is transmitted to the FPLS via the FCR. Upon receipt of such requests, or as a result of the regular comparisons of the FCR with the NDNH and other agencies" databases, the records located pertaining to the requests are disseminated to the requestor via the FCR. The records collected and disseminated, depending upon the requestor"s specific authority, may include information retrieved from the FCR, from the NDNH, or from other federal or state agencies. Records from the NDNH and other agencies disseminated through the FCR may include categories of information such as name, SSN (or TIN), address, phone number, employer, employment status and wages, retirement status and pay, assets, military status and pay, federal benefits status and amount, representative payees, unemployment status and amount, children"s health insurance, incarceration status, financial institution accounts, assets, and date of death. The FCR also contains information related to those categories of records; for example, the date of receipt of federal benefits. </p>
<p>Additional categories of information include those contained in the following documents: judicial or administrative orders pertaining to child support and medical support; an administrative subpoena; an affidavit in support of establishing paternity; a financial statement; a medical support notice; a notice of a lien; and an income withholding notice.</p>
<p>The FCR also maintains: (1) records (logs) of transactions involving the receipt of requests and the dissemination of requested information; (2) copies of the disseminated information for audit purposes; and (3) copies of certain disseminated information for the purpose of electronically filtering and suppressing the transmission of redundant information.</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>42 U.S.C. 652(a)(7) and (9), 653(a)(1), (h), and (j)(3)  </p>
</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>The Office of Child Support Enforcement (OCSE) uses the FCR primarily to assist states in administering programs under 42 U.S.C. 651 to 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity) and programs funded under 42 U.S.C. 601 to 619  (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families). Additional purposes are specified in sections 453 and 463 of the Social Security Act. (42 U.S.C. 653, 663).</p>
</xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>These routine uses specify circumstances under which ACF may disclose information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.  </p>
<p>If any record contains a "family violence indicator" associated to the record by state child support agencies, if there is reasonable evidence of domestic violence or child abuse and disclosure could be harmful to the party or the child, the record may only be disclosed as determined by a court as provided in 42 U.S.C. 653(b)(2). </p>
<p>Any information defined as "return" or "return information" under 26 U.S.C. 6103 (Internal Revenue Code) will not be disclosed unless authorized by a statute, the Internal Revenue Service (IRS) or IRS regulations. </p>
<p>(1) Disclosure for Child Support Purposes</p>
<p>Pursuant to 42 U.S.C. 653(a)(2), 653(b)(1)(A), and 653(c), information about the location of an individual or information that would facilitate the discovery of the location of an individual may be disclosed, upon request filed in accordance with law, to an "authorized person," as defined in 42 U.S.C. 653(c), for the purpose of establishing parentage or establishing, setting the amount of, modifying or enforcing child support obligations. Information disclosed may include information about an individual"s wages (or other income) from, and benefits of, employment, and information on the type, status, location, and amount of any assets of, or debts owed by or to, the individual. </p>
<p>(2) Disclosure to any Department, Agency, or Instrumentality of the United States or of any State to Locate an Individual or Information Pertaining to an Individual</p>
<p>Pursuant to 42 U.S.C. 653(e)(1), information from the FCR (names and SSNs) may be disclosed to any department, agency, or instrumentality of the United States or of any state on order to obtain information for an "authorized person" as defined in 42 U.S.C. 653(c) which pertains to an individual"s location, wages (or other income) from, and benefits of, employment (including rights to or enrollment in group health care coverage); or the type, status, location, and amount of any assets of, or debts owed by or to, the individual.</p>
<p>(3) Disclosure for Purposes Related to the Unlawful Taking or Restraint of a Child or Child Custody or Visitation </p>
<p>Pursuant to 42 U.S.C. 653(b)(1)(A), upon request of an "authorized person," as defined in 42 U.S.C. 663(d)(2), or upon request of the Department of Justice, Office of Juvenile Justice and Delinquency Prevention, pursuant to 42 U.S.C. 663(f), information as to the most recent address and place of employment of a parent or child may be disclosed for the purpose of enforcing any state or federal law with respect to the unlawful taking or restraint of a child or making or enforcing a child custody or visitation determination. </p>
<p>(4) Disclosure to the Social Security Administration for Verification</p>
<p>Pursuant to 42 U.S.C. 653(j)(1), the names, SSNs, and birth dates of individuals about who information is maintained may be disclosed to the Social Security Administration to the extent necessary for verification of the information by the Social Security Administration.</p>
<p>(5) Disclosure for Locating an Individual for Paternity Establishment or in Connection with a Support Order</p>
<p>Pursuant to 42 U.S.C. 653(j)(2)(B), the results of a comparison between records in this system and the National Directory of New Hires may be disclosed to the state IV-D child support enforcement agency responsible for the case for the purpose of locating an individual in a paternity establishment case or a case involving the establishment, modification, or enforcement of a support order.</p>
<p>(6) Disclosure to State Agencies Operating Specified Programs </p>
<p>Pursuant to 42 U.S.C. 653(j)(3), information may be disclosed to a state to the extent and with the frequency that the Secretary determines to be effective in assisting the state to carry out its responsibilities under child support programs operated under 42 U.S.C. 651 through 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity), child and family services programs operated under 42 U.S.C. 621 through 629m (Title IV-B of the Social Security Act), Foster Care and Adoption Assistance programs operated under 42 U.S.C. 670 through 679c (Title IV-E of the Social Security Act) and assistance programs funded under 42 U.S.C. 601 through 619  (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families).</p>
<p>(7) Disclosure to Department of State under International Child Abduction Remedies Act</p>
<p>Pursuant to 42 U.S.C. 653(b)(1) and 663(e), the most recent address and place of employment of a parent or child may be disclosed upon request to the Department of State, in its capacity as the Central Authority designated in accordance with section 7 of the International Child Abduction Remedies Act, 42 U.S.C. 11601 et seq., for the purpose of locating the parent or child on behalf of an applicant. </p>
<p>(8) Disclosure to Secretary of the Treasury for Certain Tax Purposes</p>
<p>Pursuant to 42 U.S.C. 653(h)(3), information may be disclosed to the Secretary of Treasury for the purpose of administering sections of the Internal Revenue Code which grant tax benefits based on support or residence of children.</p>
<p>(9) Disclosure for Authorized Research Purposes</p>
<p>Pursuant to 42 U.S.C. 653(j)(5), data in the FCR may be disclosed, without personal identifiers, for research purposes found by the Secretary to be likely to contribute to achieving the purposes of 42 U.S.C. 651 through 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity) and 42 U.S.C. 601 through 619 (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families).</p>
<p>(10) Disclosure to a Foreign Reciprocating Country for Child Support Purposes </p>
<p>Pursuant to 42 U.S.C. 653(a)(2) and 659a(c)(2), information on the State of residence of an individual sought for support enforcement purposes in cases involving residents of the United States and residents of foreign countries that are the subject of a declaration may be disclosed to a foreign reciprocating country. </p>
<p>(11) Disclosure for Law Enforcement Purpose</p>
<p>Information may be disclosed to the appropriate federal, state, local, tribal, or foreign agency responsible for identifying, investigating, and prosecuting noncustodial parents who knowingly fail to pay their support obligations and meet the criteria for federal prosecution under 18 U.S.C. 228. The information must be relevant to the violation of criminal nonsupport, as stated in the Deadbeat Parents Punishment Act, 18 U.S.C. 228 and the disclosure must be compatible with the purpose for which the records were collected.</p>
<p>(12) Disclosure to Congressional Office</p>
<p>Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual. </p>
<p>(13) Disclosure to Department of Justice or in Proceedings</p>
<p>Information may be disclosed to support the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
<p> HHS, or any component thereof; or</p>
<p>Any employee of HHS in his or her official capacity; or</p>
<p>Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
<p>The United States, </p>
<p>if HHS determines that litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or HHS is deemed by HHS to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
<p>(14) Disclosure to Contractor to Perform Duties</p>
<p>Information may be disclosed to a contractor performing or working on a contract for HHS and who has a need to have access to the information in the performance of its duties or activities for HHS in accordance with law and with the contract. </p>
<p>(15) Disclosure in the Event of a Security Breach</p>
<p>Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance.    </p>
<p>(16) Disclosure to consumer reporting agencies: None.</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p>
<p>Records are stored electronically at the Social Security Administration"s National Computer Center and the OCSE Data Facility. Historical logs and system backups are stored offsite at an alternate location.</p>
</xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Records are retrieved by an identification number assigned to a child support case by the state child support enforcement agency, an SSN or TIN of an individual, a transaction serial number, or by a name and date of birth of an individual.</p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>Specific administrative, technical and physical controls are in place to ensure that the records collected and maintained in the FCR are secure from unauthorized access. Access to the records is restricted to authorized personnel who are advised of the confidentiality of the records and the civil and criminal penalties for misuse and who sign a nondisclosure oath to that effect. Personnel are provided privacy and security training before being granted access to the records and annually thereafter. Logical access controls are in place to limit access to the records to authorized personnel and to prevent browsing. The records are processed and stored in a secure environment. All record are stored in an area that is physically safe from access by unauthorized persons at all times.</p>
<p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>Records provided from state child support agencies. </p>
<p>Electronic records furnished by the state child support agency containing child support case and order information (input files) are retained for 60 days and then deleted. </p>
<p> State agency records (as posted to the FCR) remain within the FCR until removed, upon notification by the state agency that the case is closed, provided that, upon request, a sample may be retained for research purposes found by OCSE to be likely to contribute to achieving the purposes of child support programs or the TANF program, but without personal identifiers. </p>
<p>Records pertaining to closed cases are archived on the fiscal year basis and retained for two years. Family violence indicators are removed from the individual"s record, upon request by the state that initiated the indicator. </p>
<p>Locate requests and match results. </p>
<p>Locate requests submitted by state child support agencies and other authorized persons and match results are retained for 60 days and are then deleted. </p>
<p>Audit trail records of locate requests and disclosures of match results pursuant to those requests, which include indications of which federal agencies were contacted for locate information, whether information was located, and the type(s) of information returned to the requesting entity, are archived once a year based on the fiscal year. The records are retained for two completed fiscal years and then destroyed. These records indicate the type of information located for the authorized user, not the information itself.</p>
<p>Match results generated as a result of FCR-to-FCR comparisons which locate individuals who are participants in child support cases or orders in more than one state are transmitted to the relevant states. Copies of FCR-to-FCR match results are retained for 60 days and then deleted. </p>
<p>Any record relating or potentially relating to a fraud or abuse investigation or a pending or ongoing legal action, including a class action, is retained until conclusion of the investigation or legal action. </p>
<p>Copies of the FCR records transmitted to the Secretary of the Treasury for the purpose of administering sections of the Internal Revenue Code which grant tax benefits based on support or residence of children (routine use 8) are retained for one year and then deleted. </p>
<p>Records collected or disseminated for technical assistance to child support agencies or other authorized agencies or entities are retained for 60 days to five years, and audit data is retained for a period of up to two years.</p>
</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Director, Division of Federal Systems, Office of Automation and Program Operations, Office of Child Support Enforcement, Administration for Children and Families, Department of Health and Human Services, 370 L'Enfant Promenade, SW, 4th Floor East, Washington, DC 20447.</p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>Individuals seeking to determine whether this system of records contains information about them should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed by the individual to whom such information pertains. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5.   </p>
</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Individuals seeking access to a record about them in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed by the individual to whom such information pertains. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5. </p>
</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Individuals seeking to amend a record about them in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, SSN, and address of the individual, and should be signed by the individual to whom such information pertains; </p>
<p>(2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual"s record; (3) identify the information that the individual believes is not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5.</p>
</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>Records maintained within the FCR are furnished by state child support enforcement agencies. Records disseminated from the FCR for the purpose of providing locate information from the NDNH and other federal agencies are furnished by departments, agencies, or instrumentalities of the United States or any state, employers, financial institutions, and insurers or their agents. </p>
</xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>A rulemaking is pending publication to add this system to the list of exempt systems in HHS regulations implementing the Privacy Act (45 CFR 5b, at " 5b.11), and that exemption will be effective upon publication of a Final Rule. The Final Rule will, pursuant to 5 U.S.C. 552a(k)(5), exempt the portions of this system consisting of investigatory material compiled for law enforcement purposes from the requirements in subsections (c)(3) and (d) of the Privacy Act (5 U.S.C. 552a(c)(3) and (d)), subject to the limitations set forth in subsection (k)(5) and to the limitation in 42 U.S.C. 653(b)(2). </p>
<p>Case files marked with the Family Violence Indicator (FVI) (i.e., indicating there is reasonable evidence of domestic violence or child abuse) are de facto exempt from the Privacy Act"s notification, access and accounting requirements, by virtue of the statutory prohibitions in " 653(b)(2) of the Social Security Act (42 U.S.C. 653(b)(2)). Section 653(b)(2) prohibits disclosure of case files marked with the FVI to anyone other than a court or an agent of the court pursuant to section 653(b)(2)(B), to avoid harm to the custodial parent or the child of such parent. </p>
</xhtmlContent></subsection></section>

<section id="09-80-0387" toc="yes">
<systemNumber>09-80-0387</systemNumber>
<subsection type="systemName">Federal Parent Locator Service Child Support Services Portal, HHS/ACF/OCSE.</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified </p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>OCSE Data Facility, Manassas, Virginia.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>OCSE employees and contractors, and employees of states, financial institutions, insurance companies, federal agencies and other employers who have registered to access the system and its services for the purpose(s) of exchanging information to support electronic income withholding orders process (also referred to as e-IWO), to identify financial holdings, to locate parents or other responsible parties, to intercept tax refunds and administrative payments or to deny or reinstate a U.S. passport for a noncustodial parent owing past-due child support. </p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>Information relating to registration requests by individuals seeking access to the portal and its services, including the individual"s name, Social Security number (SSN), date of birth, and the address and Federal Employer Identification Number (FEIN) of the individual"s employer. </p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>42 U.S.C. 652(a)(7) and (9) and 653(a)(1)</p>
</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>To validate eligibility for, and maintain an official registry file that identifies individuals and organizations, including third-parties conducting business on behalf of another business or organization that apply for and are granted access privileges to the FPLS Child Support Services Portal and its services.</p>
</xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>These routine uses specify circumstances under which ACF may disclose information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.  </p>
<p>Any information defined as "return" or "return information" under 26 U.S.C. 6103 (Internal Revenue Code) will not be disclosed unless authorized by a statute, the Internal Revenue Service (IRS), or IRS regulations.</p>
<p>(1) Disclosure to Department of Justice or in Proceedings</p>
<p>Records may be disclosed to support the Department of Justice, or in proceedings before a court, or adjudicative body, or other administrative body before which HHS is authorized to appear, when:</p>
<p>HHS, or any component thereof; or</p>
<p>2. Any employee of HHS in his or her official capacity; or</p>
<p>3. Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or</p>
<p>4. The United States,</p>
<p>is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or court or adjudicative body is deemed by HHS to be relevant and necessary to the litigation; provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.</p>
<p>(2) Disclosure to Congressional Office</p>
<p>Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual. </p>
<p>(3) Disclosure to Contractor to Perform Duties</p>
<p>Records may be disclosed to a contractor performing or working on a contract for HHS and who has a need to have access to the information in the performance of its duties or activities for HHS in accordance with law and with the contract. </p>
<p>(4) Disclosure in the Event of a Security Breach</p>
<p>Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, provided the information disclosed is relevant and necessary for that assistance. </p>
<p>(5) Disclosure to consumer reporting agencies: None.</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p>
<p>Records in the system are stored electronically at the OCSE Data Facility. </p>
</xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Records are retrieved by the Social Security Number of the individual to whom the record pertains.</p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>Specific administrative, technical, and physical controls are in place to ensure that the records collected and maintained in the FPLS Child Support Services Portal are secure from unauthorized access. Access to the records is restricted to authorized personnel who are advised of the confidentiality of the records and the civil and criminal penalties for misuse and who sign a nondisclosure oath to that effect. Personnel are provided privacy and security training before being granted access to the records and annually thereafter. Logical access controls are in place to limit access to the records to authorized personnel and to prevent browsing. The records are processed and stored in a secure environment. The individual"s SSN is encrypted, and access to, and viewing of, the SSN is restricted to designated employees and contractors of OCSE solely for the purpose of verifying the identity of a registrant or a user of the portal. All records are stored in an area that is physically safe from access by unauthorized persons at all times.</p>
<p>Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p> Electronic records are deleted when/if OCSE determines that the records are no longer needed for administrative, audit, legal, or operational purposes, and in accordance with records schedules approved by the National Archives and Records Administration. Approved disposal methods for electronic records and media include overwriting, degaussing, erasing, disintegration, pulverization, burning, melting, incineration, shredding, or sanding.  </p>
</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Director, Division of Federal Systems, Office of Automation and Program Operations, Office of Child Support Enforcement, Administration for Children and Families, 370 L"Enfant Promenade, SW, 4th Floor East, Washington, DC 20447.</p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, SSN, and address of the individual, and the request must be signed. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5.   </p>
</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Individuals seeking access to a record about them in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, Social Security number (SSN), and address of the individual, and should be signed by the individual to whom such information pertains. The requester"s letter must provide sufficient particulars to enable the System Manager to distinguish between records on subject individuals with the same name. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5  </p>
</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Individuals seeking to amend a record about them in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, Social Security number (SSN), and address of the individual, and should be signed by the individual to whom such information pertains; (2) identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual"s record; (3) identify the information that the individual believes is not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in HHS"s Privacy Act regulations may be required. 45 CFR 5b.5</p>
</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>Information is obtained from individuals and organizations, including third-parties conducting business on behalf of a business or organization, that apply for access privileges to the FPLS Child Support Services Portal and its services.</p>
</xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.
<section id="09-80-0388" toc="yes"> <systemNumber>09-80-0388</systemNumber> 
<subsection type="systemName">ORR Refugee Suicide Database</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified.</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>Datacenter for Administration for Children and Families (ACF), Department of Health and Human Services (HHS), Mary E. Switzer Building, 330 C. Street, SW, Washington, DC.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>Records pertain to individuals in ORR populations reported as unsuccessfully attempting a suicide in the United States.  ORR populations include refugees, asylees, Cuban/Haitian entrants, Afghan and Iraqi Special Immigrants, certain Amerasians, and victims of human trafficking.</p>
<p>The Privacy Act applies only to U.S. persons (citizens of the United States or aliens lawfully admitted for permanent residence in the United States). As a matter of discretion, ORR will treat information that it maintains in its mixed systems of records as being subject to the provisions of the Privacy Act, regardless of whether or not the information relates to U.S. persons covered by the Privacy Act. This implements a 1975 Office of Management and Budget (OMB) recommendation to apply, as a matter of policy, the administrative provisions of the Privacy Act to records about non-U.S. persons in mixed systems of records (referred to as the non-U.S. persons policy).</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>Records consist of data reported by states and other resettlement organizations, using the Refugee Suicide and Self-Harm Report Form, which ORR enters into spreadsheets.  The records may include the following information about the individual who attempted suicide: alien number; country of origin; age; gender; residence (city/county, state); estimated length of time in the U.S.; date of suicide attempt; outcome of suicide attempt; household members (type of relationship); ORR population type; current immigration status; marital/relationship status; employment status at time of suicide attempt; health insurance status; English proficiency; religion; method of suicide attempted; place of occurrence; contributing factors; and mental health concerns.</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>Section 412(b)(4) of the Immigration and Nationality Act (8 U.S.C. 1522(b)(4))</p>
</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>ORR will use records in the Refugee Suicide Database to identify trends and factors related to suicidal behavior among ORR populations. Additionally, ORR will use the records to plan, implement, and evaluate suicide prevention and intervention activities, in collaboration with local, state, and national government agencies and organizations serving the refugee population.</p>
</xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>These routine uses specify circumstances under which ACF may disclose information from this system of records without the prior written consent of the data subject.  Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.</p>
<p>1. Disclosure to Government Agencies and Organizations Assisting the Refugee Population. Information will be shared with local, state, and national government agencies and organizations serving the refugee population, for the purpose of collaborating with them to plan, implement, and evaluate suicide prevention and intervention activities.</p>
<p>2. Disclosure to Contractors, Grantees, and Others. Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or memorandum of understanding, or other activity for HHS related to the purposes of the system, and who have a need to have access to the information in the performance of their duties or activities for HHS.</p>
<p>3. Disclosure in the Event of a Security Breach. Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.</p>
<p>4. Disclosure for Cybersecurity Monitoring Purposes.  Records may be disclosed to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.</p>
<p>Information may also be disclosed from this system of records to parties outside HHS for any of the uses authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(11).</p>
<p>Disclosures to Consumer Reporting Agencies:</p>
<p>None.</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p>
<p> Records are stored in an electronic database on a computer network.</p>
</xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Records are retrieved by alien number.</p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>Information in this system is safeguarded in accordance with applicable laws, rules and policies. Records are protected from unauthorized access through appropriate administrative, physical, and technical safeguards.  Access to the records is restricted to authorized personnel (a limited number of employees in ORR with access to the database, and a limited number of employees in other HHS offices, e.g., CDC and SAMHSA, receiving data from ORR) who are advised of the confidentiality of the records and the civil and criminal penalties for misuse.  Personnel with authorized access to the system are provided privacy and security training for electronically stored information.  The records are processed and stored in a secure environment. All records are stored in an area that is physically safe from access by unauthorized persons at all times.  Safeguards conform to the HHS Information Security Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>The records will be retained indefinitely pending scheduling with the National Archives and Records Administration (NARA).  Because the records will have continuing value for epidemiological purposes, the retention period proposed to NARA may be 100 years or longer.</p>
</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Director, Division of Refugee Health, Office of Refugee Resettlement, Administration for Children and Families, Mary E. Switzer Building, 330 C. Street, SW, Washington, DC 20201.</p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>Individuals seeking to determine whether this system of records contains information about them should address written inquiries to the System Manager. The request should include the alien number, age, telephone number, and/or email address of the individual data subject. The request must be signed by the requester. Verification of identity as described in the Department’s Privacy Act regulations may be required (see 45 CFR § 5b.5).  If the individual data subject is a minor or is legally incompetent, the individual’s legal representative (parent or court-appointed guardian) may request notification on the individual’s behalf.  The representative must provide verification of identity and competent evidence of the parent or guardian relationship.</p>
</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Individuals seeking access to a record about them in this system of records should address written inquiries to the System Manager. The request should include the alien number, age, telephone number, and/or email address of the individual. The request must be signed by the individual to whom such information pertains. Verification of identity as described in the Department’s Privacy Act regulations may be required (see 45 CFR § 5b.5).  If the individual data subject is a minor or is legally incompetent, the individual’s legal representative (parent or court-appointed guardian) may request access on the individual’s behalf.  The representative must provide verification of identity and competent evidence of the parent or guardian relationship.</p>
</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Individuals seeking to amend a record about them in this system of records should address the request for amendment to the System Manager. The request should:</p>
<p>&#8226;•include the alien number, age, telephone number, and/or email address of the individual, and should be signed by the individual to whom such information pertains;</p>
<p>&#8226;•identify the system of records that the individual believes includes his or her records or otherwise provide enough information to enable the identification of the individual’s record;</p>
<p>&#8226;•identify the information that the individual believes is not accurate, relevant, timely or complete;</p>
<p>&#8226;•indicate what corrective action is sought; and</p>
<p>&#8226;•include supporting justification or documentation for the requested amendment.</p>
<p>Verification of identity as described in the Department’s Privacy Act regulations may be required (see 45 CFR § 5b.5).  If the individual data subject is a minor or is legally incompetent, the individual’s legal representative (parent or court-appointed guardian) may make an amendment request on the individual’s behalf.  The representative must provide verification of identity and competent evidence of the parent or guardian relationship.</p>
</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>The information maintained in the system is provided by states and other resettlement organizations when they report a suicide attempt using the Refugee Suicide and Report Form.  The State Refugee Coordinator and State Refugee Health Coordinator will be primarily responsible for reporting this information.  They will collect the information from various sources within the state including refugee resettlement agencies, public health departments, ethnic-based community organizations, and refugee community leaders.</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.</p></xhtmlContent></subsection></section>

</p></xhtmlContent></subsection> </section>
<section id="09-80-0390" toc="yes">
<systemNumber>09-80-0390</systemNumber>
<subsection type="systemName">Administration for Children and Families' National Responsible Fatherhood Pledge Campaign (NRFPC).</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Administration for Children and Families, Office of Family Assistance, 370 L'Enfant Promenade, W., 5th Floor East, Washington, DC 20447.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Parties who voluntarily complete and submit the NRFPC pledge card through the National Responsible Fatherhood Clearinghouse, part of the Administration for Children and Families (ACF).
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Name, Mobile Phone Number, E-mail address, City, State, Zip Code.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Legal authority for maintenance of the system is provided by section 403(a)(2)(C) of the Social Security Act, 42 U.S.C. 603(a)(2)(C).
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
 <p>As authorized by the Social Security Act, and in response to President Barack Obama's call for a national conversation on responsible fatherhood and healthy families, parties will pledge to renew their commitment to family and community and recognize the positive impact that responsible adults can have on our children and youth. By taking the President's Pledge on Responsible Fatherhood, parties commit to do all they can in providing children in their homes and communities the encouragement and support they need to fulfill their potential. In support of this objective, pledge cards will be available on the National Responsible Fatherhood Clearinghouse website and in print formats. The voluntarily provided data elements from these pledge cards will assist the Administration for Children and Families and the White House Office of Faith-Based and Neighborhood Partnerships to provide supporting parties with information to promote a national discourse on responsible fatherhood and healthy families.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which ACF may release information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.
</p> <p>(1) Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.
</p> <p>(2) Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the request of the individual.
</p> <p>(3) Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:
</p><p>1. The Agency, or any component thereof; or
</p><p>2. Any employee of the Agency in his or her official capacity; or
</p><p>3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency has agreed to represent the employee; or
</p><p>4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation; provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.
</p> <p>(4) Information may be disclosed to the National Archives and Records Administration in records management inspections.
</p> <p>(5) Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for the Agency and who have a need to have access to the information in the performance of their duties or activities for the Agency.
</p> <p>(6) Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C 552a(b)(11).
</p> <p>(7) Information from this system of records may be disclosed to the White House Office of Faith-Based and Neighborhood Partnerships for the purposes of outreach, communication and information dissemination related to the promotion of responsible fatherhood and healthy families activities, as described by the Social Security Act, at 42 U.S.C. 603(a)(2)(C)(ii)(IV).
</p> <p>(8) Information from this system of records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p> <p>Disclosure to consumer reporting agencies:
</p><p>None.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Records are stored on a computer network.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records can be accessed by name and/or location (area code, city, state, zip code).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Safeguards conform to the HHS Information Security Program, described at  <i>http://www.hhs.gov/ocio/securityprivacy/index.html.</i> </p></xhtmlContent></subsection> <subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be retained by ACF until the termination or transfer of the National Responsible Fatherhood Clearinghouse. Hard copies of collected pledge cards will be shredded upon entry into the NRFPC database.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Technical Assistance Branch Chief, Office of Family Assistance, Administration for Children and Families, 370 L'Enfant Promenade, SW., 5th Floor East, Washington, DC 20447.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, and address of the individual, and the request must be signed. Verification of identity as described in the Department's Privacy Act regulations may be required. 45 CFR 5b.5. The requestor's letter must also provide sufficient particulars to enable ACF to distinguish between records on subject individuals with the same name.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Individuals seeking access to a record about themselves in this system of records should address written inquiries to the System Manager. The request should include the name, telephone number and/or email address, and address of the individual, and should be signed. Verification of identity as described in the Department's Privacy Act regulations may be required. 45 CFR 5b.5. The requestor's letter must also provide sufficient particulars to enable ACF to distinguish between records on subject individuals with the same name.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Individuals seeking to amend a record about themselves in this system of records should address the request for amendment to the System Manager. The request should (1) include the name, telephone number and/or email address, and address of the individual, and should be signed; (2) provide the name or other information about the project that the individual believes contains his or her records; (3) identify the information that the individual believes is not accurate, relevant, timely, or complete; (4) indicate what corrective action is sought; and (5) include supporting justification or documentation for the requested amendment. Verification of identity as described in the Department's Privacy Act regulations may be required. 45 CFR 5b.5.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The record subjects are the source for the records that will be collected and contained in the system.
</p></xhtmlContent></subsection>
 <subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-15-0003" toc="yes">
<systemNumber>09-15-0003</systemNumber>
<subsection type="systemName">Contract Physicians and Consultants, HHS/HRSA/BPHC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>National Hansen's Disease Program, 1770 Physician's Park Drive, Baton Rouge, Louisiana 70816.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Medical and allied health professionals (<i>e.g.</i>, physicians, nurses, physical therapists, and dentists) who have contracted with the National Hansen's Disease Program to provide services to beneficiaries.</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Duplicate of original contract and personal data qualifications. Original contracts developed by the National Hansen's Disease Program.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 320 of the Public Health Service Act, as amended (42 U.S.C. 247e), the National Hansen's Disease Program; section 321 of the Public Health Service Act, as amended (42 U.S.C. 248), Control and Management of Hospitals; and section 326 of the Public Health Service Act, as amended (42 U.S.C. 253), Medical services to Coast Guard, National Oceanic and Atmospheric Administration, and the Public Health Service.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To monitor contract negotiations and compliance, to review credentials, and to collect statistical data required to manage the program.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>2. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal, State or local, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>3. Where a contract between a component of the Department and a labor organization recognized under E.O. 11491 provides that the agency will disclose personal records relevant to the organization's mission, records in this system of records may be disclosed to such organization.
</p> <p>4. The Department may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) Any HHS employee in his or her official capacity; or (c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>5. Disclosure may be made to State Boards of Medical Examiners and to equivalent State licensing boards of professional review actions which adversely affect the clinical privileges of health care professionals who either:
</p><p>1. Are or were employed by the Federal Government;
</p><p>2. Provide or have provided health care service under a fee-for-service contract with the Federal Government; or
</p><p>3. Provide or have provided health care services on behalf of the Federal Government as a volunteer or as a visiting fellow.
</p> <p>Boards of Medical Examiners and equivalent State licensing boards are required by the Health Care Quality Improvement Act of 1986 and by the Medicare and Medicaid Patient and Program Protection Act of 1987 to report this information to the National Practitioner Data Bank.
</p> <p>6. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>&#149; Storage: File folders.
</p> <p>&#149; Retrievability: Name and contract number.
</p> <p>&#149; Safeguards:
</p><p>1. Authorized Users: HHS medical and financial management staff and contracting personnel.
</p> <p>2. Physical Safeguards: All documents are protected during lunch hours and nonworking hours in locked file cabinets or locked storage areas.
</p> <p>3. Procedural Safeguards: All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office. Access to records is strictly limited to those staff members trained in accordance with DHHS Chapter 45-13 and Chapter PHS.hf: 45-13 of the General Administration Manual.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Duplicate contracts: Held 1-3 years dependent upon renewal. Destroyed per authority General Records Schedule 5 and 7.
</p><p>ORIGINAL CONTRACTS:  1. Transactions of more than 10,000: Destroy 6 years and 3 months after final payment.
</p> <p>2. Transactions of 10,000 or less: Destroy 3 years after final payment.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Contracting Officer, National Hansen's Disease Program, 1770 Physician's Park Drive, Baton Rouge, Louisiana 70816.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the address above. The individual must provide positive identification, such as driver's license, passport, voter registration card, or written certification verifying his or her identity. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the System Manager at the address specified above, and reasonably identify the record, specify the information to be contested, and state the corrective action sought, with supporting justification.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Medical, allied health professionals and dentists.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>

<section id="09-15-0007" toc="yes">
<systemNumber>09-15-0007</systemNumber>
<subsection type="systemName">Patients Medical Record System Public Health Service Hospitals, HHS/HRSA/BPHC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p><i>See</i> Appendices 1 and 2. A list of sites where individually identifiable data is currently located is available upon request to the System Manager.
</p> <p>Appendix 1
</p><p>A. Public Health Service Facilities: Director, Public Health Service Health Data Center, 1770 Physicians Park Drive, Baton Rouge, Louisiana 70816.
</p> <p>B. Successor Organizations: Director, Johns Hopkins Medical Service, 3100
</p><p>Wyman Park Drive, Baltimore, Maryland  21211. Administrator, Lutheran Medical Center, 2609 Franklin Boulevard, Cleveland, Ohio 44114. Administrator, Martins Point Health Center, 331 Veranda Street, Portland, Maine 04103. Director, Pacific Medical Center, 1200 12th Avenue South, Seattle, Washington 98144.
</p> <p>Appendix 2--Federal Records Centers
</p><p>&#149; Area served: Buffalo, New York OutPatient Clinic, San Juan, and Staten Island. Central Plains Federal Records Center, 200 Space Center Drive, Lee's Summit, Missouri 64064-1182.
</p> <p>&#149; Area served: Chicago and Detroit. Federal Records Center, 7358 S. Pulaski Road, Chicago, Illinois 60629-5898.
</p> <p>&#149; Area served: Cincinnati and Detroit. Federal Records Center, 3150 Springboro Road, Dayton, Ohio 45439-1883.
</p> <p>&#149; Area served: Atlanta, Charleston, Jacksonville, Memphis, Miami, Mobile, Savannah and Tampa. Federal Records Center, 4712 Southpark Boulevard, Ellenwood, Georgia 30294.
</p> <p>&#149; Area served: 090 section of Houston, New Orleans, Galveston and Nassau Bay. Federal Records Center, P.O. Box 6216, Fort Worth, Texas 76115.
</p> <p>&#149; Area served: 512 section of Houston, New Orleans, Galveston/Nassau Bay. Federal Records Center, 17501 W. 98th Street, Suite 47 -48, Lenexa, Kansas 66219.
</p> <p>&#149; Area served: San Diego and San Pedro. Federal Records Center, P.O. Box 6719, 23123 Cajalco Road, Perris, California 92570 -7298.
</p> <p>&#149; Area served: Philadelphia and Pittsburg. Federal Records Center, 14700 Townsend Road, Philadelphia, Pennsylvania 19154- 1096.
</p> <p>&#149; Area served: San Francisco and Honolulu. Federal Records Center, 1000 Commodore Drive, San Bruno, California 94066-2350.
</p> <p>&#149; Area served: Honolulu and Portland, Oregon. Federal Records Center, 6125 Sand Point Way, NE., Seattle, Washington 98115- 7999.
</p> <p>&#149; Area served: Buffalo, DC, Norfolk, Port Arthur, St. Louis Space Park Memorial, Seattle, New Orleans, Tampa, San Francisco, Galveston, Seattle and Maryland. Washington National Records Center, 4205 Suitland Road, Suitland, Maryland 20746.
</p> <p>&#149; Area served: Boston, Maine, Massachusetts, Kentucky and Indiana. Federal Records Center, 380 Trapelo Road, Waltham, Massachusetts 02154-6399.
</p> <p>&#149; Area served: Individuals with Hansen's disease, examined and/or treated at the National Hansen's Disease Program (formerly Public Health Service Hospital), National Hansen's Disease Programs, 1770 Physician's Park Drive, Baton Rouge, Louisiana 70816.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Uniformed and non-uniformed individuals treated as inpatients in Public Health Service Hospitals.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Medical examination, diagnostic and treatment data; information for proof of eligibility; social data such as address and birth date; disease registers, such as Hansen's disease and tumor and surgical procedure registers; treatment logs, medical summaries and correspondence (for example, family to doctor, doctor to doctor, doctor to clinic).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 320 of the Public Health Service Act, as amended (42 U.S.C. 247e), the National Hansen's Disease Program; and section 326 of the Public Health Service Act, as amended (42 U.S.C. 253), Medical Services to Coast Guard, National Oceanic and Atmospheric Administration, and Public Health Service.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purposes of this system are:
</p><p>1. To serve as a basis for planning patient care and for continuity in the evaluation of the patient's condition and treatment to furnish documentary evidence of the course of the patient's medical evaluation, treatment and change in condition during the hospital stay, ambulatory care or emergency visit, or while being followed in a facility-based home care program;
</p><p>2. To document communications between the responsible practitioner and any other health professional's contribution to the patient's care and treatment in order to assist in protecting the legal interests of the patient, the hospital or clinic, and responsible practitioners;
</p><p>3. To provide data for use in facility management, continuing education, Department initiatives, quality assurance activities and research at the National Hansen's Disease Program, Baton Rouge, Louisiana.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to:
</p><p>1. Any community health organization, government agency, private physician and/or company which has requested or arranged for an examination, treatment or care of an individual.
</p> <p>2. Army, Navy, Air Force to report results of examination or treatment of their uniformed service personnel.
</p> <p>3. Department of Transportation to report results of examination/treatment of their uniformed services personnel found to be suffering from conditions that render them hazardous to themselves or to others.
</p> <p>4. Department of Commerce to report results of examination/treatment of uniformed services and other personnel of that agency.
</p> <p>5. Immigration and Customs Enforcements (ICE) to report results of examination/treatment of aliens examined and treated for and in behalf of that agency.
</p> <p>6. U.S. Department of Labor, Office of Workers' Compensation Programs for persons claiming compensation benefits due to personal injury while employed by the Government.
</p> <p>7. Organizations such as Joint Commission on Accreditation of Hospitals for accreditation of hospitals and clinics, and American Medical Association for accreditation of resident training programs. Medical records are used to document quality of service by health care providers.
</p> <p>8. Health professions students serving an affiliation at the institution and their parent education program; students provide patient care and use medical records in performance of their duties.
</p> <p>9. Non-agency physicians providing continuing care to current and former Public Health Service Beneficiaries, laboratories performing tests for the continuing care of these patients, and successor organizations providing health care in former Public Health Service hospitals and clinics.
</p> <p>10. Veterans Administration to assist uniformed service personnel, retirees and veterans to obtain medical care or benefits.
</p> <p>11. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>12. A record may be disclosed for a research purpose, when the Department: (a) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (b) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (c) has required the recipient to--(1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, and (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except--(A) in emergency circumstances affecting the health or safety of any individual, (B) for use in another research project, under these same conditions, and with written authorization of the Department, (C) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (D) when required by law; (d) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
</p> <p>13. Organizations deemed qualified by the Secretary to carry out quality assessment, medical audits or utilization review.
</p> <p>14. Information regarding the commission of crimes or the reporting or occurrence of communicable diseases, tumors, child abuse, births, deaths, alcohol or drug abuse, etc. as may be required by health providers and facilities, by state law, or regulation of the department of health or other agency of the state or its subdivision in which the facility is located. Disclosure may be made to organizations as specified by the state law or regulation such as birth and deaths to vital statistics agencies and crimes to law enforcement agencies. Disclosure of the contents of records which pertain to patient identity, diagnosis, prognosis or treatment of alcohol or drug abuse is restricted under the provisions of the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations 42 CFR part 2 as authorized by 21 U.S.C. 1175 and 42 U.S.C. 4582, as amended by Public Law 93-283. To the extent possible, identical restrictions are applied to the disclosure of the contents of records pertaining to individuals with other programs who are participating in employee counseling programs.
</p> <p>15. In the event of litigation where the defendant is
</p><p>a. The Department, any component of the Department, or any employee of the Department in his or her official capacity;
</p><p>b. The United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or
</p><p>c. Any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual. Disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>16. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>&#149; Storage: File folders, magnetic tape, disk or laser optical media, punch cards, and microfilm.
</p> <p>&#149; Retrievability: Indexed by name, register number, number control register, disease and operation, and uniformed services service number (which is the Social Security number (SSN)). Those records indexed by SSN are retrieved in accordance with section 7(a)(2)(B) of the Privacy Act.
</p> <p>&#149; Safeguards:
</p><p>1. Authorized Users: Health care practitioners, and other allied health personnel, medical and allied health students and administrative personnel for determination of eligibility for care and facility management; qualified research personnel with approved protocol; Public Health Service Commissioned Personnel Operations Division; and Public Health Service Claims Officer.
</p> <p>2. Physical Safeguards: Magnetic tapes, discs, other computer equipment and other forms of personal data are stored in areas where fire and life safety codes are strictly enforced. All documents are protected during lunch hours and nonworking hours in locked file cabinets in double-locked storage areas.
</p> <p>3. Procedural Safeguards: A password is required to access the terminal and a data set name controls the release of data only to authorized users. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office. Access to records is strictly limited to those staff members trained in accordance with Privacy Act safeguards. The contractor is required to maintain confidentiality safeguards with respect to these records. These safeguards are in accordance with DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual, and Part 6 of the DHHS Information Resources Management Manual. The Memorandums of Agreement between the successor organizations and the Public Health Service require the successor organizations to comply with the Privacy Act. Public Health Service and HHS guidelines have been provided to each successor organization.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>1. Former Public Health Service Hospitals/Clinics: Destroyed 50 years after date of last treatment, inactive medical records for active duty uniformed service personnel and non-uniformed service personnel.
</p> <p>2. National Hansen's Disease Program: Retained at facility--not transferred to a Federal Records Center. Destroyed, as appropriate, after 50 years, or when no longer needed for research purposes, as determined by the project leader or principal investigator.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Public Health Service Health Data Center, National Hansen's Disease Program, 1770 Physician's Park Drive, Baton Rouge, Louisiana 70816.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine the existence of a record, write to: Public Health Service Health Data Center,  National Hansen's Disease Program, 1770 Physician's Park Drive, Baton Rouge, Louisiana 70816.
</p> <p>If requesting records by mail, a written certification verifying identity must be provided. If appearing in person at the National Hansen's Disease Program, Baton Rouge, Louisiana, positive identification such as a driver's license, passport, or voter's registration card must be provided. An individual who requests access to a medical/dental record shall designate in writing, at the time the request is made, a responsible representative who will be willing to review the record and inform the subject individual of its contents. Finally, a parent or guardian who requests notification of access to a child's/incompetent person's record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child/incompetent person as well as his/her own identity.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified in the notification procedures above, and reasonably identify the record, specify the information to be contested, and state the corrective action sought, with supporting justification.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual, health care personnel, other hospitals and physicians, employers, social agencies, maritime unions, shipping companies.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p>
<p><i>Appendix 1 </i></p><p>A. Public Health Service Facilities
</p><p>Director, Gillis W. Long Hansen's Disease Center, Carville, Louisiana 70721.
</p> <p>Director, Public Health Service Health Data Center, Gillis W. Long Hansen's Disease Center, Carville, Louisiana 70721.
</p> <p>B. Successor Organizations
</p><p>Director, John Hopkins Medical Service, 3100 Wyman Park Drive, Baltimore, MD 21211.
</p> <p>Director, Brighton Marine Public Health Center, 77 Warren Street, Boston, MA 02135.
</p> <p>Administrator, Lutheran Medical Center, 2609 Franklin Blvd., Cleveland, OH 44114.
</p> <p>Director, Hospital of St. John, 2050 Space Park Drive, Nassau Bay, TX 77058.
</p> <p>Administrator, Martins Point Health Center, 331 Veranda Street, Portland, ME 04103.
</p> <p>Officer-in-Charge, U.S. Army St. Louis Outpatient Clinic, 1520 Market Street, St. Louis, MO 63103.
</p> <p>Director, Pacific Medical Center, 1200 12th Avenue South, Seattle, WA 98144.
</p> <p>Director, Bayley Seton Hospital, Bay Street and Vanderbilt Avenue, Staten Island, NY 10304.</p>
<p><i>Appendix 2--Federal Records Centers </i></p><p>Areas Served
</p><p>Maine, Vermont, New Hampshire, Massachusetts, Connecticut, and Rhode Island:
</p><p>Federal Archives &amp; Records Center, 380 Trapelo Road, Waltham, Massachusetts 02154.
</p> <p>New York, New Jersey, Puerto Rico, the Virgin Islands, and the Panama Canal Zone:
</p><p>Federal Archives &amp; Records Center, Military Ocean Terminal, Bldg. 22, Bayonne, NJ 07002.
</p> <p>Delaware and Pennsylvania east of Lancaster:
</p><p>Federal Archives and Records Center, 5000 Wissahickon Avenue, Philadelphia, PA 19144.
</p> <p>District of Columbia, Maryland, Virginia, and West Virginia:
</p><p>Washington National Records Center, Washington, DC 20409.
</p> <p>North Carolina, South Carolina, Tennessee, Mississippi, Alabama, Georgia, Florida and Kentucky:
</p><p>Federal Archives &amp; Records Center, GSA, 1557 St. Joseph Avenue, East Point, GA 30344.
</p> <p>Illinois, Wisconsin and Minnesota:
</p><p>Federal Archives and Records Center, GSA, 7358 South Pulaski Road, Chicago, IL 60629.
</p> <p>Indiana, Michigan, and Ohio:
</p><p>Federal Records Center, 3150 Springboro Road, Dayton, Ohio 45439.
</p> <p>Greater St. Louis Area:
</p><p>National Personnel Records Center, (Civilian Personnel Records), 111 Winnebago Street, St. Louis, MO 63118.
</p> <p>Texas, Oklahoma, Arkansas, Louisiana, and New Mexico:
</p><p>Federal Archives &amp; Records Center, PO Box 6216, Ft. Worth, TX 76115.
</p> <p>Nevada (except Clark County), California (except Southern California), and American Samoa:
</p><p>Federal Archives &amp; Records Center, 1000 Commodore Drive, San Bruno, CA 94066.
</p> <p>Clark County, Nevada; Southern California (Counties of San Luis Obispo, Kern, San Bernadino, Santa Barbara, Ventura, Los Angeles, Riverside, Orange, Imperial, Inyo, and San Diego), and Arizona:
</p><p>Federal Archives &amp; Records Center, PO Box 6719, Laguna Niguel, CA 92677.
</p> <p>Washington, Oregon, Idaho, Alaska, Hawaii, and Pacific Ocean Area (except American Samoa):
</p><p>Federal Archives &amp; Records Center, 6125 Sand Point Way, Seattle, WA 98115.
</p></xhtmlContent></subsection></section>
<section id="09-15-0028" toc="yes">
<systemNumber>09-15-0028</systemNumber>
<subsection type="systemName">Public Health Service Clinical Affiliation Trainee Records, HHS/HRSA/BPHC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>National Hansen's Disease Program, 1770 Physicians Park Drive, Baton Rouge, Louisiana 70816.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Students in Public Health Service training programs or serving clinical affiliation in National Hansen's Disease Program.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Transcripts of past education, application for training, training program staff and clinical supervisor evaluations and progress reports, course grades and evidence of completion of training requirements.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 320 of the Public Health Service Act, as amended (42 U.S.C. 247e), the National Hansen's Disease Program; and section 327A of the Public Health Service Act, as amended (42 U.S.C. 254), Interdepartmental Work.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To provide communication between educational and supervisory staff for evaluation of trainees.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made:
</p><p>To Educational Program staff of affiliated college/university to provide reports of student trainee's progress in training;
</p><p>1. To prospective employers for professional reference;
</p><p>2. To professional boards or associations to certify the student's progress in or completion of training as required for professional license, registration certification, etc.
</p> <p>3. To a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>4. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
</p><p>a. HHS, or any component thereof; or
</p><p>b. Any HHS employee in his or her official capacity; or
</p><p>c. Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>d. The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>5. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>&#149; Storage: File folders.
</p> <p>&#149; Retrievability: By year of training and alphabetically by last name.
</p> <p>&#149; Safeguards:
</p><p>&#9675; Authorized Users: Rehabilitation and Educational Services Coordinator, National Hansen's Disease Program, work and staff supervisors and administrative personnel.
</p> <p>&#9675; Physical Safeguards: All documents are protected during lunch hours and nonworking hours in locked file cabinets and locked storage areas.
</p> <p>&#9675; Procedural Safeguards: All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office. Access to records is strictly limited to those staff members trained in accordance with DHHS Chapter 45-13 and Chapter PHS.hf: 45-13 of the General Administration Manual.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Retained 5 years, then destroyed per authority of General Records Schedule 1.29.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Rehabilitation and Educational Services Coordinator, National Hansen's Disease Program, 1770 Physician's Park Drive, Baton Rouge, Louisiana 70816.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>The individual should contact the Director, National Hansen's Disease Program, 1770 Physicians Park Drive, Baton Rouge, Louisiana 70816, and provide name, date of birth and approximate dates of training to allow positive identification of the record.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the facility mentioned at the address specified in the notification procedures above, and reasonably identify the record, specify the information to be contested, and state corrective action sought, with supporting justification.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individuals, clinical supervisors, instructors, training program staff and administrative personnel of facility and affiliated college/university.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
        <section id="09-15-0037" toc="yes">
            <systemNumber>09-15-0037</systemNumber>
            <subsection type="systemName">HHS/HRSA/BHW Scholarship and Loan Repayment Program Records.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>Unclassified.</p>

                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>The servers for the central database (known as the Bureau of Health Workforce (BHW) Management Information System Solution (BMISS)) are located at the Center for Information Technology, National Institutes of Health, 12 South Drive, Room 1100, Bethesda, Maryland 20892, and are accessed from computer workstations in program offices listed below.  Paper copies of records included in the central database, and any paper or electronic records not included in the central database, are also stored in the program offices listed below:</p>
                    <p>Native Hawaiian Health Scholarship Program (NHHSP) records are located at the BHW, Health Resources and Services Administration (HRSA), U.S. Department of Health and Human Services (HHS), 5600 Fishers Lane, Room 9-105, Rockville, MD 20857 and at Papa Ola Lokahi, 894 Queen St., # 706, Honolulu, HI 96813.</p>
                    <p>Ready Responder electronic records are located at BHW, HRSA, HHS, 5600 Fishers Lane, Room 15W-21D, Rockville, MD 20857. </p>
                    <p>NHSC Student/Resident Experiences and Rotations in Community Health (SEARCH) records are located at BHW HRSA, HHS, 5600 Fishers Lane, Room 7-100, Rockville, MD 20857. </p>
                    <p>Additional records (e.g., spreadsheets created to perform their duties) are kept by contractors who assist with the implementation of the NHSC LRP, NHSC SP, NURSE Corps LRP (formerly NELRP), NURSE Corps SP (formerly NSP), FLRP, and are maintained at the below contractor locations:  </p>
                    <p>Customer Care Center, Teletech, 8123 South Hardy Dr., Tempe, AZ 85284;</p>
                    <p>Futrend Technology, Inc., 8605 Westwood Center Dr., Suite 502, Vienna, VA 22182;</p>
                    <p>Sapient Government Services, 1515 N. Courthouse Rd., 4th Floor, Arlington, VA 22201.</p>
                    <p>Because contractors may change, a current listing of contractors and locations (if different from above) is available upon request by contacting the Policy-Coordinating Official. Archived records (including scanned paper files that have been merged into BMISS) are stored at the Washington National Records Center, 4205 Suitland Road, Suitland, MD 20746.  </p>

                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>The system contains information about the following categories of individuals:</p>
                    <p>Individuals who have applied for, who are receiving, or who have received awards under the following programs:  the National Health Service Corps Scholarship Program (NHSC SP), the National Health Service Corps Loan Repayment Program (NHSC LRP), Students to Service (S2S), the NURSE Corps Loan Repayment Program (NURSE Corps LRP) formerly the Nursing Education Loan Repayment Program (NELRP), the NURSE Corps Scholarship Program (NURSE Corps SP) formerly the Nursing Scholarship Program (NSP), the Native Hawaiian Health Scholarship Program (NHHSP), and the Faculty Loan Repayment Program (FLRP). </p>
                    <p>Individuals who have applied to participate, are participating, or have participated in the NHSC Student/Resident Experiences and Rotations in Community Health (SEARCH) Program. </p>
                    <p>Individuals who are current or former Ambassadors, Alumni, or Ready Responders.</p>
                    <p>Individuals who indicate an interest in employment in or an assignment to a medical facility located in a Health Professional Shortage Area (HPSA) or a medically underserved population area, including public and federal medical facilities, such as Bureau of Prisons medical facilities, Indian Health Service health care facilities, and other federally sponsored health care facilities.  </p>

                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>Records include the individual's  name, address(es), telephone number(s), email address(es), Social Security number (SSN); scholarship, loan repayment, Ambassadors, Alumni, Ready Responders or SEARCH application and associated forms/documents, contracts, employment data, professional performance and credentialing history of licensed health professionals; preference for site-selection; personal, professional, and demographic background information; academic and/or service progress reports (which include related data, correspondence, and professional performance information consisting of continuing education, performance awards, and adverse or disciplinary actions); commercial credit reports, educational data including tuition and other related education expenses; educational data including academic program and status; information concerning educational loans; employment status verification (which includes certifications and verifications of service obligation); medical data, financial data, payment data and related forms, deferment/placement/suspension/waiver data and supporting documentation; repayment/delinquent/default status information, correspondence to and from Program applicants and participants and/or their representatives, Claims Collection Litigation Reports for default cases referred to the Department of Justice (DOJ).</p>

                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>Section 333 of the Public Health Service (PHS) Act, as amended (42 U.S.C. &#167; 254f), Assignment of Corps Personnel; </p>
                    <p>Section 225 of the PHS Act (42 U.S.C. &#167; 234), as in effect on September 30, 1977, PH/NHSC Scholarship Training Program; </p>
                    <p>Section 409(b) of the Health Professions Educational Assistance Act of 1976, (42 U.S.C. &#167; 295g), PSASP; </p>
                    <p>Sections 338A-H of the PHS Act, as amended (42 U.S.C. &#167;&#167; 254l-q), NHSC Scholarship and Loan Repayment Programs; </p>
                    <p>Sections 336(c) and 331(b)(1) of the PHS Act (42 U.S.C. &#167;&#167; 254h-1(c) and 254d(b)(1)), SEARCH; </p>
                    <p>Section 846 of the PHS Act, as amended (42 U.S.C. &#167; 297n), NURSE Corps Loan  Repayment Program (formerly the Nursing Education Loan Repayment Program) and NURSE Corps Scholarship Program (formerly the Nursing Scholarship Program); </p>
                    <p>Section 10 of the Native Hawaiian Health Care Improvement Act, as amended (42 U.S.C. &#167; 11709), NHHSP; </p>
                    <p>Section 738(a) of the PHS Act (42 U.S.C. &#167;  293b(a)), Faculty Loan Repayment Program; </p>
                    <p>Section 202 of Title II of Pub. L. 92-157 (42 U.S.C. &#167; 3505d), National Health Professional Shortage Clearinghouse; </p>
                    <p>31 U.S.C. &#167; 7701(c), Debt Collection Improvement Act of 1996, Requirement That Applicant Furnish Taxpayer Identifying Number; </p>
                    <p>Section 215(a) of the PHS Act, as amended (42 U.S.C. &#167; 216(a)), pertaining to PHS commissioned officers, and 5 U.S.C. &#167; 3301 pertaining to civil service employees, both of which authorize verification of an individual's suitability for employment.</p>

                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
            <xhtmlContent>

                    <p>Relevant agency personnel use records about individuals from this system on a need to know basis for the following purposes:</p>
                    <p>1. To obtain marketing and recruitment information concerning individuals who registered to complete an online application, but did not submit or complete an application. </p>
                    <p>2. To identify and select qualified individuals to participate in the above-identified Programs.</p>
                    <p>3. To maintain records on and to verify Program applicants' or participants' credentials and educational background, and previous and current professional employment data and performance history information to verify that all claimed background and employment data are valid and all claimed credentials are current and in good standing from selection for an award through the completion of service. </p>
                    <p>4. To assist the HHS Program Support Center (PSC), the DOJ, and other government entities in the collection of Program debts. </p>
                    <p>5. To respond to inquiries from Program applicants and participants, their attorneys or other authorized representatives, and Congressional representatives. </p>
                    <p>6. To compile and generate managerial and statistical reports. </p>
                    <p>7. With respect to the PH/NHSC and NHSC SP, NHHSP, NURSE Corps SP (formerly NSP), NHSC LRP, NURSE Corps LRP (formerly NELRP), and FLRP:  (a) to select and match scholarship recipients, loan repayors, and other individuals for assignment to or employment with a health care or other facility appropriate to the Programs' purposes; (b) to perform loan repayment and scholarship program administrative activities, including, but not limited to, payment tracking, deferment of the service obligation, monitoring a participant's compliance with the service requirements, determination of service completion, review of suspension or waiver requests, default determinations, and calculation of liability upon default; and (c) to monitor the services provided by the Programs' health care providers. </p>
                    <p>8. With respect to the SEARCH Program:  (a) to track recruitment of SEARCH participants for the NHSC Scholarship and Loan Repayment Programs; and (b) to determine how many non-obligated SEARCH participants ultimately practice primary health care in a Health Professional Shortage Area (HPSA). </p>
                    <p>9. With respect to the Ambassador and Alumni activities:  (a) to advocate for more health professions students to choose primary care; (b) to mentor students and clinicians; and (c) to recruit students and clinicians for the NHSC Scholarship and Loan Repayment Programs, and to train community leaders and local clinicians to care about and for people in need. </p>
                    <p>10. To transfer records of delinquent federal debts to System No. 09-40-0012, Debt Management and Collection System, for debt collection purposes.  </p>
                    <p>11. To transfer information to System No. 09-90-0024, Unified Financial Management System (UFMS), for purposes of effecting payment of program funds (through the Department of the Treasury) and preparing and maintaining financial management and accounting documentation related to obligations and disbursements of funds, (including providing notifications to the Department of the Treasury) related to payments to, or on behalf of, awardees.  Information transferred to UFMS for these purposes is limited to the individual's name, address, SSN and other information necessary to identify him/her, the funding being sought or amount of qualifying educational loans, and the program under which the awardee is being processed. </p>

                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>In addition to the disclosures authorized by the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(b)(11), information about an individual may be disclosed from this system of records to parties outside HHS, without the individual's prior, written consent, for these routine uses:</p>
                    <p>1. HHS may disclose to a Member of Congress or to a Congressional staff member information from the record of an individual in response to a written inquiry from the Congressional office made at the written request of that individual. </p>
                    <p>2. HHS may disclose information from this system of records to the Department of Justice (DOJ) or to a court or other tribunal when </p>
                    <p>a. HHS, or any component thereof , or</p>
                    <p>b. Any HHS employee in his or her official capacity, or </p>
                    <p>c. Any HHS employee in his or her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee, or</p>
                    <p>d. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, HHS determines that the records are both relevant and necessary to the litigation and that, therefore, the use of such records by the DOJ, court, or other tribunal is deemed by HHS to be compatible with the purpose for which the records were collected. </p>
                    <p>3. In the event that a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, disclosure may be made to the appropriate public authority, whether federal, state, local, tribal, or otherwise, responsible for enforcing, investigating or prosecuting such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto, if the information is relevant to the enforcement, regulatory, investigative, or prosecutorial responsibility of the receiving entity.  This includes, but is not limited to, disciplinary actions by state licensing boards against current or former Program participants. </p>
                    <p>4. HHS may disclose information consisting of names, SSN, disciplines and/or medical specialties, current mailing addresses, dates of scholarship support, and dates of graduation of NHSC SP, NURSE Corps SP (formerly NSP) and NHHSP scholarship recipients to:  (a) designated coordinators at each health professions school participating in the scholarship program for the purpose of determining educational expenses and resulting levels of scholarship support, and for the purpose of guiding and informing these recipients about the nature of their service obligation; and (b) schools attended by scholarship recipients who have taken a leave of absence from school, have terminated enrollment or been dismissed from school, or are repeating coursework, for the purpose of determining their academic status and whether their scholarship support should be suspended or resumed, as appropriate. </p>
                    <p>5. HHS may disclose information consisting of name, address, discipline and/or medical specialty, and SSN from this system of records to a Program participant's health professions school, residency program, or other postgraduate training program, for the purpose of ascertaining the participant's enrollment status and training completion or graduation date.</p>
                    <p>6. HHS may disclose records consisting of names, disciplines and/or medical specialties, current business or school mailing addresses, email addresses of the Programs' scholarship and loan repayment participants to contractors, Ambassadors, Alumni, and professional organizations in underserved communities for the purpose of supporting these clinicians in the course of their service obligation in a HPSA, school of nursing, or critical shortage facility. </p>
                    <p>7. HHS or its contractors may disclose records consisting of a SEARCH participant's name, mailing address, email address, phone number, health professions school, residency training and specialty to state Primary Care Offices (PCOs) and Primary Care Associations (PCAs) and site representatives for the purpose of matching participants to potential employment sites. </p>
                    <p>8. HHS may disclose records consisting of a participant's name, SSN, mailing address, email address, phone number, health professions school, residency training, specialty, program status, award years, service start and end dates, and service site address and phone number to Department grantees, contractors and subcontractors who assist with the implementation of the above-identified Programs, for the purposes of collecting, compiling, aggregating, analyzing, or refining records in the system, or improving Program operations.  Grantees and contractors maintain, and contractors are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records. </p>
                    <p>9. HHS may disclose biographical data and information supplied by Program applicants or participants:  (a) to references listed on the application and associated forms for the purpose of evaluating the applicant's or participant's professional qualifications, experience, and suitability; (b) to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity for the purpose of verifying that all claimed background and employment data are valid and all claimed credentials are current and in good standing; and (c) to prospective, current or former employers, or to site representatives, PCAs, and PCOs for the purpose of appraising the applicant's professional qualifications and suitability for site assignment or employment.</p>
                    <p>10. HHS may disclose an applicant's or participant's name, mailing address, email address, phone number, SSN, health professions school, residency training, and specialty to Department grantees, site representatives, contractors, and subcontractors who assist with the implementation of the above-identified Programs, for the purpose of recruiting, screening, evaluating, and matching, placing, or assigning health professionals to a service site appropriate to the relevant Program's purposes.  In addition, Department grantees, contractors and subcontractors may disclose biographical data and information supplied by Program applicants, participants, or references listed on the application and associated forms: (a) to other references for the purpose of evaluating the applicant's or participant's professional qualifications, experience, and suitability; (b) to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity for the purpose of verifying that all claimed background and employment data are valid and all claimed credentials are current and in good standing; (c) to the System for Awards Management (formerly Excluded Parties List System) for the purpose of determining whether applicants or participants are suspended, debarred, or disqualified from participation in covered transactions; (d) to the National Practitioner Data Bank for the purpose of determining whether applicants or participants have information on their reports; and (e) to prospective employers, or to site representatives, for the purpose of appraising the applicant's or participant's professional qualifications and suitability for site assignment or employment.  Grantees and contractors maintain, and contractors are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records. </p>
                    <p>11. HHS may disclose records consisting of name, mailing address, email address, phone number, SSN, specialty, and requested or actual placement site(s) to State Loan Repayment Grantees, state PCOs and PCAs, and site representatives to facilitate PCO, PCA and site activities related to recruitment and placement of Program participants at service sites.  For the purpose of monitoring the program participant's compliance with the service obligation, including fact-finding to calculate service credit, to decide transfer requests, or to make default determinations, HHS may release to the participant's service site other information from the participant's file, including but not limited to, his/her allegations concerning conditions at the site, disputes with site management, or circumstances surrounding his/her resignation/termination.  </p>
                    <p>12. HHS may disclose records to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity which maintains records concerning:  (a) an individual's employment history; (b) the issuance, retention, suspension, revocation, or reinstatement of licenses or registrations necessary to practice a health professional occupation or specialty; (c) disciplinary action against the individual or other sanctions imposed by a state or local government licensing board; or (d) the individual's attempts to pass health professions licensure exam(s).  This disclosure may include the applicant's or participant's name, address, SSN, employment history, educational data, accreditation, licensing, and professional qualification data, and facts concerning any clinical competence, unprofessional behavior, or substance abuse problem of which HHS is aware.  The purposes of this disclosure are:  (1) to enable HHS to obtain information relevant to a decision concerning a health professional's accomplishments, professional and personal background qualifications, experience, and any licensure sanctions related to substance abuse, to determine the individual's suitability for employment, retention, or termination as a health services provider at a health care facility approved by the relevant Program; and (2) to inform health professions licensing boards or the appropriate non-government entities about the health care practices or conduct of a practicing, terminated, resigned, or retired health services provider whose professional conduct so significantly failed to conform to generally accepted standards of professional practice for health care providers as to raise reasonable concern for the health and safety of patients. </p>
                    <p>13. HHS may disclose information consisting of name, address, SSN, health professions license number, and place of employment from this system of records to federal, state, or local health agencies and law enforcement regarding a program participant who has a physical or mental condition that is, or has the potential to become, a risk to patients or to the public at large, or whose aberrant behavior poses such a risk (e.g., commission of a sexual assault, illegal use or distribution of narcotics). </p>
                    <p>14. HHS may disclose information consisting of name, address, SSN, health professions license number, and place of employment to a state or local government agency, including any agent thereof, maintaining criminal, civil, or administrative violation records, or other pertinent information such as records regarding the investigation or resolution of allegations involving a program participant.  The purpose of this disclosure is to enable HHS to monitor compliance with program requirements and make determinations regarding administrative actions or other remedies, including default determinations.      </p>
                    <p>15. HHS may disclose Ambassador information consisting of name, email and social network address(es), phone number(s), employment information, and professional biographies to current and prospective participants in BHW programs and other interested individuals. The purpose of this disclosure is to allow these individuals to contact Ambassadors who serve as mentors and local resources for the NHSC programs.</p>
                    <p>16. HHS may disclose information from this system of records to a consumer reporting agency, as defined in 31 U.S.C. &#167; 3701(a)(3), for the following purposes:</p>
                    <p>a. To obtain a commercial credit report to assess the creditworthiness of a scholarship or loan repayment applicant;</p>
                    <p>b. To verify information provided on the scholarship or loan repayment application concerning whether the applicant has ever defaulted on a federal or non-federal obligation, or had delinquent federal or non-federal debts or judgment liens;</p>
                    <p>c. To determine and verify the eligibility of loans submitted for repayment;</p>
                    <p>d. To assess and verify ability of a debtor to repay debts owed to the federal government; and</p>
                    <p>e. To provide an incentive for debtors to repay federal debts by making these debts part of their credit records.  </p>
                    <p>Pursuant to 31 U.S.C. &#167; 3711(e)(1)(F), the information disclosed to the consumer reporting agency is limited to (i) information necessary to establish the identity of the person, including name, address, and taxpayer identification number; (ii) the amount, status, and history of the claim; and (iii) the agency or program under which the claim arose.</p>
                    <p>17. HHS may disclose information about NHSC LRP, S2S, NURSE Corps LRP (formerly NELRP), and FLRP applicants or participants to lending institutions and loan servicing agencies for the purpose of obtaining payoff balances on educational loans and determining whether loans are eligible for repayment under the Program.  Disclosure will be limited to the applicant/participant's name, address, SSN, the loan account number(s), the pre-verified loan balance, account status, and other information necessary to identify the LRP applicant/participant and his/her loans for this purpose. </p>
                    <p>18. HHS may disclose information to the Department of the Treasury, Internal Revenue Service (IRS), about an individual applying under the above-identified Programs to find out whether the applicant has a delinquent tax debt.  This disclosure is for the sole purpose of determining the applicant's eligibility for funding and/or creditworthiness and is limited to the individual's name, address, SSN, other information necessary to identify him/her, and the program for which the information is being obtained. </p>
                    <p>19. HHS may disclose information from this system of records to another federal, state, or local agency or private employer to whom a Program defaulter has applied for federal grant funds, federal scholarship, loan, or loan repayment funds, or employment involving federal funds, for the purpose of ensuring that the Program defaulter does not receive federal funds for which he/she is ineligible.  Disclosure will be limited to the defaulter's name, address, SSN, inclusion on the Do Not Pay List, and any other information necessary to identify him/her. </p>
                    <p>20. HHS may disclose information from this system of records to the DOJ and applicable state agencies in order to exclude a debtor from all federal health care programs, as defined in 42 U.S.C. &#167; 1320a-7b(f), including Medicare and Medicaid, or to conclude a settlement agreement staying such an exclusion. </p>
                    <p>21. HHS may disclose information from this system of records to other federal, state, and local agencies, and public and private entities that provide scholarship and/or loan repayment funding or include bonus clauses in employment contracts, for the following purposes:  (a) to curtail fraud and abuse of federal funds by identifying individuals who have applied for, or accepted, funding from another source for performance of the same service; and (b) to determine if an applicant has an existing service obligation to another federal, state, local, or other entity. </p>
                    <p>22. HHS may disclose to federal, state, and local agencies, and public and private non-profit entities for research purposes, the name, address(es), SSN, discipline and service sites of applicants and participants in the above-identified Programs when the Department: </p>
                    <p>i. has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; </p>
                    <p>ii. has determined that a bona fide research/analysis purpose exists; </p>
                    <p>iii. has required the recipient to: </p>
                    <p>establish strict limitations concerning the receipt and use of applicant- and participant-identified data; </p>
                    <p>establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; </p>
                    <p>remove, destroy, or return the information that identifies the applicant or participant at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research nature for retaining such information; and </p>
                    <p>make no further use or disclosure of the record except as authorized by HHS or when required by law; and </p>
                    <p>iv. has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions. </p>
                    <p>23. Disclosure may be made in response to a subpoena from another federal agency having the power to subpoena other agencies' records, such as the IRS or U.S. Commission on Civil Rights.</p>
                    <p>24. Disclosure of information from this system of records may be made to the HHS/PSC/Federal Occupational Health contract physicians to review and provide a written opinion of the medical documentation submitted by scholarship and loan repayment Program participants seeking a suspension or waiver of their service or payment obligation. </p>
                    <p>25. Disclosure to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents. </p>
                    <p>26. HHS may disclose records to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance. </p>
                    <p>Because, as described in the Purposes section, certain information from this system of records is transferred to HHS' financial and debt management systems, those systems' SORNs should be consulted for additional routine use disclosures that may be made without the individual's consent.  See Unified Financial Management System, System No. 09-90-0024, and Debt Management and Collection System, System No. 09-40-0012. </p>

                    </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p> Storage:  </p>
                    <p>Records are maintained in electronic database servers and backup servers, file folders, and for NHHSP records, backup tapes. </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability"><xhtmlContent>
                    <p>Records are retrieved by an individual's name, Social Security number, or other identifying numbers or characteristics. </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
          
                    <p>a. Authorized Users:  Password-protected access is limited to persons authorized and needing to use the electronic records, which includes system managers and their staff, BHW headquarter officials and staff, HRSA Division of Regional Operations staff, financial and fiscal management personnel, Office of the General Counsel, Office of Information Technology personnel, and at Papa Ola Lokahi (POL), an entity which collaborates with HRSA/BHW in the administration of the Native Hawaiian Health Scholarship Program (NHHSP) through a Cooperative Agreement to assist with the implementation of the NHHSP.  POL is physically located at 894 Queen St., Honolulu, HI 96813. </p>
                    <p>b. Additional Authorized Users:  Password-protected access is also provided to applicants, participants, and service sites for the purpose of inputting data, uploading documents, or submitting queries through BMISS.</p>
                    <p>c. Physical Safeguards:  Rooms where records are located are locked when not in use.  During regular business hours, rooms are unlocked but are controlled by on-site personnel.  Security guards perform random checks on the physical security of the offices (storage locations) after duty hours, including weekends and holidays. </p>

                    <p>Servers and other computer equipment used to process identifiable data are located in secured areas and use physical access devices (e.g., keys, locks, combinations, card readers) and/or security guards to control entries into the facility.  All facilities housing HRSA information systems maintain fire suppression and detection devices/systems (e.g., sprinkler systems, handheld fire extinguishers, fixed fire hoses, and or smoke detectors) that can be activated in the event of a fire. </p>

                    <p>With respect to NHHSP records located at Papa Ola Lokahi (POL), an entity HRSA/BWH collaborates with to administer the NHHSP, the building in which POL's office is located is publicly accessible but secured, with limited accessibility before and after work hours.  Security guards visit the building at night.  NHHSP's office suite is kept locked during work hours and individual offices are also locked when vacant.  Applicant and participant files are kept in a locked cabinet in a locked office.  Access to these files is limited to approved staff members, and when the area the files are in is not under the direct control of NHHSP staff, the office and cabinet are kept locked.  The file server is behind a locked office door in a locked server cabinet.  Backup tapes are stored in a locked, fireproof floor safe, and a secure, confidential off-site vault.</p>
                    <p>Technical safeguards:  Encryption, intrusion detection and firewalls are utilized. Scans are run against the BMISS platform for web and architecture vulnerabilities. Complex or strong passwords are required and are changed frequently. </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
            <xhtmlContent>
                    <p>Records are retained and disposed of as follows: </p>
                    <p>Files concerning participants who complete their obligations or whose obligations are waived, cancelled, or terminated are transferred to the Washington National Records Center in Suitland, Maryland and are destroyed 6 years after final payment, under disposition schedule HSA B-351 3. 1.</p>
                    <p>HRSA has digitized and uploaded paper files concerning active participants in BHW scholarship and loan repayment programs into BMISS.  The paper files are stored at the Washington National Records Center and are destroyed 15 years after closeout, under disposition schedule N1-512-92-01, item 25P 1 and 2.  </p>
                    <p>Unfunded or withdrawn applicant records are destroyed 6 months after the close of each fiscal year application period, under disposition schedule N1-512-92-01, item 25P 1.  </p>
                    <p>Currently, all records migrated to BMISS or created in BMISS are retained indefinitely, pending NARA's approval of a revised schedule. </p>

                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent><p>The System Manager for the system of records is the following Policy-Coordinating Official: </p>
                    <p>Director, Division of Policy and Shortage Designation, Bureau of Health Workforce (BHW), Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 11W-42, Rockville, MD 20857. </p>
                    <p>Points of contact for specific programs/activities: </p>

                    <p>NHSC SP and NHSC LRP Applications/Awards; Participant Placement/Assignment; Ready Responders:  Director, Division of the National Health Service Corps, BHW, HRSA, 5600 Fishers Lane, Room 8C-26, Rockville, MD 20857. </p>
                    <p>NURSE Corps LRP (formerly NELRP), NURSE Corps SP (formerly NSP), and FLRP Applications/Awards; Participant Placement/Assignment:  Director, Division of Health Careers and Financial Support, BHW, HRSA, 5600 Fishers Lane, Room 9-105, Rockville, MD 20857.</p>
                    <p>NHSC SP, NHSC LRP, S2S, NURSE Corps LRP (formerly NELRP), NURSE Corps SP (formerly NSP), and FLRP Participants' service from matching through service completion:  Director, Division of Participant Support and Compliance, BHW, HRSA, 5600 Fishers Lane, Room 15W-50, Rockville, MD 20857.</p>
                    <p>Suspension/Waiver/Default Determination for all BHW Programs:  Chief, Legal and Compliance Branch, BHW, HRSA, 5600 Fishers Lane, Room 8-73, Rockville, MD 20857. </p>
                    <p>NHHSP:  Administrator, Papa Ola Lokahi, 894 Queen St., # 706, Honolulu, HI 96813.</p>
                    <p>
                        SEARCH and Ambassadors:  Director, Division of External Affairs, BHW, HRSA, 5600 Fishers Lane, Room 7-100, Rockville, MD 20857.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p> To find out if the system contains records about you, contact the Policy-Coordinating Official, Director, Division of Policy and Shortage Designation, Bureau of Health Workforce (BHW), Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 11W-42, Rockville, MD 20857 who will refer you to the appropriate Point of Contact for the program/activity. </p>
                    <p>Requests in person:  A subject individual who appears in person at a specific location seeking access to or disclosure of records relating to him/her shall provide his/her name, current address, Social Security Number or other identifying information (e.g., date of birth), the name of the Program(s) in which the individual participated (or applied but was not selected), and at least one piece of tangible identification, such as driver's license, passport, or voter registration card.  Identification papers with current photographs are preferred but not required.  (A federally-issued picture ID is required to access many federal facilities such as the Parklawn Building.)  If a subject individual has no identification but is personally known to an agency employee, such employee shall make a written record verifying the subject individual's identity.  Where the subject individual has no identification papers, the responsible agency official shall require that the subject individual certify in writing that he/she is the individual who he/she claims to be and that he/she understands that the knowing and willful request for or acquisition of a record concerning an individual under false pretenses is a criminal offense subject to a $5,000 fine. </p>

                    <p>Requests by mail:  A written request must contain the name and address of the requester, Social Security number or other identifying information, and his/her signature which is either notarized to verify his/her identity or includes a written certification that the requester is the person he/she claims to be and that he/she understands that the knowing and willful request for or acquisition of records pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine.  In addition, the following information is needed:  the name of the Program(s) in which the individual participated (or applied but was not selected), and the requester's current status (e.g., in training, in deferment, in service, or in default). </p>
                    <p>Requests by telephone:  Because positive identification of the caller cannot be established, telephone requests are not honored.</p>

                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>Same as notification procedure.  Requesters may also ask for an accounting of disclosures that have been made of their records, if any.</p>

                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>Same as notification procedure.  Contact the Policy-Coordinating Official; specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.</p>

                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>Records are obtained directly from the subject individuals, or from the following sources:  educational institutions; internship and/or residency training programs; employers; NHSC-approved service sites; critical shortage facilities; schools of nursing; lending institutions and loan servicing agencies; health professional associations; National Practitioner Data Bank; System for Awards Management (formerly Excluded Parties List System); HHS Office of Inspector General website listing of individuals excluded from Medicare, Medicaid, and all other federal health care programs; HHS database of Health Professional Shortage Areas; HHS grantees and contractors/subcontractors; consumer reporting agencies/credit bureaus; other federal agencies, including but not limited to the Department of the Treasury, IRS, and the U.S. Postal Service; state health professions licensing boards and/or the Federation of State Medical Boards or a similar non-government entity; and third parties who provide references or other information concerning the subject individual.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="exemptionsClaimed">
                <xhtmlContent>
                    <p>
                        None.

                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemsExempted">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                </xhtmlContent>
            </subsection>
        </section>
<section id="09-15-0038" toc="yes">
<systemNumber>09-15-0038</systemNumber>
<subsection type="systemName">Disability Claims in the Health Professions Student Loan Program and Nursing Student Loan Program, HHS/HRSA/BHPr.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>&#149; Division of Student Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, 5600 Fishers Lane, Room 9-105, Rockville, MD 20857.
</p> <p>&#149; Washington National Records Center, 4204 Suitland Road, Suitland, MD 20409.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Applicants for cancellation of health professions student loans and nursing student loans due to disability.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Letter requests claiming disability, correspondence, payment determinations and medical records or reports.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 722(d) of the Public Health Service Act, as amended (42 U.S.C. 292r (d)), Health Professions Student Loan Program provisions; Section 836(b)(4) of the Public Health Service Act, as amended (42 U.S.C. 297b (b)(4)), Nursing Student Loan Provisions.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To determine the eligibility of applicants who request loan cancellation due to total and permanent disability.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>2. Disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected, in the event of litigation where the defendant is:
</p><p>a. The Department, any component of the Department, or any employee of the Department in his or her official capacity;
</p><p>b. The United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or
</p><p>c. Any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual.
</p> <p>3. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.
</p> <p>4. Disclosure to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p> <p>5. Disability statements are reviewed by HRSA medical staff/contractors via inter-agency agreement for the purpose of approving the disability write-off.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>File folders. Medical records and reports are temporarily held during medical evaluation and returned to, and retained by, health professions schools after final determination of claim validity.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Name of individual claiming disability.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>&#149; Authorized users: Access to Borrower's Files is limited to only those individuals within the Department and the Department's contractors having a substantiated need for information. These individuals must have available proof of employment.
</p> <p>&#149; Physical safeguards: File folders, medical records, reports and other forms of personal data are stored in areas where files are locked or rooms locked during off duty hours.
</p> <p>&#149; Procedural safeguards: All users of personal information in connection with the performance of their job protect information from public view and from unauthorized personnel entering an unsupervised office. Access to records is strictly limited to those staff members trained in accordance with the Privacy Act.
</p> <p>&#149; Implementation guidelines: HHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual.
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be retained for 6 years after phase out of loan program; 1 year on site and 5 years at the Federal Records Center. Records are disposed of in accordance with the Records Control Schedule of the Health Resources and Services Administration. Contact the System Manager for the disposal standards.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Students Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, Department of Health and Human Services, 5600 Fishers Lane, Room 9-105, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Requests concerning whether the system contains records about you should be made to the Systems Manager. When requesting notification of, or access to, records covered by this Notice, an individual must provide his/her full name, date of birth, and other proof of identity as required for Privacy Requests. Information requested may be redacted. An individual may request notification of, or access to, a medical record pertaining to him. An individual who requests notification of, or access to, a medical record shall, at the time the request is made, designate a representative in writing. The representative may be a physician or other responsible individual, who would be willing to review the record and inform the subject individual of its contents.
</p> <p>Request in person: A subject individual who appears in person at a specific location seeking access or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of tangible identification such as driver's license, passport, voter registration card, or union card. Identification papers with current photographs are preferred but not required. Additional identification may be requested when there is a request for access to records which contain an apparent discrepancy between information contained in the records and that provided by the individual requesting access to the records. Where the subject individual has no identification papers, the responsible agency official shall require that the subject individual certify in writing that he/she is the individual who he/she claims to be and that he/she understands that the knowing and willful request or acquisition of a record concerning an individual under false pretenses is a criminal offense subject to a $5,000 fine.
</p> <p>Requests by mail: A written request must contain the name and address of the requester, and his/her signature which is either notarized to verify his/her identity or includes a written certification that the requester is the person he/she claims to be and that he/she understands that the knowing and willful request or acquisition of records pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine.
</p> <p>Requests by telephone: Because positive identification of the caller cannot be established, no requests by telephone will be honored.
</p></xhtmlContent></subsection>
    <subsection type="recordAccessProcedures">
        <xhtmlContent>
            <p>
                Same as notification procedures. Requesters should also provide a reasonable description of the record being sought.
            </p>
        </xhtmlContent>
    </subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Any record subject may contest the accuracy of information on file at Campus Based Branch (CBB) by writing to the Director, Division of Students Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, Department of Health and Human Services, 5600 Fishers Lane, Room 9-105, Rockville, Maryland 20857. The request should contain a reasonable description of the record, specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>1. Educational institutions requesting disability write-offs.
</p> <p>2. Financial aid officers administering disability write-offs.
</p> <p>3. Borrowers submitted for total disability write-offs.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-15-0044" toc="yes">
<systemNumber>09-15-0044</systemNumber>
<subsection type="systemName">Health Education Assistance On-Line Processing System (HOPS).</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>&#149; Division of Student Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, Room 9-105, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>&#149; Records are also located at contractor sites. A list of contractor sites where individually identifiable data are currently located is available upon request to the System Manager.
</p> <p>&#149; Washington National Records Center, 4205 Suitland Road, Suitland, MD 20409.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Recipients of Health Education Assistance Loans.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Contains name, social security number or other identifying number, birth date, demographic background, educational status, loan location and status, and financial information about the individual for whom the record is maintained. Contains lender and school identification.</p>
</xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Sections 701 and 702 of the Public Health Service Act, as amended (42 U.S.C. 292 and 292a), which authorize the establishment of a Federal program of student loan insurance; Section 715 of the Public Health Service Act, as amended (42 U.S.C. 292n), which directs the Secretary to require institutions to provide information for each student who has a loan; Section 709 of the Public Health Service Act, as amended (42 U.S.C. 292h), which authorizes disclosure and publication of HEAL defaulters; and the Debt Collection Improvement Act (31 U.S.C 3701 and 3711-3720E).
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is:
</p><p>1. To identify borrowers participating in the HEAL Program;
</p><p>2. To monitor the loan status of HEAL recipients, which includes the collection of overdue debts owed under the HEAL Program; and
</p><p>3. To compile and generate managerial and statistical reports.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to Federal, State, or local agencies, to private parties such as relatives, present and former employers, business and personal associates, educational and financial institutions, and collection agencies. The purpose of such disclosures is to verify the identity of the loan applicant, to determine program eligibility and benefits, to enforce the conditions or terms of the loan, to counsel the borrower in repayment efforts, to investigate possible fraud and abuse, to verify compliance with program regulations, and to locate delinquent borrowers through pre-claims assistance. Information may be disclosed to educational or financial institutions to assist them in loan management.
</p> <p>2. Disclosure may be made to a Congressional office from the record of an individual in response to an inquiry from the Congressional office made at the request of that individual.
</p> <p>3. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>4. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with enforcing or implementing the statute or any rule, regulation or order issued pursuant thereto.
</p> <p>5. HRSA will disclose from this system of records a delinquent debtor's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose, as follows: (a) To another Federal agency so that agency can effect a salary offset for debts owed by Federal employees; if the claim arose under the Social Security Act, the employee must have agreed in writing to the salary offset. (b) To another Federal agency so that agency can affect an authorized administrative offset; <i>i.e.,</i> withhold money payable to, or held on behalf of, debtors other than Federal employees. (c) To the Treasury Department, Internal Revenue Service (IRS), to request a debtor's current mailing address to locate him/her for purposes of either collecting or compromising a debt or to have a commercial credit report prepared.
</p> <p>6. Records may be disclosed to the Office of Management and Budget for auditing financial obligations to determine compliance with programmatic, statutory, and regulatory provisions.
</p> <p>7. HRSA may disclose information from this system of records to a consumer reporting agency (credit bureau) to obtain a commercial credit report for the following purposes: (a) To establish creditworthiness of a loan applicant; and (b) to assess and verify the ability of a debtor to repay debts owed to the Federal Government. Disclosures are limited to the individual's name, address, Social Security number and other information necessary to identify him/her; the funding being sought or amount and status of the debt; and the program under which the application or claim is being processed.
</p> <p>8. HRSA may disclose to the Internal Revenue Service (IRS), U.S. Department of the Treasury (Treasury Department), information about an individual applying for a loan under any loan program authorized by the Public Health Service Act to find out whether the loan applicant has a delinquent tax account. This disclosure is for the sole purpose of determining the applicant's creditworthiness and is limited to the individual's name, address, Social Security number, other information necessary to identify him/her, and the program for which the information is being obtained.
</p> <p>9. HRSA will report to the IRS, Treasury Department, as taxable income, the written-off amount of a debt owed by an individual to the Federal Government when a debt becomes partly or wholly uncollectible--either because the time period for collection under the statute of limitations has expired, or because the Government agrees with the individual to forgive or compromise the debt.
</p> <p>10. HRSA will disclose to debt collection agents, other Federal agencies, and other third parties who are authorized to collect a Federal debt, information necessary to identify a delinquent debtor. Disclosure will be limited to the debtor's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose.
</p> <p>11. HRSA will disclose information from this system of records to any third party that may have information about a delinquent debtor's current address, such as the U.S. Postal Service, a consumer reporting agency (credit bureau), a State motor vehicle administration, a professional organization, an alumni association, etc., for the purpose of obtaining the debtor's current address. This disclosure will be limited to information necessary to identify the individual (defaulter's name, latest known City and State of residence, total amount of the HEAL debt).
</p> <p>12. Records may be disclosed to Department contractors and subcontractors for the purpose of assisting HEAL program managers in collating, compiling, aggregating, or analyzing records used in administering the HEAL program. Contractors maintain, and are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to the records.
</p> <p>13. HRSA may disclose from this system of records to the IRS, Treasury Department: (a) A delinquent debtor's name, address, Social Security number, and other necessary information to identify the debtor; (b) the amount of the debt; and (c) the program under which the debt arose, so that the IRS can offset against the debt any income tax refunds which may be due to the debtor.
</p> <p>14. HRSA may disclose the complete loan file of defaulted HEAL recipients to potential purchasers of HEAL loans to enable them to value and price the loans, and to actual purchasers to enable them to collect the defaulted loans. The purpose of this disclosure will be to facilitate the sale and collection of defaulted HEAL loans. Potential purchasers are required to maintain Privacy Act safeguards with respect to the records.</p>
<p>15. In accordance with the directive in 42 U.S.C. 292h(c)(1), the names of HEAL borrowers who are in default will be published in the Defaulted Borrowers Web site, <i>http://www.defaulteddocs.dhhs.gov,</i> by city and State along with the amounts of their HEAL debts. The individual's address also may be published if the address is a matter of public record as a result of legal proceedings having been filed concerning the individual's HEAL debt.
</p> <p>16. In accordance with the directive in 42 U.S.C. 292h(c)(2), disclosure may be made to relevant Federal agencies, schools, school associations, professional and specialty associations, State licensing boards, hospitals with which a HEAL defaulter may be associated, and other similar organizations.
</p> <p>17. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p> <p>Disclosure to consumer reporting agencies:
</p><p>Disclosures pursuant to 5 U.S.C. 552a(b)(12), (as set forth in 31 U.S.C. Section 3711(e)): Disclosures may be made from this system to "consumer reporting agencies" as defined in the Fair Credit Reporting Act (15 U.S.C. 1681a(f)) or the Debt Collection Improvement Act (31 U.S.C. 3701(a)(3)). The purposes of these disclosures are:
</p><p>1. To provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records; and
</p><p>2. To enable HRSA to improve the quality of loan and scholarship decisions by taking into account the financial reliability of applicants. Disclosure of records will be limited to the individual's name, Social Security number (SSN), and other information necessary to establish the identity of the individual, the amount, status, and history of the claim, and the agency or program under which the claim arose.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>&#149; <i>Storage:</i> Records are maintained in database servers, file folders, cd's, dvd's and magnetic tapes.
</p></xhtmlContent></subsection>
    <subsection type="retrievability">
    <xhtmlContent>
        <p>
            Social Security Number or other identifying number.
        </p>
    </xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>1. <i>Authorized users:</i> Access is limited to authorized HEAL personnel and contractors responsible for administering the HEAL program. Authorized personnel include HEAL employees and officials, financial and fiscal management personnel, computer personnel and program managers who have responsibility for implementing the HEAL program. Read-Only users: Read-only access is given to Servicers, Holders and financial/fiscal management personnel.</p>
<p>2. <i>Physical safeguards:</i> Magnetic tapes, disc packs, computer equipment and other forms of personal data are stored in areas where fire and life safety codes are strictly enforced. All documents are protected during lunch hours and non-working hours in locked file cabinets or locked storage areas. Twenty-four hour, seven-day security guards perform random checks on the physical security of the records storage areas.
</p> <p>3. <i>Procedural safeguards:</i> A password is required to access the terminal and a data set name controls the release of data to only authorized users. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office. In addition, all sensitive data is encrypted using Oracle Transparent Data Encryption functionality. Access to records is strictly limited to those staff members trained in accordance with the Privacy Act and ADP security procedures. Contractors are required to maintain, and are also required to ensure that subcontractors maintain, confidentiality safeguards with respect to these records. Contractors and subcontractors are instructed to make no further disclosure of the records except as authorized by the System Manager and permitted by the Privacy Act. All individuals who have access to these records receive the appropriate ADP security clearances. HEAL personnel make site visits to ADP facilities for the purpose of ensuring that ADP security procedures continue to be met. Privacy Act and ADP system security requirements are specifically included in contracts. The HRSA project directors, project officers, and the System Manager oversee compliance with these requirements.
</p> <p>4. <i>Implementing guidelines:</i> The safeguards described above were established in accordance with DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual; and the <i>http://www.hhs.gov/ocio/policy#Security</i> Web site.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>HRSA is working with the Records Officer and NARA to obtain the appropriate retention value.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>&#149; Chief, Health Education Assistance Loan Program, Division of Student Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, 5600 Fishers Lane, Room 9-105, Rockville, MD 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To find out if the system contains records about you contact the System Manager.
</p><p><i> REQUESTS IN PERSON: </i> A subject individual who appears in person at a specific location seeking access or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of tangible identification such as driver's license, passport, voter registration card, or union card. Identification papers with current photographs are preferred but not required. Additional identification may be requested when there is a request for access to records which contain an apparent discrepancy between information contained in the record and that provided by the individual requesting access to the record. No verification of identity shall be required where the record is one which is required to be disclosed under the Freedom of Information Act.
</p>
     <p><i> REQUESTS BY MAIL: </i>
         Written requests for information and/or access to records received by mail must contain information providing the identity of the writer and a reasonable description of the record desired. Written requests must contain the name and address of the requester, his/her date of birth and at least one piece of information which is also contained in the subject record, and his/her signature for comparison purposes.
     </p>
     <p><i> REQUESTS BY TELEPHONE: </i> Since positive identification of the caller cannot be established, telephone requests are not honored.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also provide a reasonable description of the record being sought. Requesters may also request an accounting of disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager, provide a reasonable description of the record, specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual loan recipients, HEAL schools, lenders, and holders of HEAL loans and their agents.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-15-0046" toc="yes">
<systemNumber>09-15-0046</systemNumber>
<subsection type="systemName">Health Professions Analysis and Evaluation, HHS/HRSA/BHPr.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This system of records is an umbrella system comprising separate sets of records located either in the organizations responsible for conducting evaluations or at the sites of programs or activities under evaluation. Locations include the Health Resources and Services Administration (HRSA) facilities in Rockville, Maryland (<i>see</i> address of System Manager below), or facilities of contractors of HRSA. Write to the System Manager for a list of current locations.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>Health professionals and students in the various health professions who are the subjects of studies or evaluations being conducted by HRSA. Physicians, dentists, pharmacists, optometrists, podiatrists, veterinarians, public health personnel, audiologists, speech pathologists, health care administration personnel, nurses, allied health personnel, medical technologists, chiropractors, clinical psychologists, and other health personnel may be included.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Name, address, health profession, education history, academic grades, employment history, nationality, race, ethnicity, economic background, and sex. The specific data items collected and maintained are determined by the needs of the individual project and are restricted to the minimum set necessary to accomplish project objectives.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority is found in the following sections of the Public Health Service Act; section 761 of the Public Health Service Act (42 U.S.C 294n), Health Professions Workforce Information and Analysis; section 792 of the Public Health Service Act (42 U.S.C. 295k), Health Professions Data.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The Health Resources and Services Administration uses various records in this system to identify problems in the health care training and delivery systems to plan programs to correct those problems, and to evaluate the effectiveness of the resultant programs. The agency assesses the current supply of health professionals and predicts the supply needs of the future. The agency determines nationwide requirements as well as the needs of specific areas. The agency also collects data on the educational system which supplies health professionals and on specific health education programs. The data are used to develop and test new methods of training and utilizing health professionals.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>2. A record may be disclosed for a research purpose, when the Department: (a) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (b) Has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (c) Has required the recipient to--(1) Establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except--(A) In emergency circumstances affecting the health or safety of any individual, (B) for use in another research project, under these same conditions, and with written authorization of the Department, (C) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (D) when required by law; and (d) Has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
</p> <p>3. Disclosure may be made to HHS contractors and their staff, in order to accomplish any of the purposes of the system of records. The recipients are required to protect such records from improper disclosure and to maintain Privacy Act safeguards.
</p> <p>4. The Department may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) Any HHS employee in his or her official capacity; or (c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.</p>
<p>5. The Department may disclose information to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p> <p>Disclosure to consumer reporting agencies:
</p><p>None.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p><i>Storage:</i> Electronic files, file folders, magnetic tape, and disk storage. The needs of each project determine the types of storage actually used.
</p></xhtmlContent></subsection>
    <subsection type="retrievability">
        <xhtmlContent>
            <p>
                By name or by an assigned number.
            </p>
        </xhtmlContent>
    </subsection>
<subsection type="safeguards"><xhtmlContent><p>Locked building, locked rooms, locked file cabinets, personnel screening, locked computer rooms and computer tape vault, guard service, password protection of automated records and limited access to only authorized personnel may be used. Particular safeguards are selected as appropriate to the type of records included in each project. Authorized personnel are limited to HRSA staff and contractor personnel directly involved in data collection, compilation, and analysis. (Safeguards are in accordance with Part 6, ADP Systems Security, of the Department's Information Resources Management Manual, with Chapter 45-13, Safeguarding Records Contained in Systems of Records, of the Department's General Administration Manual, and with supplementary Chapter PHS. 45-13.)
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>The contractor removes personal identifiers and destroys the records when they are no longer needed, as appropriate to the specific project. (Records may be retired to a Federal Records Center and subsequently disposed of in accordance with the Records Control Schedule of the Health Resources and Services Administration). You may obtain a copy of the disposal standard for a particular project by writing to the System Manager.</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Director, Office of Workforce Policy and Performance Management, Bureau of Health Professions, HRSA, 5600 Fishers Lane, Room 9A- 18, Rockville, MD 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Requests concerning whether the system contains records about an individual should be made to the Systems Manager.
</p> <p><i>Request in person:</i> A subject individual who appears in person at a specific location seeking access or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of tangible identification such as driver's license, passport, voter registration card, or union card. Identification papers with current photographs are preferred but not required. Additional identification may be requested when there is a request for access to records which contain an apparent discrepancy between information contained in the records and that provided by the individual requesting access to the records. Where the subject individual has no identification papers, the responsible agency official shall require that the subject individual certify in writing that he/she is the individual who he/she claims to be and that he/she understands that the knowing and willful request or acquisition of a record concerning an individual under false pretenses is a criminal offense subject to a $5,000 fine.
</p> <p><i>Requests by mail:</i> A written request must contain the name and address of the requester and his/her signature, which is either notarized to verify his/her identify or includes a written certification that the requester is a person he/she claims to be and that he/she understands that the knowing and willful request or acquisition of records pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine.
</p> <p><i>Requests by telephone:</i> Because positive identification of the caller cannot be established, no requests by telephone will be honored.</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>To obtain access to your record, contact the System Manager and provide suitable identification for proof of identity, a reasonable description of the record and, if possible, information about the specific project. You may also request a list of accountable disclosures that have been made of your record.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>To correct your record, contact the System Manager and provide:
</p><p>a. Suitable identification for proof of identity,
</p><p>b. A reasonable description of the record,
</p><p>c. The specific information you want corrected, and
</p><p>d. A precise description of the correction, with supporting justification. The right to contest records is limited to information which is incomplete, irrelevant, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Subject individuals, State and local health departments, other health providers, health professions schools, and health professions associations may provide information depending on the individual project involved.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-15-0054" toc="yes">
<systemNumber>09-15-0054</systemNumber>
<subsection type="systemName">National Practitioner Data Bank for Adverse Information on Physicians and Other Health Care Practitioners, HHS/HRSA/BHPR.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>A contractor, SRA International, Inc., operates and maintains an Internet-based system through a technical service contract for the Division of Practitioner Data Banks, Bureau of Health Professions, Health Resources and Services Administration. SRA's physical address is 4350 Fair Lakes Courts, Fairfax, Virginia 22033-4233. This system is located at the AT&amp;T Data Center, a secure facility; the street address will not be disclosed for security reasons.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system collects and maintains records pertaining to the professional competence and conduct of individual health care practitioners (doctors, dentists, nurses, allied health care professionals, social workers, etc.) and health care entities (hospitals, laboratories, pharmacies, etc.).
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system collects and maintains reports and query history records. Reports include: (1) Medical malpractice payment reports for all health care practitioners, i.e., physicians, dentists, nurses, optometrists, pharmacists, and podiatrists, etc.; (2) adverse clinical privilege action reports for physicians, dentists, and other healthcare practitioners who may have medical staff privileges either restricted or surrendered; (3) adverse licensure action reports for physicians, dentists and other healthcare practitioners and healthcare entities such as a suspension or revocation; (4) adverse professional society membership action reports for physicians, dentists, and other health care practitioners; (5) reports of the results of formal proceedings by a State licensing authority, peer review organization, or private accreditation organization concluded against a health care practitioner or entity; (6) reports of Medicare/Medicaid exclusions of all healthcare practitioners; and (7) reports of adverse actions taken against the U.S. Drug Enforcement Administration (DEA) registration of all healthcare practitioners.
</p> <p>Reports may contain the following personally-identifiable data elements:
</p><p>1. Name;
</p><p>2. Work address;
</p><p>3. Home address;
</p><p>4. Social Security number;
</p><p>5. Date of birth;
</p><p>6. Name of each professional school attended and year of graduation;
</p><p>7. Professional license(s) number;
</p><p>8. Field of licensure;
</p><p>9. Name of the State or Territory in which the license is held;
</p><p>10. DEA registration numbers;
</p><p>11. CMS unique practitioner identification number (for exclusions only);
</p><p>12. Names of each hospital with which the practitioner is affiliated;
</p><p>13. Name and address of the entity making the payment;
</p><p>14. Name, title, and telephone number of the official responsible for submitting the report on behalf of the entity;
</p><p>15. Payment information including the date and amount of payment and whether it is for a judgment or settlement;
</p><p>16. Date action occurred;
</p><p>17. Acts or omissions upon which the action or claim was based;
</p><p>18. Description of the action/omissions and injuries or illnesses upon which the action or claim was based;
</p><p>19. Description of the Board action, the date of action and its effective date; and
</p><p>20. Classification of the action/omission per reporting code.
</p> <p>Query histories indicate the dates that an individual health care practitioner's report(s) were accessed/queried in the system and by whom. Each practitioner's report(s) and query history are available to him or her, if the practitioner elects to submit a self-query. However, the query history will not include query activity by law enforcement agencies, if any, due to the system's exemption.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The Health Care Quality Improvement Act of 1986, as amended, title IV of Public Law 99-660 [42 U.S.C. 11101 <i>et seq.</i>], and Section 1921 of the Social Security Act, as amended.</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of the system is to: (1) Receive information such as adverse licensure actions on all healthcare practitioners or entities, clinical privileges and professional society membership actions on physicians and dentists based on professional competence and conduct, medical malpractice payment history on all health care practitioners, as well as the results of formal proceedings by a State authority, peer review organization or private accreditation organization concluded against any health care practitioner or entity; (2) store such reports so that future queriers may have access to pertinent information regarding the review of a health care practitioner and/or a healthcare entity in their process of making important decisions related to the delivery of health care services; and (3) disseminate such data to entities that qualify to receive the reports under the governing statutes as authorized by the Health Care Quality Improvement Act of 1986 and Section 1921 of the Social Security Act to protect the public from unfit practitioners and prevent unfit practitioners from providing patient care.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Information from this system shall be disclosed to:
</p><p>1. Hospitals requesting information, such as, adverse licensure actions, medical malpractice payments or exclusions from Medicare and Medicaid programs taken against all licensed healthcare practitioners such as physicians, dentists, nurses, podiatrists, chiropractors, and psychologists. The information is accessible to both public and private sector hospitals who can request information concerning a physician, dentist or other health care practitioner who is on its medical staff (courtesy or otherwise) or who has clinical privileges at the hospital, for the purpose of: (a) Screening the professional qualifications of individuals who apply for staff positions or clinical privileges at the hospital; and (b) meeting the requirements of the Health Care Quality Improvement Act of 1986, which prescribes that a hospital must query the NPDB once every 2 years regarding all individuals on its medical staff or who hold clinical privileges.
</p> <p>2. Other health care entities, as defined in 45 CFR 60.3, to which a physician, dentist or other health care practitioner has applied for clinical privileges or appointment to the medical staff or who has entered or may be entering an employment or affiliation relationship. The purpose of these disclosures is to identify individuals whose professional conduct may be unsatisfactory.
</p> <p>3. A health care entity with respect to professional review activity. The purpose of these disclosures is to aid health care entities in the conduct of professional review activities, such as those involving determinations of whether a physician, dentist, or other health care practitioner may be granted membership in a professional society; the conditions of such membership, or of changes to such membership; and ongoing professional review activities conducted by a health care entity which provides health care services, of the professional performance or conduct of a physician, dentist, or other health care practitioner.
</p> <p>4. A State healthcare practitioner and/or entity licensing or certification authority can request information expanded by Section 1921 of the Social Security Act in conducting a review of all healthcare practitioners or health entities. A State healthcare practitioner and entity licensing or certification authority may also request information when making licensure determinations about healthcare practitioners and entities. The purpose of these disclosures is to aid the board or certification authority in meeting its responsibility to protect the health of the population in its jurisdiction, by identifying individuals whose professional performance or conduct may be unsatisfactory.</p>
<p>5. Federal and State health care programs (and their contractors) can request information reported under Section 1921 of the Social Security Act. The purpose of these disclosures is to aid Federal and State health programs to ensure the integrity and professional competence of affiliated health care practitioners and uncovering information needed to make appropriate decisions in the delivery of healthcare.
</p> <p>6. State Medicaid Fraud Control Units (MFCUs) can request information reported under Section 1921 of the Social Security Act<i></i> to assist with investigating fraud and prosecution of healthcare practitioners and providers in the administration of the Medicaid programs.
</p> <p>7. U.S. Comptroller General can request information reported under Section 1921 of the Social Security Act to assist in determining the fitness of individuals to provide healthcare services, and protect the health and safety of individuals receiving health care through programs who employ these individuals.
</p> <p>8. U.S. Attorney General and other law enforcement agencies can request information reported under Section 1921 of the Social Security Act to assist with healthcare investigations involving healthcare practitioners and healthcare entities. The purpose of the disclosure would assist in determining the fitness of individuals to provide healthcare services, and protect the health and safety of individuals receiving health care through programs who employ these individuals.
</p> <p>9. Utilization and quality control Peer Review Organizations and those entities which are under contract with the CMS can request information reported under Section 1921 of the Social Security Act to protect and improve the quality of care for Medicare beneficiaries when performing quality of care reviews and other related activities.
</p> <p>10. A physician, dentist, or other health care practitioner can request information concerning himself or herself.
</p> <p>11. An entity that has been reported on may query the system to receive information concerning itself.
</p> <p>12. A person or entity can request statistical information, in a form which does not permit the identification of any individual or entity pursuant to the procedures established by the Department. An example of this disclosure involves researchers who may use statistical information to identify the total number of nurses with adverse licensure actions in a specific State.
</p> <p>13. An attorney, or individual representing himself or herself, who has filed a medical malpractice action or claim in a State or Federal court or other adjudicative body against a hospital, and who requests information regarding a specific physician, dentist, or other health care practitioner who is also named in the action or claim provided that: (a) This information will be disclosed only upon the submission of evidence that the hospital failed to request information from the NPDB as required by law; and (b) the information will be used solely with respect to litigation resulting from the action or claim against the hospital. The purpose of these disclosures is to permit an attorney (or a person representing himself or herself in a medical malpractice action) to have information from the NPDB on a health care practitioner, under the conditions set out in this routine use.
</p> <p>14. Any Federal entity, employing or otherwise engaging under arrangement (e.g., such as a contract) the services of a physician, dentist, or other health care practitioner, or having the authority to sanction such practitioners covered by a Federal program, which: (a) Enters into a memorandum of understanding with HHS regarding its participation in the NPDB; (b) engages in a professional review activity in determining an adverse action against a practitioner; and (c) maintains a Privacy Act system of records regarding the health care practitioners it employs, or whose services it engages under arrangement. The purpose of such disclosures is to enable hospitals and other facilities and health care providers under the jurisdiction of Federal agencies such as the Public Health Service, HHS; the Department of Defense; the Department of Veterans' Affairs; the U.S. Coast Guard; and the Bureau of Prisons, Department of Justice, to participate in the NPDB. The Health Care Quality Improvement Act of 1986 includes provisions regarding the participation of such agencies and of the DEA.
</p> <p>15. In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to affect directly the operation of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosures may be made to the Department of Justice to enable the Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>16. The contractor, SRA International Inc., accesses the system to operate and maintain it. These functions include but are not limited to providing continuous user availability, develop system enhancements, upgrade of hardware and software, security information assurance, and system backups.</p>
<p>17. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained on database servers with disk storage, optical jukebox storage, backup tapes and printed reports.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, date of birth, social security number, educational information, and license number. The matching algorithm uses these data elements to match reports to the subject.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users include internal users such as the government and contractor personnel staff who support the NPDB and are required to obtain favorable adjudication for a Level 5 Position of Public Trust. New employees of the NPDB and the contractor must attend security training, sign a Non-Disclosure Agreement, and sign the Rules of Behavior which is renewed annually. Authorized users are given role-based access to the system on a limited need-to-know basis. All physical and logical access to the system is removed upon termination of employment. External users, who are responsible for meeting Title IV reporting and/or querying requirements to the NPDB, are responsible for determining their eligibility to access the NPDB through a self-certification process which requires completing an Entity Registration form. All external users must acknowledge the Rules of Behavior. All external users must re-register every two years to access the NPDB. Both HRSA and the contractor maintain lists of authorized users.
</p> <p>2. Physical Safeguards involve physical controls that are in place 24 hours a day/7 days a week such as identification badge access, cipher locks, locked hardware cages, man trap with biometric hand scanner, security guard monitoring, and closed circuit TV. All sites are protected with fire and environmental safety controls.
</p> <p>3. Technical Safeguards include firewalls, network intrusion detection, host-based intrusion detection and file integrity monitoring, user identification, and passwords restrictions. All Web-based traffic is encrypted using 128 bit SSL and all network traffic is encrypted internally.
</p> <p>4. Administrative Safeguards involve certification and accreditation that is required every three years, which authorizes operation of the system based on acceptable risk. Security assessments are conducted continuously throughout the year to verify compliance with all required controls.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>HRSA is working with NARA to obtain the appropriate retention value.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Practitioner Data Banks, Bureau of Health Professions, Health Resources and Services Administration, Room 8 -103, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Subject to the exemption from the Privacy Act notification procedure requirement, information is available upon request, to the persons or entities, or to the authorized agents in such form or manner as the Secretary prescribes. Currently, the subject of a report is notified via U.S. mail when a report concerning the individual is submitted to the NPDB via Subject Notification Document (SND). This procedure is unchanged by the exemption.
</p>
     <p><i> REQUESTS BY MAIL: </i>
         Practitioners may submit a "Request for Information Disclosure" to the address under system location for any report on themselves. The request must contain the following: Name, address, date of birth, gender, Social Security Number (optional), professional schools and years of graduation, and the professional license(s). For license, include: The license number, the field of licensure, the name of the State or Territory in which the license is held, and DEA registration number(s). The practitioner must submit a signed and notarized self-query request.
     </p>
     <p><i> PENALTIES FOR VIOLATION: </i> Submitting a request under false pretenses is a criminal offense and subject to a civil monetary penalty of up to $11,000 for each violation.
</p><p><i> REQUESTS IN PERSON: </i> Due to security considerations, the NPDB cannot accept requests in person.
</p><p><i> REQUESTS BY TELEPHONE: </i> Practitioners may provide all of the identifying information stated above to the NPDB Customer Service Center operator. Before the data request is fulfilled, the operator will return a paper copy of this information for verification, signature and notarization.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Although this system will be exempt from the Privacy Act access requirement, the exemption will be limited and discretionary. An individual health care practitioner may continue to seek access to his or her records in the NPDB by submitting a self-query request form on- line at: <i>www.npdb-hipdb.hrsa.gov.</i> The requests are submitted over the web using the Integrated Query and Reporting Service (IQRS), Query and Reporting Extensible Markup Language Service (QRXS), Interface Control Document (ICD) Transfer Program (ITP) or the Proactive Disclosure Service (PDS). Self-query, as described previously, may be initiated via the electronic system and is completed using the conventional mail system. Requesters, including self-queries, will receive an accounting of disclosure that has been made of their records, if any. The exemption will prevent law enforcement query activity from being disclosed to the health care practitioner in response to a self- query.
</p> <p>Notwithstanding the access exemption, a practitioner may request access to his or her full query history (<i>i.e.,</i> including law enforcement query activity, if any), by submitting a written request to the System Manager identified above and following the same procedures indicated under "Notification Procedure." The request will be processed pursuant to the agency's discretionary access authority under 45 CFR 5b.11(d).</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Because of the system's exemption, the procedures for disputing a NPDB report will not apply to any query history information that is exempt from access. The NPDB routinely mails a copy of any report filed in it to the subject individual. A subject individual may contest the accuracy of information in the NPDB concerning himself or herself and file a dispute. To dispute the accuracy of the information, the individual must contact the NPDB and the reporting entity to: (1) Request for the reporting entity to file correction to the report; and (2) request the information be entered into a "disputed" status and submit a statement regarding the basis for the inaccuracy of the information in the report. If the reporting entity declines to change the disputed report or takes no actions, the subject may request that the Secretary of HHS review the disputed report. In order to seek a Secretarial Review, the subject must: (1) Provide written documentation containing clear and brief factual information regarding the information of the report; (2) submit supporting documentation or justification substantiating that the reporting entity's information is inaccurate; and (3) submit proof that the subject individual has attempted to resolve the disagreement with reporting entity but was unsuccessful. The Department can only determine whether the report was legally required to be filed and whether the report accurately depicts the action taken and the reporter's basis for action. Additional detail on the process of dispute resolution and Secretarial Review process can be found at 45 CFR 60.14 of the NPDB regulations.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The records contained in the system are submitted by the following entities: (1) Insurance companies and others who have made payment as a result of a malpractice action or claim, (2) State Boards of Medical and Dental Examiners; (3) State Licensing Boards; (4) hospitals and other health care entities; (5) DEA; and (6) Federal entities which employ health practitioners or who have authority to sanction such practitioners covered by a Federal program. Section 1921 of the Social Security Act  expands reporting of actions submitted by State health care practitioner licensing and certification authorities (including medical and dental boards), State entity licensing and certification authorities, peer review organizations and private accreditation organizations.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>The Secretary has exempted this system from certain provisions of the Act. In accordance with 5 U.S.C. 552(k)(2) and 45 CFR 5b.11(b) (ii)(L), this system is exempt from subsections 5 U.S.C. 552a(c)(3), (d)(1)-(4), (e)(4)(G) and (H), and (f).
</p></xhtmlContent></subsection> </section>
<section id="09-15-0055" toc="yes">
<systemNumber>09-15-0055</systemNumber>
<subsection type="systemName">Organ Procurement and Transplantation Network (OPTN)/Scientific Registry of Transplant Recipients (SRTR) Data System, HHS/HRSA/HSB/DoT.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Data collected by the OPTN are maintained by the OPTN contractor and shared on a monthly basis with the contractor for the SRTR and the DoT, within HRSA, the Federal entity that oversees the OPTN and SRTR contracts.
</p> <p><i>OPTN Contractor:</i> United Network for Organ Sharing (UNOS), P.O. Box 2484, 700 North Fourth Street, Richmond, Virginia 23218.
</p> <p>SRTR Contractor: Arbor Research Collaborative for Health, 315 West Huron, Suite 360, Washtenaw County, Ann Arbor, Michigan 48103.
</p> <p>Division of Transplantation: Healthcare Systems Bureau, HRSA, Parklawn Building, Room 12C-06, 5600 Fishers Lane, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>1. Living and deceased persons from whom organs have been obtained for transplantation.</p>
<p>2. Persons who are candidates for organ transplantation.
</p> <p>3. Persons who have been recipients of transplanted organs.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Donor registration, transplant candidate registration, transplant recipient registration, histocompatibility, transplant recipient follow-up and living donor follow-up, forms and other non-registry operational information. Data items include: Name, Social Security number, identifiers assigned by OPTN and SRTR contractors, hospital and hospital provider number, State and zip code of residence, citizenship, race/ethnicity, gender, date and time of organ recovery and transplantation, name of transplant center, histocompatibility status, donor medical information and, if donor is deceased, cause of death, patient medical information before and after transplantation, immunosuppressive medication, cause of death (if recipient is deceased), health care coverage, employment and education level.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p><i>42 U.S.C. 274</i> requires that the Secretary, by contract, provide for the establishment and operation of an OPTN, and <i>42 U.S.C. 274a</i> requires that the Secretary, by grant or contract, develop and maintain a Scientific Registry of the recipients of organ transplants. 42 CFR part 121 authorizes collection of the information included in this system by the OPTN.</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>To (1) facilitate organ placement and match donor organs with recipients; (2) monitor compliance of member organizations with Federal laws and regulations and with OPTN requirements; (3) review and report periodically to the public on the status of organ donation and transplantation in the United States; (4) provide data to researchers and government agencies to study the scientific and clinical status of organ transplantation; (5) perform transplantation-related public health surveillance including possible transmission of donor disease.
</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Departmental contractors and/or their subcontractors who have been engaged by the Department to assist in accomplishment of a departmental function relating to the purposes for this system of records and who require access to the records in order to assist the Department.
</p> <p>2. HRSA, independently and through its contractor(s), may disclose records regarding organ donors, organ transplant candidates, and organ transplant recipients, to transplant centers, histocompatibility laboratories, organ procurement organizations, the Transplant Transmission Sentinel Network and other public health agencies such as SEER registries, NCI contractors, State cancer registries and other State health agencies, provided that such disclosure is compatible with the purpose for which the records were collected, including: Matching donor organs with recipients, monitoring compliance of member organizations with Federal laws and regulations and OPTN requirements, reviewing and reporting periodically to the public on the status of organ donation and transplantation in the United States, and transplantation-related public health surveillance. These records consist of Social Security numbers, other patient identification information and pertinent medical information.
</p> <p>3. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to affect directly the operation of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable the Department to present an effective defense.
</p> <p>4. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>5. A record may be disclosed for a research purpose, when the Department, independently or through its contractor(s):
</p><p>a. Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;
</p><p>b. Has determined that a bona fide research/analysis purpose exists;
</p><p>c. Has required the data recipient to: (1) Establish strict limitations concerning the receipt and use of patient-identified or center- identified data; (2) establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; (3) remove, destroy, or return the information that identifies the individual or center at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the data recipient has presented adequate justification of a research or health nature for retaining such information; and (4) make no further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law;
</p><p>d. has determined that other applicable safeguards or protocols will be followed; and
</p><p>e. has secured a written statement attesting to the data recipient's understanding of, and willingness to abide by these provisions.
</p> <p>6. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage: </p><p> Records are maintained both electronically and via hardcopy in file folders, magnetic tapes, and disc packs.
</p></xhtmlContent></subsection>
    <subsection type="retrievability">
    <xhtmlContent>
        <p>
            Records in the system are retrieved by more than one data elements including name, date of birth, and social security number.
        </p>
    </xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent><p>a. <i>Authorized users:</i> Access is limited to authorized HRSA and contract personnel responsible for administering the program. Authorized personnel include the System Manager and Project Officer, and the HRSA Automated Information System (AIS) Systems Security Officer; and the program managers/program specialists who have responsibilities for implementing the program. Both HRSA and its contractor(s) shall maintain current lists of authorized users.
</p> <p>b. <i>Physical safeguards:</i> Magnetic tapes, disc packs, computer equipment, and hard-copy files are stored in areas where fire and life safety codes are strictly enforced. All automated and nonautomated documents are protected on a 24-hour basis in locked storage areas. Security guards perform random checks on the physical security of the records storage area. The OPTN and SRTR contractors are required to maintain off site a complete copy of the system and all necessary files to run the computer organ donor-recipient match and update software.
</p> <p><i>Procedural safeguards:</i> A password is required to access the terminal and a data set name controls the release of data to only authorized users. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office. All authorized users must sign a nondisclosure statement. Access to records is limited to those staff members trained in accordance with the Privacy Act and Automated Data Processing (ADP) security procedures. The contractor(s) is required to assure that the confidentiality safeguards of these records will be employed and that it complies with all provisions of the Privacy Act. All individuals who have access to these records must have the appropriate ADP security clearances. Privacy Act and ADP system security requirements are included in the contracts. The HRSA Project Officer(s) and the System Manager(s) oversee compliance with these requirements. The HRSA authorized users will make visits to the contractors' facilities to assure security and Privacy Act compliance. The contractor(s) is/are required to adhere to a HRSA approved system security plan.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Each donor, candidate, and recipient record stored within the OPTN/SRTR Data System shall be retained for no more than 25 years beyond the known death of the candidate or the organ recipient. Paper media is placed in locked destruction bins and is shredded by a third-party vendor and electronic media is logged and degaussed before leaving the building.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p><i>OPTN Contractor:</i> United Network for Organ Sharing (UNOS), P.O. Box 2484, 700 North Fourth Street, Richmond, Virginia 23218.
</p> <p><i>SRTR Contractor:</i> Greg Levine, Arbor Research Collaborative for Health, 315 West Huron, Suite 360, Washtenaw County, Ann Arbor, Michigan 48103.
</p> <p><i>Division of Transplantation:</i> Healthcare Systems Bureau, HRSA, Parklawn Building, Room 12C-06, 5600 Fishers Lane, Rockville, Maryland 20857.</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p><i>Requests by mail:</i> To determine if a record about you exists, write to the OPTN contractor (see System Location). The request should contain the name and address of the individual; date of birth; the name of his/her transplant center, a notarized written request or a certification that the requester is the person he/she claims to be and that he/she understands that the request or acquisition of records pertaining to another individual under false pretenses is a criminal offense subject to a $5,000 fine. These procedures are in accordance with the Department's regulations (45 CFR part 5b).
</p> <p><i>Requests in person:</i> The individual must meet all the requirements stated above for a request by mail, providing the information in written form, or provide at least one piece of tangible identification. The individual should recognize that in order to maintain confidentiality, and thus the accuracy of data released through repeated internal verification, securing the information by request in person will be time consuming. These procedures are in accordance with the Department's regulations (45 CFR part 5b).
</p> <p><i>Requests by Telephone:</i> Since positive identification of the caller cannot be established, telephone requests are not honored.</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>These are the same as notification procedures. Requestors should also provide a reasonable description of the record being sought. Requestors also may request an accounting of disclosures that have been made of their records, if any. A parent or guardian who requests notification of, or access to, a minor's/incompetent person's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the minor/incompetent person as well as his/her own identity. These procedures are in accordance with the Department's regulations (45 CFR part 5b).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>To contest a record in the system, contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, and the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Organ procurement organizations, histocompatibility laboratories, and organ transplant centers.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-15-0056" toc="yes">
<systemNumber>09-15-0056</systemNumber>
<subsection type="systemName">National Vaccine Injury Compensation Program, HHS/HRSA/BHPr.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Healthcare Systems Bureau (HSB), Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 11C-26, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Persons filing claims (petitioners) under the National Vaccine Injury Compensation Program (NVICP).
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Petition for compensation, including petitioner's name and name of person vaccinated if different from petitioner, and all relevant medical records, (including autopsy reports and slides, radiological films, and home videos, if any), appropriate assessments, evaluations, prognoses, and such other records and documents as are reasonably necessary for the determination of eligibility for and the amount of compensation to be paid to, or on behalf of, the person who suffered such injury or who died from the administration of the vaccine.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authority for maintaining this system of records is the National Childhood Vaccine Injury Act of 1986, as amended (42 U.S.C. 300aa -10, et seq.) (the Vaccine Act). The Vaccine Act established the National Vaccine Injury Compensation Program and authorized the Department to track, review, and defend the Secretary, HHS in vaccine injury and death related cases brought before the United States Court of Federal Claims.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>1. To determine eligibility of petitioners to receive compensation under the National Vaccine Injury Compensation Program.
</p> <p>2. To compensate successful petitioners in the amount and in the manner determined by the court.
</p> <p>3. To evaluate vaccine safety through research programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosures may be made to a Congressional office from the record of an individual, in response to an inquiry from the Congressional office made at the written request of the individual.
</p> <p>2. In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice (DOJ) has agreed to represent such employee, for example in defending against a claim based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, the Department may disclose such records as it deems desirable or necessary to the DOJ to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. HRSA will contract with expert medical consultants for the purpose of obtaining advice on petitioner's eligibility for compensation. To the extent necessary, relevant records may be disclosed to such consultants. The consultants shall be required to maintain Privacy Act safeguards with respect to such records and return all records to HRSA.
</p> <p>4. HRSA will release the petitioner's complete medical file and may release consultants' report to the DOJ and the Special Master of the U.S. Court of Federal Claims for adjudication of the compensation claim.
</p> <p>5. HRSA will disclose for publication in the <i>Federal Register</i> the name of the petitioner, the name of the person vaccinated, if not the petitioner, the city and State where the vaccine was administered and the U.S. Court of Federal Claims' Docket Number as required by the National Childhood Vaccine Injury Act.
</p> <p>6. Records may be disclosed to organizations deemed qualified by the Secretary for the purpose of evaluating the administration, process, or outcomes of the National Vaccine Injury Compensation Program (as required by Congress). The purpose of the disclosure is to document the extent to which the National Vaccine Compensation Program is satisfying the goals and objectives of its authorizing legislation, i.e., maintaining a system for compensating those who have been injured by a vaccine that is fair and expeditious. Organizations to which information is disclosed for this use shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>7. To the extent necessary, a record may be disclosed to annuity brokers and to employees of life insurance companies for the purposes of obtaining financial advice and for the purchase of contracts to provide benefits to recipients of benefits under the Program. Organizations to which information is disclosed for this use will be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>8. To the extent necessary, a record may be disclosed to contractors for the purpose of providing medical review, analysis and determination as to whether petitions meet the medical requirements for compensation. Contractors will be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>9. A record may be disclosed for a research purpose when the Department: (A) Has determined that the disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (B) Has determined that the research purpose: (1) Is consistent with the purpose for which the Program was formed, which includes, but is not limited to, evaluating the safety of vaccines covered under the Program, (2) Cannot be reasonably accomplished with information in statistical form, and must be provided in an identifiable form to accomplish the research purpose, and (3) Warrants the risk to the privacy of the individual that additional exposure of the record might bring; (C) Has required the recipient to: (1) Establish reasonable administrative, technical and physical safeguards to prevent unauthorized use or disclosure of the record, (2) Remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) Make no further use of the record except: (a) In emergency circumstances affecting the health or safety of any individual, (b) For disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (c) When required by law; and (D) Has secured a written statement attesting to the recipient's understanding of and willingness to abide by these provisions.</p>
<p>10. To the extent necessary, a record may be disclosed for the purpose of ensuring that a Government Reversionary Trust established in connection with a Program award is being properly administered. Such disclosures may be made to institutions serving as trustees and medical administrators with respect to such trusts, to individuals serving as guardians of the estate of individuals compensated by the Program, and to attorneys representing such parties (or representing the Government). Organizations or individuals to which information is disclosed for this use will be required to maintain Privacy Act safeguards with respect to such records. Records may also be disclosed for the same purpose to courts of competent jurisdiction in which trust administration issues arising out of Program claims are raised.
</p> <p>11. Records regarding specific medical services provided to an unemancipated minor or an incompetent adult may be disclosed to the unemancipated minor's parent or legal guardian who previously consented to those specific medical services or a person who is now legally authorized to make medical decisions on behalf of the minor or the incompetent adult.
</p> <p>12. Records concerning compensation awarded on behalf of an unemancipated minor (or an incompetent adult) in the Program may be disclosed to the guardian or conservator of the estate of the minor or incompetent adult, as determined by a court of competent jurisdiction.
</p> <p>13. In the event that a record maintained in this system indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State, or local, charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto, provided that such disclosure is compatible with the purpose for which records were collected.
</p> <p>14. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>HRSA is working with NARA to obtain the appropriate retention value.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Requests must be made to the System Manager at the above address.
</p><p>
<i>REQUEST IN PERSON: </i> A subject individual who appears in person seeking access or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of tangible identification such as a driver's license, passport, voter registration card, or union card. Identification papers with current photographs are preferred but not required. Additional identification may be requested when there is a request for access to records which contain an apparent discrepancy between information contained in the records and that provided by the individual requesting access to the record. No verification of identity shall be required where the record is one which is required to be disclosed under the Freedom of Information Act.
</p><p><i> REQUESTS BY MAIL: </i> To determine if a record exist about you, write to the System Manager. The request must contain the name and address of the individual, assigned court docket number (if known), and a written statement that the requester is the person he/she claims to be and that he/she understands that the request or acquisition of records pertaining to another individual, under false pretenses, is a criminal offense subject to a $5000 fine.
</p><p><i> REQUESTS BY TELEPHONE:</i> Since positive identification of the caller cannot be established, telephone requests are not honored.
</p><p><i>RECORDS ACCESS PROCEDURES: </i> Same as notification procedures. Individuals may also request an accounting of disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the appropriate official at the address specified under Notification Procedures above and reasonably identify the record, specify the information being contested, and state the corrective action sought and the reason(s) for requesting the correction, along with supporting justification to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Petitioner, petitioner's legal representative, health care providers, and other interested persons.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-15-0057" toc="yes">
<systemNumber>09-15-0057</systemNumber>
<subsection type="systemName"> Scholarships for the Undergraduate Education of Professional Nurses Grant Programs, HHS/HRSA/BHPr.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Division of Student Assistance, Bureau of Health Professions, Health Resources and Services Administration, Room 8-34, 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>Division of Computer Research and Technology, National Institutes of Health, Building 12, 9000 Rockville Pike, Bethesda, MD 20205.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Applicants for and recipients of Scholarships for the Undergraduate Education of Professional Nurses Grant Program.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Contains name, Social Security number, school identifier, grant number, birthdate, demographic background, educational status, school location, employment status, payback status, and financial information about the individual for whom the record is maintained.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Public Health Service Act, as amended, section 843 (42 U.S.C. 297j). This section authorizes the establishment of a grant program to be administered by schools of nursing for the awarding of Scholarships for the Undergraduate Education of Professional Nurses. Executive Order 9397 regarding the use of Social Security number.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To maintain all information relative to the application for an awarding of scholarship(s) to an individual.
</p> <p>2. To monitor recipient's continued eligibility.
</p> <p>3. To monitor recipient's employment in nursing shortage areas in fulfillment of recipient's service obligations.
</p> <p>4. To monitor all repayment actions until the repayment obligation is satisfied.
</p> <p>5. To compile and generate managerial and statistical reports.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual, in response to an inquiry from the congressional office made at the request of the individual.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof, where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in such case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. HRSA will disclose to debt collection agents, other Federal agencies, and other third parties who are authorized to collect or compromise a Federal debt, information necessary to identify a delinquent debtor. Disclosure will be limited to the debtor's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose.
</p> <p>4. Records may be disclosed to authorized persons employed at educational institutions where the recipient received a scholarship. The purpose of this disclosure is to assist institutions in identifying defaulted scholarship recipients (hereafter called debtors) in order to enforce the conditions and terms of such scholarships.
</p> <p>5. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.
</p> <p>6. HRSA will disclose from this system of records a debtor's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose, as follows: (a) To another Federal agency so that agency can effect a salary offset for debts owed by Federal employees; if the claim arose under the Social Security Act, the emplnyee must have agreed in writing to the salary offset; (b) to another Federal agency so that agency can effect an authorized administrative offset (i.e., withhold money payable to or held on behalf of debtors other than Federal employees); (c) to the Treasury Department, Internal Revenue Service (IRS), to request a debtor's current mailing address to locate him/her for purposes of either collecting or compromisng a debt, or to have a commercial credit report prepared.
</p> <p>7. Records may be disclosed to the General Accounting Office and to the Office of Management and Budget for auditing financial obligations to determine compliance with programmatic, statutory, and regulatory provisions.
</p> <p>8. HRSA may disclose information from this system of records to another Federal agency that has asked the Department to effect an administrative offset to help collect a debt owed to the United States. Disclosure is limited to the individual's name, address, Social Security number, and other information necessary to identify the individual; information about the money payable to or held for the individual, and other information concerning the administrative offset.
</p> <p>9. HRSA will report to the Treasury Department, Internal Revenue Service (IRS), as taxable income, the written-off amount of a debt owed by an individual to the Federal Government when a debt becomes partly or wholly uncollectable--either because the time period for collection under the statute of limitations has expired, or because the Government agrees with the individual to forgive or compromise the debt.
</p> <p>10. HRSA will disclose information from this system of records to any third party that may have information about a delinquent debtor's current address, such as a U.S. post office, a State motor vehicle administration, professional organization, alumni association, etc., for the purpose of obtaining the debtor's current address. This disclosure will be strictly limited to information necessary to identify the individual without any reference to the reason for the agency's need for obtaining the address.
</p> <p>Disclosure to consumer reporting agencies:
</p><p>Disclosures pursuant to 5 U.S.C. 552a(b)(12): Disclosures may be made from this system to `consumer reporting agencies' as defined in the Fair Credit Reporting Act (15 U.S.C. 1681a(f) or the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a)(3)). The purpose of disclosure is to provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records. Disclosure of records will be limited to the individual's name, Social Security number, and other information necessary to establish the identity of the individual, the amount, status, and history of the claim, and the agency or program under which the claim arose.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Files of individual borrowers are maintained in a standard upright file cabinet. All original borrower contracts are kept in a fire- proof file safe. Records are maintained in file folders, on magnetic tape, and on computer disc packs.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>All record files are maintained and indexed alphabetically by last name and can be retrieved accordingly. Records will also be retrieved by Social Security number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized users: Administrative and staff personnel of the Division of Student Assistance and other components of the HRSA who have responsibility for implementing the Scholarship Program.
</p> <p>2. Physical safeguards: Magnetic tapes, disks, other computer equipment, and other forms of personal data are stored in area where fire and life safety codes are strictly enforced. Twenty-four hour, 7-day security guards perform random checks on the physical security of the data. All documents are protected during lunch hours and nonworking hours in locked file cabinets or locked storage areas.
</p> <p>3. Procedural safeguards: A password is required to access the computer system and data set name controls the release of data to only authorized users. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office. Access to records is strictly limited to those staff members trained in accordance with the Privacy Act.
</p> <p>4. Implementation guidelines: DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual; and the DHHS Information Resources Management Manual, Part 6, "ADP Systems Security."
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be retained for 6 years (1 year on site and 5 years at the National Records Center) after completion of the service obligation or repayment to the Secretary in cases of default. Records on magnetic tape are retained for 5 years and then they are destroyed. Records are disposed of in accordance with the Records Control Schedule of the Health Resources and Services Administration. Contact the System Manager for disposal standard.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Associate Division Director, Office for Campus Based Programs, Division of Student Assistance, Bureau of Health Professions, Health Resources and Services Administration,  5600 Fishers Lane, Room 8-34, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Requests must be made to the System Manager.
</p> <p>Request in person: A subject individual who appears in person at a specific location seeking access or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of tangible identification such as driver's license, passport, voter registration card, or union card. Identification papers with current photographs are preferred but not required. Additional identification may be requested when there is a request for access to records which contain an apparent discrepancy between information contained in the record and that provided by the individual requesting access to the record. No verification of identity shall be required where the record is one which is required to be disclosed under the Freedom of Information Act.
</p> <p>Requests by mail: Requests for information and/or access to records received by mail must contain information providing the identity of the writer and a reasonable description of the record desired. Written requests must contain the name and address of the requester, his/her date of birth and at least one piece of information which is also contained in the subject record, and his/her signature for comparison purposes.
</p> <p>Requests by telephone: Since positive identification of the caller cannot be established, telephone requests are not honored.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosure that have been made of their records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address specified under the Notification Procedures above and reasonably identify the record, specify the information being contested, and state the corrective action and the reason(s) for requesting the correction, along with supporting justification to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual scholarship recipients, recipient's nursing school.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-15-0059" toc="yes">
<systemNumber>09-15-0059</systemNumber>
<subsection type="systemName">Strategic Work Information and Folder Transfer System (SWIFT), HHS/HRSA/OO/OM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Division of Policy and Information Coordination, Office of Management, Office of Operations, Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 14A-11, Rockville, MD 20857.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who have sent written correspondence (including e-mails and faxes) or other documents to the Administrator, HRSA, the Deputy Administrator, an associate administrator, or a bureau director, or individuals who have been contacted in writing by one of these officials.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Correspondence includes incoming letters, memos, relevant background information, and agency outgoing correspondence. Other documents include Reports to Congress, Regulations, <i>Federal Register</i> notices and records management schedules. This information is contained on hardcopy printouts and a secured network server managed by IT staff.</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301, Departmental Regulations.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>To control and track all correspondence addressed or directed to and initiated by the Administrator, HRSA, or his/her subordinates as indicated above, as well as other documents, to assure timely and appropriate attention by relevant HRSA staff.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. The Department of Health and Human Services (DHHS) may disclose information from this system of records to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the request of that individual.
</p> <p>2. DHHS may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when:
</p><p>a. DHHS, or any component thereof; or
</p><p>b. Any DHHS employee in his or her official capacity; or
</p><p>c. Any DHHS employee in his or her individual capacity where the Department of Justice (or DHHS, where authorized to do so) has agreed to represent the employee; or
</p><p>d. The United States, or any agency thereof where DHHS determines that the litigation is likely to affect DHHS or any of its components, is a party to litigation or has an interest in such litigation, and DHHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, DHHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. DHHS may disclose information from this system of records to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:</p><p> Controlled correspondence records and other document records are maintained in hardcopy and electronically at the operational computer site.
</p></xhtmlContent></subsection>
    <subsection type="retrievability">
        <xhtmlContent>
            <p>
                Hardcopy records are indexed chronologically by date, name, subject and unique numerical control number. Electronic records are indexed chronologically by date, name, subject and unique numeral control number. Records are available to staff responsible for preparation of correspondence and to the staff of the Division of Policy and Information Coordination.
            </p>
        </xhtmlContent>
    </subsection>
<subsection type="safeguards"><xhtmlContent><p> Access to hardcopy and computer resident records is limited to the staff of the Division of Policy and Information Coordination and Bureau correspondence liaisons. Privacy training is required for those individuals. Access to hardcopy records during non- working hours is limited to these individuals who have keys to both the file cabinets and rooms where the records are stored. Remote computer terminal locations are protected with individual user identification codes and associated passwords that are changed periodically. When possible, computer terminal locations are locked during non-working hours. Confidential and/or sensitive documents are either hand carried or transmitted in sealed envelopes. Employees who handle controlled correspondence and other documents are instructed to observe established office procedures to protect correspondence documents from unauthorized access.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Temporary hardcopy records are cut off at the end of each calendar year, retained on-site for 2 years, transferred to the Washington National Records Center (WNRC), and destroyed by WNRC 5 years later, in accordance with established records retention and disposition schedules. Permanent hardcopy records are cut off at the end of each calendar year, retained on-site for 2 years, transferred to the Washington National Records Center, and then 5 years later transferred to the National Archives and Records Administration (NARA). HRSA is working with NARA to obtain the appropriate retention value regarding electronic records.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Policy and Information Coordination, Room 14A-11, Parklawn Bldg., 5600 Fishers Lane, Rockville, MD.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Inquiries for correspondence should indicate the name of the individual with whom HRSA corresponded and, where possible, the date of the incoming correspondence to HRSA, if any, and the date of the outgoing correspondence from HRSA. Inquiries for other documents should indicate the name of the document and, where possible, the date of the document.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Requesters must provide identification that they are who they claim to be and their understanding that obtaining information under false pretenses is subject to a maximum statutory penalty of $5,000. Requesters may also ask for an accounting of disclosures that have been made of records that relate to them, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record, specify the information to be contested, the corrective action sought, and the reason for seeking the correction, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Records are derived from incoming correspondence to, and the outgoing correspondence of, the Administrator, HRSA, or his/her subordinates as indicated above. Records are also derived from other documents within the Agency.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p></xhtmlContent></subsection> </section>
<section id="09-15-0065" toc="yes">
<systemNumber>09-15-0065</systemNumber>
<subsection type="systemName">Smallpox Vaccine Injury Compensation Program, HHS/HRSA/OSP.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Special Programs, Health Resources and Services Administration, 4350 East-West Highway, 10th Floor, Bethesda, Maryland 20814.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals covered by the system are requesters and/or their representatives filing for benefits and other compensation under the Smallpox Vaccine Injury Compensation Program.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Records consist of documents that may include general or congressional correspondence, requests, case number assignment, HHS responses, medical and legal documentation, employment documentation, documentation concerning services or benefits available from the United States or any third party (including any State or local governmental entity, private insurance carrier, or employer), payment information, and other related case processing documents.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Management of the system is authorized by Pub. L. 108-20, the Smallpox Emergency Personnel Protection Act of 2003, enacted April 30, 2003 (42 U.S.C. 239 et seq.).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purpose of the system is to provide for benefits and other compensatory payments to certain individuals who sustained a covered injury as the direct result of the administration of smallpox countermeasures, and certain individuals who sustained a covered injury as a direct result of accidental vaccinia inoculation through contact with the foregoing persons or with individuals accidently inoculated by them, during a specified time period.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of a subject individual, in response to an inquiry from the congressional office made at the written request of that individual or his/her representative.
</p> <p>2. Disclosure may be made to Federal, State or local Government entities or to private entities for the purpose of their providing information relevant to medical or legal documentation required for determinations of eligibility or payment, provided that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. Disclosure of records may be made to contractors engaged by the Department who need access to the records in order to assist the Department, e.g., expert consultants providing advice on requesters' eligibility for benefits and/or compensation. All such individuals shall be required to maintain Privacy Act safeguards with respect to such records and return all records to HRSA.
</p> <p>4. Disclosure of records may be made to individuals and/or entities as necessary for the purposes of obtaining financial advice and providing benefits and other compensation to requestors approved for payment under the Program. All individuals and/or entities permitted disclosure for this use shall be required to maintain Privacy Act safeguards with respect to such records and return all records to HRSA.
</p> <p>5. Disclosure of records may be made to a Federal agency administering aspects of the Program, as authorized by a Memorandum of Agreement between the Secretary and the head of the Federal agency, or to another Federal agency assisting in the accomplishment of a Departmental function relating to the purposes of this system of records, provided that such disclosure is compatible with the purposes for which the records are collected.
</p> <p>6. Disclosure of records may be made in the event of litigation where the defendant is:
</p><p>(a) The Department, any component of the Department, or any employee of the Department in his or her official capacity;
</p><p>(b) The United States where the Department determines that the action, if successful, is likely to affect directly the operation of the Department or any of its components; or
</p><p>(c) Any Department employee in his or her individual capacity where the Department of Justice (DoJ) has agreed to represent such employee, for example, in defending an action against the Department in connection with such individual, disclosure may be made to DoJ to enable DoJ to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>7. Disclosure may be made in the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, rule, regulation or order issued pursuant thereto, provided that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>8. A record may be disclosed for a medical research purpose, only when the Department has determined:
</p><p>(a) That the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;
</p><p>(b) That the research purpose is consistent with the purpose for which the Program was formed;
</p><p>(c) That the proposed research is scientifically sound in its methods and analyses and is likely to answer the proposed research question;
</p><p>(d) That the information sought is not available from any other source; and
</p><p>(e) That the record made available for medical research is redacted of all personal identifiers regarding injured individuals, health care practitioners and employers that are not essential for the accomplishment of the approved research purpose.
</p> <p>(f) The recipient must:
</p><p>(1) Establish strict limitations acceptable to the Department concerning the receipt and use of any patient-identifiable data;
</p><p>(2) Establish reasonable administrative, technical, and physical safeguards and/or protocols acceptable to the Department to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record;
</p><p>(3) Remove or destroy the information that identifies an individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project; and
</p><p>(4) Make no further use or disclosure of the record except when required by law.
</p> <p>(a) Further, the Department must secure and approve a written statement attesting to the recipient's understanding of, and agreement to abide by, these conditions of disclosure. Violation of these provisions is subject to penalties set forth under 5 U.S.C. 552a(i)(3) and any other applicable Federal law.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file folders, on computer hard drives and/or disk packs, or in electronic media storage.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Retrievability is by name of the requester, and by case number assigned based on the order in which a request form is filed.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Assign Responsibility for Security: Responsibility is assigned to a management official knowledgeable in the nature of the information and process supported by the Smallpox Vaccine Injury Compensation Program (SVICP) request and in the management, personnel, operational, and technical controls used to protect it.
</p> <p>2. Perform Risk Assessment: A risk assessment is to be conducted in conjunction with the development of, and prior to the approval of, the system design and will ensure that vulnerabilities, risks, and other security concerns are identified and addressed in the system design and throughout the life cycle of the project. This is consistent with the HHS Automated Information Systems Security Program Handbook (in particular Chapters V and X).
</p> <p>3. Develop SVICP Request Security Plan: Plan for the adequate security of the SVICP request, taking into account the security of all systems in which the request will operate. SVICP request security plans shall address request rules, training on use of the system, personnel security, contingency planning, technical controls, information sharing, and public access controls.
</p> <p>4. Review SVICP Request Controls: Perform an independent review or audit of the SVICP request security control in accordance with applicable Federal requirements and/or guidelines.
</p> <p>5. Authorize Processing: Ensure that a management official authorizes, in writing, confirmation that the security plan as implemented adequately secures the SVICP request. The SVICP request must be authorized prior to operating and reauthorized in accordance with applicable Federal requirements and/or guidelines.
</p> <p>6. Implementation Guidelines: DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual; the DHHS Automated Information Systems Security Program Handbook; and Appendix III to OMB Circular No. A-130; Appendix I, "Federal Agency Responsibilities for Maintaining Records About Individuals."
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be retained and disposed of in accordance with the Records Control Schedule of the Health Resources and Services Administration.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Office of Special Programs, Health Resources and Services Administration, 5600 Fishers Lane, Room 16C-17, Rockville, Maryland 20857, or the Director's designee.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Requests must be made to the System Manager.
</p> <p>Requests by mail: Requests for information and/or access to records received by mail must contain information providing the identity of the writer, and a reasonable description of the record desired, and whom it concerns. Written requests must contain the name and address of the requester, his/her date of birth and his/her signature for comparison purposes. Requests must be notarized to verify the identity of the requester, or the requester must certify that (s)he is the individual who (s)he claims to be and that (s)he understands that to knowingly and willfully request or acquire a record pertaining to another individual under false pretenses is a criminal offense under the Privacy Act subject to a $5,000 fine (45 CFR 5b.5(b)(2)(ii)).
</p> <p>Requests in person or by telephone, electronic mail or facsimile cannot be honored.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Record access procedures are the same as notification procedures. Requesters should also provide a reasonable description of the contents of the record being sought. A parent or guardian who requests notification of, or access to, a minor's/incompetent person's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the minor/incompetent person as well as his/her own identity. Records will be mailed only to the requester=s address that is on file, unless a different address is demonstrated by official documentation.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>To contest a record in the system, contact the System Manager at the address specified above and reasonably identify the record, specify the information being contested, and state the corrective action sought and the reason(s) for requesting the correction, along with supporting documentation to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Sources of records include, but are not limited to, requesters and/or their representatives under the Smallpox Vaccine Injury Compensation Program, and any other sources of information or documentation submitted by any other person or entity for inclusion in a request for the purpose of determining medical or legal eligibility for, or amount of benefits and/or compensation under, the Program (e.g., Federal, State, or local government or private health care entities participating in the administration of covered countermeasures under the Declaration).
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-15-0066" toc="yes">
<systemNumber>09-15-0066</systemNumber>
<subsection type="systemName">State-Provided Physician Records for the Application Submission &amp; Processing System, OSD, BHPr, HRSA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The Application Submission and Processing System (ASAPS) System Manager is located in Office of Shortage Designation, Bureau of Health Professions, Health Resources and Services Administration, 5600 Fishers Lane, Room 8A-08, Rockville, Maryland 20857. The actual computer server is located in Office of Information Technology, Health Resources and Services Administration, 5600 Fishers Lane, Room 10A-08, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Health care practitioners who are the subjects of databases collected and maintained by State Primary Care Offices/Associations. Such health care practitioners include physicians (both M.D.s and D.O.s), dentists, and mental health care providers, licensed or otherwise authorized by a State to provide health care services.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system will include records that show a value for each of the following fields for all of the physicians that are included in each States' database:
</p><p>&#149; Provider ID (System-Assigned).
</p> <p>&#149; Provider Type.
</p> <p>&#149; Provider Status.
</p> <p>&#149; First Name.
</p> <p>&#149; Middle Name.
</p> <p>&#149; Last Name.
</p> <p>&#149; Suffix.
</p> <p>&#149; Physician License Number.
</p> <p>&#149; Specialty Code.
</p> <p>&#149; Visa Status.
</p> <p>&#149; Federal Employee Status.
</p> <p>&#149; National Health Service Corps Status.
</p> <p>&#149; MD/DO/DDS.
</p> <p>&#149; AMA ID.
</p> <p>&#149; AOA ID.
</p> <p>&#149; Hospital Privileges Status.
</p> <p>&#149; Gender.
</p> <p>&#149; Source Type.
</p> <p>&#149; Address 1.
</p> <p>&#149; Address 2.
</p> <p>&#149; Address 3.
</p> <p>&#149; City.
</p> <p>&#149; State.
</p> <p>&#149; Zip.
</p> <p>&#149; FIPS State.
</p> <p>&#149; FIPS County.
</p> <p>&#149; Census Tract.
</p> <p>&#149; Minor Civil Division.
</p> <p>&#149; Longitude.
</p> <p>&#149; Latitude.
</p> <p>&#149; Address FTE.
</p> <p>&#149; Office Visits (Per Year).
</p> <p>&#149; New Patients Waiting Time For Appointments (days).
</p> <p>&#149; Current Patients Waiting Time For Appointments (days).
</p> <p>&#149; Average Wait for New Patient (hours).
</p> <p>&#149; Average Wait for Current Patient (hours).
</p> <p>&#149; Patient Percent--Homeless.
</p> <p>&#149; Patient Percent--Medicaid.
</p> <p>&#149; Patient Percent--Migrant Farmworker.
</p> <p>&#149; Patient Percent--Native American.
</p> <p>&#149; Patient Percent--Sliding Fee Scale.
</p> <p>&#149; Patient Percent--Language Barrier Present.
</p> <p>&#149; Patient Percent--Migrant/Seasonal Farmworker.
</p> <p>&#149; Patient Percent--Other Population.
</p> <p>&#149; Medicaid Claims.
</p> <p>&#149; Hours Given Include Time Spent in Hospital.
</p> <p>&#149; Accepts New Patients.
</p> <p>&#149; Tour Hours in Direct Patient Care for this Address.
</p> <p>&#149; Sub Specialty.
</p> <p>&#149; Sub Specialty Percent.
</p> <p>&#149; Language 1.
</p> <p>&#149; Language 1 Percent.
</p> <p>&#149; Language 2.
</p> <p>&#149; Language 2 Percent.
</p> <p>&#149; Language 3.
</p> <p>&#149; Language 3 Percent.
</p> <p>&#149; Age/Date of Birth (Dentists only).
</p> <p>&#149; Number of Auxillaries (Dentists only).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 332 of the Public Health Service Act provides that the Secretary of Health and Human Services shall designate health professional shortage areas, or HPSAs, and/or Medically Underserved Populations, or MUPs, based on criteria established by regulation. The authority for designation of HPSAs is delegated to the Bureau of Health Professions Office of Shortage Designation (OSD). Criteria and the process used for designation of HPSAs and/or MUPs were developed in accordance with the requirements of Section 332. Designation as a HPSA is a prerequisite to application for National Health Service Corps recruitment assistance. To accomplish this task, the OSD relies on data specified in 42 CFR Part 5, which implements Section 332, and HPSA and/or MUP guidelines, to review applications submitted by State Primary Care Offices (PCO) and their affiliates for designation status.</p>
</xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The sole purpose of the system is to support the Application Submission and Processing System electronic application for the development, submission, and review of applications for HPSAs and MUPs. The most critical requirement for accurate designation determinations is accurate data on the location of health care providers relative to the population. To this end, Office of Shortage Designation continually tries to obtain the latest data on health care providers and their practice location(s) at the lowest geographical level possible for use in the designation process, with the objective of minimizing the level of effort required on the part of States and communities seeking designations.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Each State Primary Care Office (and a few Primary Care Associations) may have access to provider data within their own State for Medically Underserved Population/Area (MUA/P) and/or Health Professional Shortage Area (HPSA) applications. These users will also have access to bordering States' data (one county-deep) at an aggregate level only.
</p> <p>2. Disclosure may be made to contractors engaged by the Department to geocode the physicians' address so that it may be seen on a computerized map, or to load the provider data into the Application Submission and Processing Systems. All such contractors shall be required to maintain Privacy Act safeguards with respect to such records and return all records to HRSA.
</p> <p>3. Disclosure may be made to contractors engaged by the Department to assist OSD in the review and processing of the HPSA and/or MUA/P applications received by the State offices. Such access will only be made with the State's permission (through a Data Use Agreement) and all such contractors shall be required to sign a Rules of Behavior document, maintain Privacy Act safeguards with respect to such records, and return all records to HRSA.
</p> <p>4. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file folders and in computer data files.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Retrieval of physician records is by use of personal identifiers used when entering the system.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. <i>Authorized users:</i> Access to records is limited to designated HRSA, HRSA hired contractors, and PCO/A staff. These employees are the only authorized users. HRSA maintains current lists of authorized users.
</p> <p>2. <i>Physical Safeguards:</i> All computer equipment and files are stored in areas where fire and life safety codes are strictly enforced. All automated and non-automated documents are protected on a 24-hour basis. Perimeter security includes intrusion alarms, on-site guard force, random guard patrol, key/passcard/combination controls, and receptionist controlled area. Hard copy files are maintained in a file room used solely for this purpose with access limited by combination lock to authorized users identified above. Computer files are password protected and are accessible only by use of computers which are password protected.
</p>
     <p>
         3. <i>Procedural Safeguards:</i> A password is required to access computer files. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised area. All authorized users sign a "Rules of Behavior" document. All passwords, keys and/or combinations are changed when a person leaves or no longer has authorized duties. Access to records is limited to those authorized personnel trained in accordance with the Privacy Act and ADP security procedures. The safeguards described above were established in accordance with DHHS Chapter 45-13 and supplementary chapter PHS hf:45 -13 of the General Administration Manual; and the DHHS Information Resources Management Manual, Part 6, "ADP Systems Security".
     </p>
 </xhtmlContent></subsection> <subsection type="retentionAndDisposal"><xhtmlContent><p>HRSA is working with the Records Officer and NARA to obtain the appropriate retention value.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Application Submission &amp; Processing System System Manager, Office of Shortage Designation, Bureau of Health Professions, Health Resources and Services Administration, 5600 Fishers Lane, Room 8A-08, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the Application Submission &amp; Processing System System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a fine.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>To obtain access to a record, contact the Application Submission and Processing System (ASAPS) System Manager at the address specified above. Requesters should provide the same information as is required under the Notification Procedures above. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official specified under Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant. The right to contest records is limited to information which is incomplete, incorrect, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Data are collected from the State Primary Care Offices and a few State Primary Care Association.</p></xhtmlContent></subsection> </section>

            <section id="09-15-0068" toc="yes">
                <systemNumber>09-15-0068</systemNumber>
                <subsection type="systemName">
                    C.W. Bill Young Cell Transplantation Program.
                </subsection>
                    <subsection type="securityClassification">
                        <xhtmlContent>
                                      <p>
                            None.
                        </p>
                                      </xhtmlContent>
                                      </subsection>
                <subsection type="systemLocation">
                    <xhtmlContent>
                        <p>
                            Data collected by the C.W. Bill Young Cell Transplantation Program (the Program) are maintained by the National Marrow Donor Program (NMDP) and the Medical College of Wisconsin, contractors for the Program. The Division of Transplantation within the Health Resources and Services Administration oversees the Program and the contracts with the NMDP and Medical College of Wisconsin.
                        </p>
                        <p>
                            Records associated with the C.W. Bill Young Cell Transplantation Program are located at the National Marrow Donor Program, 3001 Broadway Street, NE., Suite 500, Minneapolis, MN 55413 and Time Warner Telecom, 5488 Feltl Road, Minnetonka, MN 55343.
                        </p>
                        <p>Additional records associated with the Stem Cell Therapeutic Outcomes Database component of the Program are located at the Medical College of Wisconsin's Center for International Blood and Marrow Transplant Research (CIBMTR), 9200 W. Wisconsin Avenue, Milwaukee, WI 53226.</p>
                    
                    </xhtmlContent>
                </subsection>
                                                          <subsection type="categoriesOfIndividuals">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      1. Volunteers whose bone marrow, peripheral blood or cord blood donations are to be used for hematopoietic reconstitution or other therapeutic applications on behalf of patients in need.
                                                                  </p>
                                                                  <p>
                                                                      2. Patients searching for an unrelated donor or who are receiving transplant or ancillary services through the C.W. Bill Young Cell Transplantation Program.
                                                                  </p>
                                                                  <p>
                                                                      3. Recipients of allogeneic blood stem cell transplantation.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="categoriesOfRecords">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      Records consist of documents (printed and electronic) containing all information necessary to manage and facilitate patient searches and to track detailed post-transplant clinical status, including documentation and correspondence concerning patients in need of (or recipients of) blood stem cell transplants and volunteers listed on the Program's registry as potential blood stem cell donors. These documents include all information necessary to manage and facilitate patient searches, and to track detailed post-transplant and post-donation clinical status. The following information is maintained in the system: Individual identifiers about the recipients and donors (<i>e.g.</i>, social security number (voluntary), names, date of birth, etc.); recipient and donor demographics and socio-demographics; recipients' disease, disease history and treatment, transplant procedure details, post-transplantation medical history, events, and complications; donor medical history; donation procedure and blood stem cell product details; long-term follow-up of medical outcomes and assessment of functioning for donors and recipients; provider identifiers; transplant and collection facility identifiers; and donor management center identifiers.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="authorityForMaintenance">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      Public Law 109-129 establishes the C.W. Bill Young Cell Transplantation Program, authorizing the Department to establish by contract a system for identifying, matching, and facilitating bone marrow and cord blood transplants, including recruitment, patient advocacy and maintenance of a stem cell therapeutic outcomes database.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="purpose">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      The C.W. Bill Young Cell Transplantation Program is comprised of the Office of Patient Advocacy/Single Point of Access, the Bone Marrow Coordinating Center, the Cord Blood Coordinating Center, and the Stem Cell Therapeutic Outcomes Database. The purpose of the system is to support the Program's mission to facilitate and increase access to blood stem cell transplantation. Additionally, information in the system will be used to advise the Secretary of the Department of Health and Human Services and the Advisory Council on Blood Stem Cell Transplantation on matters related to the Program and for ongoing monitoring of the Program by the Health Resources and Services Administration to determine the effectiveness of the Program and to guide implementation of the policies and procedures that govern the Program's structure. Records from this system will be used to carry out the statutory charge of the C.W. Bill Young Cell Transplantation Program. Specifically, records vital and attendant to the full scope of activities involved at every stage of the process of facilitation of blood stem cell transplantation or other therapies for recipients suitably matched to biologically unrelated donors; analyzing factors affecting transplant outcomes; monitoring and reporting of adverse events; monitoring and reporting of quality, compliance, and performance indicators; monitoring and reporting on the size and composition of the registry of adult bone marrow donors and size and composition of the umbilical cord blood inventory; and to provide pertinent information to transplant programs, physicians, patients, other entities awarded a contract under Section 379 of the Public Health Service Act, donor registries, and cord blood banks as stated in Public Law 109-129.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="routineUsesOfRecords">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      Disclosure of records from this system of records may be made as provided in the Privacy Act, 5 U.S.C. 552a(b), and to the following recipients for the purposes stated:
                                                                  </p>
                                                                  <p>
                                                                      1. Departmental contractors who have been engaged by the Department to assist in accomplishment of a departmental function related to the purposes of this system of records and who have a need to access the records in order to carry out that function.
                                                                  </p>
                                                                  <p>
                                                                      2. Transplant centers, physicians and staff, and NMDP participating organizations, for the purpose of searching for donors or products and/or facilitating transplants, matching donor blood stem cells with recipients, monitoring participant outcomes, and monitoring compliance of member organizations with contractor requirements.
                                                                  </p>
                                                                  <p>
                                                                      3. Personnel involved in the care of volunteer blood stem cell donors and management of their participation in the Program. Disclosures of clinically relevant de-identified information contained in certain donor records may be made to transplant physicians, patients or their designated representatives for purposes of facilitating searches for blood stem cell donors or products and/or facilitation of unrelated donor transplants.
                                                                  </p>
                                                                  <p>
                                                                      4. Disclosures may be made by the contractors for the Office of Patient Advocacy/Single Point of Access, the Bone Marrow Coordinating Center, the Cord Blood Coordinating Center, the Stem Cell Therapeutic Outcomes Database, NMDP and CIBMTR participating centers to one another and their subcontractors (so long as such subcontractors are contractually bound to comply with the Privacy Act) as well as participating umbilical cord blood banks to carry out the purposes of the C.W. Bill Young Cell Transplantation Program.
                                                                  </p>
                                                                  <p>
                                                                      5. Disclosure may be made to the Department of Justice when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity; (c) any employee of the agency in his or her individual capacity where agency or the Department of Justice has agreed to represent the employee; or (d) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records by the Department of Justice is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
                                                                  </p>
                                                                  <p>
                                                                      6. Disclosure may be made to a court or adjudicative body in a proceeding when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity; (c) any employee of the agency in his or her individual capacity where agency or the Department of Justice has agreed to represent the employee; or (d) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
                                                                  </p>
                                                                  <p>
                                                                      7. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
                                                                  </p>
                                                                  <p>
                                                                      8. Disclosure may be made for research purposes. Rarely, with the appropriate safeguards and consistent with the applicable provisions of the Privacy Act and the Common Rule (45 CFR Part 46), disclosure for research purposes may be made when the Department, independently or through its contractor(s): (a) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (b) has determined that a bona fide research/analysis purpose exists; (c) has required the recipient to: (1) Establish strict limitations concerning the receipt and use of patient-identified data; (2) establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; (3) remove, destroy, or return the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information; and (4) make no further use or disclosure of the record except as authorized by HHS or its contractor(s) or when required by law; (d) has determined that other applicable safeguards or protocols will be followed; and (e) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
                                                                  </p>
                                                                  <p>
                                                                      9. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="policiesAndPractices">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      Records are maintained in file folders and in computer data files.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="retrievability">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      Patient and donor records may be retrieved by a unique ID assigned by the system or through the use of other identifying information ( <i>e.g.</i>, names, date of birth, Social Security Number, or address).
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="safeguards">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      1. <i>Authorized users:</i> Access is limited to authorized personnel responsible for administering the program, including program managers and program specialists who have responsibilities for implementing the program and the HRSA Information Systems Security Officer. The contractor(s) shall maintain current lists of authorized users. Retrieval of donor or patient records will be limited to authorized users for search, outcomes data collection and data auditing, or transplant management purposes.
                                                                  </p>
                                                                  <p>
                                                                      2. <i>Assign Responsibility for Security:</i> Responsibility is assigned to a management official knowledgeable of the nature of the information and processes supported by the C.W. Bill Young Cell Transplantation Program and in the management, personnel, operational, and technical controls used to protect it.
                                                                  </p>
                                                                  <p>
                                                                      3. <i>Perform Risk Assessment:</i> A risk assessment was conducted in conjunction with the development of the system. The system design ensures vulnerabilities, risks, and other security concerns are identified and addressed in the system design and throughout the life cycle of the project. This is consistent with the HHS Automated Information Systems Security Program Handbook.
                                                                  </p>
                                                                  <p>
                                                                      4. <i>Certification and Accreditation:</i> The Program's electronic data systems are certified under the auspices of HRSA's Office of Information Technology Certification and Accreditation system.
                                                                  </p>
                                                                  <p>
                                                                      5. <i>Physical safeguards:</i> All computer equipment and files and hard copy files are stored in areas where fire and life safety codes ( <i>e.g.</i>, OSHA standards) are strictly enforced. All automated and non-automated documents are protected on a 24-hour basis. Perimeter security includes intrusion alarms, key/passcard/combination controls, and receptionist controlled area. Most hard copy files are maintained in a file room used solely for purposes of the Program with access limited by combination lock to authorized users identified above. Computer files are password protected and are accessible only by use of computers which are password protected. Servers are password protected and protected in locked rooms, with access restricted to specific authorized staff using controls specified in the certification and accreditation process.
                                                                  </p>
                                                                  <p>
                                                                      6. <i>Procedural safeguards:</i> A password is required to access computer files. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised area. All authorized users sign a nondisclosure statement. All passwords, keys and/or combinations are changed when a person leaves or no longer has authorized duties. Access to records is limited to those authorized personnel trained in accordance with the Privacy Act and automated data processing (ADP) security procedures. The transmission of records is protected using secure protocols. Individuals with access to the system have User IDs and passwords and must be granted access to the system. External access to the data requires two-factor authentication. The safeguards described above were established in accordance with NIST 800-53 and OMB Circular A-130 Appendix III.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="retentionAndDisposal">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      HRSA is working with the National Archives and Records Administration (NARA) to obtain the appropriate retention value of these records.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="systemManager">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      Director, Blood Stem Cell Transplantation Program, HRSA, Parklawn Building, Room 12C-06, 5600 Fishers Lane, Rockville, MD 20857.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="notificationProcedure">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      Requests must be made to the System Manager.
                                                                  </p>
                                                                  <p><i>Requests by mail:</i> Requests for information and/or access to records received by mail must contain information providing the identity of the writer, and a reasonable description of the record desired, and whom it concerns. Written requests must contain the name and address of the requester, his/her date of birth and his/her signature. Requests must be notarized to verify the identity of the requester, or the requester must certify that (s)he is the individual who (s)he claims to be and that (s)he understands that to knowingly and willfully request or acquire a record pertaining to another individual under false pretenses is a criminal offense under the Privacy Act subject to a $5,000 fine (45 CFR 5b.5(b)(2)(ii)).
                                                                  </p>
                                                                  <p>
                                                                      Requests in person or by telephone, electronic mail or facsimile cannot be honored.
                                                                  </p>
                                                                  <p><i> Requests in Person: </i> No requests in person at the system location will be honored.
                                                                  </p>
                                                                  <p><i> Requests by Telephone: </i> Since positive identification of the caller cannot be established, telephone requests are not honored.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="recordAccessProcedures">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      Record access procedures are the same as notification procedures. Requesters should also provide a reasonable description of the contents of the record being sought. A parent or guardian who requests notification of, or access to, a minor's/incompetent person's record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the minor/incompetent person as well as his/her own identity. Records will be mailed only to the requester's address that is on file, unless a different address is demonstrated by official documentation.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="contestingRecordProcedures">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      To contest a record in the system, contact the official at the address specified above and reasonably identify the record, specify the information being contested, and state the corrective action sought and the reason(s) for requesting the correction, along with supporting documentation to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="recordSourceCategories">
                                                              <xhtmlContent>
                                                                  <p>
                                                                      Sources of records include, but are not limited to, patients, donors, and/or their representatives under the C.W. Bill Young Cell Transplantation Program and any other sources of information or documentation submitted by any other person or entity for inclusion in a request for the purpose of facilitating and monitoring blood stem cell transplantation (<i>e.g.</i>, transplant center healthcare professionals).
                                                                  </p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                          <subsection type="exemptionsClaimed">
                                                              <xhtmlContent>
                                                                  <p>None.</p>
                                                              </xhtmlContent>
                                                          </subsection>
                                                      </section>
                <section id="09-15-0069" toc="yes">
                    <systemNumber>09-15-0069</systemNumber>
                    <subsection type="systemName">Campus Based Branch (CBB) Program Document Management System (DMS), HHS/HRSA/BHPr.</subsection>
                    <subsection type="securityClassification">
                        <xhtmlContent>
                            <p>
                                None.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="systemLocation">
                        <xhtmlContent>
                            <p>
                                The Division of Student  Loans and Scholarships of the Bureau of Health Professions (BHPr), Health Resources and Services Administration (HRSA), Department of Health and Human Services (HHS). Records are located at 5600 Fishers Lane, Room 9-105, Rockville, MD 20857.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="categoriesOfIndividuals">
                        <xhtmlContent>
                            <p>
                                Student and faculty borrowers who participate/participated in CBB loan and scholarship programs.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="categoriesOfRecords">
                        <xhtmlContent>
                            <p>
                                The system includes materials such as:
                            </p>
                            <p>
                                1. Names, addresses, phone numbers, financial information, and social security numbers of borrowers.
                            </p>
                            <p>
                                2. Annual Operating Reports that contain financial information from institutions, including aggregate amounts of loans disbursed, collected and retired.
                            </p>
                            <p>
                                3. Performance reports on the aggregate number of borrowers, their classification in race/ethnicity categories, and whether they are practicing in primary care.
                            </p>
                            <p>
                                4. Contact information of financial aid officers that include name, title, school address and direct phone number.
                            </p>
                            <p>
                                5. Correspondence from the financial aid officers regarding issues with specific borrowers. The majority of these correspondences only indicate the borrower's name and/or amount borrowed.
                            </p>
                            <p>
                                6. Correspondence from borrowers on specific issues on CBB programs or the school that administers the programs. These correspondences may include the borrower's name, address and phone number.
                            </p>
                            <p>
                                7. Case reports from educational institutions on borrowers for whom the school is claiming an uncollectible debt. The documents contained in these case reports may include name, address, financial income information, medical records and social security numbers.
                            </p>
                            <p>
                                8. Any other correspondence or documentation related to general or specific issues regarding CBB programs at institutions or borrowers who participate in CBB programs.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="authorityForMaintenance">
                        <xhtmlContent>
                            <p>
                                Section 721 of the Public Health Service Act (42 U.S.C. 292q), Health Professions Student Loan; Section 835 of the Public Health Service Act (42 U.S.C. 297a), Nursing Student Loan; Section 723 of the Public Health Service Act (42 U.S.C. 292s), Primary Care Loan; Section 724 of the Public Health Service Act (42 U.S.C. 292t), Loans for Disadvantaged Students; Section 737 of the Public Health Service Act (42 U.S.C. 293a), Scholarships for Disadvantaged Students.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="purpose">
                        <xhtmlContent>
                            <p>
                                The purpose of the DMS system is to support the CBB in monitoring its programs, in order to ensure the efficiency of the factual information in reports and documents, and to archive the documents for efficient access and verification.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="routineUsesOfRecords">
                        <xhtmlContent>
                            <p>
                                Records maintained in the system above, disclosure of which is governed by the System of Records Notice for the "Campus Based Branch Program Document Management System, HHS/HRSA/BHPr" may be disclosed to others:
                            </p>
                            <p>
                                1. HRSA may disclose records to Department contractors and subcontractors for the purpose of assisting CBB in reviewing cases and maintaining systems, including conducting data analysis for program evaluations, compiling managerial and statistical reports, and record systems processing and refinement. Contractors will maintain, and are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records.
                            </p>
                            <p>
                                2. Disclosure may be made to a Congressional office from the record of an individual or institutional participant, in response to any inquiry from the Congressional office made at the written request of that individual.
                            </p>
                            <p>
                                3. Disclosure may be made to the Department of Justice, or to a court or other tribunal, from this system of records, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof, where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in such case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
                            </p>
                            <p>
                                4. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.
                            </p>
                            <p>
                                5. HRSA may disclose from this system of records a delinquent debtor's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose, to the Treasury Department, Internal Revenue Service (IRS), to request a debtor's current mailing address to locate him/her for purposes of collecting a debt. This address may be disclosed by HRSA to any school from which the defaulted borrower received the student loan, for use only by officers, employees, or agents of the school whose duties relate to the collection of health professions or nursing student loan funds, to locate the defaulted borrower to collect the loan. Any school which requests and obtains this address information must comply with the requirements of HRSA and the IRS regarding the safeguarding and proper handling of this information.
                            </p>
                            <p>
                                6. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="policiesAndPractices">
                        <xhtmlContent>
                            <p>
                                Storage:
                            </p>
                            <p>
                                Records are maintained in the DMS or in file folders and/or computer data files.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="retrievability">
                        <xhtmlContent>
                            <p>
                                Retrieval of data and case files is by subject's name or institution ID.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="safeguards">
                        <xhtmlContent>
                            <p>
                                &#149; Authorized users: Access is limited to authorized HHS staff and contractors in performance of their duties. Authorized personnel include the contractor/system manager and his staff who have responsibilities for administering the programs. HRSA maintains current lists of authorized users. Institutions do not have remote access to this system.
                            </p>
                            <p>
                                &#149; Physical safeguards: The DMS is housed on an HRSA server behind a firewall. The DMS is an intra-office system only for the sole use of CBB staff. All computer equipment and files and hard copy files are stored in areas where fire and life safety codes are strictly enforced. All automated and non-automated documents are protected on a 24-hour basis. Perimeter security includes intrusion alarms, on-site guard force, random guard patrol, key/passcard/combination controls, and receptionist controlled area. Hard copy files are maintained in a file room used solely for this purpose with access limited by combination lock to authorized users identified above. Computer files are password protected and are accessible only by use of computers which are password protected.
                            </p>
                            <p>
                                &#149; Procedural safeguards: A password is required to access computer files. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised area. All passwords, keys and/or combinations are changed when a person leaves or no longer has authorized duties. Access to records is limited to those authorized personnel trained in accordance with the Privacy Act and ADP security procedures. The safeguards described above were established in accordance with DHHS chapter 45-13 and supplementary chapter PHS hf: 45-13 of the General Administration Manual; and the DHHS Information  Resources Management Manual, Part 6, "ADP Systems Security."
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="retentionAndDisposal">
                        <xhtmlContent>
                            <p>
                                HRSA is working with the Records Officer and NARA to obtain the appropriate retention value.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="systemManager">
                        <xhtmlContent>
                            <p>
                                Director, Division of Student Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, Department of Health and Human Services, 5600 Fishers Lane, Room 9-105, Rockville, Maryland 20857.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="notificationProcedure">
                        <xhtmlContent>
                            <p>
                                Requests concerning whether the system contains records about you should be made to the Systems Manager. When requesting notification of or access to records covered by this Notice, an individual must provide his/her full name, date of birth, and other proof of identity as required for Privacy Requests.
                            </p>
                            <p>
                                &#149; Request in person: A subject individual who appears in person at a specific location seeking access or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of tangible identification such as driver's license, passport, voter registration card, or union card. Identification papers with current photographs are preferred but not required. Additional identification may be requested when there is a request for access to records which contain an apparent discrepancy between information contained in the records and that provided by the individual requesting access to the records. Where the subject individual has no identification papers, the responsible agency official shall require that the subject individual certify in writing that he/she is the individual who he/she claims to be and that he/she understands that the knowing and willful request or acquisition of a record concerning an individual under false pretenses is a criminal offense subject to a $5,000 fine.
                            </p>
                            <p>
                                &#149; Requests by telephone: Because positive identification of the caller cannot be established, no requests by telephone will be honored.
                            </p>
                            <p>
                                &#149; Requests by mail: A written request must contain the name and address of the requester, and his/her signature which is either notarized to verify his/her identify or includes a written certification that the requester is the person he/she claims to be and that he/she understands that the knowing and willful request or acquisition of records pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="contestingRecordProcedures">
                        <xhtmlContent>
                            <p>
                                Any record subject may contest the accuracy of information on file at CBB by writing to the Director, Division of Student Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, Department of Health and Human Services, 5600 Fishers Lane, Room 9-105, Rockville, Maryland 20857. The request should contain a reasonable description of the record, specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="recordSourceCategories">
                        <xhtmlContent>
                            <p>
                                1. Educational institutions participating in CBB programs.
                            </p>
                            <p>
                                2. Financial aid officers administering CBB programs.
                            </p>
                            <p>
                                3. Student borrowers and recipients participating in CBB programs.
                            </p>
                            <p>
                                4. Borrowers submitted for uncollectible debt write-offs.
                            </p>
                        </xhtmlContent>
                    </subsection>
                    <subsection type="systemsExempted">
                        <xhtmlContent>
                            <p>None.</p>
                        </xhtmlContent>
                    </subsection>
                
                </section>

        <section id="09-15-0071" toc="yes">
            <systemNumber>09-15-0071</systemNumber>
            <subsection type="systemName">Countermeasures Injury Compensation Program, HHS/HRSA/HSB.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        Healthcare Systems Bureau (HSB), Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 11C-06, Rockville, Maryland 20857.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>
                        Individuals covered by the system are injured countermeasure recipients or their representatives, survivors of such recipients or their representatives, and representatives of the estates of deceased injured countermeasure recipients, filing for benefits under the Countermeasures Injury Compensation Program (CICP or the Program).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        Records consist of documents that may include, but are not limited to, general or congressional correspondence, requests, case number assignment, HHS responses to correspondence, medical and legal documentation, employment documentation, documentation concerning services or benefits available from the United States or any third party (including any State or local governmental entity, private insurance carrier, or employer), payment information, and other related case processing documents.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>
                        The authority for maintaining this system of records is 42 U.S.C. 247d-6e. Management of the system is authorized by Public Law 109-148, the Public Readiness and Emergency Preparedness Act (PREP Act), enacted on December 30, 2005 (42 U.S.C. 247d-6e).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>
                        The purpose of the system is to provide benefits to certain individuals who have sustained a covered injury as a result of the administration or use of a covered countermeasure, and to provide benefits to the survivors and/or estates of deceased injured countermeasure recipients. Requests for Benefits must be submitted to the CICP no later than (one) 1 year from the date the recipient was administered or used a covered countermeasure.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>
                        1. Disclosure may be made to a Congressional office from the record of a subject individual, in response to an inquiry from the Congressional office made at the written request of that individual or his/her legal or personal representative.
                    </p> 
                    <p>
                        2. Disclosure may be made to Federal, State or local Government entities or to private entities for the purpose of their providing information relevant to medical, legal, or financial (e.g., insurance, payment) documentation required for determinations of eligibility or payment, provided that such disclosure is compatible with the purpose for which the records were collected.
                    </p> 
                    <p>
                        3. Disclosure of records may be made to contractors engaged by the Department who need access to the records in order to assist the Department, <i>e.g.,</i> medical experts or consultants providing advice on requesters' eligibility for benefits. All such individuals shall be required to maintain Privacy Act safeguards with respect to such records and return all records to HRSA and not retain any copies.
                    </p> 
                    <p>
                        4. Disclosure of records may be made to contractors engaged by the Department who need access to the records in order to assist the Department in evaluating the effectiveness of the CICP.
                    </p> 
                    <p>
                        5. Disclosure of records may be made to individuals and/or entities as necessary for the purposes of obtaining financial advice and providing benefits to requesters approved for payment under the Program. All individuals and/or entities permitted disclosure for this use shall be required to maintain Privacy Act safeguards with respect to such records and return all records to HRSA without retaining any copies.
                    </p> 
                    <p>
                        6. Disclosure of records may be made to a Federal agency assisting in the accomplishment of a Departmental function relating to the purposes of this system of records, provided that such disclosure is compatible with the purposes for which the records are collected, or to a Federal agency administering aspects of the Program, as authorized by a Memorandum of Agreement between the Secretary or her designee and the head of the Federal agency or designee.
                    </p> 
                    <p>
                        7. Disclosure of records may be made in the event of litigation where the defendant is:
                    </p>
                    <p>
                        (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity;
                    </p>
                    <p>
                        (b) the United States where the Department determines that the action, if successful, is likely to affect directly the operation of the Department or any of its components; or
                    </p>
                    <p>
                        (c) any Department employee in his or her individual capacity where the Department of Justice (DOJ) has agreed to represent such employee, for example, in defending an action against the Department in connection with such individual, disclosure may be made to DOJ to enable DOJ to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
                    </p> 
                    <p>
                        8. Disclosure may be made in the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, rule, regulation or order issued pursuant thereto, provided that such disclosure is compatible with the purpose for which the records were collected.
                    </p> 
                    <p>
                        9. A record may be disclosed to researchers for a scientific research purpose, only when the Department has determined:
                    </p>
                    <p>
                        (a) That the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;
                    </p>
                    <p>
                        (b) That the research purpose is consistent with the purpose for which the Program was formed;
                    </p>
                    <p>
                        (c) That the proposed research is scientifically sound in its methods and analyses and is likely to answer the proposed research question;
                    </p>
                    <p>
                        (d) That the information sought is not available from any other source;
                    </p>
                    <p>
                        (e) That the record made available for scientific research is redacted of all personal identifiers regarding injured individuals, health care practitioners and employers that are not essential for the accomplishment of the approved research purpose, and;
                    </p>
                    <p>
                        (f) That the recipient of records for scientific research purposes:
                    </p>
                    <p>
                        (1) Established strict limitations acceptable to the Department concerning the receipt and use of any patient-identifiable data;
                    </p>
                    <p>
                        (2) Established reasonable administrative, technical, and physical safeguards and/or protocols acceptable to the Department to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record;
                    </p>
                    <p>
                        (3) Removes or destroys the information that identifies an individual at the earliest time that removal or destruction can be accomplished consistent with the purpose of the research project;
                    </p>
                    <p>
                        (4) Makes no further use or disclosure of the record except when required by law; and
                    </p>
                    <p>
                        (5) Secures and approves a written statement attesting to the recipient's understanding of, and agreement to abide by, these conditions of disclosure.
                    </p> 
                    <p>Violation of these provisions is subject to penalties set forth under 5 U.S.C. 552a(i)(3) and any other applicable Federal law.</p>
                    <p>
                        10. Disclosure of records may be made to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p> 
                    <p>
                        Records are maintained in file folders, on computer hard drives and shared drives, and/or in electronic media storage.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        Records can be retrieved by the requester's name and by the case number assigned based on the order in which the Letter of Intent to File a Request for Benefits or the Request for Benefits form is filed.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        1. Assign Responsibility for Security: Responsibility is assigned to a CICP management official who is knowledgeable about the nature of the information in this system of records, the process of reviewing records contained in it, and in the management, personnel, operational, and technical controls used to protect it.
                    </p> 
                    <p>
                        2. Perform Risk Assessment: A risk assessment is to be conducted in conjunction with the development of, and prior to the approval of, the system design and will ensure that vulnerabilities, risks, and other security concerns are identified and addressed in the system design and throughout the life cycle of the project. This is consistent with the Information Security Program Policy, HHS IRM Policy 2004-002.001 (Dec. 15, 2004), Section 3.7.3.
                    </p> 
                    <p>
                        3. Develop CICP Request Security Plan: Plan for the adequate security of the CICP Request for Benefits system, taking into account the security of all systems in which Requests for Benefits will operate. CICP request security plans shall address request rules, training on use of the system, personnel security, contingency planning, technical controls, information sharing, and public access controls.
                    </p> 
                    <p>
                        4. Review CICP Request for Benefits System Controls: Perform an independent review or audit of the CICP Request for Benefits system security control in accordance with applicable Federal requirements and/or guidelines.
                    </p> 
                    <p>
                        5. Authorize Processing: Ensure that a management official authorizes, in writing, confirmation that the security plan as implemented adequately secures the CICP Request for Benefits system. The CICP Request for Benefits system must be authorized prior to operating and reauthorized in accordance with applicable Federal requirements and/or guidelines.
                    </p> 
                    <p>
                        6. Implementation Guidelines: DHHS Chapter 45-13 "Safeguarding Records Contained in Systems of Records;" the Information Security Program Policy, HHS IRM Policy 2004-002.001 (Dec. 15, 2004); and Appendix III to OMB Circular No. A-130 "Security of Federal Automated Information Resources;" Appendix I to OMB Circular No. A-130, "Federal Agency Responsibilities for Maintaining Records About Individuals."
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        HRSA is working with NARA to obtain the appropriate retention value. Records will be retained and disposed of in accordance with the Records Control Schedule of the Health Resources and Services Administration.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        Director, Countermeasures Injury Compensation Program, Healthcare Systems Bureau, Health Resources and Services Administration, 5600 Fishers Lane, Room 11C-06, Rockville, Maryland 20857, or the Director's designee.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        Requests must be made to the System Manager.
                    </p> 
                    <p><i>Requests by mail:</i> Requests for information and/or access to records received by mail must contain information providing the identity of the writer, and a reasonable description of the record desired, and whom it concerns. Written requests must contain the name and address of the requester, his/her date of birth and his/her signature for comparison purposes. Requests must be notarized to verify the identity of the requester, or the requester must certify that (s)he is the individual who (s)he claims to be and that (s)he understands that to knowingly and willfully request or acquire a record pertaining to another individual under false pretenses is a criminal offense under the Privacy Act subject to a $5,000 fine (45 CFR 5b.5(b)(2)(ii)).
                    </p> 
                    <p><i>Requests in person:</i> Record access procedures are the same as notification procedures. The requester should provide a reasonable description of the contents of the record being sought. Records will be mailed only to the requester's address that is on file, unless a different address is demonstrated by official documentation. A parent or guardian who requests notification of, or access to, a minor/legally incompetent person's medical records must verify his/her relationship to the minor/legally incompetent person as well as his/her own identity and shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent.
                    </p> 
                    <p><i>Requests by telephone/facsimile/electronic mail:</i> Since positive identification of the requester cannot be established, telephone, facsimile, or electronic mail (e-mail) requests will not be honored.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>
                        Record access procedures are the same as Requests in Person procedures above.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>
                        To contest a record in the system, contact the System Manager at the address specified above and reasonably identify the record, stipulate the information being contested, state the corrective action sought and the reason(s) for requesting the correction, along with supporting documentation to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        Sources of records include, but are not limited to, countermeasure recipients and/or their legal or personal representatives under the Countermeasures Injury Compensation Program, and any other sources of information or documentation submitted by any other person or entity for inclusion in a request for the purpose of determining medical or legal eligibility for, or amount of benefits and/or compensation under, the Program (<i>e.g.,</i> Federal, State, or local government or private health care entities participating in the administration of covered countermeasures under a Secretarial declaration).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemsExempted">
                <xhtmlContent>
                    <p>None.</p>
                </xhtmlContent>
            </subsection>
        </section>
        <section id="09-17-0001" toc="yes">
<systemNumber>09-17-0001</systemNumber>
<subsection type="systemName">Medical, Health, and Billing Records Systems, Health and Human Services/Indian Health Service/Office of Clinical and Preventive Services (HHS/IHS/OCPS).</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>IHS hospitals, health centers, school health centers, health stations, field clinics, Service Units, IHS Area Offices (Appendix 1), and Federal Archives and Records Centers (Appendix 2). Automated, electronic health and computerized records, including but not limited to clinical information and Patient Care Component (PCC) records, are stored in the Resource and Patient Management System (RPMS) at the National Programs/Office of Information Technology (NP/OIT), IHS, located in Albuquerque, New Mexico. Records may also be located at contractor sites. A current list of contractor sites is available by writing to the appropriate System Manager (Area or Service Unit Director/Chief Executive Officer) at the address shown in Appendix 1.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals, including both IHS beneficiaries and non-beneficiaries, who are examined/treated on an inpatient and/or outpatient basis by IHS staff and/or contract health care providers (including Tribal contractors).
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Note:
</p><p>Records relating to claims by and against the HHS are maintained in the Privacy Act System of Records (PASOR) Notice, Administrative Claims System, 09-90-0062, HHS/Office of the Secretary/Office of the General Counsel (HHS/OS/OGC). Such claims include those arising under the Federal Torts Claims Act, Military Personnel and Civilian Employees Claims Act, Federal Claims Collection Act, Federal Medical Care Recovery Act, and the Act for Waiver of Overpayment of Pay.
</p> <p>1. Health and medical records containing examination, diagnostic and treatment data, proof of IHS eligibility, social data (such as name, address, date of birth, Social Security Number (SSN), Tribe), laboratory test results, and dental, social service, domestic violence, sexual abuse and/or assault, mental health, and nursing information.
</p> <p>2. Follow-up registers of individuals with a specific health condition or a particular health status such as cancer, diabetes, communicable diseases, suspected and confirmed abuse and neglect, immunizations, suicidal behavior, or disabilities.
</p> <p>3. Logs of individuals provided health care by staff of specific hospital or clinic departments such as surgery, emergency, obstetric delivery, medical imaging, and laboratory.
</p> <p>4. Surgery and/or disease indices for individual facilities that list each relevant individual by the surgery or disease.
</p> <p>5. Monitoring strips and tapes such as fetal monitoring strips and Electroencephalogram (EEG) and Electrocardiogram (EKG) tapes.
</p> <p>6. Third-party reimbursement and billing records containing name, address, date of birth, dates of service, third party insurer claim numbers, SSN, health plan name, insurance number, employment status, and other relevant claim information necessary to process and validate third-party reimbursement claims.
</p> <p>7. Contract Health Service (CHS) records containing name, address, date of birth, dates of care, Medicare or Medicaid claim numbers, SSN, health plan name, insurance number, employment status, and other relevant claim information necessary to determine CHS eligibility and to process CHS claims.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Departmental Regulations (5 U.S.C. 301); Privacy Act of 1974 (5 U.S.C. 552a); Federal Records Act (44 U.S.C. 2901); Section 321 of the Public Health Service Act, as amended (42 U.S.C. 248); Section 327A of the Public Health Service Act, as amended (42 U.S.C. 254a); Snyder Act (25 U.S.C. 13); Indian Health Care Improvement Act (25 U.S.C. 1601 <i>et seq.</i>); and the Transfer Act of 1954 (42 U.S.C. 2001-2004).</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purposes of this system are:
</p><p>1. To provide a description of an individual's diagnosis, treatment and outcome, and to plan for immediate and future care of the individual.
</p> <p>2. To collect and provide information to IHS officials and epidemiology centers established and funded under 25 U.S.C. 1621m in order to evaluate health care programs and to plan for future needs.
</p> <p>3. To serve as a means of communication among members of the health care team who contribute to the individual's care; <i>e.g.,</i> to integrate information from field visits with records of treatment in IHS facilities and with non-IHS health care providers.</p>
<p>4. To serve as the official documentation of an individual's health care.
</p> <p>5. To contribute to continuing education of IHS staff to improve the delivery of health care services.
</p> <p>6. For disease surveillance purposes. For example:
</p><p>(a) The Centers for Disease Control and Prevention may use these records to monitor various communicable diseases;
</p><p>(b) The National Institutes of Health may use these records to review the prevalence of particular diseases (<i>e.g.,</i> malignant neoplasms, diabetes mellitus, arthritis, metabolism, and digestive diseases) for various ethnic groups of the United States; or
</p><p>(c) Those public health authorities that are authorized by law and epidemiology centers established and funded under 25 U.S.C. 1621m may use these records to collect or receive such information for purposes of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death and the conduct of public health surveillance, investigations, and interventions.
</p> <p>7. To compile and provide aggregated program statistics. Upon request of other components of HHS, IHS will provide statistical information, from which individual/personal identifiers have been removed, such as:
</p><p>(a) To the National Committee on Vital and Health Statistics for its dissemination of aggregated health statistics on various ethnic groups;
</p><p>(b) To the Assistant Secretary for Planning and Evaluation, Health Policy to keep a record of the number of sterilizations provided by Federal funding;
</p><p>(c) To the Centers for Medicare &amp; Medicaid Services (CMS) to document IHS health care covered by the Medicare and Medicaid programs for third-party reimbursement; or
</p><p>(d) To the Office of Clinical Standards and Quality, CMS to determine the prevalence of end-stage renal disease among the American Indian and Alaska Native (AI/AN) population and to coordinate individual care.
</p> <p>8. To process and collect third-party claims and facilitate fiscal intermediary functions and to process debt collection activities.
</p> <p>9. To improve the IHS national patient care database by means of obtaining and verifying an individual's SSN with the Social Security Administration (SSA).
</p> <p>10. To provide information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs to facilitate organ, eye, or tissue donation and transplant.
</p> <p>11. To provide information to individuals about treatment alternatives or other types of health-related benefits and services.
</p> <p>12. To provide information to the Food and Drug Administration (FDA) in connection with an FDA-regulated product or activity.
</p> <p>13. To provide information to correctional institutions as necessary for health and safety purposes.
</p> <p>14. To provide information to governmental authorities (<i>e.g.,</i> social services or protective services agencies) on victims of abuse, neglect, sexual assault or domestic violence.
</p> <p>15. To provide information to the National Archives and Records Administration in records management inspections conducted under the authority of 44 U.S.C. 2901 <i>et seq.</i>
</p><p>16. To provide relevant health care information to funeral directors or representatives of funeral homes to allow necessary arrangements prior to and in anticipation of an individual's impending death.</p>
</xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>This system of records contains individually identifiable health information. The HHS Privacy Act Regulations (45 CFR Part 5b) and the Privacy Rule (45 CFR Parts 160 and 164) issued pursuant to the Health Insurance Portability and Accountability Act (HIPAA) of 1996 apply to most health information maintained by IHS. Those regulations may place additional procedural requirements on the uses and disclosures of such information beyond those found in the Privacy Act of 1974 or mentioned in this system of records notice. An accounting of all disclosures of a record made pursuant to the following routine uses will be made and maintained by IHS for five years or for the life of the records, whichever is longer.
</p> <p>Note:
</p><p>Special requirements for alcohol and drug abuse patients: If an individual receives treatment or a referral for treatment for alcohol or drug abuse, then the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2, may apply. In general, under these regulations, the only disclosures of the alcohol or drug abuse record that may be made without patient consent are: (1) To meet medical emergencies (42 CFR 2.51), (2) for research, audit, evaluation and examination (42 CFR 2.52-2.53), (3) pursuant to a court order (42 CFR 2.61-2.67), and (4) pursuant to a qualified service organization agreement, as defined in 42 CFR 2.11.
</p> <p>In all other situations, written consent of the individual is usually required prior to disclosure of alcohol or drug abuse information under the routine uses listed below.
</p> <p>1. Records may be disclosed to Federal and non-Federal (public or private) health care providers that provide health care services to IHS individuals for purposes of planning for or providing such services, or reporting results of medical examination and treatment.
</p> <p>2. Records may be disclosed to Federal, State, local or other authorized organizations that provide third-party reimbursement or fiscal intermediary functions for the purposes of billing or collecting third-party reimbursements. Relevant records may be disclosed to debt collection agencies under a business associate agreement arrangement directly or through a third party.
</p> <p>3. Records may be disclosed to State agencies or other entities acting pursuant to a contract with CMS, for fraud and abuse control efforts, to the extent required by law or under an agreement between IHS and respective State Medicaid agency or other entities.
</p> <p>4. Records may be disclosed to school health care programs that serve AI/AN for the purpose of student health maintenance.
</p> <p>5. Records may be disclosed to the Bureau of Indian Affairs (BIA) or its contractors under an agreement between IHS and the BIA relating to disabled AI/AN children for the purposes of carrying out its functions under the Individuals with Disabilities Education Act (IDEA), 20 U.S.C. 1400, <i>et seq.</i>
</p><p>6. Records may be disclosed to organizations deemed qualified by the Secretary of HHS and under a business associate agreement to carry out quality assessment/improvement, medical audits, utilization review or to provide accreditation or certification of health care facilities or programs.
</p> <p>7. Records may be disclosed under a business associate agreement to individuals or authorized organizations sponsored by IHS, such as the National Indian Women's Resource Center, to conduct analytical and evaluation studies.
</p> <p>8. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. An IHS-810 form, Authorization for Use or Disclosure of Protected Health Information, is required for the disclosure of sensitive PHI (<i>e.g.,</i> alcohol/drug abuse patient information, Human Immunodeficiency Virus/Acquired Immune Deficiency Syndrome (HIV/AIDS), Sexually Transmitted Diseases (STDs), or mental health) that is maintained in the medical record.
</p> <p>9. Records may be disclosed for research purposes to the extent permitted by:
</p><p>(a) Determining that the use(s) or disclosure(s) are met under 45 CFR 164.512(i), or
</p><p>(b) Determining that the use(s) or disclosure(s) are met under 45 CFR 164.514(a) through (c) for de-identified PHI, and 5 U.S.C. 552a(b) (5), or
</p><p>(c) Determining that the requirements of 45 CFR 164.514(e) for limited data sets, and 5 U.S.C. 552a(b)(5) are met.
</p> <p>10. Information from records, including but not limited to information concerning the commission of crimes, suspected cases of abuse (including child, elder and sexual abuse), the reporting of neglect, sexual assault or domestic violence, births, deaths, alcohol or drug abuse, immunization, cancer, or the occurrence of communicable diseases, may be disclosed to public health authorities, epidemiology centers established and funded under 25 U.S.C. 1621m, and other appropriate government authorities which are authorized by applicable Federal, State, Tribal or local law or regulations to receive such information.</p>
<p>Note:
</p><p>In Federally conducted or assisted alcohol or drug abuse programs, under 42 CFR Part 2, disclosure of patient information for purposes of criminal investigations must be authorized by court order issued under 42 CFR 2.65, except that reports of suspected child abuse may be made to the appropriate State or local authorities under State law.
</p> <p>11. Information may be disclosed from these records regarding suspected cases of child abuse to:
</p><p>(a) Federal, State or Tribal agencies that need to know the information in the performance of their duties, and
</p><p>(b) Members of community child protection teams for the purposes of investigating reports of suspected child abuse, establishing a diagnosis, formulating or monitoring a treatment plan, and making recommendations to the appropriate court. Community child protection teams are comprised of representatives of Tribes, the BIA, child protection service agencies, the judicial system, law enforcement agencies and IHS.
</p> <p>12. IHS may disclose information from these records in litigations and/or proceedings related to an administrative claim when:
</p><p>(a) IHS has determined that the use of such records is relevant and necessary to the litigation and/or proceedings related to an administrative claim and would help in the effective representation of the affected party listed in subsections (i) through (iv) below, and that such disclosure is compatible with the purpose for which the records were collected. Such disclosure may be made to the HHS/OGC and/or Department of Justice (DOJ), pursuant to an agreement between IHS and OGC, when any of the following is a party to litigation and/or proceedings related to an administrative claim or has an interest in the litigation and/or proceedings related to an administrative claim:
</p><p>(i) HHS or any component thereof; or
</p><p>(ii) Any HHS employee in his or her official capacity; or
</p><p>(iii) Any HHS employee in his or her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(iv) The United States or any agency thereof (other than HHS) where HHS/OGC has determined that the litigation and/or proceedings related to an administrative claim is likely to affect HHS or any of its components.
</p> <p>(b) In the litigation and/or proceedings related to an administrative claim described in subsection (a) above, information from these records may be disclosed to a court or other tribunal, or to another party before such tribunal in response to an order of a court or administrative tribunal, provided that the covered entity discloses only the information expressly authorized by such order.
</p> <p>13. Records may be disclosed under a business associate agreement to an IHS contractor (including a Health Information Exchange, Regional Health Information Organization, or E-prescribing Gateway) for the purpose of computerized data entry, medical transcription, duplication services, maintenance of records, data formatting services or for any other agency function or activity involving the use or disclosure of records contained in this system.
</p> <p>14. Records may be disclosed under a personal services contract or other agreement to student volunteers, individuals working for IHS, and other individuals performing functions for IHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
</p> <p>15. Records regarding specific medical services provided to a unemancipated minor individual may be disclosed to the unemancipated minor's parent or legal guardian who previously consented to those specific medical services, to the extent permitted under 45 CFR 164.502(g).</p>
<p>16. Records may be disclosed to an individual having authority to act on behalf of an incompetent individual concerning health care decisions, to the extent permitted under 45 CFR 164.502(g).
</p> <p>17. Information may be used or disclosed from an IHS facility directory in response to an inquiry about a named individual from a member of the general public to establish the individual's presence (and location when needed for visitation purposes) or to report the individual's condition while hospitalized (<i>e.g.</i>, satisfactory or stable), unless the individual objects to disclosure of this information. IHS may provide the religious affiliation only to members of the clergy.
</p> <p>18. Information may be disclosed to a relative, a close personal friend, or any other person identified by the individual that is directly relevant to that person's involvement with the individual's care or payment for health care.
</p> <p>Information may also be used or disclosed in order to notify a family member, personal representative, or other person responsible for the individual's care, of the individual's location, general condition or death.
</p> <p>If the individual is present for, or otherwise available prior to, a use or disclosure, and is competent to make health care decisions;
</p><p>(a) May use or disclose after the facility obtains the individual's consent,
</p><p>(b) Provides the individual with the opportunity to object and the individual does not object, or
</p><p>(c) It could reasonably infer, based on professional judgment, that the individual does not object. If the individual is not present, or the opportunity to agree or object cannot practicably be provided due to incapacity or emergent circumstances, an IHS health care provider may determine, based on professional judgment, whether disclosure is in the individual's best interest, and if so, may disclose only what is directly relevant to the individual's health care.
</p> <p>19. Information concerning exposure to the HIV/AIDS may be disclosed, to the extent authorized by Federal, State or Tribal law, to the sexual and/or needle-sharing partner(s) of a subject individual who is infected with HIV/AIDS under the following circumstances:
</p><p>(a) The information has been obtained in the course of clinical activities at IHS facilities;
</p><p>(b) IHS has made reasonable efforts to counsel and encourage the subject individual to provide information to the individual's sexual or needle-sharing partner(s);
</p><p>(c) IHS determines that the subject individual is unlikely to provide the information to the sexual or needle-sharing partner(s) or that the provision of such information cannot reasonably be verified;
</p><p>(d) The notification of the partner(s) is made, whenever possible, by the subject individual's physician or by a professional counselor and shall follow standard counseling practices; and
</p><p>(e) IHS has advised the partner(s) to whom information is disclosed that they shall not re-disclose or use such information for a purpose other than that for which the disclosure was made.
</p> <p>20. Records may be disclosed to Federal and non-Federal protection and advocacy organizations that serve AI/AN for the purpose of investigating incidents of abuse and neglect of individuals with developmental disabilities (including mental disabilities), as defined in 42 U.S.C. 10801-10805(a)(4) and 42 CFR 51.41-46, to the extent that such disclosure is authorized by law and the conditions of 45 CFR 1386.22(a)(2) are met.
</p> <p>21. Records of an individual may be disclosed to a correctional institution or law enforcement official, during the period of time the individual is either an inmate or is otherwise in lawful custody, for the provision of health care to the individual or for health and safety purposes. Disclosure may be made upon the representation of either the institution or a law enforcement official that disclosure is necessary for the provision of health care to the individual, for the health and safety of the individual and others (<i>e.g.</i>, other inmates, employees of the correctional facility, transport officers), and for facility administration and operations. This routine use applies only for as long as the individual remains in lawful custody, and does not apply once the individual is released on parole or placed on either probation or on supervised release, or is otherwise no longer in lawful custody.
</p> <p>22. Records including patient name, date of birth, SSN, gender and other identifying information may be disclosed to the SSA as is reasonably necessary for the purpose of conducting an electronic validation of the SSN(s) maintained in the record to the extent required under an agreement between IHS and SSA.</p>
<p>23. Disclosure of relevant health care information may be made to funeral directors or representatives of funeral homes in order to allow them to make necessary arrangements prior to and in anticipation of an individual's impending death.
</p> <p>24. Records may be disclosed to a public or private covered entity that is authorized by law or charter to assist in disaster relief efforts (<i>e.g.</i>, the Red Cross and the Federal Emergency Management Administration), for purposes of coordinating information with other similar entities concerning an individual's health care, payment for health care, notification of the individual's whereabouts and his or her health status or death.
</p> <p>25. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>File folders, ledgers, card files, microfiche, microfilm, computer tapes, disk packs, digital photo discs, and automated, computer- based or electronic files.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Indexed by name, record number, and SSN and cross-indexed.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Safeguards apply to records stored on-site and off-site.
</p> <p>1. <i>Authorized Users:</i> Access is limited to authorized IHS personnel, volunteers, IHS contractors, subcontractors, and other business associates in the performance of their duties. Examples of authorized personnel include: medical records personnel, business office personnel, contract health staff, health care providers, authorized researchers, medical audit personnel, health care team members, and legal and administrative personnel on a need to know basis.</p>
<p>2. <i>Physical Safeguards:</i> Records are kept in locked metal filing cabinets or in a secured room or in other monitored areas accessible to authorized users at all times when not actually in use during working hours and at all times during non-working hours. Magnetic tapes, disks, other computer equipment (<i>e.g.</i>, pc workstations) and other forms of personal data are stored in areas where fire and life safety codes are strictly enforced. Telecommunication equipment (<i>e.g.</i>, computer terminal, servers, modems and disks) of the Resource and Patient Management System (RPMS) are maintained in locked rooms during non-working hours. Network (Internet or Intranet) access of authorized individual(s) to various automated and/or electronic programs or computers (<i>e.g.</i>, desktop, laptop, handheld or other computer types) containing protected personal identifiers or PHI is reviewed periodically and controlled for authorizations, accessibility levels, expirations or denials, including passwords, encryptions or other devices to gain access. Combinations and/or electronic passcards on door locks are changed periodically and whenever an IHS employee resigns, retires or is reassigned.</p>
<p>3. <i>Procedural Safeguards:</i> Within each facility a list of personnel or categories of personnel having a demonstrable need for the records in the performance of their duties has been developed and is maintained. Procedures have been developed and implemented to review one- time requests for disclosure to personnel who may not be on the authorized user list. Proper charge-out procedures are followed for the removal of all records from the area in which they are maintained. Records may not be removed from the facility except in certain circumstances, such as compliance with a valid court order or shipment to the Federal Records Center(s) (FRC). Persons who have a need to know are entrusted with records from this system of records and are instructed to safeguard the confidentiality of these records. These individuals are to make no further disclosure of the records except as authorized by the system manager and permitted by the Privacy Act and the HIPAA Privacy Rule as adopted, and to destroy all copies or to return such records when the need to know has expired. Procedural instructions include the statutory penalties for noncompliance.
</p> <p>The following automated information systems (AIS) security procedural safeguards are in place for automated medical, health and billing records maintained in the RPMS. A profile of automated systems security is maintained. Security clearance procedures for screening individuals, both Government and contractor personnel, prior to their participation in the design, operation, use or maintenance of IHS AIS are implemented. The use of current passwords and log-on codes are required to protect sensitive automated data from unauthorized access. Such passwords and codes are changed periodically. An automated or electronic audit trail is maintained and reviewed periodically. Only authorized IHS Division of Information Resources staff may modify automated files in batch mode. Personnel at remote terminal sites may only retrieve automated or electronic data. Such retrievals are password protected. Privacy Act requirements, HIPAA Privacy and Security Rule requirements and specified AIS security provisions are specifically included in contracts and agreements and the system manager or his/her designee oversee compliance with these contract requirements.
</p> <p>4. <i>Implementing Guidelines:</i> HHS Chapter 45-10 and supplementary Chapter PHS.hf: 45-10 of the General Administration Manual; HHS, "Automated Information Systems Security Program Handbook," as amended; HHS IRM Policy HHS-IRM-2000- 0005, "IRM Policy for IT Security for Remote Access"; OMB Circular A-130 "Management of Federal Information Resources "; HIPAA Security Standards for the Protection of Electronic Protected Health Information, 45 CFR 164.302 through 164.318; and E- Government Act of 2002 (Pub. L. 107-347, 44 U.S.C. Ch 36).</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Patient listings which may identify individuals are maintained in IHS Area and Program Offices permanently. Inactive records are held at the facility that provided medical, health and billing services from three to seven years and then are transferred to the appropriate FRC. Monitoring strips and tapes (<i>e.g.,</i> fetal monitoring strips, EEG and EKG tapes) that are not stored in the individual's official medical record are stored at the health facility for one year and are then transferred to the appropriate FRC. (<i>See</i> Appendix 2 for FRC addresses). In accordance with the records disposition authority approved by the Archivist of the United States, paper records are maintained for 75 years after the last episode of individual care except for billing records. The retention and disposal methods for billing records will be in accordance with the approved IHS Records Schedule. The disposal methods of paper medical and health records will be in accordance with the approved IHS Records Schedule and National Archives and Records Administration (NARA). The electronic data consisting of the individual personal identifiers and PHI maintained in the RPMS or any subsequent revised IHS database system should be inactivated once the paper record is forwarded to the appropriate FRC.</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Policy Coordinating Official: Director, OCPS, IHS, Reyes Building, 801 Thompson Avenue, Suite 300, Rockville, Maryland 20852- 1627. <i>See</i> Appendix 1. The IHS Area Office Directors, Service Unit Directors/Chief Executive Officers and Facility Directors listed in Appendix 1 are System Managers.</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p><i>General Procedure:</i> Requests must be made to the appropriate System Manager (IHS Area, Program Office Director or Service Unit Director/Chief Executive Officer). A subject individual who requests a copy of, or access to, his or her medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents. Such a representative may be an IHS health professional. When a subject individual is seeking to obtain information about himself/herself that may be retrieved by a different name or identifier than his/her current name or identifier, he/she shall be required to produce evidence to verify that he/she is the person whose record he/she seeks. No verification of identity shall be required where the record is one that is required to be disclosed under the Freedom of Information Act. Where applicable, fees for copying records will be charged in accordance with the schedule set forth in 45 CFR Part 5b.</p>
<p><i>Requests in Person:</i> Identification papers with current photographs are preferred but not required. If a subject individual has no identification but is personally known to the designated agency employee, such employee shall make a written record verifying the subject individual's identity. If the subject individual has no identification papers, the responsible system manager or designated agency official shall require that the subject individual certify in writing that he/she is the individual whom he/she claims to be and that he/she understands that the knowing and willful request or acquisition of records concerning an individual under false pretenses is a criminal offense subject to a $5,000 fine. If an individual is unable to sign his/her name when required, he/she shall make his/her mark and have the mark verified in writing by two additional persons.
</p> <p><i>Requests by Mail:</i> Written requests must contain the name and address of the requester, his/her date of birth and at least one other piece of information that is also contained in the subject record, and his/her signature for comparison purposes. If the written request does not contain sufficient information, the System Manager shall inform the requester in writing that additional, specified information is required to process the request.
</p> <p><i>Requests by Telephone:</i> Since positive identification of the caller cannot be established, telephone requests are not honored.
</p> <p><i>Parents, Legal Guardians and Personal Representatives:</i> Parents of minor children and legal guardians or personal representatives of legally incompetent individuals shall verify their own identification in the manner described above, as well as their relationship to the individual whose record is sought. A copy of the child's birth certificate or court order establishing legal guardianship may be required if there is any doubt regarding the relationship of the individual to the patient.</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures: Requesters may write, call or visit the last IHS facility where medical care was provided. Requesters should also provide a reasonable description of the record being sought. Requesters may be required to fill out an IHS-810 form, Authorization for Use or Disclosure of Protected Health Information, for this purpose. Requesters may be required to fill out the following forms for the purposes stated:
</p><p>a. IHS-912-1 form, Request for Restriction(s). (The requester may restrict the use of their PHI with some exceptions);
</p><p>b. IHS-912-2 form, Request for Revocation of Restriction(s). (The requester or the IHS may revoke a previous restriction(s));
</p><p>c. IHS-913 form, Request for An Accounting of Disclosures. (The requester and/or personal representative may request an accounting where IHS has disclosed during the calendar year without their consent); or,
</p><p>d. IHS-963 form, Request for Confidential Communication By Alternative Means or Alternate Location. (The requester and/or personal representative may request their PHI be communicated by an alternative means such as regular mail, telephone, or facsimile; or communicated to an alternate location).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Requesters may write, call or visit the appropriate IHS Area/Program Office Director or Service Unit Director/Chief Executive Officer at his/her address specified in Appendix 1, and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant. The requestor shall use the IHS-917 form, Request for Correction/Amendment of Protected Health Information, for this purpose.</p>
</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Individual and/or family members, IHS health care personnel, contract health care providers, State and local health care provider organizations, Medicare and Medicaid funding agencies, and the SSA.</p></xhtmlContent></subsection>
<subsection type="systemsExempted"><xhtmlContent><p>None.</p>
<p><i>Appendix 1--System Managers and IHS Locations Under Their Jurisdiction Where Records Are Maintained </i></p><p>Director, Aberdeen Area Indian Health Service, Room 309, Federal Building, 115 Fourth Avenue, SE., Aberdeen, South Dakota 57401.
</p> <p>Director, Cheyenne River Service Unit, Eagle Butte Indian Hospital, P.O. Box 1012, Eagle Butte, South Dakota 57625.
</p> <p>Director, Crow Creek Service Unit, Ft. Thompson Indian Health Center, P.O. Box 200, Ft. Thompson, South Dakota 57339.
</p> <p>Director, Fort Berthold Service Unit, Fort Berthold Indian Health Center, P.O. Box 400, New Town, North Dakota 58763.
</p> <p>Director, Carl T. Curtis Health Center, P.O. Box 250, Macy, Nebraska 68039.
</p> <p>Director, Fort Totten Service Unit, Fort Totten Indian Health Center, P.O. Box 200, Fort Totten, North Dakota 58335.
</p> <p>Director, Kyle Indian Health Center, P.O. Box 540, Kyle, South Dakota 57752.
</p> <p>Director, Lower Brule Indian Health Center, P.O. Box 191, Lower Brule, South Dakota 57548.
</p> <p>Director, McLaughlin Indian Health Center, P.O. Box 879, McLaughlin, South Dakota 57642.
</p> <p>Director, Omaha-Winnebago Service Unit, Winnebago Indian Hospital, Winnebago, Nebraska 68071.
</p> <p>Director, Pine Ridge Service Unit, Pine Ridge Indian Hospital, Pine Ridge, South Dakota 57770.
</p> <p>Director, Rapid City Service Unit, Rapid City Indian Hospital, 3200 Canyon Lake Drive, Rapid City, South Dakota 57701.
</p> <p>Director, Rosebud Service Unit, Rosebud Indian Hospital, Rosebud, South Dakota 57570.
</p> <p>Director, Sisseton-Wahpeton Service Unit, Sisseton Indian Hospital, P.O. Box 189, Sisseton, South Dakota 57262.
</p> <p>Director, Standing Rock Service Unit, Fort Yates Indian Hospital, P.O. Box J, Fort Yates, North Dakota 58538.
</p> <p>Director, Trenton-Williston Indian Health Center, P.O. Box 210, Trenton, North Dakota 58853.
</p> <p>Director, Turtle Mountain Service Unit, Belcourt Indian Hospital, P.O. Box 160, Belcourt, North Dakota 58316.
</p> <p>Director, Wanblee Indian Health Center, 100 Clinic Drive, Wanblee, South Dakota 57577.
</p> <p>Director, Yankton-Wagner Service Unit, Wagner Indian Hospital, 110 Washington Street, Wagner, South Dakota 57380.
</p> <p>Director, Youth Regional Treatment Center, P.O. Box 68, Mobridge, South Dakota 57601.
</p> <p>Director, Sac &amp; Fox Health Center, 307 Meskwaki Road, Tama, Iowa 52339.
</p> <p>Director, Santee Health Center, 425 Frazier Avenue, N ST Street #2, Niobrara, Nebraska 68760.
</p> <p>Director, Alaska Area Native Indian Health Service, 4141 Ambassador Drive, Suite 300, Anchorage, Alaska 99508-5928.</p>
<p>Director, Albuquerque Area Health Service, 5300 Homestead Road, NE, Albuquerque, New Mexico 87110.
</p> <p>Director, Acoma-Canoncito-Laguna Service Unit, Acoma-Canoncito-Laguna Indian Hospital, P.O. Box 130, San Fidel, New Mexico 87049.
</p> <p>Director, To'Hajille Health Center, P.O. Box 3528, Canoncito, New Mexico 87026.
</p> <p>Director, New Sunrise Treatment Center, P.O. Box 219, San Fidel, New Mexico 87049.
</p> <p>Director, Albuquerque Service Unit, Albuquerque Indian Hospital, 801 Vassar Drive, NE., Albuquerque, New Mexico 87106.
</p> <p>Director, Albuquerque Indian Dental Clinic, P.O. Box 67830, Albuquerque, New Mexico 87193.
</p> <p>Director, Santa Fe Service Unit, Santa Fe Indian Hospital, 1700 Cerrillos Road, Santa Fe, New Mexico 87505.
</p> <p>Director, Santa Clara Health Center, RR5, Box 446, Espanola, New Mexico 87532.
</p> <p>Director, San Felipe Health Center, P.O. Box 4344, San Felipe, New Mexico 87001.
</p> <p>Director, Cochiti Health Center, P.O. Box 105, 255 Cochiti Street, Cochiti, New Mexico 87072.
</p> <p>Director, Santo Domingo Health Center, P.O. Box 340, Santo Domingo, New Mexico 87052.
</p> <p>Director, Southern Colorado-Ute Service Unit, P.O. Box 778, Ignacio, Colorado 81137.
</p> <p>Director, Ignacio Indian Health Center, P.O. Box 889, Ignacio, Colorado 81137.
</p> <p>Director, Ute Mountain Ute Health Center, Towaoc, Colorado 81334.
</p> <p>Director, Jicarilla Indian Health Center, P.O. Box 187, Dulce, New Mexico 87528.
</p> <p>Director, Mescalero Service Unit, Mescalero Indian Hospital, P.O. Box 210, Mescalero, New Mexico 88340.
</p> <p>Director, Taos/Picuris Indian Health Center, P.O. Box 1956, 1090 Goat Springs Road, Taos, New Mexico 87571.
</p> <p>Director, Zuni Service Unit, Zuni Indian Hospital, P.O. Box 467, Zuni, New Mexico 87327.
</p> <p>Director, Pine Hill Health Center, P.O. Box 310, Pine Hill, New Mexico 87357.</p>
<p>Director, Bemidji Area Indian Health Service, 522 Minnesota Avenue, NW., Bemidji, Minnesota 56601.
</p> <p>Director, Red Lake Service Unit, PHS Indian Hospital, Highway 1, Red Lake, Minnesota 56671.
</p> <p>Director, Leech Lake Service Unit, PHS Indian Hospital, 425 7th Street, NW., Cass Lake, Minnesota 56633.
</p> <p>Director, White Earth Service Unit, PHS Indian Hospital, P.O. Box 358, White Earth, Minnesota 56591.
</p> <p>Director, Billings Area Indian Health Service, P.O. Box 36600, 2900 4th Avenue North, Billings, Montana 59107.
</p> <p>Director, Blackfeet Service Unit, Browning Indian Hospital, P.O. Box 760, Browning, Montana 59417.
</p> <p>Director, Heart Butte PHS Indian Health Clinic, Heart Butte, Montana 59448.
</p> <p>Director, Crow Service Unit, Crow Indian Hospital, Crow Agency, Montana 59022.
</p> <p>Director, Lodge Grass PHS Indian Health Center, Lodge Grass, Montana 59090.
</p> <p>Director, Pryor PHS Indian Health Clinic, P.O. Box 9, Pryor, Montana 59066.
</p> <p>Director, Fort Peck Service Unit, Poplar Indian Hospital, Poplar, Montana 59255.
</p> <p>Director, Fort Belknap Service Unit, Harlem Indian Hospital, Harlem, Montana 59526.
</p> <p>Director, Hays PHS Indian Health Clinic, Hays, Montana 59526.
</p> <p>Director, Northern Cheyenne Service Unit, Lame Dear Indian Health Center, Lame Deer, Montana 59043.
</p> <p>Director, Wind River Service Unit, Fort Washakie Indian Health Center, Fort Washakie, Wyoming 82514.
</p> <p>Director, Arapahoe Indian Health Center, Arapahoe, Wyoming 82510.
</p> <p>Director, Chief Redstone Indian Health Center, Wolf Point, Montana 59201.
</p> <p>Director, California Area Indian Health Service, John E. Moss Federal Building, 650 Capitol Mall, Suite 7-100, Sacramento, California 95814.</p>
<p>Director, Nashville Area Indian Health Service, 711 Stewarts Ferry Pike, Nashville, Tennessee 37214-2634.
</p> <p>Director, Catawba PHS Indian Nation of South Carolina, P.O. Box 188, Catawba, South Carolina 29704.
</p> <p>Director, Unity Regional Youth Treatment Center, P.O. Box C-201, Cherokee, North Carolina 28719.
</p> <p>Director, Navajo Area Indian Health Service, P.O. Box 9020, Highway 264, Window Rock, Arizona 86515-9020.
</p> <p>Director, Chinle Service Unit, Chinle Comprehensive Health Care Facility, Hwy 191 &amp; Hospital Road, P.O. Drawer PH, Chinle, Arizona 86503.
</p> <p>Director, Tsaile Health Center, P.O. Box 467, Navajo Routes 64 and 12, Tsaile, Arizona 86556.
</p> <p>Director, Rock Point Field Clinic, c/o Tsaile Health Center, P.O. Box 647, Tsaile, Arizona 86557.
</p> <p>Director, Pinon Health Center, Navajo Route 4, P.O. Box 10, Pinon, Arizona 86510.
</p> <p>Director, Crownpoint Service Unit, Crownpoint Comprehensive Health Care Facility, P.O. Box 358, Crownpoint, New Mexico 87313.
</p> <p>Director, Pueblo Pintado Health Station, c/o Crownpoint Comprehensive Health Care Facility, P.O. Box 358, Crownpoint, New Mexico 87313.
</p> <p>Director, Fort Defiance Service Unit, Fort Defiance Indian Hospital, P.O. Box 649, Intersection of Navajo Routes N12 and N7, Fort Defiance, Arizona 86515.
</p> <p>Director, Nahata Dziil Health Center, P.O. Box 125, Sanders, Arizona 86512.
</p> <p>Director, Gallup Service Unit, Gallup Indian Medical Center, P.O. Box 1337, Nizhoni Boulevard, Gallup, New Mexico 87305.
</p> <p>Director, Tohatchi Indian Health Center, P.O. Box 142, Tohatchi, New Mexico 87325.
</p> <p>Director, Ft. Wingate Health Station, c/o Gallup Indian Medical Center, P.O. Box 1337, Gallup, New Mexico 87305.
</p> <p>Director, Kayenta Service Unit, Kayenta Indian Health Center, P.O. Box 368, Kayenta, Arizona 86033.
</p> <p>Director, Inscription House Health Center, P.O. Box 7397, Shonto, Arizona 86054.
</p> <p>Director, Dennehotso Clinic, c/o Kayenta Health Center, P.O. Box 368, Kayenta, Arizona 86033.
</p> <p>Director, Shiprock Service Unit, Northern Navajo Medical Center, P.O. Box 160, U.S. Hwy 491 North, Shiprock, New Mexico 87420.
</p> <p>Director, Dzilth-Na-O-Dith-Hle Indian Health Center, 6 Road 7586, Bloomfield, New Mexico 87413.
</p> <p>Director, Four Corners Regional Health Center, U.S. Hwy 160, Navajo Route 35-Red Mesa, HRC 6100, Box 30, Teec Nos Pos, Arizona 86514.
</p> <p>Director, Sanostee Health Station, c/o Northern Navajo Medical Center, P.O. Box 160, Shiprock, New Mexico 87420.
</p> <p>Director, Toadlena Health Station, c/o Northern Navajo Medical Center, P.O. Box 160, Shiprock, New Mexico 87420.
</p> <p>Director, Teen Life Center, c/o Northern Navajo Medical Center, P.O. Box 160, Shiprock, New Mexico 87420.</p>
<p>Director, Oklahoma City Area Indian Health Service, Five Corporation Plaza, 3625 NW 56th Street, Oklahoma City, Oklahoma 73112.
</p> <p>Director, Claremore Service Unit, Claremore Comprehensive Indian Health Facility, West Will Rogers Boulevard and Moore, Claremore, Oklahoma 74017.
</p> <p>Director, Clinton Service Unit, Clinton Indian Hospital, Route 1, P.O. Box 3060, Clinton, Oklahoma 73601-9303.
</p> <p>Director, El Reno PHS Indian Health Clinic, 1631A E. Highway 66, El Reno, Oklahoma 73036.
</p> <p>Director, Watonga Indian Health Center, Route 1, Box 34-A, Watonga, Oklahoma 73772.
</p> <p>Director, Haskell Service Unit, PHS Indian Health Center, 2415 Massachusetts Avenue, Lawrence, Kansas 66044.
</p> <p>Director, Lawton Service Unit, Lawton Indian Hospital, 1515 Lawrie Tatum Road, Lawton, Oklahoma 73501.
</p> <p>Director, Anadarko Indian Health Center, P.O. Box 828, Anadarko, Oklahoma 73005.
</p> <p>Director, Carnegie Indian Health Center, P.O. Box 1120, Carnegie, Oklahoma 73150.
</p> <p>Director, Holton Service Unit, PHS Indian Health Center, 100 West 6th Street, Holton, Kansas 66436.
</p> <p>Director, Pawnee Service Unit, Pawnee Indian Service Center, RR2, Box 1, Pawnee, Oklahoma 74058-9247.
</p> <p>Director, Pawhuska Indian Health Center, 715 Grandview, Pawhuska, Oklahoma 74056.
</p> <p>Director, Tahlequah Service Unit, W. W. Hastings Indian Hospital, 100 S. Bliss, Tahlequah, Oklahoma 74464.
</p> <p>Director, Wewoka Indian Health Center, P.O. Box 1475, Wewoka, Oklahoma 74884.
</p> <p>Director, Phoenix Area Indian Health Service, Two Renaissance Square, 40 North Central Avenue, Phoenix, Arizona 85004.
</p> <p>Director, Colorado River Service Unit, Chemehuevi Indian Health Clinic, P.O. Box 1858, Havasu Landing, California 92363.
</p> <p>Director, Colorado River Service Unit, Havasupai Indian Health Station, P.O. Box 129, Supai, Arizona 86435.
</p> <p>Director, Colorado River Service Unit, Parker Indian Health Center, 12033 Agency Road, Parker, Arizona 85344.
</p> <p>Director, Colorado River Service Unit, Peach Springs Indian Health Center, P.O. Box 190, Peach Springs, Arizona 86434.
</p> <p>Director, Colorado River Service Unit, Sherman Indian High School, 9010 Magnolia Avenue, Riverside, California 92503.
</p> <p>Director, Elko Service Unit, Newe Medical Clinic, 400 "A" Newe View, Ely, Nevada 89301.
</p> <p>Director, Elko Service Unit, Southern Bands Health Center, 515 Shoshone Circle, Elko, Nevada 89801.
</p> <p>Director, Fort Yuma Service Unit, Fort Yuma Indian Hospital, P.O. Box 1368, Fort Yuma, Arizona 85366.
</p> <p>Director, Keams Canyon Service Unit, Hopi Health Care Center, P.O. Box 4000, Polacca, Arizona 86042.
</p> <p>Director, Schurz Service Unit, Schurz Service Unit Administration, Drawer A, Schurz, Nevada 89427.
</p> <p>Director, Fort McDermitt Clinic, P.O. Box 315, McDermitt, Nevada 89421.
</p> <p>Director, Phoenix Service Unit, Phoenix Indian Medical Center, 4212 North 16th Street, Phoenix, Arizona 85016.
</p> <p>Director, Phoenix Service Unit, Salt River Health Center, 10005 East Osborn Road, Scottsdale, Arizona 85256.
</p> <p>Director, San Carlos Service Unit, Bylas Indian Health Center, P.O. Box 208, Bylas, Arizona 85550.
</p> <p>Director, San Carlos Service Unit, San Carlos Indian Hospital, P.O. Box 208, San Carlos, Arizona 85550.</p>
<p>Director, Unitah and Ouray Service Unit, Fort Duchesne Indian Health Center, P.O. Box 160, Ft. Duchesne, Utah 84026.
</p> <p>Director, Whiteriver Service Unit, Cibecue Health Center, P.O. Box 37, Cibecue, Arizona 85941.
</p> <p>Director, Whiteriver Service Unit, Whiteriver Indian Hospital, P.O. Box 860, Whiteriver, Arizona 85941.
</p> <p>Director, Desert Vision Youth Wellness Center, P.O. Box 458, Sacaton, Arizona 85247.
</p> <p>Director, Nevada Skies Youth Wellness Center, 104 Big Bend Ranch Road, P.O. Box 280, Wadsworth, Nevada 89442.
</p> <p>Director, Portland Area Indian Health Service, Room 476, Federal Building, 1220 Southwest Third Avenue, Portland, Oregon 97204-2829.
</p> <p>Director, Colville Service Unit, Colville Indian Health Center, P.O. Box 71-Agency Campus, Nespelem, Washington 99155.
</p> <p>Director, Fort Hall Service Unit, Not-Tsoo Gah-Nee Health Center, P.O. Box 717, Fort Hall, Idaho 83203.
</p> <p>Director, Warm Springs Service Unit, Warm Springs Indian Health Center, P.O. Box 1209, Warm Springs, Oregon 97761.
</p> <p>Director, Wellpinit Service Unit, David C. Wynecoop Memorial Clinic, P.O. Box 357, Wellpinit, Washington 99040.
</p> <p>Director, Western Oregon Service Unit, Chemawa Indian Health Center, 3750 Chemawa Road, NE, Salem, Oregon 97305-1198.
</p> <p>Director, Yakama Service Unit, Yakama Indian Health Center, 401 Buster Road, Toppenish, Washington 98948.
</p> <p>Director, Tucson Area Indian Health Service, 7900 South "J" Stock Road, Tucson, Arizona 85746-9352.
</p> <p>Chief Medical Officer, Pascua Yaqui Service Unit, Division of Public Health, 7900 South "J" Stock Road, Tucson, Arizona 85746.
</p> <p>Facility Director, San Xavier Indian Health Center, 7900 South "J" Stock Road, Tucson, Arizona 85746.
</p> <p>Director, Sells Service Unit, Santa Rosa Indian Health Center, HCO1, P.O. Box 8700, Sells, Arizona 85634.
</p> <p>Director, Sells Service Unit, Sells Indian Hospital, P.O. Box 548, Sells, Arizona 85634.
</p> <p>Director, Sells Service Unit, San Simon Health Center, HC01 Box 8150, Sells, Arizona 85634.</p>
<p><i>Appendix 2--Federal Archives and Records Centers </i> District of Columbia, Maryland Except U.S. Court Records for Maryland, Washington National Records Center, 4205 Suitland Road, Suitland, Maryland 20746-8001.
</p> <p>Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, and Vermont, Federal Archives and Records Center, Frederick C. Murphy Federal Center, 380 Trapelo Road, Waltham, Massachusetts 02452-6399.
</p> <p>Northeast Region, Federal Archives and Records Center, 10 Conte Drive, Pittsfield, Massachusetts 01201-8230.
</p> <p>Mid-Atlantic Region and Pennsylvania, Federal Archives and Records Center, 14700 Townsend Road, Philadelphia, Pennsylvania 19154- 1096.
</p> <p>Alabama, Florida, Georgia, Kentucky, Mississippi, North Carolina, South Carolina, and Tennessee, Federal Archives and Records Center, 1557 St. Joseph Avenue, East Point, Georgia 30344-2593.
</p> <p>Illinois, Indiana, Michigan, Minnesota, Ohio and Wisconsin and U.S. Court Records for the mentioned States, Federal Archives and Records Center, 7358 South Pulaski Road, Chicago, Illinois 60629-5898.
</p> <p>Michigan, Except U.S. Court Records, Federal Records Center, 3150 Springboro Road, Dayton, Ohio 45439-1883.
</p> <p>Kansas, Iowa, Missouri and Nebraska, and U.S. Court Records for the mentioned States, Federal Archives and Records Center, 2312 East Bannister Road, Kansas City, Missouri 64131-3011.</p>
<p>New Jersey, New York, Puerto Rico, and the U.S. Virgin Islands, and U.S. Court Records for the mentioned States and territories, 200 Space Center Drive, Lee's Summit, Missouri 64064-1182.
</p> <p>Arkansas, Louisiana, Oklahoma and Texas, and U.S. Courts Records for the mentioned States, Federal Archives and Records Center, P.O. Box 6216, Ft. Worth, Texas 76115-0216.
</p> <p>Colorado, Wyoming, Utah, Montana, New Mexico, North Dakota, and South Dakota, and U.S. Courts Records for the mentioned States, Federal Archives and Records Center, P.O. Box 25307, Denver, Colorado 80225-0307.
</p> <p>Northern California Except Southern California, Hawaii, and Nevada Except Clark County, the Pacific Trust Territories, and American Samoa, and U.S. Courts Records for the mentioned States and territories, Federal Archives and Records Center, 1000 Commodore Drive, San Bruno, California 94066-2350.
</p> <p>Arizona, Southern California, and Clark County, Nevada, and U.S. Courts Records for the mentioned States, Federal Archives and Records Center, 23123 Cajalco Road, Perris, California 93570-7298.
</p> <p>Washington, Oregon, Idaho and Alaska, and U.S. Courts Records for the mentioned States, Federal Archives and Records Center, 6125 Sand Point Way NE, Seattle, Washington 98115-7999.
</p></xhtmlContent></subsection></section>
<section id="09-17-0002" toc="yes">
<systemNumber>09-17-0002</systemNumber>
<subsection type="systemName">Indian Health Service Scholarship and Loan Repayment Programs, HHS/IHS/OPHS/DHPS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Public Health Support (OPHS), Division of Health Professions Support (DHPS), Scholarship and Loan Repayment Branch(es) and Health Professions Support Branch, Indian Health Service, 12300 Twinbrook Parkway, Suite 450A, Rockville, MD 20852. Washington National Records Center, 4205 Suitland Road, Suitland, MD 20746-8001. Records are also located at the Indian Health Service (IHS) Area Offices. A list of the IHS Area Offices where individually identifiable data are currently located is available upon request to the Policy-Coordinating Official(s) at IHS Headquarters East, 12300 Twinbrook Parkway, Suite 450A, Rockville, MD 20852.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Applicants for and recipients of benefits from the scholarship programs (Sections 103 and 104 of the Indian Health Care Improvement Act, as amended (IHCIA)), loan repayment program (Section 108 of the IHCIA; and grant programs (Section 112 Nursing Program; Section 114 Indians into Medicine; and Section 217 Indians into Psychology under the ICHIA), and recruitment programs administered by the IHS. The IHS scholarship program includes the Health Professions Pre-Graduate Scholarship Program for Indians, the Health Professions Preparatory Scholarship Program for Indians; and the Health Professions Scholarship Program for Indians. Also included are records of scholarship, loan repayment and grant recipients who are obligated to fulfill, are fulfilling, or have fulfilled their IHS service obligations as a result of receiving funds from these IHS programs, and individuals who have an expressed and/or obligated interest in employment in or an assignment to an IHS medical facility, Tribal medical/health care facility, Title V urban healthcare entity, or other facility described in sections 104, 108, 112 and 217 of the IHCIA.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p><i>Contains:</i> Name, telephone number(s), work, school, home and/or mailing address; Social Security Number (SSN); IHS scholarship or IHS loan repayment application; associated forms; employment data; professional performance and credentialing history of licensed health professionals; preference for site selection; personal, professional, and demographic background information; progress reports (which include related data, correspondence, and professional performance information); payroll forms; lender's loan repayment confirmation forms; Form W -4 (for withholding Federal taxes on scholarship recipients monthly stipends); direct deposit forms (for monthly stipends for scholarship recipients and for annual loan repayment distribution among participants in the programs); deferment and placement data; and repayment/delinquent/default status information including medical documentation related to default/waiver proceedings.</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>25 U.S.C. 1613, including the Health Professions Compensatory Pre-professional and the Health Professions Pre-graduate Scholarships;
</p><p>25 U.S.C. 1613a, Health Professions Scholarship;
</p><p>25 U.S.C. 1616a, IHS Loan Repayment Program,
</p><p>31 U.S.C. 7701, Requirement That Applicant Furnish Taxpayer Identifying Number; 42 U.S.C. 216(a), for PHS Commissioned Officers, and 5 U.S.C. 3301 for civil service employee, both of which authorize verification of an individual's suitability for employment; the grants program is codified at 25 U.S.C. 1616e. Nursing Program; 25 U.S.C. 1616g. Indians into Medicine Program; and 25 U.S.C. 1621p. American Indians into Psychology Program; Federal Records Act (44 U.S.C. 2901); Privacy Act of 1974, as amended (5 U.S.C. 552a); Department Regulation (5 U.S.C 301); and 42 U.S.C. 254f, Assignment of Corps Personnel.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purposes of this system of records are as follows:
</p><p>1. <i>The IHS Scholarship Programs.</i>
</p><p>(a) To select applicants for the IHS Scholarship Programs;
</p><p>(b) To monitor scholarship related activities, such as payment tracking, deferment and/or postponement of service obligations owed, placement, completion, default, and debt collection through national credit company subscription(s);
</p><p>(c) To select and match IHS scholarship recipients for qualified employment assignments with the following: IHS medical facilities, including but not limited to hospitals, health clinics and ambulatory stations; and any other programs authorized under 25 U.S.C. 1616a;
</p><p>(d) To monitor services provided by these IHS scholarship recipient/participant/obligated health care professionals;
</p><p>(e) To maintain records on and to verify individuals' credentials, educational background, prior and current performance history and data and previous and current employment and professional history information to verify and validate all claimed credentials are current, accurate, and in good standing;
</p><p>(f) To negotiate site assignments, and to recruit and retain health professionals for Indian Health programs. Portions of records from this system of records may be used by staff of the HHS/PSC; Division of Financial Operations(DFO), Debt Management, who maintain System No. 09 -40-0012, "Debt Management and Collection Systems" and System No. 09-90-0024, "Financial Transaction of HHS Accounting and Finance Offices", for activities related to the participants' breach of contract including debt collection information provided to PSC staff includes, but may not be limited to the participants' personal identification, number of years of support in school while covered by an IHS scholarship contract, number of days served and still owed, and amount of funds expended and still owed;
</p><p>(g) To assist the IHS in determining eligibility for a partial or full waiver of the service obligation as provided for by statute; and
</p><p>(h) To assist Department of Health and Human Services (HHS), Program Support Center (PSC) and other government officials in the collection of any and all overdue debts owed under the IHS Scholarship Program.</p>
<p>2. <i>The IHS Loan Repayment Program.</i>
</p><p>(a) To monitor loan repayment related activities including but not limited to service obligations, default and claims determinations;
</p><p>(b) To assure IHS loan repayment recipients match to a health care facility serving high priority health professional shortage areas or populations as outlined by current IHS scoring criteria policy and procedure, such as IHS medical facilities, including but not limited to hospitals, health clinics and ambulatory stations; and any other programs as required under 25 U.S.C. 1616a;
</p><p>(c) To monitor services provided by IHS loan repayment participants;
</p><p>(d) To maintain records on and to verify individuals' credentials and educational background;
</p><p>(e) To assist the IHS in determining eligibility for a partial or full waiver of the service obligation as provided for by statute; and
</p><p>(f) To assist PSC and other governmental officials in the collection of overdue debts owed under the IHS Loan Repayment Agreement Program.
</p> <p>3. <i>The IHS Grant Programs (Indians Into Nursing, Indians Into Medicine, and Indians Into Psychology).</i>
</p><p>(a) To select applicants for the IHS grant programs;
</p><p>(b) To monitor grant related activities, such as payment tracking, deferment and/or postponement of service obligations owed, placement, completion, default, and debt collection through national credit company subscription(s);
</p><p>(c) To select and match IHS grant funds recipients for qualified employment assignments with the following: IHS medical facilities, including but not limited to hospitals, health clinics and ambulatory stations; and any other programs authorized under 25 U.S.C. 1616a;
</p><p>(d) To monitor services provided by these IHS grant fund recipient/participant/obligated health care professionals;
</p><p>(e) To maintain records on and to verify individuals' credentials, educational background, prior and current performance history and data and previous and current employment and professional history information to verify and validate all claimed credentials are current, accurate, and in good standing;
</p><p>(f) To negotiate site assignments, and to recruit and retain health professionals for Indian Health programs. Portions of records from this system of records may be used by staff of the HHS/PSC; Division of Financial Operations (DFO), Debt Management, who maintain System No. 09 -40-0012, "Debt Management and Collection Systems" and System No. 09-90-0024, "Financial Transaction of HHS Accounting and Finance Offices", for activities related to the participants' breach of contract including debt collection information provided to PSC staff includes, but may not be limited to the participants' personal identification, number of years of support in school while covered by an IHS scholarship contract, number of days served and still owed, and amount of funds expended and still owed;
</p><p>(g) To assist the IHS in determining eligibility for a partial or full waiver of the service obligation as provided for by statute; and
</p><p>(h) To assist Department of Health and Human Services (HHS), Program Support Center (PSC) and other government officials in the collection of any and all overdue debts owed under the IHS grant programs.
</p> <p>3. <i>The IHS Health Professions Support Branch.</i>
</p><p>(a) To negotiate site assignments, and recruit and retain health professionals for Indian Health programs. Portions of records from this system of records may be used by staff of the HHS/PSC; Division of Financial Operations (DFO), Debt Management, who maintain System No. 09 -40-0012, "Debt Management and Collection Systems" and System No. 09-90-0024, "Financial Transaction of HHS Accounting and Finance Offices", for activities related to the participants' breach of contract including debt collection information provided to PSC staff includes, but may not be limited to the participants' personal identification, number of days served and still owed, and amount of funds expended and still owed.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. IHS may disclose records to a congressional office in response to a verified inquiry from the congressional office made at the written request of the subject individual.
</p> <p>2. Records may be disclosed to authorized persons employed by the grantee institution (the educational institution which the recipient of a scholarship or grant is attending as needed for the administration of a scholarship or grant award.
</p> <p>3. Records may be disclosed to other Federal or State agencies that also provide scholarships, loan repayment or grant funding at the request of these agencies to detect or curtail fraud and abuse in Federal programs, and to collect delinquent loans or benefit payments owed to the Federal Government.
</p> <p>4. IHS may disclose information from these records in litigations and/or proceedings related to an administrative claim when:
</p><p>(a) IHS has determined that the use of such records is relevant and necessary to the litigation and/or proceedings related to an administrative claim and would help in the effective representation of the affected party listed in subsections (i) through (iv) below, and that such disclosure is compatible with the purpose for which the records were collected. Such disclosure may be made to the Department of Justice (DOJ) when any of the following is a party to litigation and/or proceedings related to an administrative claim or has an interest in the litigation and/or proceedings related to an administrative claim:
</p><p>(i) HHS or any component thereof; or
</p><p>(ii) Any HHS employee in his or her official capacity; or
</p><p>(iii) Any HHS employee in his or her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(iv) The United States or any agency thereof (other than HHS) where HHS/OGC has determined that the litigation and/or proceedings related to an administrative claim is likely to affect HHS or any of its components.
</p> <p>(b) In the litigation and/or proceedings related to an administrative claim described in subsection (a) above, information from these records may be disclosed to a court or other tribunal, or to another party before such tribunal when such records are relevant and necessary to the litigation and such use by the court, tribunal, or other party is compatible with the purpose for which the agency collected the records.
</p> <p>5. IHS may provide to any organization, program or facility administered under the authority of the IHCIA (Pub. L. 93-437) solely to provide health care services for the benefit of Indians, whether directly by our service; or by any Federally recognized Tribe under authority of the Indian Self Determination and Education Assistance Act (ISDEAA) (Pub. L. 93-638, as amended); a list of obligated recipients of scholarships, loan repayment or grants, and any relevant information pursuant to recruiting and retaining these individuals for the purpose of meeting the health care needs of the requesting organization, program, facility or the Federal recognized Tribe under IHCIA and ISDEAA.
</p> <p>6. IHS may disclose records consisting of names, disciplines, current mailing addresses, e-mail address and dates of graduation of scholarship, loan repayment or grant recipients to designated coordinators at schools for the purpose of guiding and informing these recipients about the nature of their forthcoming professional service obligation.
</p> <p>7. IHS may disclose records consisting of names of the IHS scholarship, loan repayment, and/or grant recipient, professional school he or she is attending, and the date of graduation to Indian health programs as defined by the IHCIA; health professions associations, other interested health professions groups and contractors and subcontractors which have responsibility for coordinating funds paid to students from Federal and other sources. Contractors and/or subcontractors are required to maintain Privacy Act safeguards with respect to such records.
</p> <p>8. IHS may disclose records contained in this system of records to HHS contractors and subcontractors for the purpose of collecting, compiling, aggregating, analyzing, or refining records in the system. Contractors and/or subcontractors are required to maintain Privacy Act safeguards with respect to such records.
</p> <p>9. IHS may disclose records contained in this system of records to HHS contractors and subcontractors for the purpose of recruiting, screening, and matching health/allied health professionals for assignment to or employment in a medical facility located in one of the options cited in sections 104(b)(3), 108(a)(2)(A), and/or 217(d) of the IHCIA. In addition, HHS contractors and subcontractors:
</p><p>(a) May disclose biographic data and information supplied by potential applicants;
</p><p>(i) To references listed on application and associated forms for the purpose of evaluating the applicant's professional qualifications, experience, and suitability, and
</p><p>(ii) To a State or local government medical licensing board and/or to the Federation of State Medical Boards or a similar non-government entity for the purpose of verifying that all claimed background and employment data are valid and all claimed credentials are current and in good standing.
</p> <p>(b) May disclose biographic data and information supplied by references listed on application and associated forms to other references for the purpose of inquiring into the applicants' professional qualifications and suitability; and
</p><p>(c) May disclose professional suitability evaluation information to IHS officials, prospective employers, or to officials of prospective employers, or to site representatives, for the purpose of appraising the applicant's professional qualifications and suitability for site assignment or employment.</p>
<p>Contractors and/or subcontractors are required to maintain Privacy Act safeguards with respect to such records.
</p> <p>10. IHS may disclose records contained in this system of records to private parties such as present and former employers references listed on application and associated forms, other references, and education institutions. The purpose of such disclosures is to obtain information to evaluate an individuals' professional accomplishments, performance, and educational background, and to determine if an applicant is suitable for employment in/assignment to a medical facility located at one of the sites listed in sections 104(b)(3), 108(a)(2)(A), and/or 217(d) of the IHCIA.
</p> <p>11. IHS may disclose records contained in this system of records to other Federal agencies that also provide scholarship, educational loan repayment, or grant funding at the request of these Federal agencies in conjunction with a computer matching program conducted by these Federal agencies to detect or curtail fraud and abuse in Federal scholarship or educational loan repayment programs, and to collect delinquent loans or benefit payments owed to the Federal Government.
</p> <p>12. IHS may disclose information from this system of records to a consumer reporting agency (credit bureau) to obtain an applicant or participant's commercial credit report for the following purposes: (1) To establish his or her credit worthiness; (2) to assess and verify his or her ability to repay debts owed to the Federal Government; (3) to determine and verify the eligibility of loans submitted for repayment; and to determine current contact information and mailing address.
</p> <p>13. IHS may also disclose information from this system of records to the National Student Clearinghouse using the Loan Locator Internet System or similar system to assist in the verification loan data submitted by Loan Repayment Program (LRP) applicants. Disclosure are limited to the individual's name, address, and other information necessary to identify him or her; locate all student loans and verify payment addresses; identify the funding being sought or amount and status of the debt; and the program under which the applicant or claim is being processed.
</p> <p>Disclosure to consumer reporting agencies: Disclosures pursuant to 5 U.S.C. 552a(b)(12): Disclosures may be made from this system to "consumer reporting agencies" as defined in the Fair Credit Reporting Act (15 U.S.C. 158a(f)) or the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a)(3)). The purposes of these disclosures are: (1) To provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records, and (2) to enable PHS agencies to improve the quality of loan, scholarship and grant decisions by taking into account the financial reliability of applicants. Disclosure of records will be limited to the individual's name, and other information necessary to establish the identity of the individual, the amount, status, and history of the claim, and the agency or program under which the claim arose.
</p> <p>14. IHS may disclose from this system of records a delinquent debtor's or a defaulting participant's name, address, and other relevant information necessary to identify him or her; the amount, status, and the history of the claim, and the agency or program under which the claim arose, as follows:
</p><p>(a) To any Federal agency to effect a salary offset for debts owed by Federal employees; if the claim arose under Social Security Act, and the employee must have agreed in writing to the salary offset with the supporting document from the requesting Federal agency.
</p> <p>(b) To any Federal agency to effect authorized administrative offset; <i>i.e.,</i> withhold money, other than Federal salaries, payable to or held on behalf of the individual that is court ordered and/or in accordance with a specific law/mandate.
</p> <p>(c) To the Treasury Department, Internal Revenue Service (IRS), to request an individual's current mailing address to locate him or her for purposes of either collecting or compromising a debt or to pay a commercial credit report prepared.
</p> <p>15. IHS may disclose to debt collection agents, other Federal agencies, and other third parties who are authorized to collect a Federal debt, information necessary to identify a delinquent debtor or a defaulting participant. Disclosure will be limited to the individual's name, address, and other information necessary to identify him or her; the amount, status, and history of the claim, and the agency or program under which the claim arose.
</p> <p>16. IHS may disclose to the IRS information about an individual applying for the IHS loan repayment, scholarship or grant program authorized by the Public Health Service Act to find out whether the applicant has a delinquent tax account. This disclosure is for the sole purpose of determining the applicant's creditworthiness and is limited to the individuals' name, address, and other relevant information necessary to identify him or her, and the program for which the information is being obtained.
</p> <p>17. IHS may report to the IRS, as taxable income, the written-off amount of a debt owed by an individual to the Federal Government when a debt becomes partly or wholly uncollectible, either because the time period for collection under statute or regulations has expired, or because the Government agrees with the individual to forgive or compromise the debt.
</p> <p>18. IHS may disclose from this system of records to the Department of Treasury, IRS: (1) A delinquent debtor's or a defaulting participant's name, address, and other relevant information necessary to identify the individual; (2) the amount of the debt; and (3) the program under which the debt arose, so that the IRS can offset against the debt any income tax refunds which may be due to the individual.
</p> <p>19. IHS may disclose information provided by the lender or education institution to other Federal agencies, debt collection agents, and other third parties who are authorized to collect a Federal debt. The purpose of this disclosure is to identify an individual who is delinquent in loan or benefit payments owed to the Federal Government and the nature of the debt.
</p> <p>20. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in paper format (<i>i.e.,</i> file folders), and in computerized and electronic format (<i>i.e.,</i> forms, database(s), <i>etc.</i>).</p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent><p>Records which identify individual persons are indexed by name or assigned identification number of scholarship, loan repayment or grant applicant or recipient.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. <i>Authorized users:</i> Access is limited only to authorized personnel in the performance of their duties. Authorized personnel includes and is limited to: The system manager, his or her staff, IHS Area Office Scholarship or IHS Loan Repayment Coordinators or grant project officers, IHS Headquarters Branch and Division Chiefs while acting as advisors to scholarship or IHS loan repayment or grant recipients, IHS and PSC debt management staff for activities related to the participants' breach of contract including debt collection.</p>
<p>2. <i>Physical safeguards:</i> Paper records are stored in locked file cabinets or file room. The records storage areas are secured during off-duty hours. Electronic records are stored in areas where fire and life safety codes are strictly enforced. Any and all records pertaining to IHS Scholarship, Loan Repayment and grant program databases are to be enforced by the current Security Guidelines provided by HHS/IHS. All automated and non-automated documents are protected during lunch hours and nonworking hours in locked file cabinets or locked storage areas. The Automated Data Processing remote stations are locked during non-standard working hours. Twenty-four hour, 7-day security guards perform random checks on the physical security of the data and the storage areas. Backup files are maintained in an off-site facility with controlled entrances and exits.
</p> <p>3. <i>Procedural safeguards:</i> All IHS personnel who make use of records contained in this system are made aware of their responsibilities under the provisions of the Privacy Act and are required to maintain Privacy Act safeguards with respect to such records. The records storage areas are not left unattended during office hours, including lunch hours. Records are not removed from these areas in which they are maintained in the absence of proper charge-out procedures. Twenty-four hour, seven-day security guards perform random checks on the physical security of all records storage areas. A data set name controls the release of data to only authorized users. When copying records for authorized purposes, care is taken to ensure that any imperfect pages are not left in the reproduction room where they can be read, but are destroyed or obliterated.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>1. Scholarship applications of individuals not selected for participation in the program are retained for 1 full year, and then destroyed by shredding. Applications, contracts, and other records of IHS scholarship recipients are retained through the completion or other disposition of the scholarship service obligation, then sent to the Federal Records Center (FRC) for an additional 15-year retention period and destroyed in accordance with FRC disposal standards. Automated historical tapes are sent to a FRC and the initial records are destroyed in accordance with IHS Records Control Schedule.
</p> <p>The records for the scholarship applicants, who are not obligated to the IHS, are destroyed 6 years and 3 months after final payment, or upon resolution of any adverse audit findings, whichever is later.
</p> <p>2. Loan repayment applications of individuals not selected for participation in the program are retained until the end of the fiscal year. Loan repayment applications, upon notification, are applied to the loan repayment cycle of the following fiscal year. The records for the loan repayment participants are destroyed 6 to 10 years after the final payment, or upon resolution of any adverse audit findings, whichever is later.
</p> <p>Records are transferred to the FRC 2 years after final repayment or when closed, for 4 years, and are then subsequently disposed of in accordance with the IHS Records Disposition Schedule. The IHS Records Disposition Schedule regulations for these records may be obtained by writing to the System Manager(s) at the address listed below.
</p> <p>3. Applications, contracts, and other records of IHS grant recipients are retained through the completion or other disposition of the service obligation, then sent to the Federal Records Center (FRC) for an additional 15-year retention period and destroyed in accordance with FRC disposal standards. Automated historical tapes are sent to a FRC and the initial records are destroyed in accordance with IHS Records Control Schedule.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p><i>POLICY COORDINATING OFFICIAL(S): </i> Director, Division of Health Professions Support, Office of Public Health Support, Indian Health Service, 12300 Twinbrook Parkway, Suite 450A, Rockville, Maryland 20852.
</p> <p>Director, Division of Grants Operations, Office of Management Services, Indian Health Service, 12300 Twinbrook Parkway, Suite 360, Rockville, Maryland 20852.
</p> <p>Chief, Scholarship Branch, Division of Health Professions Support, Office of Public Health Support, Indian Health Service, 12300 Twinbrook Parkway, Suite 450A, Rockville, Maryland 20852.
</p> <p>Chief, Loan Repayment Branch, Division of Health Professions Support, Office of Public Health Support, Indian Health Service, 12300 Twinbrook Parkway, Suite 450A, Rockville, Maryland 20852.</p>
</xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p><i>Requests in person:</i> A subject individual who appears in person at a specific location seeking access to or disclosure of records relating to him or her shall provide his or her name, current address, Grant Identification Number, last four digits of their SSN or other identification numbers, dates of enrollment in the IHS scholarship, loan repayment or grant program, and at least one piece of tangible identification such as driver's license, passport, or voter registration card. Identification papers with current photographs are preferred, but not required. If a subject individual has no identification, but is personally known to an agency employee, such employee shall make a written record verifying the subject individual's identity. Where the subject individual has no identification papers, the responsible agency official shall require that the subject individual certify in writing that he or she is the individual who he or she claims to be and that he or she understands that the knowing and willful request or acquisition of a record concerning an individual under false pretenses is a criminal offense subject to a 5,000 dollar fine.
</p> <p><i>Requests by mail:</i> A written request must contain the name and address of the requestor, last 4 digits of their respective SSN and/or signature which is either notarized to verify his or her identity or includes a written certification that the requestor is the person he or she claims to be and that he or she understands that the knowing and willful request or acquisition of records pertaining to an individual under false pretenses is a criminal offense subject to a 5,000 dollar fine. In addition, the following information is needed: Dates of enrollment in the IHS scholarship program, IHS Loan Repayment program, or grant program and current enrollment status, such as pending application approval, deferment or service obligation, or shortage area placement.
</p> <p><i>Requests by facsimile:</i> A written request must contain the name and address of the requestor, last 4 digits of their respective SSN and/or signature. In addition, the following information is needed: Dates of enrollment in the IHS Scholarship Program, IHS Loan Repayment Program, or grant program and current enrollment status, such as pending application approval, deferment or service obligation, or shortage area placement. The IHS Scholarship, Loan Repayment or grant program will authorize transmission and reception of all faxed information only if the fax coversheets contain the following Confidentiality Statement or a similar standard procedural statement for liability purposes:
</p><p>THIS FAX IS INTENDED ONLY FOR THE USE OF THE PERSON OR OFFICE TO WHOM IT IS ADDRESSED, AND CONTAINS PRIVILEGED OR CONFIDENTIAL INFORMATION PROTECTED BY LAW. ALL RECIPIENTS ARE HEREBY NOTIFIED THAT INADVERTENT OR UNAUTHORIZED RECEIPT DOES NOT WAIVE SUCH PRIVILEGE, AND THAT UNAUTHORIZED DISSEMINATION, DISTRIBUTION, OR COPYING OF THIS COMMUNICATION IS PROHIBITED. IF YOU HAVE RECEIVED THIS FAX IN ERROR, PLEASE DESTROY THE ATTACHED DOCUMENT(S) AND NOTIFY THE SENDER OF THE ERROR BY CALLING.
</p> <p><i>Requests by telephone:</i> Since positive identification of the caller cannot be established, telephone requests are not honored; the caller is asked to submit his or her request in writing.
</p> <p><i>Requests by electronic mail:</i> Since positive identification of the requestor cannot be established, and the electronic transmission of personal identifiers is not encrypted, the security safeguards is not guaranteed from an unauthorized disclosure, so electronic mail requests are not honored and will be deleted from the IHS e-mail system; the computer user is asked to submit his or her request in writing and/or by facsimile transmission.
</p> <p><i>Record access procedures:</i> Same as notification procedures. Requesters should also provide a reasonable description of the record being sought. Requesters may also request an accounting of disclosures that have been made of their record, if any.
</p> <p><i>Contesting record procedures:</i> Contact the Policy Coordinating Official(s), provide a reasonable description of the record, and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p> <p><i>Record source categories:</i> Information will be collected from the following sources: Educational institutions attended; internship and/or residency training progress reports; IHS site selection questionnaires; IHS Scholarship, Loan Repayment or grant applicants; Indian health programs human resources department; financial institutions from which these applicants have obtained educational loans; Bureau of Health Professions Area Resources File tapes; health professional associations; HHS contractors/subcontractors; consumer reporting agencies/credit bureaus; lending institutions; PHS Commissioned Personnel Operations Division and U.S. Office of Personnel Operations Division and U.S. Office of Personnel Management personnel records; other Federal agencies, including but not limited to the Department of Treasury, the IRS, and the U.S. Postal Service; State or local government medical licensing boards and/or the Federation of State Medical Boards or a similar non-government entity; and third parties who provide references concerning the subject individual.
</p> <p><i>Systems exempted from certain provisions of the Act:</i> None.
</p></xhtmlContent></subsection> </section>
<section id="09-17-0003" toc="yes">
<systemNumber>09-17-0003</systemNumber>
<subsection type="systemName">Indian Health Service Medical Staff Credentials and Privileges Records, HHS/IHS/OCPS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Each Indian Health Service (IHS) Area Office and each IHS Service Unit (Appendix 1). Records may also be located at hospitals and offices of health care providers who are under contract with IHS. A current list of contractor sites is available by writing to the appropriate System Manager (Area or Service Unit Director) at the address shown in Appendix I.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Prospective, current and former IHS medical staff members. The term IHS medical staff includes fully licensed individuals permitted by law to provide patient care services independently and without concurrent professional direction or supervision, within the scope of his/her license and in accordance with individually granted clinical privileges. The IHS medical staff includes physicians (M.D. and D.O.) and dentists and may include other health care practitioners such as psychologists, optometrists, podiatrists, audiologists, and, in some states, certified nurse midwives. Types of assignment categories of current and former IHS medical staff members include the following:
</p><p>Provisional--Those new members of the medical staff who are serving a required initial probationary period, as specified in the local medical staff bylaws. During this time, their qualifications for membership on the active or courtesy IHS medical staff are assessed.
</p> <p>Active--Those members who are Federal employees and/or spend at least fifty percent of their professional time providing patient care related services in the facility.
</p> <p>Temporary--Those members who provide services on a short-term basis or have applied for active medical staff membership and are awaiting a full credential review.
</p> <p>Courtesy or Associate--Those members who generally provide services on a periodic or episodic basis (<i>e.g.,</i> consultants for specialty clinics).
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Contains name, Social Security number, IHS medical staff membership and privileges applications and associated forms, employment data, liability insurance coverage, credentialing history of licensed health professionals, personal, educational, and demographic background information, professional performance information consisting of continuing education, performance awards, and adverse or disciplinary actions, and evaluations and approvals completed by IHS medical staff reviewers.</p>
</xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Federal Records Act (44 U.S.C. 2901), Privacy Act of 1974, as amended (5 U.S.C. 552a), Indian Self Determination and Education and Assistance Act (25 U.S.C. 450), Snyder Act (25 U.S.C. 13), Indian Health Care Improvement Act (25 U.S.C. 1601 <i>et seq.</i>), Indian Health Service Transfer Act (42 U.S.C. 2001-2004).</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purposes of this system are:
</p><p>1. To ensure that IHS medical staff members are qualified, competent and capable of delivering quality health services consistent with those of the medical community at large and that they are granted privileges commensurate with their training and competence and with the ability of the facility to provide adequate support equipment, services, and staff.
</p> <p>2. To inform health care practitioner(s) and staff of health care facilities, state or county health professional societies or licensing boards to whom the subject individual may apply for clinical privileges, membership or licensure, of the subject individual's professional competence, character and ethical qualifications. This may include information regarding drug or alcohol abuse or dependency. Within the Department such releases may be made to personnel staffs of DHHS Regional Offices.
</p> <p>3. To provide adverse health care practice information to the National Practitioner Data Bank-Healthcare Integrity and Protection Data Bank (NPDB-HIPDB) established under Title IV of Pub. L. 99-660, the Health Care Quality Improvement Act of 1986, as amended, and Section 221(a) of Pub. L. 104-191, the Heath Insurance Portability and Accountability Act of 1996.  The purpose of such a release is to provide information concerning a current or former IHS medical staff member whose professional health care activity failed to conform to generally accepted standards of professional medical practice.
</p> <p>4. To provide health care practice information concerning current or former members of the IHS medical staff with  Commissioned Corps status to the Division of Commissioned  Personnel, U.S. Public Health Service, so that an informed decision may be made concerning the promotion, retention, or reassignment of the subject individual.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Records may be disclosed to organizations authorized to conduct evaluation studies concerning the delivery of health care services by the IHS (e.g., Joint Commission on the Accreditation of Healthcare Organizations) .
</p> <p>2. IHS may disclose records consisting of name, Social Security number, employment history and any professional qualification information concerning medical staff membership and privileges, professional competence, clinical judgment and personal character to a state or local government health professional licensing board, to the Federation of State Medical Boards, to the NPDB-HIPDB, and/or to a similar entity which has the authority to maintain records concerning the issuance, retention or revocation of licenses or registrations necessary to practice a health professional occupation or specialty.  The purpose of this disclosure is to inform medical profession licensing boards and appropriate entities about the health care practices of a current, terminated, resigned, or retired IHS medical staff member whose professional health care activity significantly failed to conform to generally accepted standards of professional medical practice. This will be done within the guidelines for notice, hearing, and review as delineated in the medical staff bylaws for the IHS facility and/or within other HHS or IHS regulations or policies.
</p> <p>3. IHS may disclose biographic data and information supplied by potential applicants to (a) references listed on the IHS medical staff and/or privileges application and associated forms for the purpose of evaluating the applicant's professional qualifications, experience, and suitability, and (b) a state or local government health profession licensing board, to a health-related professional organization, to the Federation of State Medical Boards, and to the NPDB-HIPDB or a similar entity for the purpose of verifying that all claimed background and employment data are valid and all claimed credentials are current and in good standing.
</p> <p>4. Records may be disclosed to other Federal agencies (including the Office of Personnel Management for subject individuals applying for or maintaining Civil Service appointments), to state and local governmental agencies, and to organizations in the private sector to which the subject individual applies for clinical privileges, membership or licensure for the purpose of documenting the qualifications and competency of the subject individual to provide health services in his/her health profession based on the individual's professional performance while employed by the IHS.
</p> <p>5. The Department may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof, or  (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such  litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>6. Records may be disclosed to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>7. In the event that a system of records maintained by the IHS to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, state, or local, charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>File folders and computer-based or electronic files.</p>
</xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Indexed and retrieved by name, Social Security number, and any other identifying numbers necessary to establish the identity of an individual whose record is maintained in the system of records.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. <i>Authorized Users:</i> Access is limited to authorized personnel for use in the performance of their official duties. Authorized personnel include: Physician Recruitment and other Health Professions Branch Staff and Area Governing Board Members at IHS Area Offices, and Service Unit Directors, Clinical Directors and members of the Credentials and Privilege Committee of each IHS Service Unit. At each location where records in this system will be maintained, a list of personnel or categories of personnel having an official need-to-know has been developed and is maintained.
</p> <p>2. <i>Physical Safeguards:</i> Records are kept in locked metal filing cabinets or in locked desk drawers in secured rooms at all times when not actually in use during working hours and at all times during non-working hours. Record storage areas, including file cabinets and desks, are not left unattended or unlocked during office hours, including lunch hours. Computer-based or electronic records are password protected security and any additional internal security for database (linked or unlinked).
</p> <p>3. <i>Procedural Safeguards:</i> Persons who have an official need-to-know are entrusted with records from this system of records and are instructed to safeguard the confidentiality of these records and to destroy all copies or to return such records when the need to know has expired. Instructions include the statutory penalties for noncompliance. Proper charge-out procedures are followed for the removal of records from the area in which they are maintained. Before an employee who will control disclosure of records can work with the records (<i>i.e.</i>, employees who report to the system manager) the system manager or designee ensures that the employee has received training in the safeguards applicable to the records and is aware of the actions to take to restrict disclosure. When copying records for authorized purposes, care is taken to ensure that any imperfect pages are not left in the reproduction room where they can be read but are destroyed or obliterated.
</p> <p>4. <i>Implementation Guidelines:</i> DHHS Chapter 45-13 and supplementary Chapter PHS.hf:45-13 of the General Administration Manual; DHHS, "Automated Information Systems Security Program Handbook," as amended; DHHS IRM Policy HHS-IRM-2000-0005, "IRM Policy for IT Security for Remove Access; OMB Circular A-130 "Management of Federal Information Resources"; and E-Government Act of 2002 (Pub. L. 107-347, 44 U.S.C. Ch 36).</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained by IHS for at least ten years after the individual's termination of employment or association with IHS. Records of unsuccessful applicants for medical staff membership will be retained for three years after his/her rejection. After these periods of retention expire, records are destroyed by shredding or burning.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>See Appendix 1.
</p> <p><i>Policy Coordinating Official:</i> Director, Office of Clinical and Preventive Services, IHS, 801 Thompson Avenue, Suite 300, Rockville, Maryland 20852. The IHS Clinical Directors at all IHS Service Units listed in Appendix 1 are System Managers. IHS medical staff credentials and privileges files are stored at these locations. Other addresses listed in Appendix 1 are locations at which all or parts of these  records may also be stored (Physician Recruiter at IHS Area Offices). Post Office Box designations appearing in Appendix 1 should be specified when making requests by mail.</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>Requests must be made to the appropriate System Manager (Clinical Director for the appropriate Service Unit) listed in Appendix 1.
</p> <p><i>Requests by mail:</i> Requests for information and/or access to  records received by mail must contain information providing the identity of the writer and a reasonable description of the record desired. Written requests must contain, at a minimum, the name, signature, Social Security number, and address of the requester, and for unsuccessful applicants the date when the application was submitted, and for current or former IHS health care providers the dates and locations of service. We may request additional identification when we hold records for different persons with the same name or where an apparent discrepancy exists between information contained in the record and that provided by the individual requesting access to the record.
</p> <p><i>Other names used:</i> Where an individual is seeking to obtain information about himself/herself which may be retrieved by a different name than his/her current name, he/she shall be required to produce evidence to verify that he/she is the person whose record he/she seeks.
</p> <p><i>Requests in person:</i> A subject individual who appears in person at a specific location (where he or she currently works or formerly worked) seeking access or disclosure of records contained in this system of records relating to him/her shall provide the information described in "Requests by mail" (above) and at least one piece of tangible identification such as a driver's license or passport.
</p>
    <p><i>Requests by telephone:</i> Since positive identification of the caller cannot be established, telephone requests are not honored.
    </p>
</xhtmlContent></subsection><subsection type="recordAccessProcedures"><xhtmlContent><p><i>Same as Notification Procedure:</i> Requesters should also provide a reasonable description of the record being sought. Requesters may also request an accounting of disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p> Write to the appropriate Service Unit Clinical Director at the address specified in Appendix 1 and reasonably identify the record, specify the information being contested, and state the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Subject individual, IHS health care personnel, references supplied by the subject individual, professional societies or associations, specialty boards, colleges and universities attended by the subject individual, former employers, health facilities or health providers with which the subject individual was associated, liability insurance carriers, organizations providing cardiopulmonary resuscitation (CPR) training to the subject individual, state and local health and health care licensing or certifying organizations, and organizations which serve as repositories of information on health care professionals.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p>
     <p>
         <i>
             Appendix 1: System Managers and IRS Locations Under Their Jurisdiction Where Records Are Maintained
         </i>
     </p>
     <p>Director, Aberdeen Area Indian Health Service, Room 309, Federal Building, 115 Fourth Avenue, SE., Aberdeen, South Dakota 57401.
</p> <p>Director, Cheyenne River Service Unit, Eagle Butte Indian Hospital, P.O. Box 1012, Eagle Butte, South Dakota 57625.
</p> <p>Director, Crow Creek Service Unit, Ft. Thompson Indian Health Center, P.O. Box 200, Ft. Thompson, South Dakota 57339.
</p> <p>Director, Fort Berthold Service Unit, Fort Berthold Indian Health Center, P.O. Box 400, New Town, North Dakota 58763.
</p> <p>Director, Carl T. Curtis Health Center, P.O. Box 250, Macy, Nebraska 68039.
</p> <p>Director, Fort Totten Service Unit, Fort Totten Indian Health Center, P.O. Box 200, Fort Totten, Norh Dakota 58335.
</p> <p>Director, Kyle Indian Health Center, P.O. Box 540, Kyle, South Dakota 57752.
</p> <p>Director, Lower Brule Indian Health Center, P.O. Box 191, Lower Brule, South Dakota 57548.
</p> <p>Director, McLaughlin Indian Health Center, P.O. Box 879, McLaughlin, South Dakota 57642.
</p> <p>Director, Omaha-Winnebago Service Unit, Winnebago Indian Hospital, Winnebago, Nebraska 68071.
</p> <p>Director, Pine Ridge Service Unit, Pine Ridge Indian Hospital, Pine Ridge, South Dakota 57770.
</p> <p>Director, Rapid City Service Unit, Rapid City Indian Hospital, 3200 Canyon Lake Drive, Rapid City, South Dakota 57701.
</p> <p>Director, Rosebud Service Unit, Rosebud Indian Hospital, Rosebud, South Dakota 57570.
</p> <p>Director, Sisseton-Wahpeton Service Unit, Sisseton Indian, Hospital, P.O. Box 189, Sisseton, South Dakota 57262.
</p> <p>Director, Standing Rock Service Unit, Fort Yates Indian Hospital, P.O. Box J, Fort Yates, North Dakota 58538.
</p> <p>Director, Trenton-Williston Indian Health Center, P.O. Box 210, Trenton, Noth Dakota 58853.
</p> <p>Director, Turtle Mountain Service Unit, Belcourt Indian Hospital, P.O. Box 160, Belcourt, North Dakot 58316.
</p> <p>Director, Wanblee Indian Health Center, 100 Cinic Drive, Wanblee, South Dakota 57577.
</p> <p>Director, Yankton-Wagner Service Unit, Wagner Indian Hospital, 110 Washington Street, Wagner, Sout Dakota 57380.
</p> <p>Director, Youth Regional Treatment Center, P.O. Box #68, Mobridge, South Dakota 57601.
</p> <p>Director, Sac &amp; Fox Health Center, 307 Meskwaki Road, Tama, Iowa 52339.
</p> <p>Director, Santee Health Center, 425 Frazier Avenue, Main Street #2, Niobrara, Nebraska 68760.
</p> <p><i>Director, Alaska Area Native Health Service</i>, 4141 Ambassador Drive, Suite 300, Anchorage, Alaska 99508-5928.
</p> <p><i>Director, Albuquerque Area Health Service</i>, 5300 Homestead Road, NE., Albuquerque, New Mexico 87110.
</p> <p>Director, Acoma-Canoncito-Laguna Service Unit, Acoma-Canoncito-Laguna Indian Hospital, P.O. Box 130, San Fidel, New Mexico 87049.
</p> <p>Director, To-Hajille Health Center, P.O. Box 3528, Canoncito, New Mexico 87026.
</p> <p>Director, New Sunrise Treatment Center, P.O. Box 219, San Fidel, New Mexico 87049.
</p> <p>Director, Albuquerque Service Unit, Albuquerque Indian Hospital, 801 Vassar Drive, NE., Albuquerque, New Mexico 87049.
</p> <p>Director, Albuquerque Indian Dental Clinic, P.0. Box 67830, Albuquerque, New Mexico 87193.
</p> <p>Director, Alamo Navajo Health Center, P.O. Box 907, Magdalena, New Mexico 87825.
</p> <p>Director, Jemez PHS Health Center, P.O. Box 279, Jemez, New Mexico 87024.
</p> <p>Director, Santa Ana PHS Health Center, P.O. Box 37, Bernalillo, New Mexico 87004.
</p> <p>Director, Sandia PHS Health Center, P.O. Box 6008, Bernalillo, New Mexico 87004.
</p> <p>Director, Zia PHS Health Center, 155 Capital Square, Zia, New Mexico 87053.
</p> <p>Director, Santa Fe Service Unit, Santa Fe Indian Hospital, 1700 Cerrillos Road, Santa Fe, New Mexico 87501.
</p> <p>Director, Santa Clara Health Center, RR5, Box 446, Espanola, New Mexico 87532.
</p> <p>Director, San Felipe Health Center, P.O. Box 4344, San Felipe, New Mexico 87001.
</p> <p>Director, Cochiti Health Center, P.O. Box 105, 255 Cochiti Street, Cochiti, New Mexico 87072.
</p> <p>Director, Santo Domingo Health Center, P.O. Box 340, Santo Domingo, New Mexico 87052.
</p> <p>Director, Southern Colorado-Ute Service Unit, P.O. Box 778, Ignacio, Colorado 81137.
</p> <p>Director, Ignacio Indian Health Center, P.O. Box 889, Ignacio, Colorado 81137.
</p> <p>Director, Towaoc Ute Health Center, Towaoc, Colorado 81334.
</p> <p>Director, Jicarilla Indian Health Center, P.O. Box 187, Dulce, New Mexico 87528.
</p> <p>Director, Mescalero Service Unit, Mescalero Indian Hospital, P.O. Box 210, Mescalero, New Mexico 88340.
</p> <p>Director, Taos/Picuris Indian Health Center, P.O. Box 1956, 1090 Goat Springs Road, Taos, New Mexico 87571.
</p> <p>Director, Zuni Service Unit, Zuni Indian Hospital, Zuni, New Mexico 87327.
</p> <p>Director, Pine Hill Health Center, P.O. Box 310, Pine Hill, New Mexico 87357.
</p> <p><i>Director, Bemidji Area Indian Health Service,</i> 522 Minnesota Avenue, NW., Bemidji, Minnesota 56601.
</p> <p>Director, Red Lake Service Unit, PHS Indian Hospital, Highway 1, Red Lake, Minnesota 56671.
</p> <p>Director, Leech Lake Service Unit, PHS Indian Hospital, 425 7th Street, NW., Cass Lake, Minnesota 56633.
</p> <p>Director, White Earth Service Unit, PHS Indian Hospital, P.O. Box 358, White Earth, Minnesota 56591.
</p> <p><i>Director, Billings Area Indian Health Service,</i> P.O. Box 36600, 2900 4th Avenue North, Billings, Montana 59101.
</p> <p>Director, Blackfeet Service Unit, Browning Indian Hospital, P.O. Box 760, Browning, Montana 59417.
</p> <p>Director, Heart Butte PHS Indian Health Clinic, Heart Butte, Montana 59448.
</p> <p>Director, Crow Service Unit, Crow Indian Hospital, Crow Agency, Montana 59022.
</p> <p>Director, Lodge Grass PHS Indian Health Center, Lodge Grass, Montana 59090.
</p> <p>Director, Pryor PHS Indian Health Clinic, P.O. Box 9, Pryor, Montana 59066.
</p> <p>Director, Fort Peck Service Unit, Poplar Indian Hospital, Poplar, Montana 59255.
</p> <p>Director, Fort Belknap Service Unit, Harlem Indian Hospital, Harlem, Montana 59526.
</p> <p>Director, Hays PHS Indian Health Clinic, Hays, Montana 59526.
</p> <p>Director, Northern Cheyenne Service Unit, Lame Dear Indian Health Center, Lame Deer, Montana 59043.
</p> <p>Director, Wind River Service Unit, Fort Washakie Indian Health Center, Fort Washakie, Wyoming 82514.
</p> <p>Director, Arapahoe Indian Health Center, Arapahoe, Wyoming 82510.
</p> <p>Director, Chief Redstone Indian Health Center, Wolf Point, Montana 59201.
</p> <p><i>Director, California Area Indian Health Service,</i> John E. Moss Federal Building, 650 Capitol Mall, Suite 7-100, Sacramento, California 95814.
</p> <p><i>Director, Nashville Area Indian Health Service,</i> 711 Stewarts Ferry Pike, Nashville, Tennessee 37214-2634.
</p> <p>Director, Catawba PHS Indian Nation of South Carolina, P.O. Box 188, Catawba, South Carolina 29704.
</p> <p>Director, Unity Regional Youth Treatment Center, P.O. Box C-201, Cherokee, North Carolina 28719.
</p> <p><i>Director, Navajo Area Indian Health Service,</i> P.O. Box 9020, Highway 264, Window Rock, Arizona 86515-9020.
</p> <p>Director, Chinle Service Unit, Chinle Comprehensive Health Care Facility, PO Drawer PH, Chinle, Arizona 86503.
</p> <p>Director, Tsaile Health Center, P.O. Box 467, Navajo Routes 64 &amp; 12, Tsaile, Arizona 86556.
</p> <p>Director, Rock Point Field Clinic, c/o Tasaile Health Center, P.O. Box 647, Tsaile, Arizona 86557.
</p> <p>Director, Pinon Health Station, Pinon, Arizona 86510.
</p> <p>Director, Crownpoint Service Unit, Crownpoint Comprehensive Health Care Facility, P.O. Box 358, Crownpoint, New Mexico 87313.
</p> <p>Director, Pueblo Pintado Health Station, c/o Crownpoint Comprehensive Health Care Facility, P.O. Box 358, Crownpoint, New Mexico 87313.
</p> <p>Director, Fort Defiance Service Unit, Fort Defiance Indian Hospital, P.O. Box 649, Intersection of Navajo Routes N12 &amp; N7, Fort Defiance, Arizona 86515.
</p> <p>Director, Nahata Dziil Health Center, P.O. Box 125, Sanders, Arizona 86512.
</p> <p>Director, Gallup Service Unit, Gallup Indian Medical Center, P.O. Box 1337, Nizhoni Boulevard, Gallup, New, Mexico 87305.
</p> <p>Director, Tohatchi Indian Health Center, P.O. Box 142, Tohatchi, New Mexico 87325.
</p> <p>Director, Ft. Wingate Health Station, c/o Gallup Indian Medical Center, P.O. Box 1337, Gallup, New Mexico 87305.
</p> <p>Director, Kayenta Service Unit, Kayenta Indian Health Center, P.O. Box 368, Kayenta, Arizona 86033.
</p> <p>Director, Inscription House Health Center, P.O. Box 7397, Shonto, Arizona 86054.
</p> <p>Director, Dennehotso Clinic, c/o Kayenta Health Center, P.O. Box 368, Kayenta, Arizona 86033.
</p> <p>Director, Shiprock Service Unit, Northern Navajo Medical Center, P.O. Box 160, U.S. Hwy 491 North, Shiprock, New Mexico 87420.
</p> <p>Director, Dzilth-Na-O-Dith-Hle Indian Health Center, 6 Road 7586, Bloomfield, New Mexico 87413.
</p> <p>Director, Teecnospos Health Center, P.O. Box 103, N5114 BIA School Road, Teecnospos, Arizona 86514.
</p> <p>Director, Sanostee Health Station, c/o Northern Navajo Medical Center, P.O. Box 160, Shiprock, New Mexico 87420.
</p> <p>Director, Toadlena Health Station, c/o Northen Navajo Medical Center, P.O. Box 160, Shiprock, New Mexico 87420.
</p> <p>Director, Teen Life Center, c/o Northern Navajo Medical Center, P.O. Box 160, Shiprock, New Mexico 87420.
</p> <p><i>Director, Oklahoma City Area Indian Health Service</i>, Five Corporation Plaza, 3625 NW. 56th Street, Oklahoma City, Oklahoma 73112.
</p> <p>Director, Claremore Service Unit, Claremore Comprehensive Indian Health Facility, West Will Rogers Boulvard and Moore; Claremore, Oklahoma 74017.
</p> <p>Director, Clinton Service Unit, Clinton Indian Hospital, Route 1, Box 3060, Clinton, Oklahoma 73601-9303.
</p> <p>Director, El Reno PHS Indian Health Clinic, 1631A E. Highway 66, El Reno, Oklahoma 73036.
</p> <p>Director, Watonga Indian Health Center, Route 1, Box 34-A, Watonga, Oklahoma 73772.
</p> <p>Director, Haskell Service Unit, PHS Indian Health Center, 2415 Massachusetts Avenue, Lawrence, Kansas 66044.
</p> <p>Director, Lawton Service Unit, Lawton Indian Hospital, 1515 Lawrie Tatum Road, Lawton, Oklahoma 73501.
</p> <p>Director, Anadarko Indian Health Center, P.O. Box 828, Anadarko, Oklahoma 73005.
</p> <p>Director, Carnegie Indian Health Center, P.O. Box 1120, Carnegie, Oklahoma 73150.
</p> <p>Director, Holton Service Unit, PHS Indian Health Center, 100 West 6th Street, Holton, Kansas 66436.
</p> <p>Director, Pawnee Service Unit, Pawnee Indian Service Center, RR2, Box 1, Pawnee, Oklahoma 74058-9247.
</p> <p>Director, Pawhuska Indian Health Center, 715 Grandview, Pawhuska, Oklahoma 74056.
</p> <p>Director, Tahlequah Service Unit, W. W. Hastings Indian Hospital, 100 S. Bliss, Tahlequah, Oklahoma 74464.
</p> <p>Director, Wewoka Indian Health Center, P.O. Box 1475, Wewoka, Oklahoma 74884.
</p> <p><i>Director, Phoenix Area Indian Health Service</i>, Two Renaissance Square, 40 North Central Avenue, Phoenix, Arizona 85004.
</p> <p>Director, Colorado River Service Unit, Chemehuevi Indian Health Clinic, P.O. Box 1858, Havasu Landing, California 92363.
</p> <p>Director, Colorado River Service Unit, Havasupai Indian Health Station, P.O. Box 129, Supai, Arizona 86435.
</p> <p>Director, Colorado River Service Unit, Parker Indian Health Center, 12033 Agency Road, Parker, Arizona 85344.
</p> <p>Director, Colorado River Service Unit, Peach Springs Indian Health Center, P.O. Box 190, Peach Springs, Arizona 86434.
</p> <p>Director, Colorado River Service Unit, Sherman Indian High School, 9010 Magnolia Avenue, Riverside, California 92503.
</p> <p>Director, Elko Service Unit, Southern Bands Health Center, 515 Shoshone Circle, Elko, Nevada 89801.
</p> <p>Director, Fort Yuma Service Unit, Fort Yuma Indian Hospital, P.O. Box 1368, Fort Yuma, Arizona 85366.
</p> <p>Director, Kearns Canyon Service Unit, Hopi Health Care Center, P.O. Box 4000, Polacca, Arizona 86042
</p><p>Director, Phoenix Service Unit, Phoenix Indian Medical Center, 4212 North 16th Street, Phoenix, Arizqna 85016.
</p> <p>Director, Phoenix Service Unit, Salt River Health Center, 10005 East Osborn Road, Scottsdale, Arizona 85256.
</p> <p>Director, San Carlos Service Unit, Bylas Indian Health Center, P.O Box 208, Bylas, Arizona 85550.
</p> <p>Director, San Carlos Service Unit, San Carlos Indian Hospital, P.O. Box 208, San Carlos, Arizona 85550.
</p> <p>Director, Schurz Service Unit, Schurz Service Unit Administration, Drawer A, Schurz, Nevada 89427.
</p> <p>Director, Fort McDermitt Clinic, P.O. Box 315, McDermitt, Nevada 89421.
</p> <p>Director, Unitah and Ouray Service Unit, Fort Duchesne Indian Health Center, P.O. Box 160, Fort Duchesne, Utah 84026.
</p> <p>Director, Whiteriver Service Unit, Cibecue Health Center, P.O. Box 37, Cibecue, Arizona 85941.
</p> <p>Director, Whiteriver Service Unit, Whiteriver Indian Hospital, P.O. Box 860, Whiteriver, Arizona 85941.
</p> <p>Director, Desert Vision Youth Wellness Center/RTC, P.O. Box 458, Sacaton, AZ 85247.
</p> <p><i>Director, Portland Area Indian Health Service,</i> Room 476, Federal Building, 1220 Southwest Third Avenue, Portland, Oregon 97204 -2829.
</p> <p>Director, Colville Service Unit, Colville Indian Health Center, P.O. Box 71-Agency Campus, Nespelem, Washington 99155.
</p> <p>Director, Fort Hall Service Unit, Not-Tsoo Gah-Nee Health Center, P.O. Box 717, Fort Hall, Idaho 83203.
</p> <p>Director, Neah Bay Service Unit, Sophie Trettevick Indian Health Center, P.O. Box 410, Neah Bay, Washington 98357.
</p> <p>Director, Warm Springs Service Unit, Warm Springs Indian Health Center, P.O. Box 1209, Warm Springs, Oregon 97761.</p>
<p> Director, Wellpinit Service Unit, David C. Wynecoop Memorial Clinic, P.O. Box 357, Wellpinit, Washington 99040.
</p> <p>Director, Western Oregon Service Unit, Chemawa Indian Health Center, 3750 Chemawa Road, NE, Salem, Oregon 97305-1198.
</p> <p>Director, Yakama Service Unit, Yakama Indian Health Center, 401 Buster Road, Toppenish, Washington 98948.
</p> <p><i>Director, Tucson Area Indian Health Service,</i> 7900 South "J"  Stock Road, Tucson, Arizona 85746-9352.
</p> <p>Director, Pascua Yaqui Service Unit, Division of Public Health, 7900 South "J" Stock Road, Tucson, Arizona 85746.
</p> <p>Director, San Xavier Indian Health Center, 7900 South "J" Stock Road, Tucson, Arizona 85746.
</p> <p>Director, Sells Service Unit, Santa Rosa Indian Health Center, HC01, Box 8700, Sells, Arizona 85634.
</p> <p>Director, Sells Service Unit, Sells Indian Hospital, P.O. Box 548, Sells, Arizona 85634.
</p> <p>Director, Sells Service Unit, West Side Health Station, P.O. Box 548, Sells, Arizona 85634.
</p></xhtmlContent></subsection> </section>
        <section id="09-17-0004" toc="yes">
            <systemNumber>09-17-0004</systemNumber>
            <subsection type="systemName">Indian Health Service Sanitation Facilities Construction Individual Applicant Records, HHS/IHS/OEHE.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        Each Indian Health Service (IHS) Area and local Sanitation Facilities Construction (SFC) office. (See Appendix 1).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>
                        Individuals requesting and/or receiving sanitation facilities.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        Contains name, home and/or mailing address, e-mail address, telephone phone number, Tribal roll/census number, request for service application to obtain sanitation facilities and all pertinent documents necessary to determine eligibility for such services.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>
                        &#149; Indian Sanitation Facilities Act, Public Law 86-121; 42 U.S.C. 2004a.
                    </p> 
                    <p>
                        &#149; Safe Water and Sanitary Waste Disposal Facilities, Public Law 94-437 Section 302; 25 U.S.C. 1632.
                    </p> 
                    <p>
                        &#149; Indian Lands Open Dump Cleanup, 25 U.S.C. 3901 <i>et seq.</i>
                    </p>
                    <p>
                        &#149; Department Regulation, 5 U.S.C. 301.
                    </p> 
                    <p>
                        &#149; Privacy Act of 1974 as amended, 5 U.S.C. 552a.
                    </p> 
                    <p>
                        &#149; Federal Records Act, 44 U.S.C. 2901.
                    </p> 
                    <p>
                        &#149; Section 321 of the Public Health Service Act as amended, 42 U.S.C. 248, and
                    </p>
                    <p>
                        &#149; Indian Health Care Improvement Act, 25 U.S.C. 1601 <i>et seq.</i>
                    </p>
                    <p>
                        Purpose(s): The purposes of this system of records are:
                    </p>
                    <p>
                        1. To determine basic individual and home eligibility for sanitation services provided by the SFC Program under Public Law 86-121.
                    </p> 
                    <p>
                        2. Budget justification for appropriation and project development to serve eligible homes and persons with sanitation facilities.
                    </p> 
                    <p>
                        3. To monitor, track and report status and progress of services provided.
                    </p> 
                    <p>
                        4. To maintain records on and to verify individuals' eligibility for services.
                    </p> 
                    <p>
                        5. To link with the IHS Resource and Patient Management System (RPMS) for purposes of verifying and determining individuals' eligibility.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>
                        In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, other routine uses are as follows:
                    </p>
                    <p>
                        1. IHS may disclose records to a congressional office in response to a verified inquiry from the Congressional office made at the written request of the subject individual.
                    </p> 
                    <p>
                        2. IHS may disclose records to other Federal agencies or Tribes that provide funding for or are involved in providing sanitation facilities to individuals or communities. In addition, records may be disclosed to individuals specifically involved in the process of providing sanitation facilities, including but not limited to Tribal officials, Tribal housing authorities, Tribal utilities, contractors, State and local entities and consultants.
                    </p> 
                    <p>
                        3. IHS may disclose information from these records in litigations and/or proceedings related to an administrative claim when:
                    </p>
                    <p>
                        (a) IHS has determined that the use of such records is relevant and necessary to the litigation and/or proceedings related to an administrative claim and would help in the effective representation of the affected party listed in subsections (i) through (iv) below, and that such disclosure is compatible with the purpose for which the records were collected. Such disclosure may be made to the Department of Justice (DOJ) when any of the following is a party to litigation and/or proceedings related to an administrative claim or has an interest in the litigation and/or proceedings related to an administrative claim:
                    </p>
                    <p>
                        (i) HHS or any component thereof; or
                    </p>
                    <p>
                        (ii) Any HHS employee in his or her official capacity; or
                    </p>
                    <p>
                        (iii) Any HHS employee in his or her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or
                    </p>
                    <p>
                        (iv) The United States or any agency thereof (other than HHS) where HHS/OGC has determined that the litigation and/or proceedings related to an administrative claim is likely to affect HHS or any of its components.
                    </p> 
                    <p>
                        (b) In the litigation and/or proceedings related to an administrative claim described in subsection (a) above, information from these records may be disclosed to a court or other tribunal, or to another party before such tribunal when such records are relevant and necessary to the litigation and such use by the court, tribunal, or other party is compatible with the purpose for which the agency collected the records.
                    </p> 
                    <p>
                        4. In the event that a SOR maintained by the IHS to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the SOR may be referred to the appropriate agency, whether Federal, state, or local, charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.
                    </p> 
                    <p>
                        5. IHS may disclose records contained in this system of records to HHS contractors and subcontractors for the purpose of collecting, compiling, aggregating, analyzing, or refining records in the system. Contractors maintain, and are also required to ensure that subcontractors maintain Privacy Act safeguards with respect to such records.
                    </p> 
                    <p>
                        6. IHS may disclose records contained in this system of records to other Federal or Tribal entities that provide sanitation facilities at the request of these entities in conjunction with a computer-matching program conducted by these entities to detect or curtail fraud and abuse in similar types of program services.
                    </p> 
                    <p>
                        7. To appropriate Federal agencies and Departmental contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this SOR, and the information disclosed is relevant and necessary for that assistance.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p> 
                    <p>
                        Paper records are maintained in folders and/or ledgers. Electronic records are stored on computer servers.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        Records, which identify individual persons, are indexed by name; address, phone number; Tribal/Census ID or SFC identification numbers.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        Records are accessed by persons responsible for servicing the record system in performance of their official duties. Paper records are stored in locked standard file cabinets. Electronic records are stored on servers and access or updates to information require a system password, thereby preserving the integrity of the data. All IHS personnel who make use of records contained in this system are made aware of their responsibilities under the provisions of the Privacy Act and are required to maintain Privacy Act safeguards with respect to such records.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        For individuals who receive IHS sanitation facility services, the proposed IHS Records Disposition Authority (Schedule 3, Section 11, Item No. 11-11a) states the following: Transfer to the Federal Records Center (FRC) when administrative value ends, or after 10 years of inactivity, whichever is sooner. Destroy 20 years after retirement to FRC.
                    </p> 
                    <p>
                        For individuals who do not receive IHS sanitation facility services, the proposed IHS Records Disposition Authority (Schedule 3, Section 11, Item No. 11-11b) states the following: Transfer to the FRC when administrative value ends, or after 10 years of inactivity, whichever is sooner. Destroy 20 years after retirement to the FRC.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        See Appendix 1.
                    </p> 
                    <p>
                        Policy Coordinating Official: Director, DSFC, OEHE, IHS, 801 Thompson Avenue, TMP, Suite 610, Rockville, Maryland 20852. The IHS Area Office SFC Director or designee is the System Manager for all SFC offices located within their respective IHS Area. Each SFC Office Manager is the System Manager for the respective local IHS SFC office within an Area and is the point of contact for written request(s) from the individual of the record. The local IHS SFC Office Manager will process the written request by locating all or parts of the records stored either physically or electronically.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        For information, assistance, or inquiry about the existence of records, make a written request to the IHS Area SFC Director, local IHS SFC Office Manager or designee at the appropriate location. A list of all locations is provided in Appendix 1.
                    </p> 
                    <p>
                        Individuals must provide their full name, current address and telephone number, Tribal/census ID and signature.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>
                        Individuals seeking access to information about themselves contained in this system should make a written request to the IHS Area SFC Director, local IHS SFC Office Manager or designee at the appropriate location. A list of all locations is provided in Appendix 1.
                    </p> 
                    <p>
                        Individuals must provide their full name, current address and telephone number, Tribal/Census ID and signature.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>
                        Make a written request to the IHS Area SFC Director, local IHS SFC Office Manager or designee at the appropriate location. A list of all locations is provided in Appendix 1.
                    </p> 
                    <p>
                        Individuals must provide their full name, current address and telephone number, Tribal/census ID and signature.
                    </p> 
                    <p>
                        Provide a reasonable description of the record, and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        Information will be collected from the following sources:
                    </p>
                    <p>
                        &#149; From the individual and/or a by individual's family member or designated representative.
                    </p> 
                    <p>
                        &#149; RPMS.
                    </p> 
                    <p>
                        &#149; Tribal entities.
                    </p> 
                    <p>
                        &#149; Tribal housing authorities.
                    </p> 
                    <p>
                        &#149; Tribal utilities.
                    </p> 
                    <p>
                        &#149; Other Federal agencies, including but not limited to the Bureau of Indian Affairs, state or local governments or non- governmental entities.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemsExempted">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                    <p>Appendix 1: System Managers and IHS locations under their Jurisdiction Where Records are Maintained</p>
                    <p>
                        Director, Aberdeen Area IHS; Attention: Division of Sanitation Facilities Construction, 115 4th Avenue, SE., Aberdeen, South Dakota 57401.
                    </p> 
                    <p>
                        Director, Belcourt Hospital IHS; Attention: Sanitation Facilities Construction, P.O. Box 160, Belcourt, North Dakota 58316.
                    </p> 
                    <p>
                        Director, Martin Field Office IHS; Attention: Sanitation Facilities Construction, P.O. Box F, Martin, South Dakota 57551.
                    </p> 
                    <p>
                        Director, Minot Field Office IHS; Attention: Sanitation Facilities Construction, Federal Building, Room 302, Minot, North Dakota 58701.
                    </p> 
                    <p>
                        Director, Mobridge Field Office IHS; Attention: Sanitation Facilities Construction, P.O. Box 159, Mobridge, South Dakota 57601.
                    </p> 
                    <p>
                        Director, Pierre Field Office IHS; Attention: Sanitation Facilities Construction, 420 South Garfield, Suite 200, Pierre, South Dakota 57501.
                    </p> 
                    <p>
                        Director, Rosebud Hospital IHS; Attention: Sanitation Facilities Construction, P.O. Box 400, Rosebud, South Dakota 57570.
                    </p> 
                    <p>
                        Director, Sioux City Field Office IHS; Attention: Sanitation Facilities Construction, 6th and Douglas, Room 207, Box 19, Sioux City, Iowa 51101.
                    </p> 
                    <p>
                        Director, Alaska Area Native Health Service; OEHE--Division of Sanitation Facilities Construction, 4141 Ambassador Drive, Suite 300, Anchorage, Alaska 99508.
                    </p> 
                    <p>
                        Director, Albuquerque Area IHS; Attention: Sanitation Facilities Construction, 5300 Homestead Road, NE., Albuquerque, New Mexico 87110.
                    </p> 
                    <p>
                        Director, Albuquerque Service Unit IHS; Attention: Sanitation Facilities Construction, 801 Vassar Drive, NE., Albuquerque, New Mexico 87106.
                    </p> 
                    <p>
                        Director, Santa Fe Service Unit IHS; Attention: Sanitation Facilities Construction, 1700 Cerrillos Road, Santa Fe, New Mexico 87505.
                    </p> 
                    <p>
                        Director, Southern Ute Service Unit IHS; Attention: Sanitation Facilities Construction, 322 Buckskin Charlie, Ignacio, Colorado 81137.
                    </p> 
                    <p>
                        Director, Bemidji Area IHS; Attention: Sanitation Facilities Construction, 522 Minnesota Avenue, NW., Room 216, Bemidji, Minnesota 56601.
                    </p> 
                    <p>
                        Director, Ashland Field Office IHS; Attention: Sanitation Facilities Construction, 2800 Lake Shore Drive East, Ashland, Wisconsin 54806.
                    </p> 
                    <p>
                        Director, Minnesota District Office IHS; Attention: Sanitation Facilities Construction, 522 Minnesota Avenue, NW., Room 216, Bemidji, Minnesota 56601.
                    </p> 
                    <p>
                        Director, Rhinelander District Office IHS; Attention: Sanitation Facilities Construction, 9A South Brown Street, Rhinelander, Wisconsin 54501.
                    </p> 
                    <p>
                        Director, Sault St. Marie Field Office IHS; Attention: Sanitation Facilities Construction, 2847 Ashmun Street, Suite 1, Sault Ste. Marie, Minnesota 49783.
                    </p> 
                    <p>
                        Director, Billings Area IHS; Attention: Sanitation Facilities Construction, 2900 4th Avenue North, Box 36600, Billings, Montana 59107.
                    </p> 
                    <p>
                        Director, PHS Indian Hospital; Attention: Sanitation Facilities Construction, P.O. Box 760, Browning, Montana 59417.
                    </p> 
                    <p>
                        Director, Crow Agency PHS Indian Hospital; Attention: Sanitation Facilities Construction, P.O. Box 9, Crow Agency, Montana 59022.
                    </p> 
                    <p>
                        Director, Wind River Service Unit IHS; Attention: Sanitation Facilities Construction, #76 Black Cole Drive, Box 128, Fort Washakie, Wyoming 82514.
                    </p> 
                    <p>
                        Director, Harlem PHS Indian Hospital; Attention: Sanitation Facilities Construction, RR1, Box 67, Harlem, Montana 59526.
                    </p> 
                    <p>
                        Director, Lame Deer PHS Indian Health Center; Attention: Sanitation Facilities Construction, Lame Deer, Montana 59043.
                    </p> 
                    <p>
                        Director, Wolf Point PHS Indian Health Center; Attention: Sanitation Facilities Construction, Chief Redstone Health Center, #729, Wolf Point, Montana 59201.
                    </p> 
                    <p>
                        Director, California Area IHS; Attention: Division of Sanitation Facilities Construction, 650 Capitol Mall, Suite 7-100, Sacramento, California 95814.
                    </p> 
                    <p>
                        Director, Arcata Field Office, IHS; Attention: Sanitation Facilities Construction, 1125 16th Street, Suite 100, Arcata, California 95521.
                    </p> 
                    <p>
                        Director, Escondido District Office IHS; Attention: Sanitation Facilities Construction, 1320 West Valley Parkway, Suite 309, Escondido, California 92029.
                    </p> 
                    <p>
                        Director, Fresno Field Office IHS; Attention: Sanitation Facilities Construction, 1551 East Shaw Avenue, Suite 117B, Fresno, California 93710.
                    </p> 
                    <p>
                        Director, Redding District Office IHS; Attention: Sanitation Facilities Construction, 1900 Churn Creek Road, Suite 210, Redding, California 96002.
                    </p> 
                    <p>
                        Director, Ukiah Field Office IHS; Attention: Sanitation Facilities Construction, 609 South State Street, Suite A, Ukiah, California 95482.
                    </p> 
                    <p>
                        Director, Nashville Area IHS; Attention: Division of Sanitation Facilities Construction, 711 Stewarts Ferry Pike, Nashville, Tennessee 37214-2634.
                    </p> 
                    <p>
                        Director, Atmore Field Office IHS; Attention: Sanitation Facilities Construction, 5811 Jack Springs Road, Atmore, Alabama 46502.
                    </p> 
                    <p>
                        Director, Bangor Field Office IHS; Attention: Sanitation Facilities Construction, 304 Hancock Street, #3H, Bangor, Maine 04401-6573.
                    </p> 
                    <p>
                        Director, Opelousas Field Office IHS; Attention: Sanitation Facilities Construction, 2341 Larkspur Lane, Suite 2, Opelousas, Louisiana 70570.
                    </p> 
                    <p>
                        Director, Manlius Field Office; Attention: Sanitation Facilities Construction, 122 East Seneca Street, Manlius, New York 13104.
                    </p> 
                    <p>
                        Director, Navajo Area IHS; Attention: Director, Division of Sanitation Facilities Construction, P.O. Box 9020 (Physical Address: Hwy 264 &amp; St. Michael Road), Window Rock, Arizona 86515.
                    </p> 
                    <p>
                        Director, Crownpoint Health Care Facility; Attention: Sanitation Facilities Construction, P.O. Box 680, Crownpoint, New Mexico 87313.
                    </p> 
                    <p>
                        Director, Farmington Field Office IHS; Attention: Sanitation Facilities Construction, 300 West Arrington, Suite 121, Farmington, New Mexico 87401.
                    </p> 
                    <p>
                        Director, Flagstaff Field Office IHS; Attention: Sanitation Facilities Construction, P.O. Box KK, Flagstaff, Arizona 86002.
                    </p> 
                    <p>
                        Director, Fort Defiance Indian Hospital; Attention: Sanitation Facilities Support Center, P.O. Box 648, Fort Defiance, Arizona 86504.
                    </p> 
                    <p>
                        Director, Gallup Indian Medical Center IHS; Attention: Sanitation Facilities Construction, 3412 East Highway 66, Gallup, New Mexico 87301.
                    </p> 
                    <p>
                        Director, Kayenta Indian Health Center; Attention: Sanitation Facilities Construction, P.O. Box 368, Kayenta, Arizona 86033.
                    </p> 
                    <p>
                        Director, Many Farms Field Office IHS; Attention: Sanitation Facilities Construction, P.O. Box 694, Many Farms, Arizona 86538.
                    </p> 
                    <p>
                        Director, Northern Navajo Medical Center IHS; Attention: Sanitation Facilities Construction, P.O. Box 160, Shiprock, New Mexico 87420.
                    </p> 
                    <p>
                        Director, Tuba City Regional Health Care Center; Attention: Sanitation Facilities Construction, P.O. Box 600, Tuba City, Arizona 86045.
                    </p> 
                    <p>
                        Director, Winslow Indian Health Care Center; Attention: Sanitation Facilities Construction, 500 N. Indiana Avenue, Winslow, Arizona 86047.
                    </p> 
                    <p>
                        Director, Oklahoma City Area IHS; Attention: Director, Division of Sanitation Facilities Construction, Five Corporate Plaza, 3625 NW. 56th Street, Oklahoma City, Oklahoma 73112.
                    </p> 
                    <p>
                        Director, Clinton Field Office IHS; Attention: Sanitation Facilities Construction, Route 1, Box 3060, Clinton, Oklahoma 73601.
                    </p> 
                    <p>
                        Director, Holton Field Office IHS; Attention: Sanitation Facilities Construction, 324 New York Avenue, Holton, Kansas 66436.
                    </p> 
                    <p>
                        Director, Lawton Indian Hospital IHS; Attention: Sanitation Facilities Construction, 1515 Lawrie Tatum Road, Lawton, Oklahoma 73507.
                    </p> 
                    <p>
                        Director, Miami Field Office IHS; Attention: Sanitation Facilities Construction, P.O. Box 1498, Miami, Oklahoma 74354.
                    </p> 
                    <p>
                        Director, Okmulgee Field Office IHS; Attention: Sanitation Facilities Construction, P.O. Box 67, Okmulgee, Oklahoma 74447.
                    </p> 
                    <p>
                        Director, Pawnee Field Office IHS; Attention: Sanitation Facilities Construction, 1201 Heritage Circle, Pawnee, Oklahoma 74058.
                    </p> 
                    <p>
                        Director, Shawnee Field Office IHS; Attention: Sanitation Facilities Construction, 14106 Highway 177, Shawnee, Oklahoma 74804.
                    </p> 
                    <p>
                        Director, Phoenix Area IHS; Attention: Director, Division of Sanitation Facilities Construction, Two Renaissance Square, Suite 720, 40 North Central Avenue, Phoenix, Arizona 85004-4424.
                    </p> 
                    <p>
                        Director, Elko Field Office IHS; Attention: Sanitation Facilities Construction, 557 W. Silver Street, Suite 204, Elko, Nevada 89801.
                    </p> 
                    <p>
                        Director, Fort Duchesne Indian Health Center; Attention: Sanitation Facilities Construction, P.O. Box 489, Fort Duchesne, Utah 84026.
                    </p> 
                    <p>
                        Director, Eastern Arizona District Office IHS; Attention: Sanitation Facilities Construction, 5448 S. White Mountain Road, Suite 220, Lakeside, Arizona 85929.
                    </p> 
                    <p>
                        Director, Hopi Health Care Center; Attention: Sanitation Facilities Construction, P.O. Box 4000, Polacca, Arizona 86042
                    </p>
                    <p>
                        Director, San Carlos PHS Indian Hospital; Attention: Sanitation Facilities Construction, P.O. Box 208, San Carlos, Arizona 85550.
                    </p> 
                    <p>
                        Director, Reno District Office IHS; Attention: Sanitation Facilities Construction, 1395 Greg Street, Suite 101, Sparks, Nevada 89431.
                    </p> 
                    <p>
                        Director, Western Arizona District Office IHS; Attention: Sanitation Facilities Construction, 1553 West Todd Drive, Suite 107, Tempe, Arizona 85283.
                    </p> 
                    <p>
                        Director, Whiteriver PHS Indian Hospital; Attention: Sanitation Facilities Construction, P.O. Box 860, Whiteriver, Arizona 85941.
                    </p> 
                    <p>
                        Director, Fort Yuma PHS Indian Hospital; Attention: Sanitation Facilities Construction, P.O. Box 1368, Yuma, Arizona 85364.
                    </p> 
                    <p>
                        Director, Portland Area IHS; Attention: Director, Division of Sanitation Facilities Construction, 1220 SW. Third Avenue, Room 476, Portland, Oregon 97204.
                    </p> 
                    <p>
                        Director, Olympic District Office IHS; Attention: Sanitation Facilities Construction, 4060 Wheaton Way, Suite B, Bremerton, Washington 98310.
                    </p> 
                    <p>
                        Director, Fort Hall Field Office IHS; Attention: Sanitation Facilities Construction, P.O. Box 717, Mission Road, Fort Hall, Idaho 83203.
                    </p> 
                    <p>
                        Director, Port Angeles Field Office IHS; Attention: Sanitation Facilities Construction, 1601 East Front Street, Building B, Suite C, Port Angeles, Washington 98362.
                    </p> 
                    <p>
                        Director, Western Oregon Service Unit IHS; Attention: Sanitation Facilities Construction, 3750 Chemawa Road, NE., Salem, Oregon 97305.
                    </p> 
                    <p>
                        Director, Seattle District Office IHS; Attention: Sanitation Facilities Construction, 2201 Sixth Avenue, Room 300, Seattle, Washington 98121.
                    </p> 
                    <p>
                        Director, Spokane District Office IHS; Attention: Sanitation Facilities Construction, 1919 E. Francis Avenue, Spokane, Washington 99208.
                    </p> 
                    <p>
                        Director, Tucson Area IHS; Attention: Director, Division of Sanitation Facilities Construction, 7900 S.J. Stock Road, Tucson, Arizona 85746 -7012.
                    </p> 
                    <p>
                        Director, Western District Office IHS; Attention: Sanitation Facilities Construction, 2250 North Final Avenue, Suite 4, Casa Grande, Arizona 85222.
                    </p> 
                    <p>
                        Director, Sells Service Unit IHS; Attention: Sanitation Facilities Construction, P.O. Box 548, Mesquite Street, Sells, Arizona 85634.
                    </p>
                </xhtmlContent>
            </subsection>
        </section>
<section id="09-17-0005" toc="yes">
<systemNumber>09-17-0005</systemNumber>
<subsection type="systemName">Personal Health Records (PHR) Administrative Records-IHS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Unclassified.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>IHS local facilities and the IHS National Data Centers. Address locations for IHS facilities are listed in IHS Appendix 1 of the biennial publications of the IHS systems of records.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system will contain personally identifiable information (PII) about individuals using the IHS PHR system. Users include: (1) IHS patients who successfully register and/or opt-in for a IHS PHR account and whose identity has been verified; (2) IHS Information Technology (IT) staff and/or their approved contractors who may need to enter identifying, administrative information into the system to initiate, support and maintain electronic services for PHR participants; and (3) in the future, personal and other representatives of patients who have been granted or delegated access to a patient's IHS PHR account including, but not limited to, family members, friends, legal guardians, as well as non-IHS health care providers, IHS health care providers, and certain IHS administrative staff.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system will contain the following categories of administrative records and PII data elements pertaining to system users:
</p><p>1. Registration information, including the individual's full name; IHS PHR User Identifier (ID); date of birth; email address; telephone number(s); mother's maiden name; ZIP code; place and date of registration for IHS PHR; and
</p><p>2. System Usage Information, including date and type of transaction; web analytics information for the purpose of monitoring, researching and preparing reports on site usage; patient medical record number (MRN); and other administrative data needed to administer PHR roles and services.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>25 U.S.C. 1662.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Registration information will be used to register and verify the identity of patient-users (and, in the future, their representatives), to assign and verify administrators of the PHR portal, to retrieve a patient's information to perform specific functions, to allow access to specific information and to provide other associated PHR electronic services in current and future applications of the PHR program. The registrar has the capacity to authenticate personal representatives or those who are authorized by the patient to create the account in lieu of the patient.
</p> <p>System usage information may be used (in aggregate and/or anonymized form, whenever possible) to create administrative business reports for system operators and IHS managers who are responsible for ensuring that the PHR system is meeting performance expectations and is in compliance with applicable Federal laws and regulations. Administrative information may also be used for evaluation to support program improvement, including IHS approved research studies.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Records in this system may contain information protected by 45 CFR Parts 160 and 164 (i.e., individually identifiable health information). Disclosure of this information must comply with the requirements of these regulations.
</p> <p>1. Disclosure of information in this system of records may be made to contractors and other individuals, organizations, private or public agencies with whom the IHS has a contract or agreement, to perform such services as the IHS may deem practical for the purposes of administering the PHR program, or to perform other such services as IHS deems appropriate and practical for the purposes of administering IHS programs, policies, regulations, rules, executive orders, and statutes.
</p> <p>The IHS must be able to give contractors whatever administrative information is necessary to fulfill their duties. In these situations, safeguards are provided in the contract prohibiting the contractor from using or disclosing the information for any purpose other than that described in the contract.
</p> <p>2. The IHS may disclose information that is relevant to a suspected or reasonably imminent violation of the law whether civil, criminal, or regulatory in nature and whether arising by general or program statute or by regulation, rule, or order issued pursuant thereto, to a Federal, State, local, or Tribal agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule, or order. The IHS may also disclose the names and addresses of IHS patients to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal, or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, or order issued pursuant thereto.
</p> <p>The IHS must be able to comply with the requirements of agencies charged with enforcing the law and conducting investigations. The IHS must also be able to provide information to State or local agencies charged with protecting the public's health as set forth in State law.
</p> <p>3. Disclosure may be made to the National Archives and Records Administration (NARA) and the General Services Administration (GSA) for it to perform its records management inspection responsibilities and its role as Archivist of the United States under authority of Title 44 of the United States Code.
</p> <p>In general, NARA is responsible for the physical maintenance and archiving of the Federal Government's records that are no longer actively used but which may be appropriate for preservation. The IHS must be able to turn records over to these agencies in order to determine the proper disposition of such records.
</p> <p>4. Information may be disclosed to the United States Department of Justice or Assistant United States Attorneys in order to prosecute or defend litigation involving or pertaining to the United States, or in which the United States has an interest.
</p> <p>5. IHS may disclose information from these records in litigations and/or proceedings related to an administrative claim when:
</p><p>a. IHS has determined that the use of such records is relevant and necessary to the litigation and/or proceedings related to an administrative claim and would help in the effective representation of the affected party listed in subsections (i) through (iv) below, and that such disclosure is compatible with the purpose for which the records were collected. Such disclosure may be made to the HHS/OGC, when any of the following is a party to litigation and/or proceedings related to an administrative claim or has an interest in the litigation and/or proceedings related to an administrative claim:
</p><p>(i) HHS or any component thereof; or
</p><p>(ii) Any HHS employee in his or her official capacity; or
</p><p>(iii) Any HHS employee in his or her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(iv) The United States or any agency thereof (other than HHS) where HHS/OGC has determined that the litigation and/or proceedings related to an administrative claim is likely to affect HHS or any of its components.
</p> <p>b. In the litigation and/or proceedings related to an administrative claim described in subsection (a) above, information from these records may be disclosed to a court or other tribunal, or to another party before such tribunal in response to an order of a court or administrative tribunal, provided that the covered entity discloses only the information expressly authorized by such order.
</p> <p>6. Disclosure may be made to a Congressional office from this system of records in response to an inquiry from the Congressional office made at the request of the individual who is the subject of the records.  For example, in special cases, an individual may request the help of a member of Congress to resolve an issue relating to a matter before the IHS. Consequently, the member of Congress may write the IHS, and the IHS must be able to give sufficient information to respond to the inquiry. If the issue involved the PHR, then the individual's PHR may need to be released to Congress, per that individual's request.
</p> <p>7. Disclosure may be made to other Federal agencies to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs. This routine use permits disclosures by HHS to report a suspected incident of identity theft and provide information or documentation related to or in support of the reported incident.
</p> <p>8. Information, including information about PHR use and user transactions accomplished via the Web site, may be provided to research investigators with IHS Institutional Review Board (IRB) and/or IHS Privacy Board approval. Disclosure of this information to research investigators will allow the IHS to evaluate the value of the PHR for purposes of system modification and improvement (i.e., to enhance, advance and promote both the function and the content of the PHR application), and for purposes of promoting patient self-management of health and improved health outcomes.
</p> <p>9. Information may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting HHS's efforts to respond to a suspected or confirmed breach of the security of confidentiality of information maintained in this system of records, if the information disclosed is relevant and necessary for that assistance.</p>
<p>The IHS may disclose any information or records to appropriate agencies, entities, and persons when:
</p><p>a. It is suspected or confirmed that the integrity or confidentiality of information in the system of records has been compromised;
</p><p>b. HHS has determined that as a result of the suspected or confirmed compromise, there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by HHS or another agency) that rely upon the compromised information; and
</p><p>c. The disclosure is to agencies, entities, or persons whom the IHS determines are reasonably necessary to assist or carry out HHS's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosures by HHS to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or prevision of credit protection services.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>These administrative records are maintained on paper and electronic media, including hard drive disks, which are backed up to tape at regular intervals.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records may be retrieved by an individual's name, user ID, date of registration for IHS PHR electronic services, zip code, the IHS assigned MRN, date of birth and/or social security number, if provided.
</p></xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent><p>(Technical, Physical and Administrative):
</p><p>1. Access to and use of the IHS PHR is limited to those individuals whose roles or official duties require such access. The IHS has established security procedures for this system to ensure that access is appropriately limited. Information security officers and system data stewards review and authorize data access requests. The IHS regulates data access with security software that authenticates IHS PHR users and requires individual unique codes and passwords. The IHS provides information security training to all staff and instructs staff on the responsibility each person has for safeguarding data confidentiality. The IHS regularly updates security standards and procedures that are applied to systems and individuals supporting this program.
</p> <p>2. Physical access to computer rooms housing the PHR Administrative Records is restricted to authorized staff and protected by a variety of security devices. Unauthorized employees, contractors, and other staff are not allowed in computer rooms. The IHS uses contracted security personnel to provide physical security for the buildings housing computer systems and data centers.</p>
<p>3. Data transmissions between operational systems and IHS PHR are protected by telecommunications software and hardware as prescribed by IHS standards and practices. This includes firewalls, encryption, and other security measures necessary to safeguard data as it travels across the IHS-Wide Area Network.
</p> <p>4. Copies of back-up computer files are maintained at secure off-site locations.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained and disposed of in accordance with the records disposition authority approved by the Archivist of the United States. Records from this system that are needed for audit purposes will be disposed of six (6) years after a user's account becomes inactive. Routine records will be disposed of when the agency determines they are no longer needed for administrative, legal, audit, or other operational purposes. These retention and disposal statements are pursuant to NARA General Records Schedules GRS 20, "Electronic Records ", item 1c (found at Internet Web site address: <i>http://www.archives.gov/records-mgmt/grs/grs20.html</i>) and GRS 24, " Information Technology Operations and Management Records", item 6a, (found at Internet Web site address: <i> http://www.archives.gov/records-mgmt/grs/grs24.html).</i></p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Officials responsible for policies and procedures: Director, Office of Information Technology (OIT) and Director, Office of Clinical and Preventive Services (OCPS), IHS, 801 Thompson Avenue, Rockville, MD 20852. Officials maintaining this system of records: The local IHS facility (address locations for IHS facilities are listed in IHS Appendix 1 of the IHS systems of records 09-17-0001 Medical, Health and Billings Records).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Individuals who wish to determine whether a PHR is being maintained under their name in this system, or wish to access and determine the accuracy of the contents of such records, have several options:
</p><p>1. Submit a written request or apply in person to the IHS facility where the records are located. IHS facility location information can be found at <i>http://www.IHS.GOV;</i> or
</p><p>2. Submit a written request or apply in person to the local Privacy Act official at their facility or Area office. Inquiries should include the patient's full name, user ID, date of birth and return address.
</p> <p>3. Individuals seeking to contest the accuracy of records in this system may also write or call their local IHS facility and/or submit to the local Privacy official the IHS 917 form (found at Internet Web address--<i>http://www.hhs.gov/forms/IHS-917_508.pdf</i>).</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The sources of information for this system of records include the individuals covered by this notice and additional contributors, as listed below:
</p><p>1. All individuals who successfully register for a PHR account; and
</p><p>2. IHS staff and/or their contractors and subcontractors who may need to enter information into the system to initiate, support and maintain PHR electronic services for PHR users.
</p></xhtmlContent></subsection>
 <subsection type="exemptionsClaimed"><xhtmlContent><p>None.</p></xhtmlContent></subsection> </section>
<section id="09-25-0005" toc="yes">
<systemNumber>09-25-0005</systemNumber>
<subsection type="systemName">Administration: Library Operations and NIH Library User I.D. File, HHS/NIH.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This system of records is an umbrella system comprising separate sets of records located in National Institutes of Health (NIH) facilities in Bethesda, Maryland, or facilities of contractors of the NIH. Write to the appropriate System Manager listed below for list of current contractor locations.
</p> <p>Clinical Center (CC), Building 10, Room 1L07, 10 Center Drive, Bethesda, MD 20892.
</p> <p>National Library of Medicine (NLM), Building 38, Room 1S33, 8600 Rockville Pike, Bethesda, MD 20894.
</p> <p>National Library of Medicine (NLM), Building 38, Room 1N21, 8600 Rockville Pike, Bethesda, MD 20894.
</p> <p>National Library of Medicine (NLM), Building 38, Room B1E21, 8600 Rockville Pike, Bethesda, MD 20894.
</p> <p>National Technical Information Service (NTIS), Accounting Department, 8001 Forbes Place, Room 208F, Springfield, VA 22151.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Users of library services.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Name, organization, address, phone number, photographs, issue date, email address, signature, user code and identification number; and when applicable, credit card number and billing information.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 301 of the Public Health Service Act, describing the general powers and duties of the Public Health Service relating to research and investigation (42 U.S.C. 241).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To monitor library material, services, and circulation control.
</p> <p>2. To provide user documentation.
</p> <p>3. To provide copying services (duplication of library materials).
</p> <p>4. To manage invoice and billing transactions for library services.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Disclosure may be made to contractors and staff to monitor library material, services, circulation control; to provide user documentation; and to process or refine the records. Recipients are required to maintain Privacy Act safeguards with respect to those records.
</p> <p>Disclosure may be made for billing purposes to: (a) contractors providing copying services and (b) NTIS for document delivery services.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored on computer tape and disk, paper and file cards.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, user code and/or identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to Library staff members who need to verify that Library identification cards have been issued to those Library users requesting services such as reference and interlibrary loans. Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the system manager. The contractor maintains a list of personnel having authority to access records to perform their duties.
</p> <p>2. Physical Safeguards: The offices housing the cabinets and file drawers for storage of records are locked during all library off-duty hours. During all duty hours offices are attended by employees who maintain the files. The contractor has secured records storage areas which are not left unattended during the working hours and file cabinets which are locked after hours.
</p> <p>3. Procedural Safeguards: Access to the file is strictly controlled by employees who maintain the files. Records may be removed from files only at the request of the system manager or other authorized employees. Access to computerized records is controlled by the use of security codes known only to authorized users. Contractor personnel receive instruction concerning the significance of safeguards under the Privacy Act.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 8000-D-2, which allows records to be kept until superseded or for a maximum period of six years. Refer to the NIH Manual Chapter for specific conditions on disposal.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Management Analyst, Office of Administration, National Library of Medicine (NLM), Building 38A, Room B2N12, 8600 Rockville Pike, Bethesda, MD 20894.
</p> <p>Chief, Reference and Bibliographic Services Section, Library Branch, Office of Research Services, Office of the Director (OD), Building 10, Room 1L21, 10 Center Drive, Bethesda, MD 20892.
</p> <p>Head, Quality Assurance Unit, Preservation and Collection Management Section, Public Services Division, Library Operations, National Library of Medicine (NLM), Building 38, Room B1E21, 8600 Rockville Pike, Bethesda, MD 20894.
</p> <p>Chief, Public Services Division, Library Operations, National Library of Medicine (NLM), Building 38, Room 1S33, 8600 Rockville Pike, Bethesda, MD 20894.
</p> <p>Librarian, History of Medicine Division, National Library of Medicine (NLM), Building 38, Room 1N21, 8600 Rockville Pike, Bethesda, MD 20894.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official at the address specified under Notification Procedures above, and reasonably identify the record and specify the information to be contested, the corrective action sought, and the reasons for the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual, NIH Library ID card data.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0007" toc="yes">
<systemNumber>09-25-0007</systemNumber>
<subsection type="systemName">Administration: NIH Safety Glasses Issuance Program, HHS/NIH/ORS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Health Unit, Occupational Medical Service, Division of Safety, Office of Research Services (ORS), Building 13, Room G904, 13 South Drive, Bethesda, MD 20892.
</p> <p>Write to the System Manager at the address below for the address of any Federal Records Center where records from this system may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>NIH employees who apply for safety glasses.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Explanation of eye impact and hazard occupation.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5. U.S.C. 7902.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Records are used for proper distribution of safety glasses and for proof of delivery.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical and procedural safeguards such as the following:
</p><p>1. Authorized Users: Access is limited to personnel involved in safety glasses issuance program, to supervisors of employees who have requested glasses, and to personnel involved in accounting.
</p> <p>2. Physical Safeguards: Record storage locations are locked when unattended.
</p> <p>3. Procedural Safeguards: Access to file rooms and files is controlled by system manager or designee.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1300-B-3, which allows records to be kept for a maximum period of five years. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Deputy Director, Division of Safety, Office of Research Services (ORS), Building 31, Room 1C02, 31 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official at the address specified under Notification Procedures above, and reasonably identify the record and specify the information to be contested, the corrective action sought, and the reasons for the correction, with supporting information to how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Previous employer and education institutions.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0011" toc="yes">
<systemNumber>09-25-0011</systemNumber>
<subsection type="systemName">Clinical Research: Blood Donor Records, HHS/NIH/CC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Transfusion Medicine Department, Clinical Center (CC), Building 10, Room 1C711, 10 Center Drive, Bethesda, MD 20892-1184.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Donors of blood and blood components to be used in the NIH Clinical Center for patient infusions.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Past donations, blood types, phenotypes. Laboratory results of infectious disease testing, serologic reactions on all blood samples, donations of blood or blood components.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>"Preparation of Biological Products" of the Public Health Service Act (42 U.S.C. 263).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To provide a means for contacting blood donors for patient care and research.
</p> <p>2. To provide a medical history of all donors for the transfusion records of each blood unit.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to HHS contractors and their staff in order to accomplish the purposes for which the records are collected. The recipients are required to comply with the requirements of the Privacy Act with respect to such records.
</p> <p>2. Certain diseases and conditions, including infectious diseases, may be reported to State or Federal government as required by State or Federal law.
</p> <p>3. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>4. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example in defending against a claim based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, the Department may disclose such records as it deems desirable or necessary to the Department of Justice or other appropriate Federal agency to enable that agency to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>5. (a) PHS may inform the sexual and/or needle-sharing partner(s) of a subject individual who is infected with the human immunodeficiency virus (HIV) of their exposure to HIV, under the following circumstances: (1) The information has been obtained in the course of clinical activities at PHS facilities carried out by PHS personnel or contractors; (2) The PHS employee or contractor has made reasonable efforts to counsel and encourage the subject individual to provide the information to the individual's sexual or needle-sharing partner(s); (3) The PHS employee or contractor determines that the subject individual is unlikely to provide the information to the sexual or needle-sharing partner(s) or that the provision of such information cannot reasonably be verified; and (4) The notification of the partner(s) is made, whenever possible, by the subject individual's physician or by a professional counselor and shall follow standard counseling practices.
</p> <p>(b) PHS may disclose information to State or local public health departments, to assist in the notification of the subject individual's sexual and/or needle-sharing partner(s), or in the verification that the subject individual has notified such sexual or needle-sharing partner(s).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in a computer file, on donor cards, and on microfilm.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by a unique control number assigned to each individual donor.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Access is granted only to authorized employees in the Department of Transfusion Medicine including physicians, nurses, technologists, computer operators, and the department's administrative officer.
</p> <p>1. Authorized Users: Access is granted only to authorized employees of the Department of Transfusion Medicine including physicians, nurses technologists, computer operators and the secretary to the Chief.
</p> <p>2. Physical Safeguards: Record facilities are locked when system personnel are not present.
</p> <p>3. Procedural Safeguards: Access to manual files is limited to authorized users. Access to computerized records is controlled by the use of security codes known only to the authorized users.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 3000-E-50. Refer to the NIH Manual Chapter for specific conditions on disposal.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, Transfusion Medicine Department, Clinical Center (CC), Building 10, Room 1C711, 10 Center Drive, Bethesda, MD 20892-1184.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p> <p>An individual who requests notification of or access to a medical record shall, at the time the request is made, designate in writing, a responsible representative, who may be a physician, who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>To obtain access to a record, contact the System Manager at the address specified above. Requesters should provide the same information as is required under the Notification Procedures above. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official specified under Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Data are collected from the individual.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0012" toc="yes">
<systemNumber>09-25-0012</systemNumber>
<subsection type="systemName">Clinical Research: Candidate Healthy Volunteer Records, HHS/NIH/CC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Clinical Research Volunteer Program, Building 61, 10 Cloister Court, Bethesda, MD 20892-4754.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Normally healthy individuals who volunteer to participate in NIH studies.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Program application, health questionnaire and record of participation.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241, 263.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To determine suitability for participation in the normal volunteer program.
</p> <p>2. To document remuneration of normal volunteers.
</p> <p>3. To provide a record of participation to be used (a) in writing letters of recommendation/reference for the volunteer, and (b) preparing reports on the normal volunteer program.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Clinical research data are made available to approved or collaborating researchers, including HHS contractors and grantees.
</p> <p>2. Certain diseases and conditions, including infectious diseases, may be reported to appropriate representatives of State or Federal Government as required by State or Federal law.
</p> <p>3. Information may be used to respond to congressional inquiries for constituents concerning admission to the NIH Clinical Center.
</p> <p>4. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Program applications and health questionnaires are stored in file folders. Records of participation are stored in databases and date files.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical, procedural safeguards such as the following:
</p><p>1. Authorized Users: Access is granted only to the Healthy Volunteer Program staff and to NIH physicians who have requested the recruitment of volunteers for their clinical research projects.
</p> <p>2. Physical Safeguards: Access to the files is strictly controlled by the files staff. Records may be removed from the file only at the request of the system manager or other authorized employees. Record facilities are locked when system personnel are not present.
</p> <p>3. Procedural Safeguards: Access to the files is strictly controlled by the files staff. Records may be removed from the file only at the request of the system manager or other authorized employees.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1-"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 3000-E-61, which allows records to be kept for a maximum period of three years after the volunteer period ends. Refer to the NIH Manual Chapter for specific conditions on disposal.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Clinical Research Volunteer Program, Building 61,10 Cloister Court, Bethesda, MD 20892-4745.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p> <p>An individual who requests notification of or access to a medical record shall, at the time the request is made, designate in writing, a responsible representative, who may be a physician, who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.
</p> <p>A parent or guardian who requests notification of, or access to, a child's or incompetent person's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child or incompetent person as well as his or her own identity.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>To obtain access to a record, contact: Clinical Research Volunteer Program, National Institutes of Health, 10 Cloister Court, Building 61, Bethesda, MD 20892-4754 and provide the information described under notification procedures above. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested, the corrective action sought, and the reasons for the correction, with supporting justification. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Volunteer.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0014" toc="yes">
<systemNumber>09-25-0014</systemNumber>
<subsection type="systemName">Clinical Research: Student Records, HHS/NIH/OD/OIR/OE.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Education, Office of Intramural Research, Office of the Director (OD), Building 2, Room 2E06, 2 Center Drive, Bethesda, MD 20892-1158.
</p> <p>Write to the System Manager at the address below for the address of any Federal Records Center where records from this system may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Potential and accepted Clinical and Research Fellows, medical students, and other students in NIH training programs.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Application form, transcripts, references, evaluations.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To identify candidates for clinical and research fellow, clinical elective, and other training positions.
</p> <p>2. To maintain a permanent record of those individuals who have received clinical research training at the NIH for historical and reference uses.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Information may be used to respond to congressional inquiries regarding constituents who have applied for training programs.
</p> <p>2. Information may be used to respond to hospitals and other healthcare institutions seeking verification of training for physicians who trained in NIH clinical programs.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders, electronic databases and disks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name and year.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent the unauthorized disclosure of information covered under the Privacy Act are implemented for each training program administered through the Office of Education.
</p> <p>1. Authorized Users: Staff in the Office of Education are instructed to disclose information only to NIH personnel who are involved in the evaluation and selection of candidates for intramural training programs.
</p> <p>2. Physical Safeguards: Paper files and disks are stored in cabinets in a locked room that is under constant surveillance by security personnel. Electronic databases are accessible only with a password on secure web sites.
</p> <p>3. Procedural safeguards: Access to the paper files is strictly controlled by the Office of Education staff. Files may be removed only with the approval of the system manager or other authorized official(s).
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1-"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), items 2300-320-1- 13, which allows records to be kept up to a maximum period of ten years. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Deputy Director, Office of Education, Office of Intramural Research, Office of the Director (OD), Building 2, Room 2E06, 2 Center Drive, Bethesda, MD 20892-1158.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>To obtain access to a record, contact the System Manager at the above address and provide the information described under notification procedures above. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the System Manager at the address specified above, and reasonably identify the record and specify the information to be contested, the corrective action sought, and the reasons for the correction, with supporting justification. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Applicants, universities and teachers.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0033" toc="yes">
<systemNumber>09-25-0033</systemNumber>
<subsection type="systemName">International Activities: Fellowships Awarded by Foreign Organizations, HHS/NIH/FIC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Fogarty International Center (FIC), Building 31, Room B2C39, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Write to System Manager at the address below for the address of any Federal Records Center where records from this system may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>U.S. citizens qualified in health-related sciences submitting applications through NIH for fellowships for study abroad.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Applications and associated records and reports.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>To perform scientific reviews and evaluations of applicants' suitability of referral to awarding organization in foreign countries.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. After review by the operating agency review panel the applications and all supporting documents are forwarded to the foreign organizations or agencies making awards.
</p> <p>2. In addition, such application may be made available to authorized employees and agents of the Federal Government for purposes of investigations, inspections and audits, and, in appropriate cases, to the Department of Justice for prosecution under civil and criminal laws.
</p> <p>3. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>4. Disclosure may be made to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name and fellowship number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical and procedural safeguards such as the following:
</p><p>1. Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to FIC program staff. Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the system manager.
</p> <p>2. Physical Safeguards: The records are maintained in locked file cabinets, and offices are locked during off-duty hours.
</p> <p>3. Procedural Safeguards: Access to file rooms and files is strictly controlled by files staff. Records may be removed from files only at the request of the system manager or other authorized employees.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), items 2300-320-5, which allows records to be destroyed after a maximum period of six years after the close of a case. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of International Training and Research, Fogarty International Center (FIC), Building 31, Room B2C39, 31 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Requests for notification of or access to records should be addressed to the System Manager, as listed above. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official under Notification Procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Applicants and persons supplying references.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0034" toc="yes">
<systemNumber>09-25-0034</systemNumber>
<subsection type="systemName">International Activities: Scholars-in-Residence Program, HHS/NIH/FIC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Fogarty International Center (FIC), Building 16, Room 202, 16 Center Drive, Bethesda, MD 20892.
</p> <p>Write to System Manager at the address below for the address of the Federal Records Center where records may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Distinguished scientists and scholars invited to accept NIH scholarships.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Employment and education histories; references.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 2421, "International Cooperation" of the PHS Act.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To administer and award scholarships to distinguished scientists.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Information is made available to authorized employees and agents of the Federal Government for purposes of investigations, inspections and audits, and in appropriate cases, to the Department of Justice for prosecution under civil and criminal laws.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>3. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical, and procedural safeguards such as the following:
</p><p>1. Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to FIC program staff. Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the system manager.
</p> <p>2. Physical safeguards: Records are kept in file cabinets. Offices are locked during off-duty hours.
</p> <p>3. Procedural safeguards: Access to files is strictly controlled by files staff. Files may be removed only at the request of the system manager or other authorized employee.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), items 2300-320-7 which allows records to be destroyed after a maximum period of six years after the close of a case. Refer to the NIH Manual Chapter for specific retention instructions.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Director, Division of Advanced Studies and Policy Analysis, Fogarty International Center (FIC), Building 16, Room 202, 16 Center Drive, Bethesda, MD 20892-6705.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Requests for notification of or access to records should be addressed to the System Manager, as listed above. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official under Notification Procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information is obtained from invitees, reference sources, and persons supplying recommendations.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0036" toc="yes">
<systemNumber>09-25-0036</systemNumber>
<subsection type="systemName">Extramural Awards and Chartered Advisory Committees (IMPAC 2), Contract Information (DCIS), and Cooperative Agreement Information, HHS/NIH.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Policy for Extramural Research Administration, Office of Extramural Research, Office of the Director (OD), Rockledge II, Room 2172, 6701 Rockledge Drive, Bethesda, MD 20892.
</p> <p>Office of Federal Advisory Committee Policy, Office of the Director (OD), Building 31, Room 3B-59, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Office of Acquisition Management and Policy, Office of the Director (OD), 6100 Executive Boulevard, Room 6D01, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Principal investigators; program directors; program and projects staff and others named in the application; National Research Service Awards (NRSA) trainees and fellows; research career awardees; chartered advisory committee members; contractor personnel; subcontractor personnel; and consultants.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Funding applications, awards, associated records, trainee appointments, current and historical information pertaining to chartered advisory committees, and past performance information pertaining to contractors.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5. U.S.C. 301; 42 U.S.C. 217a, 241, 282(b)(6), 284a, and 288. 48 CFR Subpart 15.3 and Subpart 42.15.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To support centralized grant programs of the Public Health Service.
</p> <p>Services are provided in the areas of grant application assignment and referral, initial review, council review, award processing and grant accounting. The database is used to provide complete, accurate, and up-to-date reports to all levels of management.
</p> <p>2. To maintain communication with former fellows and trainees who have incurred a payback obligation through the National Research Service Award Program.
</p> <p>3. To maintain current and historical information pertaining to the establishment of chartered advisory committees of the National Institutes of Health and the appointment or designation of their members.
</p> <p>4. To maintain current and historical information pertaining to contracts awarded by the National Institutes of Health, and performance evaluations on NIH contracts and contracts awarded by other Federal agencies that participate in the NIH Contractor Performance System.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to the National Technical Information Service (NTIS), Department of Commerce, for dissemination of scientific and fiscal information on funded awards (abstract of research projects and relevant administrative and financial data).
</p> <p>2. Disclosure may be made to the cognizant audit agency for auditing.
</p> <p>3. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>4. Disclosure may be made to qualified experts not within the definition of Department employees as prescribed in Department regulations for opinions as a part of the application review process.
</p> <p>5. Disclosure may be made to a Federal agency, in response to its request, in connection with the issuance of a license, grant or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision in the matter.
</p> <p>6. Disclosure of past performance information pertaining to contractors may be made to a Federal agency upon request. In addition, routine access to past performance information on contractors will be provided to Federal agencies that subscribe to the NIH Contractor Performance System.
</p> <p>7. A record may be disclosed for a research purpose, when the Department: (A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (B) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) justifies the risk to the privacy of the individual that additional exposure of the record might bring; (C) has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining that information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law; and (D) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
</p> <p>8. Disclosure may be made to a private contractor or Federal agency for the purpose of collating, analyzing, aggregating or otherwise refining records in this system. The contractor or Federal agency will be required to maintain Privacy Act safeguards with respect to these records.
</p> <p>9. Disclosure may be made to a grantee or contract institution in connection with performance or administration under the conditions of the particular award or contract.
</p> <p>10. Disclosure may be made to the Department of Justice, or to a court or other adjudicative body, from this system of records when (a) HHS, or any component thereof; or (b) any HHS officer or employee in his or her official capacity; or (c) any HHS officer or employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the officer or employee; or (d) the United States or any agency thereof where HHS determines that the proceeding is likely to affect HHS or any of its components, is a party to proceeding or has any interest in the proceeding, and HHS determines that the records are relevant and necessary to the proceeding and would help in the effective representation of the governmental party.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored by name, application, grant or contract ID number, and contractor tax ID number.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, application, grant or contract ID number, and contractor tax ID number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to NIH extramural and advisory committee staff, NIH contract management staff, and Federal acquisition personnel. Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the System manager.
</p> <p>2. Physical Safeguards: Physical access to Office of Extramural Research (OER) work areas is restricted to OER employees. Physical access to the Office of Acquisition and Policy (OAMP) work areas is restricted to OAMP employees. Physical access to Office of Federal Advisory Committee Policy (OFACP) work areas is restricted to OFACP employees. Access to the contractor performance files is restricted through the use of secure socket layer encryption and through an IBM password protection system. Only authorized government contracting personnel are permitted access. Access is monitored and controlled by OAMP.
</p> <p>3. Procedural Safeguards: Access to source data files is strictly controlled by files staff. Records may be removed from files only at the request of the System manager or other authorized employee. Access to computer files is controlled by the use of registered accounts, registered initials, keywords, and similar limited access systems.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 4000-A-2, which allows records to be destroyed when no longer needed for administrative purposes. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>For Extramural Awards: Director, Extramural Information Systems, Division of Grants Compliance and Oversight in the Office of Policy for Extramural Research Administration (OPERA), Office of Extramural Research, Office of the Director (OD), Rockledge II, Room 2172, 6701 Rockledge Drive, Bethesda, MD 20892.
</p> <p>For Chartered Federal Advisory Committees of the National Institutes of Health: Director, Office of Federal Advisory Committee Policy, Office of the Director, Building 31, Room 3B-59, 31 Center Drive, Bethesda, MD 20892.
</p> <p>For Contracts: Office of Acquisition Management and Policy, Office of the Director (OD), 6100 Executive Boulevard, Room 6D01, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official under Notification Procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction, with supporting justification. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Applicant institution, individual, individual's educational institution and references, and participating Federal acquisition personnel.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0041" toc="yes">
<systemNumber>09-25-0041</systemNumber>
<subsection type="systemName">Research Resources: Scientists Requesting Hormone Distribution, HHS/NIH/NIDDK.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>National Institute of Diabetes, and Digestive Kidney Diseases (NIDDK), Democracy Plaza II, Room 693, 6707 Democracy Boulevard, Bethesda, MD 20892-5460.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Scientists requesting hormones from the National Institute of Diabetes, and Digestive Kidney Diseases.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Justification for request for hormones, including requester's competence.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241, 263, 289a, 289c.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. For review of applications requesting hormones and antibodies for research purposes, prior to awarding these substances.
</p> <p>2. To determine if the requester is qualified to receive these materials.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to NIDDK Contractors for distribution of various hormones to requesters.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>3. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to staff working for the contractor who need the records for hormone distribution, to NIH staff who supervise the Hormone Distribution Program, and, as approved by the system manager, to scientists and physicians who may have need of the information for research.
</p> <p>2. Physical Safeguards: Records are kept in cabinets in offices which are locked during off-duty hours and which have alarms.
</p> <p>3. Procedural Safeguards: Access to files is strictly controlled by files staff. Files may be obtained only at the request of the system manager or other authorized employee.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records
</p><p>Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 3000-G-3, which allows records to be kept as long as they are useful in scientific research. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Hormone Distribution Program, National Institute of Diabetes, Digestive and Kidney Diseases (NIDDK), Democracy Plaza II, Room 693, 6707 Democracy Boulevard, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists write to: Administrative Officer, National Institute of Diabetes, Digestive and Kidney Diseases (NIDDK), Building 31, Room 9A46, 31 Center Drive, Bethesda, MD 20892.
</p> <p>The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official under Notification Procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction, with supporting justification. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Data is obtained from the individual.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0054" toc="yes">
<systemNumber>09-25-0054</systemNumber>
<subsection type="systemName">Administration: Property Accounting (Card Key System), HHS/NIH/ORS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>NIH Computer Center, National Institutes of Health, Building 12A, Room 1011, 12 South Drive, Bethesda, MD 20892.
</p> <p>Office of Research Services, Building 13, Room 215, 13 South Drive, Bethesda, MD 20892-5758.
</p> <p>Facilities Engineering Branch, National Institute of Environmental Health Sciences (NIEHS), 102-01, PO Box 12233, Research Triangle Park, NC 27709.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Employees of the National Institutes of Health who are issued card keys.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Property management.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301; 5 U.S.C. 5901; 5 U.S.C. 7903; 40 U.S.C. 318a; 42 U.S.C. 241.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Used for card keys issuance and control.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>3. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders, and on magnetic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to officials whose duties require use of the information. Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the system manager.
</p> <p>2. Physical Safeguards: Textual records are stored in offices which are locked when not in use.
</p> <p>3. Procedural Safeguards: Computer files are password protected.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1300-C-14, which allows records to be destroyed after all listed credentials are accounted for or three months after the return of credentials to the issuing office. Refer to the NIH Manual Chapter for specific instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Management Analyst, Division of Engineering Services, Office of Research Services (ORS), Building 3, Room 112, 3 Center Drive, Bethesda, MD 20892-0307.
</p> <p>Chief, Facilities Engineering Branch, National Institute of Environmental Health Sciences (NIEHS), 102-01, PO Box 12233, Research Triangle Park, NC 27709.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official specified under Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Data is obtained from the individual.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0078" toc="yes">
<systemNumber>09-25-0078</systemNumber>
<subsection type="systemName">Administration: Consultant File, HHS/NIH/NHLBI.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>National Heart, Lung, and Blood Institute (NHLBI), Rockledge II, 6701 Rockledge Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>List of consultants available for use in evaluation of National Heart, Lung, and Blood Institute special grants and contracts.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Names and resumes.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241(d), 281.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To identify and select experts and consultants for program reviews and evaluations.
</p> <p>2. For use in evaluation of NHLBI special grants and contracts.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Computer disk and file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Data on computer files is accessed by keyword known only to authorized users.
</p> <p>2. Physical Safeguards: Rooms where records are stored are locked when not in use.
</p> <p>3. Procedural Safeguards: During regular business hours, rooms are unlocked but are controlled by on-site personnel.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1100-G. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, Review Branch, National Heart, Lung, and Blood Institute (NHLBI), Rockledge II, Room 7178, 6701 Rockledge Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, contact: Privacy Act Coordinator, National Heart, Lung, and Blood Institute (NHLBI), Building 31, Room 5A33, 31 Center Drive, Bethesda, MD 20892-2490.
</p> <p>The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under also pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official under Notification Procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Subject individual.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0087" toc="yes">
<systemNumber>09-25-087</systemNumber>
<subsection type="systemName">Administration: Senior Staff, HHS/NIH/NIAID.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>National Institute of Allergy and Infectious Diseases (NIAID), Building 31, Room 7A50, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Write to System Manager at the address below for the address of the Federal Records Center where records from this system may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Current and former key professional employees of the Institute, and consultants.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Press releases, curricula vitae, nominations for awards, and photographs.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241(d), 289a.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>For background records to provide public announcements on National Institute of Allergy and Infectious Diseases research.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Stored in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical, and procedural safeguards such as the following:
</p><p>1. Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to staff whose duties require the use of such information. Authorized users are located in the Office of the Director, NIAID. Other one time and special access by other employees is granted on a need-to-know basis as specifically authorized by the system manager.
</p> <p>2. Physical Safeguards: Records in this system are stored in file folders which are kept in locked cabinets. The room is locked during off- duty hours.
</p> <p>3. Procedural Safeguards: Access to files is strictly controlled by files staff. Records may be removed from files only at the request of the system manager or other authorized employee.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1100-G. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Office of Communications and Public Liaison, National Institute of Allergy and Infectious Diseases (NIAID), Building 31, Room 7A-50, 31 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to: Privacy Act Coordinator, National Institute of Allergy and Infectious Diseases (NIAID), 6700-B Rockledge Drive, Room 2143, Bethesda, MD 20892. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as record Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction, with supporting justification. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individuals and newspaper clippings.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0078" toc="yes">
<systemNumber>09-25-0078</systemNumber>
<subsection type="systemName">Clinical Research: Patient Medical Records, HHS/NIH/CC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Medical Record Department, Clinical Center, Building 10, Room 1N208, 10 Center Drive, Bethesda, MD 20892-1192 and at private organizations under contract. Write to the system manager for a list of current locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Registered Clinical Center patients and some individuals not registered as patients but seen in the Clinical Center for diagnostic tests.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Medical treatment records.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241, 248: "Research and Investigation," and "Hospitals, Medical Examinations, and Medical Care."
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To provide a continuous history of the treatment afforded individual patients in the Clinical Center.
</p> <p>2. To provide a data base for the clinical research conducted within the hospital.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Information may be used to respond to Congressional inquiries for constituents concerning their admission to NIH Clinical Center.
</p> <p>2. Social Work Department may give pertinent information to community agencies to assist patients or their families.
</p> <p>3. Referring physicians receive medical information for continuing patient care after discharge.
</p> <p>4. Information regarding diagnostic problems, or having unusual scientific value may be disclosed to appropriate medical or medical research organizations or consultants in connection with treatment of patients or in order to accomplish the research purposes of this system. For example, tissue specimens may be sent to the Armed Forces Institute of Pathology; X-rays may be sent for the opinion of a radiologist with extensive experience in a particular kind of diagnostic radiology. The recipients are required to maintain Privacy Act safeguards with respect to these records.
</p> <p>5. Records may be disclosed to representatives of the Joint Commission on Accreditation of Hospitals conducting inspections to ensure that the quality of the Clinical Center medical record-keeping meets established standards.
</p> <p>6. Certain diseases and conditions, including infectious diseases, may be reported to appropriate representatives of State or Federal Government as required by State or Federal law.
</p> <p>7. Medical information may be disclosed in identifiable form to tumor registries for maintenance of health statistics, e.g., for use in epidemiologic studies.
</p> <p>8. The Department contemplates that it may contract with a private firm for transcribing, updating, copying, or otherwise refining records in this system. Relevant records will be disclosed to such a contractor. The contractor will be required to comply with the requirements of the Privacy Act with respect to such records.
</p> <p>9. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example in defending against a claim based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that agency to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>10.(a). PHS may inform the sexual and/or needle-sharing partner(s) of a subject individual who is infected with the human immunodeficiency virus (HIV) of their exposure to HIV, under the following circumstances: (1) The information has been obtained in the course of clinical activities at PHS facilities carried out by PHS personnel or contractors; (2) The PHS employee or contractor has made reasonable efforts to counsel and encourage the subject individual to provide the information to the individual's sexual or needle-sharing partner(s); (3) The PHS employee or contractor determines that the subject individual is unlikely to provide the information to the sexual or needle-sharing partner(s) or that the provision of such information cannot reasonably be verified; and (4) The notification of the partner(s) is made, whenever possible, by the subject individual's physician or by a professional counselor and shall follow standard counseling practices.
</p> <p>(b). PHS may disclose information to State or local public health departments, to assist in the notification of the subject individual's sexual and/or needle-sharing partner(s), or in the verification that the subject individual has notified such sexual or needle-sharing partner(s).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders and/or on microfiche, and on computer tapes.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by unit number and patient name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical, and procedural safeguards such as the following:
</p><p>1. Authorized Users: Employees maintaining records in this system are instructed to grant regular access only to physicians and dentists and other health care professionals officially participating in patient care, to contractors, or to NIH researchers specifically authorized by the system manager.
</p> <p>2. Physical Safeguards: All record facilities are locked when system personnel are not present.
</p> <p>3. Procedural Safeguards: Access to files is strictly controlled by the system manager. Records may be removed only by system personnel following receipt of a request signed by an authorized user. Access to computerized records is controlled by the use of security codes known only to the authorized user. Codes are user- and function-specific.
</p> <p>Contractor compliance is assured through inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records in this system are instructed to make no disclosure of the records except as authorized by the System Manager.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 3000-E-22, which allows records to be kept until no longer needed for scientific reference. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Medical Record Department, Clinical Center (CC), Building 10, Room 1N208, 10 Center Drive, Bethesda, MD 20892-1192.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the above address. The requester must provide tangible proof of identity, such as a driver's license. If no identification papers are available, the requester must verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p> <p>An individual who requests notification of or access to a medical/dental record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. The representative may be a physician, or other health professional, or other responsible individual. The subject individual will be granted direct access unless it is determined that such access is likely to have an adverse effect on him or her. In that case, the medical/dental record will be sent to the designated representative. The individual will be informed in writing if the record is sent to the representative.
</p> <p>A parent or guardian who requests notification of or access to a child's/incompetent person's record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child/incompetent person as well as his/her own identity.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably identify the specific reports and related dates pertaining to the information to be released. There may be a fee for reproducing more than 20 pages of material. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager and reasonably identify the record and specify the information to be contested, and state the corrective action sought and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Referring physicians, other medical facilities (with patient's consent), patients, relatives of patients.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0105" toc="yes">
<systemNumber>09-25-0105</systemNumber>
<subsection type="systemName">Administration: Health Records of Employees, Visiting Scientists, Fellows, and Others who Receive Medical Care Through the Employee Health Unit, HHS/NIH/ORS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Main Employee Health Unit, Occupational Medical Service, Building 10, 6th Floor Clinic, 10 Center Drive, Bethesda, MD 20892.
</p> <p>Auxiliary Employee Health Unit, Occupational Medical Service, Building 13, Room G904, 13 South Drive, Bethesda, MD 20892.
</p> <p>Employee Health Unit, Rocky Mountain Laboratories, Hamilton, Montana 59840.
</p> <p>Employee Assistance Program, Occupational Medical Service, Building 31, Room B2B57, 31 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Employees, fellows, visiting scientists, relatives of inpatients, visitors, and others who receive medical care through the Employee Health Unit.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Medical records.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 7901.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. For medical treatment.
</p> <p>2. Upon researcher request with individual's written permission, release of record for research purposes to medical personnel.
</p> <p>3. Upon request by HHS personnel offices for determination of fitness for duty, and for disability retirement and other separation actions.
</p> <p>4. For monitoring personnel to assure that safety standards are maintained.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to Federal, State, and local government agencies for adjudication of benefits under workman's compensation, and for disability retirement and other separation actions.
</p> <p>2. To district office of OPEC, Department of Labor with copies to the U.S. Office of Personnel Management for processing of disability retirement and other separation actions.
</p> <p>3. Upon non-HHS agency request, for examination to determine fitness for duty with copies to requesting agency and to the U.S. Office of Personnel Management.
</p> <p>4. Disclosure may be made to a congressional office from the record of an individual in response to any inquiry from the congressional office made at the request of the individual.
</p> <p>5. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name and social security number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical and procedural safeguards such as the following:
</p><p>1. Authorized Users: Access is limited to authorized personnel (system manager and staff; Occupational Medicine Service staff; and personnel and administrative officers with need for information for fitness for duty, disability, and other similar determinations).
</p> <p>2. Physical Safeguards: Files are maintained in locked cabinets.
</p> <p>3. Procedural Safeguards: Access to files is strictly controlled by authorized staff.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule, Manual Chapter 1743 (HHS Records Management Manual, Appendix B-361), item 2300-792-3.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Deputy Director, Division of Safety, Office of Research Services (ORS), Building 31, Room 1C02, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Chief, Rocky Mountain Operations Branch, Rocky Mountain Laboratories, Hamilton, Montana 59840.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Contact System Manager at appropriate treatment location listed above, to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requester should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official specified under Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Records contain data resulting from clinical and preventative services provided at treatment location, and data received from individual.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0106" toc="yes">
<systemNumber>09-25-0106</systemNumber>
<subsection type="systemName">Administration: Office of the NIH Director and Institute/Center Correspondence Records, HHS/NIH/OD.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Executive Secretariat, Office of the Director (OD), Building 1, Room B1-55, 1 Center Drive, Bethesda, MD 20892-0122.
</p> <p>Machine Room, Executive Secretariat, Office of the Director (OD), Building 31, Room 3B33, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Office of Legislative Policy and Analysis, Office of the Director (OD), Building 1, Room 244, 1 Center Drive, Bethesda, MD 20892.
</p> <p>Office of Science Education, Office of Science Policy, Office of the Director (OD), Rockledge I, Room 724, 6705 Rockledge Drive, Bethesda, MD 20892.
</p> <p>Institute/Center staff offices that retain correspondence files and computer servers which store document images.
</p> <p>Write to the appropriate System Manager listed in Appendix I for a list of current locations and for the address of the Federal Records Center where records are stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who have contacted the NIH Director or his/her subordinates, or have been contacted in writing by one of these officials.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Correspondence and other supporting documents; mailing lists.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301; 44 U.S.C. 3101.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To control, address, and track all correspondence documents addressed or directed to the NIH Director or his/her subordinates, as well as documents/supporting documents initiated by them, in order to assure timely and appropriate attention.
</p> <p>2. Incoming correspondence and supporting documentation is forwarded to other HHS components when a response from them is warranted.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. Disclosure may be made from this system of records by the Department of Health and Human Services (HHS) to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored by computer index, optical image and in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, document number, date, and subject.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Access to textual records is limited to authorized personnel (system managers and staff).
</p> <p>2. Physical Safeguards: Physical access to records and to computer servers containing records is restricted to authorized personnel.
</p> <p>3. Procedural Safeguards: Access to textual records is strictly controlled by system managers and staff. Records may be removed from files only at the request of system managers or other authorized employees. Computer files are password protected.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1700-C, which allows records to be kept for a maximum period of ten years. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>System Managers are listed in Appendix I; each maintains full responsibility for their specific correspondence system.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the appropriate System Manager as listed in Appendix I.
</p> <p>The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official under Notification Procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Records are derived from incoming and outgoing correspondence.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p><p><i> Appendix I: System Managers </i> Information Systems Manager, Executive Secretariat, Office of the Director (OD), Building 1, Room B146, 1 Center Drive, Bethesda, MD 20892-0122.</p>
<p>Acting Associate Director, Office of Legislative Policy and Analysis, Office of the Director (OD), Building 1, Room 244, 1 Center Drive, Bethesda, MD 20892-0160</p>
<p>Privacy Act Systems Manager, Office of Science Education, Office of Science Policy, Office of the Director (OD), Rockledge I, Room 729, 6705 Rockledge Drive, Bethesda, MD 20892-7984.</p><p>Secretary to the Director, National Cancer Institute (NCI), Building 31, Room 11A48, 31 Center Drive, Bethesda, MD 20892-2590.</p>
<p>Secretary to the Director, Office of the Director, National Heart, Lung, and Blood Institute (NHLBI), Building 31, Room 5A52, 31 Center Drive, Bethesda, MD 20892-2486.</p>
<p>Director, Office of Communication and Public Liaison, National Institute of Diabetes and Digestive and Kidney (NIDDK), Building 31, Room 9A04, 31 Center Drive, Bethesda, MD 20892-2560.</p>
<p>Executive Secretariat, National Institute of Environmental Health Sciences (NIEHS), PO Box 12233, South Campus, Building 2, Room B201, Research Triangle Park, NC 27709-B201.</p>
<p>Secretary to the Director, National Eye Institute (NEI), Building 31, Room 6A03, 31 Center Drive, Bethesda, MD 20892-2510.</p>
<p>Executive Assistant to the Director, National Institute of Arthritis and Musculoskeletal and Skin Diseases (NIAMS), Building 31, Room 4C32, 31 Center Drive, Bethesda, MD 20892-2350.</p>
<p>Chief, Administrative Management Branch, National Institute on Deafness and Other Communication Disorders (NIDCD), Building 31, Room 3C02, 31 Center Drive, Bethesda, MD 20892-2320.</p>
<p>Secretary to the Director, National Institute of General Medical Sciences (NIGMS), Natcher Building, Room 2AN12D, 45 Center Drive, Bethesda, MD 20892-6200.</p>
<p>Secretary to the Director, Office of the Director, National Library of Medicine (NLM), Building 38, Room 2E17, 8600 Rockville Pike, Bethesda, MD 20894-6075.</p>
<p>Secretary to the Director, Fogarty International Center (FIC), Building 31, Room B2C02, 31 Center Drive, Bethesda, MD 20892- 2220.</p>
<p>Special Assistant for Liaison Activities, Office of AIDS Research, Office of the Director (OD), Building 2, Room 4E14, 2 Center Drive, Bethesda, MD 20892.</p>
<p>Executive Secretariat, National Institute on Drug Abuse (NIDA), Neuroscience Center, 6001 Executive Boulevard, Room 5101, Bethesda, MD 20892-9585.</p>
<p>Executive Secretariat, National Institute on Alcohol Abuse and Alcoholism (NIAAA), Willco Building, Room 400, 6000 Executive Boulevard, Bethesda, MD 20892-7003.</p>
<p>Executive Secretariat, National Institute of Mental Health (NIMH), Neuroscience Center, 6001 Executive Boulevard, Room 8208, Bethesda, MD 20892-9667.</p>
<p>Director, Office of Communications, National Center for Complementary and Alternative Medicine (NCCAM), Democracy Plaza II, Room 401, 6707 Democracy Boulevard, Bethesda, MD 20892-5475.</p>
<p>Privacy Act Coordinator, National Institute of Biomedical Imaging and Bioengineering (NIBIB), Building 31, Room 1B37, 31 Center Drive, Bethesda, MD 20892-2077.</p>
<p>Privacy Act Coordinator, National Center on Minority Health and Health Disparities (NCMHD), Democracy Plaza II, Room 800, 6707 Democracy Boulevard, Bethesda, MD 20892-5465.</p></xhtmlContent></subsection></section>
<section id="09-25-0108" toc="yes">
<systemNumber>09-25-0108</systemNumber>
<subsection type="systemName">Personnel: Guest Researchers, Special Volunteers, and Scientists Emeriti, HHS/NIH/OHRM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This system is located in the Personnel/Administrative Offices of individual Institutes/Centers of the National Institutes of Health. These records are interspersed with staff records and filed alphabetically.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals using NIH facilities who are not NIH employees.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Personal information including name, address, date and place of birth, education, employment, purpose for which NIH facilities are desired, outside sponsor, and NIH sponsor.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241(a)(2), 42 U.S.C. 282(b)(10), and 42 U.S.C. 284(b)(1)(k).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To determine eligibility to use NIH facilities, to document the individual's presence at NIH, and to record that the individual is not an employee.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to U.S. Office of Personnel Management for program evaluation purposes; to General Accounting Office for fund disbursement determinations.
</p> <p>2. Disclosure may be made to institutions providing financial support.
</p> <p>3. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the request of that individual.
</p> <p>4. Disclosure may be made to the Department of Justice or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>5. Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>File folders and computer programs.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>For each location and for the particular records maintained in each project. Each site implements personnel, physical and procedural safeguards such as the following:
</p><p>1. Authorized Users: Access is granted only to personnel staff, administrative office staff and management officials directly involved in the administration of the Guest Researcher, Special Volunteer and Scientist Emeriti programs.
</p> <p>2. Physical Safeguards: Record facilities are locked when system personnel are not present.
</p> <p>3. Procedural Safeguards: Access to files is strictly controlled by system personnel. Records may be removed from the file only with the approval of the system manager or other authorized employees.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 2300-320-3(a), which allows records to be destroyed after a maximum period of two years after the individual completes work at NIH. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Personnel/Principal or Senior Administrative Officers of National Institutes of Health Institutes/Centers.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists and where it is located, contact the Privacy Act Coordinator, Office of Human Resource Management, Office of the Director (OD), Building 31, Room 1C39, 31 Center Drive, Bethesda, MD 20892.
</p> <p>The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Contact the Personnel Officer or Administrative Officer in whose office the record is located and provide verification of identity as described under notification procedure above. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official specified under Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Subject individual, NIH sponsor, funding institution.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0115" toc="yes">
<systemNumber>09-25-0115</systemNumber>
<subsection type="systemName">Administration: Curricula Vitae of Consultants and Clinical Investigators, HHS/NIH/NIAID.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>National Institute of Allergy and Infectious Diseases (NIAID), 6700-B Rockledge Drive, Room 3134, Bethesda, MD 20892-7630.
</p> <p>McKesson BioServices Corporation, 7501 Standish Place, Rockville, MD 20850.
</p> <p>Write to the System Manager at the address below for the address of the Federal Records Center where records are stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Consultants and Clinical Investigators under National Institute of Allergy and Infectious Diseases (NIAID) Investigational New Drug Applications.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Curricula vitae.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241, 289a.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To maintain a record of the investigators under Investigational New Drug (IND) applications.
</p> <p>2. To appoint consultants to the NIAID Institutional Review Board (IRB).
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Stored in books.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical, and procedural safeguards such as the following:
</p><p>1. Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to NIAID staff whose duties require the use of such information. Authorized users are located in the Office of Clinical Research Affairs, Division of Microbiology and Infectious Diseases, NIAID. Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the system manager.
</p> <p>2. Physical Safeguards: Building is locked during off-duty hours.
</p> <p>3. Procedural safeguards: Access to files is strictly controlled by files staff. Records may be removed from files only at the request of the System Manager or other authorized employee.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1100-G. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Office of Clinical Research Affairs, Division of Microbiology and Infectious Diseases, National Institute of Allergy and Infectious Diseases (NIAID), 6700-B Rockledge Drive, Room 3134, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to: Privacy Act Coordinator, National Institute of Allergy and Infectious Disease (NIAID), 6700 -B Rockledge Drive, Room 2143, Bethesda, MD 20892.
</p> <p>The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official specified under Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individuals.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0118" toc="yes">
<systemNumber>09-25-0118</systemNumber>
<subsection type="systemName">Contracts: Professional Services Contractors, HHS/NIH/NCI.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Write to System Manager at the address below for the address of the Federal Records Center where records may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals under contract with the National Cancer Institute.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Professional services contracts.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241(d), 281.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Used by staff for general administrative purposes to assure compliance with contract program requirements.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Stored in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Retrieved by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Access is limited to authorized personnel (system manager and staff).
</p> <p>2. Physical Safeguards: Records are maintained in offices which are locked when not in use
</p><p>3. Procedural Safeguards: Access to files is strictly controlled by system manager and staff.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 2600-A-4, which allows records to be destroyed after a maximum period of six years and three months after final payment. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>ARC Manager, Division of Cancer Treatment and Diagnosis (DCTD), National Cancer Institute (NCI), Building 31, Room 3A44, 31 Center Drive, Bethesda, MD 20892.
</p> <p>ARC Manager, Office of the Director (OD), National Cancer Institute (NCI), Building 31, Room 11A35, 31 Center Drive, Bethesda, MD 20892.
</p> <p>ARC Manager, Executive Plaza (EP), National Cancer Institute (NCI), Building 6116, Room 220, 6116 Executive Boulevard, Bethesda, MD 20892.
</p> <p>ARC Manager, Building 6116, National Cancer Institute (NCI), 6116 Executive Boulevard, Room 200, Bethesda, MD 20892.
</p> <p>ARC Manager, Division of Cancer Prevention (DCP), National Cancer Institute (NCI), Executive Plaza North, Room 3060, 6130 Executive Boulevard, Bethesda, MD 20892.
</p> <p>ARC Manager, Division of Cancer Biology (DCB), National Cancer Institute (NCI), Executive Plaza North, Room 500, 6130 Executive Boulevard, Bethesda, MD 20892.
</p> <p>ARC Manager, Division of Cancer Control and Population Sciences (DCCPS), National Cancer Institute (NCI), Executive Plaza North, Room 3038, 6130 Executive Boulevard, Bethesda, MD 20892.
</p> <p>ARC Manager, Building 41, National Cancer Institute (NCI), Building 41, Room A101, 41 Medlars Drive, Bethesda, MD 20892.
</p> <p>ARC Manager, Building 37, National Cancer Institute (NCI), Building 37, Room 5A15, 37 Convent Drive, Bethesda, MD 20892.
</p> <p>ARC Manager, Frederick Cancer Research and Development Center (FCRDC), National Cancer Institute (NCI), Building 578, Room 23, Frederick, MD 21702.
</p> <p>ARC Manager, Division of Cancer Epidemiology and Genetics (DCEG), National Cancer Institute (NCI), Executive Plaza South, Room 8086, 6120 Executive Boulevard, Bethesda, MD 20892.
</p> <p>ARC Manager, Center for Cancer Research (CCR), National Cancer Institute (NCI), Building 31, Room 3A19, 31 Center Drive, Bethesda, MD 20892.
</p> <p>ARC Manager, Building 10A, National Cancer Institute (NCI), Building 10, Room 12N210, 10 Center Drive, Bethesda, MD 20892.
</p> <p>ARC Manager, Building 10B, National Cancer Institute (NCI), Building 10, Room 12N210, 10 Center Drive, Bethesda, MD 20892.
</p> <p>ARC Manager, Information Technology (IT), National Cancer Institute (NCI), Building 6116, Room 503, 6116 Executive Boulevard, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the appropriate System Manager listed above to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official under Notification Procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction, with supporting justification. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individuals in the system.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0121" toc="yes">
<systemNumber>09-25-0121</systemNumber>
<subsection type="systemName">International Activities: Senior International Fellowships Program, HHS/NIH/FIC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Division of International Training and Research, Fogarty International Center (FIC), Building 31, Room B2C39, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Write to System Manager at the address below for the address of the Federal Records Center where records from this system are stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Applicants for Senior International Fellowships.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Applications and associated records and reports.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 242e.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>For award and administration of fellowships to outstanding faculty members in mid-career from U.S biomedical research and educational institutions for study abroad.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Each fellow's home institution receives a notice of award and funding for the fellowship.
</p> <p>2. Applications are made available to authorized employees and agents of the U.S., including the General Accounting Office for purposes of investigations, inspections and audits, and in appropriate cases, to the Department of Justice for proper action under civil and criminal laws.
</p> <p>3. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>4. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>File folders and computer disks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Name and fellowship number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical, procedural safeguards such as the following:
</p><p>1. Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to Fogarty International Center (FIC) program staff. Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the system manager.
</p> <p>2. Physical Safeguards: The records are stored in locked file cabinets and offices are locked during off-duty hours.
</p> <p>3. Procedural Safeguards: Access to files is strictly controlled by files staff. Records may be removed from files only at the request of the system manager or other authorized employees. For computerized records access is controlled by the use of security codes known to authorized users and access codes are changed periodically. The computer system maintains an audit record of all requests for access.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 2300-320-7, which allows records to be destroyed after a maximum period of six years after the close of a case. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of International Training and Research, Fogarty International Center (FIC), Building 31, Room B2C39, 31 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Requests for notification of or access to records should be addressed to the System Manager, listed above. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official under Notification Procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information obtained from applicants and persons supplying recommendations through the Center for Scientific Review.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0124" toc="yes">
<systemNumber>09-25-0124</systemNumber>
<subsection type="systemName">Administration: Pharmacology Research Associates, HHS/NIH/NIGMS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Director, PRAT Program, Pharmacological Sciences, National Institute of General Medical Sciences (NIGMS), Natcher Building, Room 2AS43D, 45 Center Drive, Bethesda, MD 20892.
</p> <p>Write to System Manager at the address below for the address of the Federal Records Center where records are stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Applicants for positions as Pharmacology Research Associates with the National Institute of General Medical Sciences (NIGMS) and current and former Pharmacology Research Associates.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Individual application forms, addresses, telephone numbers, lists of awards received, research keywords, preceptor and institute during time of fellowship for former fellows, academic transcripts, reprints and references, curricula vitae and salary adjustment memorandum for fellows.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 209.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>For review, award and administration of the Pharmacology Research Associate Program (PRAT).
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>File folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>By name of applicant.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical, and procedural safeguards such as the following:
</p><p>1. Authorized Users: Employees who maintain the system are instructed to grant access only to authorized personnel (System manager and staff assigned to the program).
</p> <p>2. Physical Safeguards: The records are maintained in locked file cabinets when not in use and system location is locked during non-working hours.
</p> <p>3. Procedural Safeguards: Access to files is strictly controlled by responsible individuals who have been instructed in the Privacy Act requirements. Records are returned to the locked cabinets when not in use.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 2300-320-2(a). Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, PRAT Program, Pharmacological Sciences, National Institute of General Medical Sciences (NIGMS), Natcher Building, Room 2AS49K, 45 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to System Manager and provide the following information: applicant's name and date of application. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedures above, and reasonably identify the record and specify the information to be contested, the corrective action sought. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information obtained from applicants, university registrars, and persons supplying recommendations through the PRAT Program. Salary adjustment memos from preceptors. Information on former fellows obtained from former fellows.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0140" toc="yes">
<systemNumber>09-25-0140</systemNumber>
<subsection type="systemName">International Activities: International Scientific Researchers in Intramural Laboratories at the National Institutes of Health, HHS/NIH/FIC/ORS/DIRS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Center for Information Technology (CIT), Building 12A, Room 3061, 12 South Drive, Bethesda, Maryland 20892.
</p> <p>Ancillary records are located in the Office of the Associate Director for Intramural Affairs, laboratories, administrative and personnel offices where participants are assigned. Write to System manager at the address below for the address of the Federal Records Center where records are stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Health scientists at all levels of their pre- and postdoctoral or equivalent research careers who are invited to the National Institutes of Health to conduct research related to their doctoral studies, for further postdoctoral training, or to conduct research in their biomedical specialties under the auspices of FIC's administration of International Activities. Most of these scientists are foreign, however some may be resident aliens .
</p> <p>Individuals in these categories include the following: Visiting Scientists (i.e., Title 42 employees) and Foreign Special Experts (also employees) and Visiting Fellows, Guest Researchers, Exchange Scientists, International Research Fellows, Fogarty Scholars, and Special Volunteers.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>History of fellowship, employment and/or stay at NIH; education, previous institution of affiliation, immigration data, and references. For payroll purposes, social security numbers are requested of all applicants accepted into the program.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 242l and Section 307 of the Public Health Service Act.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To document the individual's presence at the NIH, to record immigration history of the individual in order to verify continued eligibility in existing programs, and to meet requirements in the code of Federal Regulations (8 CFR, "Aliens and Nationality," and 22 CFR, "Foreign Relations").
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Information is made available to authorized employees and agents of the U.S. Government including, but not limited to, the General Accounting Office, the Internal Revenue Service, the FBI and Immigration and Naturalization Service, Department of Justice, and the Department of State for purposes of investigations, inspections and audits.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.
</p> <p>3. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has any interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders, computer hard disks and tapes, and computer diskettes.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>By name, country of citizenship, country of birth, gender, fellowship case number, visa and immigration status, program category, NIH institute and lab, sponsor, degree attained, stipend or salary level, dates of stay at NIH, termination date, work address and telephone number, and home address.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>A variety of safeguards is implemented for the various sets of records included under this system according to the sensitivity of the data they contain.
</p> <p>1. Authorized Users: NIH administrative and personnel staff screened by FIC staff to access information on a need-to-know basis. Only FIC staff are authorized to add, change, or delete data. Access by other employees is granted on a need-to-know basis as specifically authorized by the system manager.
</p> <p>2. Physical Safeguards: The records are maintained in file cabinets in offices that are locked during off-duty hours.
</p> <p>3. Procedural Safeguards: Access to files is strictly controlled by files staff. Records may be removed from files only at the request of the system manager or other authorized employees. For computerized records, access is controlled by the use of security codes known only to authorized users; access codes are changed periodically. The computer system maintains an audit record of all requests for access.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 2300-320, which allows records to be destroyed after a maximum period of six years after the close of a case. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Director, Division of Intramural Research Services, Office of Research Services (ORS), Building 31, Room 3B65, 31 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedure. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official listed under Notification Procedure above, and reasonably identify the record, and specify the information to be contested, and state the corrective action sought and the reasons for the correction. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Subject individuals and other Federal agencies.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0156" toc="yes">
<systemNumber>09-25-0156</systemNumber>
<subsection type="systemName">Records of Participants in Programs and Respondents in Surveys Used to Evaluate Programs of the Public Health Service, HHS/PHS/NIH/OD.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This system of records is an umbrella system comprising separate sets of records located either in the organizations responsible for conducting evaluations or at the sites of programs or activities under evaluation. Locations include Public Health Service (PHS) facilities, or facilities of contractors of the PHS. Write to the appropriate System manager below for a list of current locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals covered by this system are those who provide information or opinions that are useful in evaluating programs or activities of the PHS other persons who have participated in or benefitted from PHS programs or activities; or other persons included in evaluation studies for purposes of comparison. Such individuals may include (1) participants in research studies; (2) applicants for and recipients of grants, fellowships, traineeships or other awards; (3) employees, experts and consultants; (4) members of advisory committees; (5) other researchers, health care professionals, or individuals who have or are at risk of developing diseases or conditions studied by PHS; (6) persons who provide feedback about the value or usefulness of information they receive about PHS programs, activities or research results; (7) persons who have received Doctorate level degrees from U.S. institutions; (8) persons who have worked or studied at U.S. institutions that receive(d) institutional support from PHS.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This umbrella system of records covers a varying number of separate sets of records used in different evaluation studies. The categories of records in each set depend on the type of program being evaluated and the specific purpose of the evaluation. In general, the records contain two types of information: (1) Information identifying subject individuals, and (2) information which enables PHS to evaluate its programs and services.
</p> <p>1. Identifying information usually consists of a name and address, but it might also include a patient identification number, grant number, social security number, or other identifying number as appropriate to the particular group included in an evaluation study.
</p> <p>2. Information used for evaluation varies according to the program evaluated. Categories of evaluative information include personal data and medical data on participants in clinical and research programs; personal data, publications, professional achievements and career history of researchers; and opinions and other information received directly from individuals in evaluation surveys and studies of PHS programs.
</p> <p>The system does not include any master list, index or other central means of identifying all individuals whose records are included in the various sets of records covered by the system.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for this system comes from the authorities regarding the establishment of the National Institutes of Health, its general authority to conduct and fund research and to provide training assistance, and its general authority to maintain records in connection with these and its other functions (42 U.S.C. 203, 241, 289l-1 and 44 U.S.C. 3101), and Section 301 and 493 of the Public Health Service Act.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>This system supports evaluation of the policies, programs, organization, methods, materials, activities or services used by PHS in fulfilling its legislated mandate for (1) conduct and support of biomedical research into the causes, prevention and cure of diseases; (2) support for training of research investigators; (3) communication of biomedical information.
</p> <p>This system is not used to make any determination affecting the rights, benefits or privileges of any individual.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to HHS contractors and collaborating researchers, organizations, and State and local officials for the purpose of conducting evaluation studies or collecting, aggregating, processing or analyzing records used in evaluation studies. The recipients are required to protect the confidentiality of such records.
</p> <p>2. Disclosure may be made to organizations deemed qualified by the Secretary to carry out quality assessments, medical audits or utilization review.
</p> <p>3. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>4. The Department may disclose information from this system of records to the Department of Justice, to court or other tribunal, or to another party before such tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the tribunal, or the other party is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Data may be stored in file folders, bound notebooks, or computer-accessible media (e.g., magnetic tapes, disks, cartridges, CD- ROMs, etc.).
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information is retrieved by name and/or participant identification number within each evaluation study. There is no central collection of records in this system, and no central means of identifying individuals whose records are included in the separate sets of records that are maintained for particular evaluation studies.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>A variety of safeguards are implemented for the various sets of records in this system according to the sensitivity of the data each set contains. Information already in the public domain, such as titles and dates of publications, is not restricted. However, sensitive information, such as personal or medical history or individually identified opinions, is protected according to its level of sensitivity. Records derived from other systems of records will be safeguarded at a level at least as stringent as that required in the original systems. Minimal safeguards for the protection of information which is not available to the general public include the following:
</p><p>1. Authorized Users: Regular access to information in a given set of records is limited to PHS or to contractor employees who are conducting, reviewing or contributing to a specific evaluation study. Other access is granted only on a case-by-case basis, consistent with the restrictions required by the Privacy Act (e.g., when disclosure is required by the Freedom of Information Act), as authorized by the system manager or designated responsible official.
</p> <p>2. Physical Safeguards: Records are stored in closed or locked containers, in areas which are not accessible to unauthorized users, and in facilities which are locked when not in use. Records collected in each evaluation project are maintained separately from those of other projects. Sensitive records are not left exposed to unauthorized persons at any time. Sensitive data in machine-readable form may be encrypted.
</p> <p>3. Procedural Safeguards: Access to records is controlled by responsible employees and is granted only to authorized individuals whose identities are properly verified. Data stored in mainframe computers is accessed only through the use of keywords known only to authorized personnel. When personal computers are used, magnetic media (e.g. diskettes, CD-ROMs, etc.) are protected as under Physical Safeguards. When data is stored within a personal computer (i.e., on a "hard disk"), the machine itself is treated as though it were a record, or records, under Physical Safeguards. Contracts for operation of this system of records require protection of the records in accordance with these safeguards; PHS project and contracting officers monitor contractor compliance.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1100-C-2. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>See Appendix I.
</p> <p>Policy coordination for this system is provided by: Acting Director, Office of Reports and Analysis, Office of Extramural Research, Office of the Director (OD), Building 1, Room 252, 1 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the official of the organization responsible for the evaluation, as listed in Appendix II. If you are not certain which component of PHS was responsible for the evaluation study, or if you believe there are records about you in several components of PHS, write to: NIH Privacy Act Officer, 6011 Executive Boulevard, Room 601, Bethesda, MD 20892-7669.
</p> <p>Requesters must provide the following information:
</p><p>1. Full name, and name(s) used while studying or employed;
</p><p>2. Name and location of the evaluation study or other PHS program in which the requester participated or the institution at which the requester was a student or employee, if applicable;
</p><p>3. Approximate dates of participation, matriculation or employment, if applicable.
</p> <p>The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p> <p>An individual who requests notification of or access to a medical record shall, at the time the request is made, designate in writing, a responsible representative, who may be a physician, other health professional, or other responsible individual, who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.
</p> <p>A parent or guardian who requests notification of, or access to, a child's or incompetent person's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child or incompetent person as well as his or her own identity.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official specified under Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information contained in these records is obtained directly from individual participants; from systems of records 09-25- 0036, "Extramural Awards and Chartered Advisory Committees: IMPAC (Grants/Contract Information/Cooperative Agreement Information/Chartered Advisory Committee Information), HHS/NIH/OER and HHS/NIH/CMO;" 09-25-0112, "Grants and Cooperative Agreements: Research, Research Training, Fellowship and Construction Applications and Related Awards, HHS/NIH/OD;" NSF-6, "Doctorate Record File," NSF-43, "Doctorate Work History File" (previously entitled NSF-43, "Roster and Survey of Doctorate Holders in The United States" and other records maintained by the operating programs of NIH; the National Academy of Sciences, professional associations such as the AAMC and ADA, and other contractors; grantees or collaborating researchers; or publicly available sources such as bibliographies.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p><p><i>Appendix I: System Managers </i></p>
<p>Office of Reports and Analysis, Office of Extramural Research, Office of the Director (OD), Rockledge II, Room 6212, 6701 Rockledge Drive, Bethesda, MD 20892.</p>
<p>Director, Office of Human Resource Management, Office of the Director (OD), Building 1, Room B160, 1 Center Drive, Bethesda, MD 20892.</p>
<p>Program Analyst, Office of Science and Technology, PSR, National Heart, Lung and Blood Institute (NHLBI), Building 31, Room 5A03, 31 Center Drive, Bethesda, MD 20892-2482.</p>
<p>Associate Director for Health Information Programs Development, National Library of Medicine (NLM), Building 38, Room 2S20, 8600 Rockville Pike, Bethesda, MD 20894.</p>
<p>Associate Director for Science Policy and Legislation, National Eye Institute (NEI), Building 31, Room 6A25, 31 Center Drive, Bethesda, MD 20892-2510.</p>
<p>Public Health Educator, Office of Cancer Communications, National Cancer Institute (NCI), Building 31, Room 10A03, 31 Center Drive, Bethesda, MD 20892.</p>
<p>Chief, Office of Planning, Analysis, National Institute on Aging (NIA), Building 31, Room 5C05, 31 Center Drive, Bethesda, MD 20892.</p>
<p>Associate Director for Science Policy, Analysis, and Communication, National Institute of Child Health and Human Development (NICHD), Building 31, Room 2A18, 31 Center Drive, Bethesda, MD 20892.</p>
<p>Chief, Science Policy and Planning Branch, National Institute on Deafness and Other Communication Disorders (NIDCD), Building 31, Room 3C27, 31 Center Drive, Bethesda, MD 20892-2320.</p>
<p>Evaluation Officer, Office of Science Policy and Analysis, National Institute of Dental and Craniofacial Research (NIDCR), Building 31, Room 5B55, 31 Center Drive, Bethesda, MD 20892-2190.</p>
<p>Program Analyst, Office of Program Planning and Evaluation, National Institute of Environmental Health Sciences (NIEHS), PO Box 12233, Research Triangle Park, NC 27709.</p>
<p>Chief, Office of Program Analysis and Evaluation, National Institute of General Medical Sciences (NIGMS), Natcher Building, Room 2AS55F, 45 Center Drive, Bethesda, MD 20892.</p>
<p>Director, Division of Advanced Studies and Policy Analyses, Fogarty International Center (FIC), Building 16, Room 202, 16 Center Drive, Bethesda, MD 20892-6705.</p>
<p>Information Officer, Center for Scientific Review (CSR), Rockledge II, Room 6160, 6701 Rockledge Drive, Bethesda, MD 20892.</p>
<p>Director, Office of Science Policy and Public Liaison, National Center for Research Resources (NCRR), Rockledge II, Room 5046, 6701 Rockledge Drive, Bethesda, MD 20892.</p>
<p>Chief, Office of Planning, Analysis and Evaluation, National Institute of Nursing Research (NINR), Building 31, Room 5B09, 31 Center Drive, Bethesda, MD 20892.</p>
<p>Policy Analyst, Division of Policy and Education, Office of Research Integrity, U.S. Public Health Service, 5515 Security Lane, Suite 700, Rockwall II Building, Rockville, MD 20852.</p>
<p>Contract Officer, National Institute of Mental Health (NIMH), 6001 Executive Boulevard, Room 6107, Bethesda, MD 20892.</p>
<p>Program Evaluation Team, Office of Scientific Affairs, National Institute on Alcohol Abuse and Alcoholism (NIAAA), Willco Building, Room 409, 6000 Executive Boulevard, Bethesda, MD 20892-7003.</p>
<p>Evaluation Officer, Office of Science Policy and Operations, National Center for Complementary and Alternative Medicine (NCCAM), Democracy Plaza II, Room 401, 6707 Democracy Boulevard, Bethesda, MD 20892-5475.</p>
<p>Privacy Act Coordinator, National Institute of Biomedical Imaging and Bioengineering (NIBIB), Building 31, Room 1B37, 31 Center Drive, Bethesda, MD 20892-2077.</p>
<p>Privacy Act Coordinator, National Center on Minority Health and Health Disparities (NCMHD), Democracy Plaza II, Room 800, 6707 Democracy Boulevard, Bethesda, MD 20892-5465.</p>
<p><i>Appendix II: Notification and Access Officials </i></p>
<p>Acting Director, Office of Reports and Analysis, Office of Extramural Research, Office of the Director (OD), Building 1, Room 252, 1 Center Drive, Bethesda, MD 20892.</p>
<p>Director, Office of Human Resources Management, Office of the Director (OD), Building 1, Room B160, 1 Center Drive, Bethesda, MD 20892.</p>
<p>Privacy Act Coordinator, National Heart, Lung, and Blood Institute (NHLBI), Building 31, Room 5A33, 31 Center Drive, Bethesda, MD 20892.</p>
<p>Assistant Director for Planning and Evaluation, National Library of Medicine (NLM), Building 38, Room 2S18, 8600 Rockville Pike, Bethesda, MD 20894.</p>
<p>Program Evaluation Team, Office of Scientific Affairs, National Institute on Alcohol Abuse and Alcoholism (NIAAA), Willco Building, Room 409, 6000 Executive Boulevard, Bethesda, MD 20892-7003.</p>
<p>Contract Officer, National Institute of Mental Health (NIMH), 6001 Executive Boulevard, Room 6107, Bethesda, MD 20892.</p>
<p>Executive Officer, National Eye Institute (NEI), Building 31, Room 6A03, 31 Center Drive, Bethesda, MD 20892-2510.</p>
<p>Director, Division of Advanced Studies and Policy Analysis, Fogarty International Center (FIC), Building 16, Room 202, 16 Center Drive, Bethesda, MD 20892-6705.</p>
<p>Information Officer, Center for Scientific Review (CSR), Rockledge II, Room 6160, 6701 Rockledge Drive, Bethesda, MD 20892.</p>
<p>Director, Office of Science Policy and Public Liaison, National Center for Research Resources (NCRR), Rockledge II, Room 5046, 6701 Rockledge Drive, Bethesda, MD 20892.</p>
<p>Privacy Act Coordinator, National Cancer Institute (NCI), Building 31, Room 10A30, 31 Center Drive, Bethesda, MD 20892.</p></xhtmlContent></subsection></section>
<section id="09-25-0158" toc="yes">
<systemNumber>09-25-0158</systemNumber>
<subsection type="systemName">Administration: Records of Applicants and Awardees of the NIH Intramural Research Training Awards Program, HHS/NIH/OD/OIR/OE.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This system is located in each of the intramural offices and laboratories where the Intramural Research Training Awards (IRTA) Fellow is located and assigned, including the respective Scientific Director's office, the administrative and personnel offices, and in Personnel branches responsible for administering the IRTA Program, and the Office of Education, Office of Intramural Research, Office of the Director, Building 2, Room 2E04, 2 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Applicants for IRTA Fellowships, current IRTA Fellows, and former IRTA Fellows.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>These records contain information relating to education and training, employment history, scientific publications; research goals; letters of reference; and personal information such as name, date of birth, social security number, home address and citizenship; and information related to fellowship awards such as stipend levels, training assignments, training expenses and travel allowances.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 284(b)(1)(C), 286b-3, and 287c-1 authorizes PHS to make awards for biomedical research and research training.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Records in this system are used to determine individuals' eligibility and evaluate their qualifications for IRTA Fellowships; to document the basis for management actions relating to Fellowships that are awarded; and to provide data for program evaluation.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to the Office of Human Resource Management for evaluation of NIH Personnel programs.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the written request of that individual.
</p> <p>3. Disclosure may be made to the Department of Justice or to a court or other tribunal from this system of records, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>4. Disclosure may be made to a Federal, State or local agency maintaining civil, criminal or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the selection or retention of a fellow.
</p> <p>5. Disclosure may be made to a Federal agency, in response to its request, in connection with hiring or retention of an employee, the issuance of a security clearance, an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders, and on magnetic tapes and disks and computer programs.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, social security number, or institute list number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Access is granted only to NIH scientists, administrative office staff, personnel staff and financial management staff directly involved in the administration of the IRTA Program.
</p> <p>2. Physical Safeguards: File folders are kept in locked drawers or locked rooms when system personnel are not present.
</p> <p>3. Procedural Safeguards: Access to file folders is controlled by system personnel. Records may be removed from the files only with the approval of the system manager or other authorized employees. Data stored in the automated system is accessed through the use of keywords known only to authorized personnel.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1 -"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 4000-E-3. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Personnel/Principal or Senior Administrative Officers of the National
</p><p>Institutes of Health Institutes/Centers. Contact the individual listed under notification procedure for the name and address of the appropriate System Manager.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists and where it is located, contact: Chief, Staffing Management Branch, Office of Human Resource Management, Building 31, Room 1C31, 31 Center Drive, Bethesda, MD 20892.
</p> <p>The requestor must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to the official specified under the Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is untimely, incomplete, irrelevant or inaccurate. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Applicants, persons and institutions supplying references.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0160" toc="yes">
<systemNumber>09-25-0160</systemNumber>
<subsection type="systemName">United States Renal Data System (USRDS), HHS/NIH/NIDDK.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Records are located at contractor operated coordinating center. Write to the System manager at address below for address of current location. U.S. Renal Data System, Coordinating Center (CC), 914 South 8th Street, Suite D-206, Minneapolis, MN 55404.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Persons with end-stage renal disease (ESRD), providers of ESRD services.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Health and medical record data; fiscal information; patient names, social security number, Centers for Medicare and Medical Services (CMS) beneficiary ID, patient demographic, epidemiologic and survival characteristics; physician provider characteristics; facility provider characteristics.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241a, 289c, as last amended by Pub. L. 100-607, November 4, 1988 under the Health Omnibus Programs Extension of 1988.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To design and implement a consolidated renal disease system that will provide the biostatistical, data management and analytical expertise necessary to characterize the total renal patient population and describe the distribution of patients by sociodemographic variables across treatment modalities.
</p> <p>2. To report on the incidence, prevalence, and mortality rates of renal disease by primary diagnosis.
</p> <p>3. To identify the modalities of treatment best suited to individual patients. To compare the various treatment alternatives to examine the prevention and progression of renal disease by morbidity, mortality, and quality of life criteria.
</p> <p>4. To identify problems and opportunities for more focused investigations of renal research issues currently unaddressed by the consolidated data system.
</p> <p>5. To share data with other PHS agencies and CMS for their use in research analysis and program administration.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure from the record of an individual may be made to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her official capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>2. Disclosure may be made to a Congressional office from the record of an individual in response to a written inquiry from the Congressional office made at the written request of the individual.
</p> <p>3. Disclosure may be made to the HHS contractor for the purpose of collating, analyzing, aggregating or otherwise refining or processing records in this system for developing, modifying and/or manipulating ADP software. Data would also be disclosed to contractors incidental to consultation, programming, operation, user assistance, or maintenance for an ADP or telecommunications systems containing or supporting records in the system. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>4. A record may be disclosed for a research purpose, when the Department: (A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (B) Has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (C) Has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law; (D) Has secured a written statement attesting to the recipients understanding of, and willingness to abide by these provisions.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Electronic medium; selected hard copy backup.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information will be retrieved by patient identification number such as social security number and CMS beneficiary ID. Individual patient data provided only as noted above. Statistical data provided as noted above and to the general public as part of periodic published reports.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>A variety of safeguards are implemented for the various sets of records in this system according to the sensitivity of the records:
</p><p>1. Authorized Users: Regular access is limited to National Institute of Diabetes and Digestive and Kidney Diseases (NIDDK), CMS and contract personnel who have a need for the data in performance of their duties as determined by the system manager.
</p> <p>2. Physical Safeguards: Records are stored in areas where access is restricted to areas where data are maintained and processed; data tapes and hard copy data are stored in locked files in secured areas; terminal access controlled by user ID and keywords; off-site data backups in two locations--a remote area of the same building and a separate building; and fire protection secured by Halon fire extinguisher system and fire alarm system present in the computer room.
</p> <p>3. Procedural Safeguards: Contractors who maintain records in this system are instructed to make no further disclosure of the records except as authorized by the system manager and permitted by the Privacy Act.
</p> <p>Privacy Act requirements are specifically included in contracts and in agreements with grantees or collaborators participating in research activities supported by this system. HHS project directors, contract officers, and project officers oversee compliance with these requirements.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 3000-G-3(b), which allows records to be kept as long as they are useful in scientific research. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Epidemiology Program Director, National Institute of Diabetes and Digestive and Kidney Diseases (NIDDK), Division of Kidney, Urologic and Hematologic Diseases, Rockledge II, Room 615, 6701 Democracy Boulevard, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the address noted above. Provide notarized signature as proof of identity. The request should include as much of the following information as possible: (a) Full name; (b) title of project individual participated in; and (c) approximate dates of participation.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address specified under notification procedures above and reasonably identify the record, specify the information being contested, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The majority of health, medical, fiscal and other demographic information on patients and health care providers is from the end stage renal disease program of the Centers for Medicare and Medicaid Services (CMS). Additional data comes from other CMS Medicare patient records, the National Death Index, and other sources of non-Medicare ESRD patient records such as the NIH Continuous Ambulatory Peritoneal Dialysis (CAPD) Registry, the United Network of Organ Sharing (UNOS) transplant patients, the Veteran's Administration, and the Indian Health Service.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-25-0165" toc="yes">
<systemNumber>09-25-0165</systemNumber>
<subsection type="systemName">National Institutes of Health (NIH) Office of Loan Repayment and Scholarship (OLRS) Records System, HHS/NIH/OD.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Loan Repayment and Scholarship (OLRS), National Institutes of Health, 2 Center Drive, 2E30, Bethesda, Maryland 20892- 0230.
</p> <p>Office of Loan Repayment and Scholarship (OLRS), National Institutes of Health, 6011 Executive Boulevard, Suite 206, Rockville, Maryland 20892.
</p> <p>National Center on Minority Health and Health Disparities, National Institutes of Health, 6707 Democracy Boulevard, Suite 800, Bethesda, Maryland 20892-5465.
</p> <p>See Appendix I for a listing of NIH offices responsible for administration of the NIH LRSPs. Write to the System Manager at the address below for the address of any Federal Records Center where records from this system may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who have applied for, who have been approved to receive, who are receiving, or who have received funds under the NIH LRSPs; and individuals who are interested in participation in the NIH LRSPs.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Name, address, Social Security number (SSN), grant number, program application and associated forms, service pay-back obligations, employment data, professional performance and credentialing history of licensed health professionals; personal, professional, and demographic background information; academic and research progress reports (which include related data, correspondence, and professional performance information consisting of continuing education, performance awards, and adverse or disciplinary actions); standard school budgets; financial data including loan balances, deferment, forbearance, and repayment/delinquent/default status information; commercial credit reports; educational data including tuition and other related educational expenses; educational data including academic program and status; employment status verification (which includes certifications and verifications of continuing participation in qualified research); Federal, State and county tax related information, including copies of tax returns.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Sections 487A-F (42 U.S.C. 288-1, 288-2, 288-3, 288-4, 288-5, 288-5a, 288-6) of the PHS Act, as amended; Section 103 of the Minority Health and Health Disparities Research Education Act (Pub. L. 106-525), as amended; and section 223 of Pub. L. 106-554 (114 Stat. 2763A-30) authorize the NIH to establish and implement (a) multiple programs of educational loan repayment for qualified health professionals who agree to conduct research, subject to each program's specific statutory requirements; and (b) a scholarship program for undergraduates who agree to pursue academic programs appropriate for careers in professions needed by the NIH and who agree to serve as NIH employees. The provisions of subpart III of part D of title III of the PHS Act (42 U.S.C. 2541 et seq.), as amended, governing the National Health Service Corps (NHSC) loan repayment and scholarship programs, are incorporated in these authorities, except as inconsistent with sections 487A-F, sections 103 of Pub. L. 106-525, and section 223 of Pub. L. 106- 554. The Internal Revenue Code at 26 U.S.C. 6109 requires the provision of the SSN for the receipt of loan repayment and scholarship funds under the NIH LRSPs. The Federal Debt Collection Procedures Act of 1990, Public Law 101-647 (28 U.S.C. 3201) requires that an individual who has a judgement lien against his/her property for a debt to the United States shall not be eligible to receive funds directly from the Federal Government in any program, except funds to which the debtor is entitled as a beneficiary, until the judgement is paid in full or otherwise satisfied. Thus, individuals applying to the LRSPs are required to disclose in their applications whether they have a judgement lien against them arising from a debt to the United States.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>These records are used to: (1) Identify and select applicants for the NIH LRSPs; (2) monitor loan repayment and scholarship activities, such as payment tracking, academic status and performance, research and related services, deferment of service obligation, and default; and (3) assist NIH officials in the collection of overdue debts owed under the NIH LRSPs. Records may be transferred to System No. 09 -15-0045, "Health Resources and Services Administration Loan Repayment/Debt Management Records System, HHS/HRSA/OA," for debt collection purposes when NIH officials are unable to collect overdue debts owed under the NIH LRSPs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal when: (a) HHS or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, HHS determines that the records are both relevant and necessary to the litigation and the use of such records by the Department of Justice is therefore deemed by HHS to be for a purpose that is compatible with the purpose for which the records were collected.
</p> <p>3. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate agency, whether Federal, foreign, State, local, or tribal, or other public authority responsible for enforcing, investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to any enforcement, regulatory, investigative or prosecutive responsibility of the receiving entity.
</p> <p>4. The NIH may disclose records to HHS contractors and subcontractors for the purpose of collecting, compiling, aggregating, analyzing, or refining records in the system, and/or for the purpose of evaluating the programs covered by the system. Contractors maintain, and are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records.
</p> <p>5. The NIH may disclose information from this system of records to private parties such as present and former employers, references listed on applications and associated forms, other references and educational institutions. The purpose of such disclosures is to evaluate an individual's professional and or academic accomplishments and plans, performance, credentials, and educational background, and to determine if an applicant is suitable for participation in the NIH LRSPs.
</p> <p>6. The NIH will disclose information from this system of records to a consumer reporting agency (credit bureau) to obtain an applicant or participant's commercial credit report for the following purposes: (1) To establish his/her creditworthiness; (2) To assess and verify his/her ability to repay debts owed to the Federal Government; and (3) To determine and verify the eligibility of loans submitted for repayment. The NIH will also disclose information from this system of records to the National Student Clearinghouse using the Loan Locator Internet System or similar system to assist in the verification of loan data submitted by LRP applicants. Disclosures are limited to the individual's name, address, Social Security number and other information necessary to identify him/her; locate all student loans and verify payment addresses; identify the funding being sought or amount and status of the debt; and the program under which the applicant or claim is being processed.
</p> <p>7. The NIH may disclose from this system of records a delinquent debtor's or a defaulting participant's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose, as follows:
</p><p>a. To another Federal agency so that agency can effect a salary offset for debts owed by Federal employees; if the claim arose under the Social Security Act, the employee must have agreed in writing to the salary offset.
</p> <p>b. To another Federal agency so that agency can effect an authorized administrative offset; i.e., withhold money, other than Federal salaries, payable to or held on behalf of the individual.
</p> <p>c. To the Treasury Department, Internal Revenue Service (IRS), to request an individual's current mailing address to locate him/her for purposes of either collecting or compromising a debt, or to have a commercial credit report prepared.
</p> <p>8. The NIH may disclose information from this system of records to another agency that has asked the HHS to effect a salary or administrative offset to help collect a debt owed to the United States. Disclosure is limited to the individual's name, address, Social Security number, and other information necessary to identify the individual, information about the money payable to or held for the individual, and other information concerning the offset.
</p> <p>9. The NIH may disclose to the IRS information about an individual applying for any NIH loan repayment or scholarship program authorized by the Public Health Service Act to find out whether the applicant has a delinquent tax account. This disclosure is for the sole purpose of determining the applicant's creditworthiness and is limited to the individual's name, address, Social Security number, other information necessary to identify him/her, and the program for which the information is being obtained.
</p> <p>10. The NIH may report to the IRS, as taxable income, the written-off amount of a debt owed by an individual to the Federal Government when a debt becomes partly or wholly uncollectible, either because the time period for collection under statute or regulations has expired, or because the Government agrees with the individual to forgive or compromise the debt.
</p> <p>11. The NIH may disclose to debt collection agents, other Federal agencies, and other third parties who are authorized to collect a Federal debt, information necessary to identify a delinquent debtor or a defaulting participant. Disclosure will be limited to the individual's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose.
</p> <p>12. The NIH may disclose information from this system of records to any third party that may have information about a delinquent debtor's or a defaulting participant's current address, such as a U.S. post office, a State motor vehicle administration, a university's office of the registrar or dean's office, a professional organization, an alumni association, etc., for the purpose of obtaining the individual's current address. This disclosure will be strictly limited to information necessary to identify the individual, without any reference to the reason for the agency's need for obtaining the current address.
</p> <p>13. The NIH may disclose information from this system of records to other Federal agencies that also provide loan repayment or scholarship at the request of these Federal agencies in conjunction with a matching program conducted by these Federal agencies to detect or curtail fraud and abuse in Federal loan repayment or scholarship programs, and to collect delinquent loans or benefit payments owed to the Federal Government.
</p> <p>14. The NIH will disclose from this system of records to the Department of Treasury, IRS: (1) A delinquent debtor's or a defaulting participant's name, address, Social Security number, and other information necessary to identify the individual; (2) the amount of the debt; and (3) the program under which the debt arose, so that the IRS can offset against the debt any income tax refunds which may be due to the individual.
</p> <p>15. The NIH may disclose information provided by a lender or educational institution to other Federal agencies, debt collection agents, and other third parties who are authorized to collect a Federal debt. The purpose of this disclosure is to identify an individual who is delinquent in loan or benefit payments owed to the Federal Government and the nature of the debt.
</p> <p>16. The NIH may disclose information from this system of records to officials or representatives of grantee institutions in connection with the review of an LRP application or performance or administration under the terms and conditions of the LRP award, or in connection with problems that might arise in performance or administration of the LRP contract.
</p> <p>17. The NIH will disclose records consisting of names, disciplines, current mailing addresses, and dates of scholarship support and dates of graduation of scholarship recipients to: (a) Designated coordinators at each school participating in the scholarship program for the purpose of determining educational expenses and resulting levels of scholarship support, and for the purpose of guiding and informing these recipients about the nature of their service obligations to the NIH; and (b) undergraduate, graduate and medical schools, attended by UGSP scholars who have elected to defer their service obligation, for the purpose of determining their academic status and verifying the validity of the NIH UGSP service deferment.
</p> <p>18. The NIH may disclose records to HHS contractors and subcontractors for the purpose of recruiting, screening, and matching health professionals for NIH employment in qualified research positions under the NIH LRSPs. In addition, HHS contractors and subcontractors: (1) May disclose biographic data and information supplied by potential applicants (a) to references listed on application and associated forms for the purpose of evaluating the applicant's professional qualifications, experience, and suitability, and (b) to a State or local government medical licensing board and/or to the Federation of State Medical Boards or a similar nongovernment entity for the purpose of verifying that all claimed background and employment data are valid and all claimed credentials are current and in good standing; (2) may disclose biographic data and information supplied by references listed on application and associated forms to other references for the purpose of inquiring into the applicant's professional qualifications and suitability; and (3) may disclose professional suitability evaluation information to NIH officials for the purpose of appraising the applicant's professional qualifications and suitability for participation in the NIH LRSPs. Contractors maintain, and are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records.
</p> <p>Disclosure to consumer reporting agencies:
</p><p>Disclosures pursuant to 5 USC 552a(b)(12): Disclosures may be made from this system to "consumer reporting agencies" as defined in the Federal Claims Collection Act of 1966, as amended (31 USC 3701(a)(3)). The purposes of these disclosures are: (1) To provide an incentive for debtors to repay delinquent debts to the Federal Government by making these debts part of their credit records, and (2) to enable NIH to improve the quality of loan repayment and scholarship decisions by taking into account the financial reliability of applicants, including obtaining a commercial credit report to assess and verify the ability of an individual to repay debts owed to the Federal Government. Disclosure of records will be limited to the individual's name, Social Security number, and other information necessary to establish the identity of the individual, the amount, status, and history of the claim, and the agency or program under which the claim arose.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file folders, file cards, microfiche and electronic media, including computer tape, discs, servers connected to local area networks, and Internet servers.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, NIH Institutes and Centers, grantee institutions, Social Security number, grant number, or other identifying numbers or characteristics.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Access to information is limited to authorized personnel in the performance of their duties. Authorized personnel include system managers and their staffs, financial, fiscal and records management personnel, legal personnel, computer personnel, and NIH contractors and subcontractors--all of whom are responsible for administering the NIH LRSPs.
</p> <p>2. Physical Safeguards: Rooms where records are stored are locked when not in use. During regular business hours rooms are unlocked but are controlled by on-site personnel. Security guards perform random checks on the physical security of the storage locations after duty hours, including weekends and holidays.
</p> <p>3. Procedural and Technical Safeguards: A password is required to access the terminal and a data set name controls the release of data to only authorized users. All users of personal information in connection with the performance of their jobs (see Authorized Users, above) protect information from public view and from unauthorized personnel entering an unsupervised office. Data on local area network computer files is accessed by keyword known only to authorized personnel. Codes by which automated files may be accessed are changed periodically. This procedure also includes deletion of access codes when employees or contractors leave. New employees and contractors are briefed and the security department is notified of all staff members and contractors authorized to be in secured areas during working and nonworking hours. This list is revised as necessary. Individuals remotely accessing the secured areas of the OLRS Internet sites have separate accounts and passwords. Passwords are assigned by project staff and may include both alphabetic and non-alphabetic characters. These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the Department's Automated Information System Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1-- "Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 2300-537-1. Participant case files are transferred to a Federal Records Center one year after closeout and destroyed five years later. Closeout is the process by which it is determined that all applicable administrative actions and disbursements of benefits have been completed by the OLRS and service obligations have been completed by the participant. Applicant case files are destroyed three years after disapproval or withdrawal of their application. Appeal and litigation case files are destroyed six years after the calendar year in which the case is closed. Other copies of these files are destroyed two years after the calendar year in which the case is closed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Office of Loan Repayment and Scholarship, National Institutes of Health, 2 Center Drive, Suite 2E30, Bethesda, Maryland 20892-0230.
</p> <p>Director, Office of Loan Repayment and Scholarship, National Institutes of Health, 6011 Executive Boulevard, Suite 206, Rockville, Maryland 20892.
</p> <p>Director, National Center on Minority Health and Health Disparities, National Institutes of Health, 6707 Democracy Boulevard, Suite 800, Bethesda, Maryland 20892-5465.
</p> <p>Director, Contraceptive and Infertility Research Loan Repayment Program, National Institute of Child Health and Human Development, National Institutes of Health, 6100 Executive Boulevard, Room 8B01A, Rockville, Maryland 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the appropriate System Manager listed above. A written request must contain the name and address of the requester, Social Security number, and his/her signature which is either notarized to verify his/her identity or includes a written certification that the requester is the person he/she claims to be and that he/she understands that the knowing and willful request or acquisition of records pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine. In addition, the following information is needed: dates of enrollment in the NIH LRSPs and current enrollment status, such as pending application approval or approved for participation.
</p> <p>An individual who appears in person at a specific location seeking access to or disclosure of records relating to him/her shall provide his/her name, current address, Social Security number, dates of enrollment in an NIH loan repayment or scholarship program, and at least one piece of tangible identification, such as driver's license, passport, or voter registration card. Identification papers with current photographs are preferred but not required. If an individual has no identification papers but is personally known to an agency employee, such employees shall make a written record verifying the individual's identity. Where the individual has no identification papers, the responsible agency official shall require that the individual certify in writing that he/she is the individual who he/she claims to be and that he/she understands that the knowing and willful request or acquisition of a record concerning an individual under false pretenses is a criminal offense subject to a $5,000 fine. Since positive identification of the caller or sender cannot be established, telephone and electronic mail requests are not honored.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Write to the appropriate System Manager specified above to attain access to records and provide the same information as is required under the Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosures of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the appropriate System Manager specified above and reasonably identify the record, specify the information to be contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information that is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Subject individual; participating lending and loan servicing institutions; educational and grantee institutions; other Federal agencies; consumer reporting agencies/credit bureaus; National Student Clearinghouse; and third parties that provide references concerning the subject individual.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p><p><i> Appendix I: System Locations </i></p><p>Office of Loan Repayment and Scholarship, National Institutes of Health, 2 Center Drive, 2E30, Bethesda, Maryland 20892-0230.</p>
<p>Office of Loan Repayment and Scholarship, National Institutes of Health, 6011 Executive Boulevard, Suite 206, Rockville, Maryland 20892.</p>
<p>Center for Information Technology, National Institutes of Health, Building 12A, Room 1011, 9000 Rockville Pike, Bethesda, Maryland 20892.</p>
<p>Clinical Center, National Institutes of Health, 6100 Executive Boulevard, Room 3E01, Bethesda, Maryland 20892-7509.</p>
<p>National Cancer Institute, National Institutes of Health, Building 31, Room 11A19, 9000 Rockville Pike, Bethesda, Maryland 20892 -2590.</p>
<p>National Center on Minority Health and Health Disparities, National Institutes of Health, 6707 Democracy Boulevard, Suite 800, Bethesda, Maryland 20892-5465.</p>
<p>National Heart, Lung, and Blood Institute, National Institutes of Health, Building 10, Room 7N220, 9000 Rockville Pike, Bethesda, Maryland 20892-1670.</p>
<p>National Institute of Dental and Craniofacial Research, National Institutes of Health, Building 31, Room 2C23, 9000 Rockville Pike, Bethesda, Maryland 20892-2290.</p>
<p>National Institute of Diabetes and Digestive and Kidney Diseases National Institutes of Health, Building 10, Room 9N222, 9000 Rockville Pike, Bethesda, Maryland 20892-1818.</p>
<p>National Institute of Neurological Disorders and Stroke, National Institutes of Health, Building 10, Room 5N220, 9000 Rockville Pike, Bethesda, Maryland 20892-4152.</p>
<p>National Institute of Allergy and Infectious Diseases, National Institutes of Health, Building 31, Room 7A05, 9000 Rockville Pike, Bethesda, Maryland 20892-2520.</p>
<p>National Institute of Mental Health, National Institutes of Health, Building 10, Room 4N222, 9000 Rockville Pike, Bethesda, Maryland 20892.</p>
<p>National Institute of General Medical Sciences, Pharmacological Sciences Program, National Institutes of Health, Building 45, Room 2AS-43, 9000 Rockville Pike, Bethesda, Maryland 20892-6200.</p>
<p>National Institute of Child Health and Human Development, National Institutes of Health, Building 31, Room 2A25, 9000 Rockville Pike, Bethesda, Maryland 20892.</p>
<p>National Institute of Child Health and Human Development, National Institutes of Health, 6100 Executive Boulevard, Room 8B01A, Bethesda, Maryland 20892.</p>
<p>National Eye Institute, National Institutes of Health, Building 10, Room 10N202, 9000 Rockville Pike, Bethesda, Maryland 20892- 1858.</p>
<p>National Institute of Environmental Health Sciences, National Institutes of Health, South Campus, Building 101, Room A-210, 111 Alexander Drive, Research Triangle Park, NC 27709.</p>
<p>National Institute on Aging, Gerontology Research Center, National Institutes of Health, 4940 Eastern Avenue, Baltimore, Maryland 21224.</p>
<p>National Institute of Arthritis and Musculoskeletal and Skin Diseases, National Institutes of Health, Building 45, Room 5AN40, 9000 Rockville Pike, Bethesda, Maryland 20892.</p>
<p>National Institute of Deafness and Communication Disorders, National Institutes of Health, Building 31, Room 3C02, 9000 Rockville Pike, Bethesda, Maryland 20892-2320.</p>
<p>National Institute on Drug Abuse, National Institutes of Health, Parklawn Building, Room 9A30, 5600 Fishers Lane, Rockville, Maryland 20857.</p>
<p>National Center for Research Resources, National Institutes of Health, One Rockledge Center, Room 6070, 6705 Rockledge Drive, Bethesda, Maryland 20892-7965.</p>
<p>National Institute for Nursing Research, National Institutes of Health, Building 31, Room 5B25, 9000 Rockville Pike, Bethesda, Maryland 20892-2178.</p>
<p>National Institute on Alcohol Abuse and Alcoholism, National Institutes of Health, Building 31, Room 1B58, 9000 Rockville Pike, Bethesda, Maryland 20892-2088.</p>
<p>National Human Genome Research Institute, National Institutes of Health, 49 Covent Drive, Building 49, Room 4A06, 9000 Rockville Pike, Bethesda, Maryland 20892-4470.</p>
<p>Office of Financial Management, National Institutes of Health, Building 31, Room B1B47, 9000 Rockville Pike, Bethesda, Maryland 20892.</p></xhtmlContent></subsection></section>
<section id="09-25-0166" toc="yes">
<systemNumber>09-25-0166</systemNumber>
<subsection type="systemName">Administration: Radiation and Occupational Safety and Health Management Information Systems, HHS/NIH/ORS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Radiation Safety Branch, Division of Safety, Office of Research Services (ORS), Building 21, Room 134, 21 Wilson Drive, Bethesda, MD 20892.
</p> <p>Occupational Safety and Health Branch, Division of Safety, Office of Research Services (ORS), Building 13, Room 3K04, 13 South Drive, Bethesda, Maryland 20892.
</p> <p>Write to appropriate System Manager at the address below for the address of contractor locations, including the address of any Federal Records Center where records from this system may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Radiation Safety Branch (RSB): NIH employees using radioactive materials or radiation producing machinery, contractor employees who provide service to the Radiation Safety Branch and any other individuals who could potentially be exposed to radiation or radioactivity as a result of NIH operations and who, therefore, must be monitored in accordance with applicable regulations.
</p> <p>Occupational Safety and Health Branch (OSHB): Individuals (including NIH employees and NIH service contract employees) who use or come into contact with potentially hazardous biological or chemical materials, and participants of occupational safety and health monitoring/surveillance programs.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Employee name, title, organizational affiliation, birth date, social security number (optional), work address, work telephone number, name of supervisor, and other necessary employment information; radiation/occupational safety and health training information; medical and technical information pertaining to safety and health related initiatives; research protocols and other related documents used to monitor and track radiation exposure and exposure to potentially hazardous biological or chemical materials; radiation materials usage data; and incident data.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>42 U.S.C. 241, regarding the general powers and duties of the Public Health Service relating to research and investigation; 5 U.S.C 7902 regarding agency safety programs; and 42 U.S.C. 2201, regarding general duties of the Nuclear Regulatory Commission including the setting of standards to cover the possession and use of nuclear materials in order to protect health.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To provide adequate administrative controls to assure compliance with internal NIH policies, and applicable regulations of the Occupational Safety and Health Administration (OSHA), Department of Labor, and other Federal and/or State agencies which may establish health and safety requirements or standards. Ensure legal compliance with requirements of Nuclear Regulatory Commission to maintain internal and external radiation exposure data.
</p> <p>2. To identify, evaluate and monitor use or contact (including incident follow-up) with: radiation (exposure maintained at lowest levels reasonable); biological and/or chemical (potentially hazardous materials). To monitor, track, and assess the use of personal protective equipment in the work place to ensure availability, effectiveness, and proper maintenance. To address emergent safety and health issues or concerns.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual
</p><p>2. Disclosure may be made to the Department of Justice or to a court or other tribunal from this system of records, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States of any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. Disclosure may be made to contractors for the purpose of processing or refining the records. Contracted services may include monitoring, testing, sampling, surveying, evaluating, transcription, collation, computer input, and other records processing. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>4. Disclosure may be made to: (a) Officials of the United States Nuclear Regulatory Commission which, by Federal regulation, licenses, inspects and enforces the regulations governing the use of radioactive materials; and (b) OSHA, which provides oversight to ensure that safe and healthful work conditions are maintained for employees. Disclosure will also be permitted to other Federal and/or State agencies which may establish health and safety requirements or standards.
</p> <p>5. Radiation exposure and/or training and experience history may be transferred to new employer.
</p> <p>6. A record may be disclosed for a research purpose, when the Department: (A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (B) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (C) has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law; (D) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file cabinets or in computer databases maintained by the RSB and OSHB. Records may be stored in file folders, binders, magnetic tapes, magnetic disks, optical disks and/or other types of data storage devices.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, social security number, office address, or unique RSB or OSHB assigned identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Employees who maintain this system are instructed to grant regular access only to RSB/OSHB staff, authorized contractor personnel, U.S. Nuclear Regulatory Commission Inspectors, Radiation Safety Committee Members, Biosafety Committee members, and other appropriate NIH administrative and management personnel with a need to know. Access to information is thus limited to those with a need to know.
</p> <p>2. Physical Safeguards: Rooms where records are stored are locked when not in use. During regular business hours, rooms are unlocked but are controlled by on-site personnel. Individually identifiable records are kept in locked file cabinets or rooms under the direct control of the Project Director.
</p> <p>3. Procedural Safeguards: Names and other identifying particulars are deleted when data from original records are encoded for analysis. Data stored in computers is accessed through the use of keywords known only to authorized users. All users of personal information in connection with the performance of their jobs (see Authorized Users, above) will protect information from public view and from unauthorized personnel entering an unsupervised office. The computer terminals are in secured areas and keywords needed to access data files will be changed frequently.
</p> <p>4. Additional RSB Technical Safeguards: Computerized records are accessible only through a series of code or keyword commands available from and under direct control of the Project Director or his/her delegated representatives. The computer records are secured by a multiple level security system which is capable of controlling access to the individual data field level. Persons having access to the computer database can be restricted to a confined application which only permits a narrow "view" of the data. Data on computer files is accessed by keyword known only to authorized users who are NIH or contractor employees involved in work for the program.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361): item 1300-B which applies to Division of Safety records. Refer to the NIH Manual Chapter for specific disposition instructions. Radiation exposure records are retained under item 1300-B-10, which does not allow disposal at this time.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Assistant Chief, Information Technology, Radiation Safety Branch, Division of Safety, Office of Research Services (ORS), National Institutes of Health, Building 21, Room 134, 21 Wilson Drive, Bethesda, Maryland 20892.
</p> <p>Chief, Occupational Safety and Health Branch, Division of Safety, Office of Research Services (ORS), Building 13, Room 3K04, 13 South Drive, Bethesda, Maryland 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the appropriate System Manager as listed above. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is whom he or she claims to be. The request should include: (a) Full name, and (b) appropriate dates of participation.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosure of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the appropriate System Manager specified above and reasonably identify the record, specify the information to be contested, and state the corrective action sought with supporting documentation. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information is obtained from the subject individual, previous employers and educational institutions, contractors, safety and health monitoring/surveillance records, employee interviews, site visits, or other relevant NIH organizational components.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0167" toc="yes">
<systemNumber>09-25-0167</systemNumber>
<subsection type="systemName">National Institutes of Health (NIH) TRANSHARE Program, HHS/NIH/OD.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Employee Transportation Services Office, National Institutes of Health, Building 31, Room B3B08, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Recreation and Welfare Association Activities Desk, National Institutes of Health, Building 31, Room B1W30A, 31 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>NIH employees who apply for and participate in the NIH TRANSHARE Program.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Name, home address, parking hanger permit number, unique computer identification number, NIH TRANSHARE commuter card number, NIH pay plan, grade level, office phone number, building and room, Institute/Center designation, name of supervisor, commute mode to work, and type of fare media used.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 629 of Pub. L. 101-509, "State or Local Government Programs Encouraging Employee Use of Public Transportation; Federal Agency Participation," found at 5 U.S.C. note prec. section 7901.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To manage the NIH TRANSHARE Program, including receipt and processing of employee applications, and coordination of the fare media distribution to employees.
</p> <p>2. To monitor the use of appropriated funds used to support the NIH TRANSHARE Program.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. NIH may disclose applicant's name, unique computer identification number, NIH TRANSHARE commuter card number, and type of participant's fare media to be disbursed to cashiers of the Recreation and Welfare Association of the National Institutes of Health, Inc. (R&amp;W Association) who are responsible for distribution of fare media. Cashiers are required to maintain Privacy Act safeguards with respect to such records.
</p> <p>4. Disclosure may be made to organizations deemed qualified by the Secretary to carry out quality assessments or utilization review.
</p> <p>5. NIH may disclose statistical reports containing information from this system of records to city, county, State, and Federal Government agencies (including the General Accounting Office).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file folders and computer disks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name and NIH TRANSHARE commuter card number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Data on computer files is accessed by keyword known only to authorized users who are ETSO employees and cashiers of the R&amp;W Association who are responsible for implementing the Program. Cashier access will be limited to applicant's name, unique computer identification number, NIH TRANSHARE computer card number, and type of fare media disbursed. Access to information is thus limited to those with a need to know.
</p> <p>2. Physical Safeguards: Rooms where records are stored are locked when not in use. During regular business hours, rooms are unlocked but are controlled by on-site personnel.
</p> <p>3. Procedural and Technical Safeguards: A password is required to access the terminal, and a data set name controls the release of data to only authorized users. All users of personal information in connection with the performance of their jobs (see Authorized Users, above) protect information from public view and from unauthorized personnel entering an unsupervised office.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1500-A-3. Records are retained for a maximum of two years following the last month of an employee's participation in the NIH TRANSHARE Program. Paper copies are destroyed by shredding. Computer files are destroyed by deleting the record from the file.
</p></xhtmlContent></subsection>
    <subsection type="systemManager">
        <xhtmlContent>
                    <p>
                        Traffic Management Specialist, Employee Transportation Service Officer, Division of Security Operations, Office of Research Services (ORS), Building 31, Room B3B08, 31 Center Drive, Bethesda, MD 20892.
                    </p>
                </xhtmlContent>
</subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager listed above. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be. The request should include: (a) full name, and (b) appropriate dates of participation. The requester must also understand that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Write to the System Manager specified above to attain access to records and provide the same information as is required under the Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosure of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager specified above and reasonably identify the record, specify the information to be contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Subject individual.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-25-0168" toc="yes">
<systemNumber>09-25-0168</systemNumber>
 <subsection type="systemName">Invention, Patent, and Licensing Documents Submitted to the Public Health Service by its Employees, Grantees, Fellowship Recipients, and Contractors, HHS/NIH/OD.
</subsection>
    <subsection type="securityClassification">
        <xhtmlContent>
            <p>None.</p>
        </xhtmlContent>
    </subsection>
<subsection type="systemLocation"><xhtmlContent><p>Office of Technology Transfer (OTT), Office of Intramural Research, Office of the Director, 6011 Executive Boulevard, Suite 325, Bethesda, MD 20852.
</p> <p>Office of Financial Management (OFM), Office of the Director, Building 31, Room B1B55, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Office of Reports and Analysis (ORA), Office of Extramural Research, Office of the Director, Building 1, Room 252, 1 Center Drive, Bethesda, MD 20892-2184.
</p> <p>Health and Humans Services Technology Development Coordinators and HHS Contract Attorneys who retain files supplemental to the records maintained by the Office of Technology Transfer.
</p> <p>Extramural Inventions and Technology Resources Branch, Office of Policy for Extramural Research Administration (OPERA), Office of Extramural Research, Office of the Director, Rockledge I, Room 1040, 6705 Rockledge Drive, Bethesda, MD 20892-7980.
</p> <p>Write to the System Manager below for office locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>HHS grantees and contractors who have reported inventions made with HHS funding, as well as HHS employee inventors who have assigned title to their inventions to HHS when HHS has applied for patents, has been granted patents, and/or is receiving royalties from patents.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This System of Records contains information such as inventor name, address, social security number (required if inventor is receiving royalties, otherwise optional), title and description of the invention, Employee Invention Report (EIR) Number, Case/Serial Number, prior art related to the invention, evaluation of the commercial potential of the invention, prospective licensees' intended development of the invention, associated patent prosecution and licensing documents and royalty payment information.
</p> <p>This System also includes other documents developed or information and material received by HHS from grantees and contractors who have reported inventions made with HHS funding, as well as HHS employee inventors who have assigned title to their inventions to HHS when HHS has applied for patents, has been granted patents, and/or is receiving royalties from patents. The records in this System may also contain reports of action taken by the agency, and decisions and reports on legal matters associated with invention, patent, and licensing matters.
</p> <p>This System also includes information and material received from inventors and other collaborating persons, grantees, fellowship recipients and contractors; other Federal agencies; scientific experts from non-Government organizations; contract patent counsel and their employees and foreign contract personnel; United States and foreign patent offices; prospective licensees; HHS Technology Development Coordinators, Internet and commercial databases, and third parties whom HHS contacts to determine individual invention ownership or Government ownership. These records are retrieved by name of the inventor, Employee Invention Report (EIR) Number, or keywords relating to the nature of the invention, Case/Serial Number, licensing number, internal reference numbers, contractor, agency, Institute, and/or Center.
</p> <p>The records in this System are stored in file folders, computer tapes, and computer disks. The records in this System will be maintained in designated NIH offices in a secure manner compatible with their content and use. During normal business hours, records at OTT are managed by on-site contractor personnel who regulate availability of the files. During evening and weekend hours the offices are locked and the building is closed. These practices are in compliance with the standards of the General Administration Manual, PHS Supplementary Chapter 45-13 "Safeguarding Records Contained in Systems of Records"; and the HHS Automated Information Systems Security Program Handbook.</p>
<p>Data on computer files is accessed by password known only to authorized users who are NIH or contractor employees involved in patenting and licensing of HHS inventions or in keeping records of inventions made by HHS contractors and grantees. Access to information is thus limited to those with a need to know. Data stored in computers will be accessed through the use of passwords known only to the authorized users. A password is required to access the database. All users of personal information in connection with the performance of their jobs protect information, including confidential business information submitted by potential licensees, from public view and from unauthorized personnel entering an unsupervised office.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>15 U.S.C. 3710, 3710a, 3710c &amp; 3710d and 35 U.S.C. 200 et seq. provide authority to maintain the records; 37 CFR Part 401 "Rights to Inventions Made by Nonprofit Organizations and Small Business Firms under Government Grants, Contracts, and Cooperative Agreements;" 37 CFR Part 404 "Licensing of Government Owned Inventions;" and 45 CFR Part 7 "Employee Inventions."
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>Records in this System are used to: (1) Obtain patent protection of inventions when title is assigned to HHS; (2) monitor the development of inventions made by grantees and contractors and protect the government rights to patents made with NIH support; (3) grant licenses to HHS inventions; and (4) administer and provide royalty payments to HHS inventors.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The routine uses proposed for this System are compatible with the stated purpose of the System and support the agency's administration of invention, patent, and licensing programs and requirements:
</p><p>1. Disclosure may be made to a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>2. The Department of Health and Human Services (HHS; also referred to as "Department") may disclose information from this System of Records to the Department of Justice when: (a) HHS or any component thereof; or (b) any employee of HHS in their official capacity where the Department of Justice has agreed to represent the employee; or (c) the United States Government is a party to litigation or has an interest in the litigation, and after careful review, HHS determines that the records are both relevant and necessary to the litigation and the use of the records by the Department of Justice is therefore deemed by HHS to be for a purpose that is compatible with the purpose for which HHS collected the records. Disclosure may also be made to the Department of Justice to obtain legal advice concerning issues raised by the records in this System.</p>
<p>3. Disclosure may be made to a court or adjudicative body of competent jurisdiction in a proceeding when: (a) HHS or any component thereof; or (b) any employee of the agency in their official capacity; or (c) any employee of HHS in their individual capacity where HHS has agreed to represent the employee; or (d) the United States Government is party to litigation or has an interest in the litigation, and, after careful review, HHS determines that the records are both relevant and necessary to the litigation and the use of the records is therefore deemed by HHS to be for a purpose that is compatible with the purpose for which HHS collected the records.
</p> <p>4. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising under general statute or particular program statute, or under regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate agency, whether Federal, State, local, foreign or tribal, or other public authority or agency responsible for enforcing, investigating or prosecuting the violation or charged with enforcing or implementing the statute, or rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to any enforcement, regulatory, investigative or prosecutive responsibility of the receiving entity.
</p> <p>5. Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority or agency of any portion of this System of Records that contains information relevant to the retention of an employee, the retention of a security clearance, the award of a grant or contract, or the issuance or retention of a license, patent or other monetary or nonmonetary benefit. Another agency or licensing organization may make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosures shall be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.
</p> <p>6. Disclosure may be made to a Federal, State, local or foreign agency maintaining civil, criminal, or other relevant enforcement records, or other pertinent records, or to another public authority or professional organization, if necessary to obtain information relevant to an investigation concerning the retention of an employee or other personnel action, the retention of a security clearance, the award of a grant or contract, or the issuance or retention of a license, patent or other monetary or nonmonetary benefit.
</p> <p>7. Where Federal agencies having the power to subpoena other Federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to HHS for records in this system of records, HHS may make those records available.
</p> <p>8. Disclosure may be made to agency contractors, experts, or consultants who have been engaged by the agency to assist in the performance of a service related to this System of Records and who need to have access to the records in order to perform the activity. Recipients shall be required to comply with the requirements of the Privacy Act of 1974, as amended (Act, also referred to as "Privacy Act"), pursuant to 5 U.S.C. 552a(m).
</p> <p>9. NIH may disclose information from this System of Records for the purpose of obtaining patent protection for HHS inventions and licenses for these and other HHS inventions to: (a) Scientific personnel, both in this agency and other Government agencies, and in non-Governmental organizations such as universities, who possess the expertise to understand the invention and evaluate its importance as a scientific advance; (b) contract patent counsel and their employees and foreign contract personnel retained by the Department for patent searching and prosecution in both the United States and foreign patent offices; (c) all other Government agencies whom HHS contacts regarding the possible use, interest in, or ownership rights in HHS inventions; (d) prospective licensees or technology finders who may further make the invention available to the public through sale or use; (e) parties, such as supervisors of inventors, whom HHS contacts to determine ownership rights, and those parties contacting HHS to determine the Government's ownership; and (f) the United States and foreign patent offices involved in the filing of HHS patent applications.
</p> <p>10. NIH shall report to the Treasury Department, Internal Revenue Service (IRS), as taxable income, the amount of royalty payment paid to HHS inventors.
</p> <p>11. NIH may disclose information from this System of Records to: (a) Potential clinical trial participants, under the rules and regulations governing the NIH human subjects protections program, when an investigator has any financial interests that might be relevant for their consideration when deciding whether or not to participate in a trial and; (b) the general public to reveal the compensation that government scientists receive on licensed inventions generated during their government work.
</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>The records in this System are stored in file folders, computer tapes, and computer disks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name of the inventor, Employee Invention Report (EIR) Number, or keywords relating to the nature of the invention, Case/Serial Number, licensing number, internal reference numbers, contractor, agency, Institute, and/or Center.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Data on computer files is accessed by password known only to authorized users who are NIH or contractor employees involved in patenting and licensing of HHS inventions or in keeping records of inventions made by HHS contractors and grantees. Access to information is thus limited to those with a need to know.
</p> <p>2. Physical Safeguards: The records in this System will be maintained in designated NIH offices in a secure manner compatible with their content and use. During normal business hours, records at OTT are managed by on-site contractor personnel who regulate availability of the files. During evening and weekend hours the offices are locked and the building is closed. These practices are in compliance with the standards of the General Administration Manual, PHS Supplementary Chapter 45-13 "Safeguarding Records Contained in Systems of Records"; and the HHS Automated Information Systems Security Program Handbook.
</p> <p>3. Procedural and Technical Safeguards: Data stored in computers will be accessed through the use of passwords known only to the authorized users. A password is required to access the database. All users of personal information in connection with the performance of their jobs (see Authorized Users, above) protect information, including confidential business information submitted by potential licensees, from public view and from unauthorized personnel entering an unsupervised office.
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1100-L, which allows records to be kept for a maximum of thirty years. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Freedom of Information Act Coordinator, Office of Technology Transfer, Office of Intramural Research, Office of the Director, 6011 Executive Boulevard, Suite 325, Bethesda, MD 20852.
</p> <p>Office of Financial Management, Office of Management, Office of the Director, 2115 E. Jefferson Street, Room 3A-307, Rockville, MD 20892.
</p> <p>Office of Reports and Analysis, Office of Extramural Research, Office of the Director, Building 1, Room 252, 1 Center Drive, Bethesda, MD 20892-2184.
</p> <p>Extramural Inventions and Technology Resources Branch, Office of Policy for Extramural Research Administration, Office of Extramural Research, Office of the Director, Rockledge I, 6705 Rockledge Drive, Room 1040, Bethesda, MD 20892-7980.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager listed above. A requestor must also verify their identity by providing either a notarization of the request or a written certification that the requestor is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine. The request should include: (a) Full name, and (b) appropriate identifying information on the nature of the invention.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Write to the System Manager specified above to attain access to records and provide the same information as is required under the Notification Procedures. Requesters should also reasonably specify the contents of the records being sought. Individuals may also request an accounting of disclosure of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager specified above and reasonably identify the record, specify the information to be contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Inventors and other collaborating persons, grantees, fellowship recipients and contractors; other Federal agencies; scientific experts from non-Government organizations; contract patent counsel and their employees and foreign contract personnel; United States and foreign patent offices; prospective licensees; HHS Technology Development Coordinators, Internet and commercial databases, and third parties whom HHS contacts to determine individual invention ownership or Government ownership.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0169" toc="yes">
<systemNumber>09-25-0169</systemNumber>
<subsection type="systemName">Medical Staff-Credentials Files, HHS/NIH/CC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Credentialing Services Office, Clinical Center (CC), Building 10, Room 1N204, 10 Center Drive, Bethesda, MD 20892-1192.
</p> <p>Write to the System Manager at the address below for a list of Contractor locations, including the address of any Federal Records Center where records from this system may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who have been approved as members of the medical staff at the Warren G. Magnuson Clinical Center.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Medical staff names, date of birth, home address and telephone number, office address and telephone number, citizenship, visa information, appointment date, hospital-wide computer access privileges, Institute/Center designation, branch/lab, type of medical staff membership, privilege delineation, professional degree(s) including school of attendance and graduation dates, foreign medical examinations, specialty board certifications, licensing information (including state of licensure and license number), record of disciplinary actions, documentation of training, and admitting privileges.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authority for collecting the requested information is contained in section 301 (42 U.S.C. 241) of the Public Health Service Act, as amended, outlining the authority of the Secretary to, within the Public Health Service (PHS), promote the coordination of various research and associated activities, including for purposes of study, admitting and treating individuals at PHS facilities. Section 402(b) of the Public Health Service Act (42 U.S.C. 282(b)), as amended, outlining the authority of the Director of the National Institutes of Health (NIH) with respect to the admission and treatment of individuals at NIH facilities for purposes of study.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>These records are used to: (1) Maintain information used in the credentialing and privileging of active medical staff members at the Warren G. Magnuson Clinical Center; (2) document patient care privileges for active members of the medical staff; (3) provide information about active and non-active members of the medical staff to authorized individuals; and (4) report to the National Practitioner Data Bank as required by the provisions of Title IV of Pub. L. 99-660, as amended.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State, or local, charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.
</p> <p>4. NIH may disclose records to Department contractors and subcontractors for the purpose of collecting, compiling, aggregating, analyzing, or refining records in the system. Contractors maintain, and are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records.
</p> <p>5. NIH may disclose information to representatives of the Joint Commission on Accreditation of Healthcare Organizations for the purpose of conducting quality assurance reviews and inspections of the Warren G. Magnuson Clinical Center credentialing policies and procedures.
</p> <p>6. NIH may disclose information from this system of records to State medical boards for purposes of professional quality assurance activities.
</p> <p>7. NIH may disclose information from this system of records to health care facilities for the purpose of verifying that an individual to whom they intend to grant medical staff or patient care privileges has or previously held such privileges at the Warren G. Magnuson Clinical Center.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored on paper forms in file folders and in electronic databases.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, date of birth, type of medical staff membership, Institute/Center and licensing status.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Data on the computer network system is accessed by a password known only to authorized users who are NIH employees and contractor staff responsible for implementing the medical staff credentials data system. Access to information is thus limited to those with a need to know.
</p> <p>2. Physical Safeguards: Rooms where records are stored are locked when not in use. During regular business hours rooms are unlocked but entry is controlled by on-site personnel.
</p> <p>3. Procedural and Technical Safeguards: Access to files is strictly controlled by the system manager. Names and other identifying particulars are deleted when data from original records are encoded for analysis. Data stored in computers is accessed through a network system by use of a password known only to authorized users. All authorized users of personal information in connection with the performance of their jobs (see Authorized Users, above) protect information from public view and from unauthorized personnel entering an unsupervised office.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1B "Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 2300-293-4, "Medical Staffs' Credential Files," which allows inactive records to be transferred to the Federal Records Center at five year intervals and to be destroyed after thirty years. Refer to the NIH Manual Chapter for specific disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, Credentialing Services Office, Clinical Center, Building 10, Room 1N204, 10 Center Drive, Bethesda, MD 20892-1192.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the above address. The requester must provide tangible proof of identity (e.g., driver's license). If no identification papers are available, the requester must verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Write to the System Manager specified above to attain access to records and provide the same information as that required under the Notification Procedures. Requesters should also reasonably specify the record contents being requested. Individuals may also request an accounting of disclosure of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager specified above and reasonably identify the record, specify the information to be contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Subject individual.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
        <section id="09-25-0200" toc="yes">
            <systemNumber>09-25-0200</systemNumber>
            <subsection type="systemName">Clinical, Basic and Population-based Research Studies of the National Institutes of Health (NIH), HHS/NIH/OD.</subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>
                        Records are located at NIH and Contractor research facilities which collect or provide research data for this system. Contractors may include, but are not limited to: Research centers, clinics, hospitals, universities, medical schools, research institutions/foundations, national associations, commercial organizations, collaborating State and Federal Government agencies, and coordinating centers. A current list of sites, including the address of any Federal Records Center where records from this system may be stored, is available by writing to the appropriate Coordinator listed under Notification Procedure.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>
                        Adults and/or children who are the subjects of clinical, basic, or population-based research studies of the NIH. Individuals with disease. Individuals who are representative of the general population or of special groups including, but not limited to: normal controls, normal volunteers, family members and relatives; providers of services (e.g., health care and social work); health care professionals and educators, and demographic sub-groups as applicable, such as age, sex, ethnicity, race, occupation, geographic location; and groups exposed to real and/or hypothesized risks (e.g., exposure to biohazardous microbial agents).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>
                        The system contains data about individuals as relevant to a particular research study. Examples include, but are not limited to: name, study identification number, address, relevant telephone numbers, social security number (voluntary), driver's license number, date of birth, weight, height, sex, race; medical, psychological and dental information, laboratory and diagnostic testing results; registries; social, economic and demographic data; health services utilization; insurance and hospital cost data, employers, conditions of the work environment, exposure to hazardous substances/compounds; information pertaining to stored biologic specimens (including blood, urine, tissue and genetic materials), characteristics and activities of health care providers and educators and trainers (including curricula vitae); and associated correspondence.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>
                        "Research and Investigation," "Appointment and Authority of the Directors of the National Research Institutes," "National Cancer Institute," "National Eye Institute," "National Heart, Lung and Blood Institute," "National Institute on Aging," "National Institute on Alcohol Abuse and Alcoholism," "National Institute on Allergy and Infectious Diseases," "National Institute of Arthritis and Musculoskeletal and Skin Diseases," "National Institute of Child Health and Human Development," "National Institute on Deafness and Other Communication Disorders," "National Institute of Dental and Craniofacial Research," "National Institute of Diabetes, and Digestive and Kidney Diseases," "National Institute of Drug Abuse," "National Institute of Environmental Health Sciences," "National Institute of Mental Health," "National Institute of Neurological Disorders and Stroke," and the "National Human Genome Research Institute" of the Public Health Service Act. (42 U.S.C. 241, 242, 248, 281, 282, 284, 285a, 285b, 285c, 285d, 285e, 285f, 285g, 285h, 285i, 285j, 285l, 285m, 285n, 285o, 285p, 285q, 287, 287b, 287c, 289a, 289c, and 44 U.S.C. 3101.)
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>
                        To document, track, monitor and evaluate NIH clinical, basic, and population-based research activities.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>
                        1. A record may be disclosed for a research purpose, when the Department: (A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; e.g., disclosure of alcohol or drug abuse patient records will be made only in accordance with the restrictions of confidentiality statutes and regulations 42 U.S.C. 241, 42 U.S.C 290dd-2, 42 CFR part 2, and where applicable, no disclosures will be made inconsistent with an authorization of confidentiality under 42 U.S.C. 241 and 42 CFR part 2a; (B) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (C) has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law; and (D) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by, these provisions.
                    </p> 
                    <p>
                        2. Disclosure may be made to a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.
                    </p> 
                    <p>
                        3. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity where the Department of Justice has agreed to represent the employee; or (c) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records by the Department of Justice is, therefore, deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
                    </p> 
                    <p>
                        4. Disclosure may be made to agency contractors, grantees, experts, consultants, collaborating researchers, or volunteers who have been engaged by the agency to assist in the performance of a service related to this system of records and who need to have access to the records in order to perform the activity. Recipients shall be required to comply with the requirements of the Privacy Act of 1974, as amended, pursuant to 5 U.S.C. 552a(m).
                    </p> 
                    <p>
                        5. Information from this system may be disclosed to Federal agencies, State agencies (including the Motor Vehicle Administration and State vital statistics offices, private agencies, and other third parties (such as current or prior employers, acquaintances, relatives), when necessary to obtain information on morbidity and mortality experiences and to locate individuals for follow-up studies. Social security numbers, date of birth and other identifiers may be disclosed: (1) To the National Center for Health Statistics to ascertain vital status through the National Death Index; (2) to the Health Care Financing Agency to ascertain morbidities; and (3) to the Social Security Administration to ascertain disabilities and/or location of participants. Social security numbers may also be given to other Federal agencies, and State and local agencies when necessary to locating individuals for participation in follow-up studies.
                    </p> 
                    <p>
                        6. Medical information may be disclosed in identifiable form to tumor registries for maintenance of health statistics, e.g., for use in research studies.
                    </p> 
                    <p>
                        7. PHS may inform the sexual and/or needle-sharing partner(s) of a subject individual who is infected with the human immunodeficiency virus (HIV) of their exposure to HIV, under the following circumstances: (1) The information has been obtained in the course of clinical activities at PHS facilities carried out by PHS personnel or contractors; (2) The PHS employee or contractor has made reasonable efforts to counsel and encourage the subject individual to provide the information to the individual's sexual or needle-sharing partner(s); (3) The PHS employee or contractor determines that the subject individual is unlikely to provide the information to the sexual or needle-sharing partner(s) or that the provision of such information cannot reasonably be verified; and (4) The notification of the partner(s) is made, whenever possible, by the subject individual's physician or by a professional counselor and shall follow standard counseling practices.
                    </p> 
                    <p>
                        PHS may disclose information to State or local public health departments, to assist in the notification of the subject individual's sexual and/or needle-sharing partner(s), or in the verification that the subject individual has notified such sexual or needle-sharing partner(s).
                    </p> 
                    <p>
                        8. Certain diseases and conditions, including infectious diseases, may be reported to appropriate representatives of State or Federal Government as required by State or Federal law.
                    </p> 
                    <p>
                        9. Disclosure may be made to authorized organizations which provide health services to subject individuals or provide third-party reimbursement or fiscal intermediary functions, for the purpose of planning for or providing such services, billing or collecting third-party reimbursements.
                    </p> 
                    <p>
                        10. The Secretary may disclose information to organizations deemed qualified to carry out quality assessment, medical audits or utilization reviews.
                    </p> 
                    <p>
                        11. Disclosure may be made for the purpose of reporting child, elder or spousal abuse or neglect or any other type of abuse or neglect as required by State or Federal law.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>
                        Storage:
                    </p> 
                    <p>
                        Records may be stored on index cards, file folders, computer tapes and disks (including optical disks), photography media, microfiche, microfilm, and audio and video tapes. For certain studies, factual data with study code numbers are stored on computer tape or disk, while the key to personal identifiers is stored separately, without factual data, in paper/computer files.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>
                        During data collection stages and follow-up, retrieval is by personal identifier (e.g., name, social security number, medical record or study identification number, etc.). During the data analysis stage, data are normally retrieved by the variables of interest (e.g., diagnosis, age, occupation).
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>
                        1. Authorized Users: Access to identifiers and to link files is strictly limited to the authorized personnel whose duties require such access. Procedures for determining authorized access to identified data are established as appropriate for each location. Personnel, including contractor personnel, who may be so authorized include those directly involved in data collection and in the design of research studies, e.g., interviewers and interviewer supervisors; project managers; and statisticians involved in designing sampling plans. Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the system manager. Researchers authorized to conduct research on biologic specimens will typically access the system through the use of encrypted identifiers sufficient to link individuals with records in such a manner that does not compromise confidentiality of the individual.
                    </p> 
                    <p>
                        2. Physical Safeguards: Records are either stored in locked rooms during off-duty hours, locked file cabinets, and/or secured computer facilities. For certain studies, personal identifiers and link files are separated and stored in locked files. Computer data access is limited through the use of key words known only to authorized personnel.
                    </p> 
                    <p>
                        3. Procedural Safeguards: Collection and maintenance of data is consistent with legislation and regulations in the protection of human subjects, informed consent, confidentiality, and confidentiality specific to drug and alcohol abuse patients where these apply. When anonymous data is provided to research scientists for analysis, study numbers which can be matched to personal identifiers will be eliminated, scrambled, or replaced by the agency or contractor with random numbers which cannot be matched. Contractors who maintain records in this system are instructed to make no further disclosure of the records. Privacy Act requirements are specifically included in contracts for survey and research activities related to this system. The OHS project directors, contract officers, and project officers oversee compliance with these requirements. Personnel having access are trained in Privacy Act requirements. Depending upon the sensitivity of the information in the record, additional safeguard measures may be employed.
                    </p> 
                    <p>
                        4. Implementation Guidelines: These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>
                        Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 3000-G-3, which allows records to be kept as long as they are useful in scientific research. Collaborative Perinatal Project records are retained in accordance with item 3000-G-4, which does not allow records to be destroyed. Refer to the NIH Manual Chapter for specific conditions on disposal or retention instructions.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>
                        See Appendix I for a listing of current System Managers. This system is for use by all NIH Institutes and Centers.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>
                        To determine if a record exists, write to the appropriate IC Privacy Act Coordinator listed below. In cases where the requester knows specifically which System Manager to contact, he or she may contact the System Manager directly (See Appendix I). Notification requests should include: individual's name; current address; date of birth; date, place and nature of participation in specific research study; name of individual or organization administering the research study (if known); name or description of the research study (if known); address at the time of participation; and in specific cases, a notarized statement (some highly sensitive systems require two witnesses attesting to the individual's identity). A requester must verify his or her identity by providing either a notarization of the request or by submitting a written certification that the is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
                    </p> 
                    <p>
                        Individuals will be granted direct access to their medical records unless the System Manager determines that such access is likely to have an adverse effect (i.e., could cause harm) on the individual. In such cases when the System Manager has determined that the nature of the record information requires medical interpretation, the subject of the record shall be requested to designate, in writing, a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. The representative may be a physician, other health professional, or other responsible individual. In this case, the medical/dental record will be sent to the designated representative. Individuals will be informed in writing if the record is sent to the representative. This same procedure will apply in cases where a parent or guardian requests notification of, or access to, a child's or incompetent person's medical record. The parent or guardian must also verify (provide adequate documentation) their relationship to the child or incompetent person as well as his or her own identity to prove their relationship.
                    </p> 
                    <p>
                        If the requester does not know which Institute or Center Privacy Act Coordinator to contact for notification purposes, he or she may contact directly the NIH Privacy Act Officer at the following address: NIH Privacy Act Officer, Office of Management Assessment, 6011 Executive Blvd., Room 601L, Rockville, MD 20852.
                    </p> 
                    <p>
                        NIH Privacy Act Coordinators
                    </p>
                    <p>
                        Associate Director for Disease Prevention, Office of the Director (OD), Building 1, Room 260, 1 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, Clinical Center (CC), Building 10, Room 1N208, 10 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Center for Complementary and Alternative Medicine (NCCAM), Building 31, Room 2B11, 31 Center Drive, Bethesda, MD 20892-2182.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Cancer Institute (NCI), Building 31, Room 10A34, 31 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Center on Minority Health and Health Disparities (NCMHD), Democracy Plaza II, Room 800, 6707 Democracy Boulevard, Bethesda, MD 20892-5465.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Center for Research Resources (NCRR), Rockledge I, Room 5140, 6705 Rockledge Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Eye Institute (NEI), Building 31, Room 6A32, 31 Center Drive, Bethesda, MD 20892-2510.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Human Genome Research Institute (NHGRI), Building 10, 3C710, 10 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Heart, Lung, and Blood Institute (NHLBI), Building 31, Room 5A33, 31 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute on Aging (NIA), Gateway Building 31, Room 2C234, 7201 Wisconsin Avenue, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute on Alcohol Abuse and Alcoholism (NIAAA), Willco Building, Room 400, 6000 Executive Boulevard, Bethesda, MD 20892-7003.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Allergy and Infectious Diseases (NIAID), 6700-B Rockledge Drive, Room 2143, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Arthritis and Musculoskeletal and Skin Diseases (NIAMS), Natcher Building, Room 5AS49, 45 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Biomedical Imaging and Bioengineering (NIBIB), Building 31, Room 1B37, 31 Center Drive, Bethesda, MD 20892-2077.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Child Health and Human Development (NICHD), Building 31, Room 2A11, 31 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, Office of Extramural Affairs, National Institute on Drug Abuse (NIDA), Neuroscience Center, 6001 Executive Boulevard, Room 3158, Bethesda, MD 20892-9547.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute on Deafness and Other Communication Disorders (NIDCD), Building 31, Room 3C02, 31 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Dental and Craniofacial Research (NIDCR), Natcher Building, Room 4AS25, 45 Center Drive, Bethesda, MD 20892-6401.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Diabetes and Digestive and Kidney Disease (NIDDK), Building 31, Room 9A47, 31 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Environmental Health Sciences (NIEHS), PO Box 12233, Research Triangle Park, NC 27709.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of General Medical Sciences (NIGMS), Natcher Building, Room 2AN32, 45 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Mental Health (NIMH), Neuroscience Center, 6001 Executive Boulevard, Room 8102, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Neurological Disorders and Stroke (NINDS), Building 31, Room 8A33, 31 Center Drive, Bethesda, MD 20892.
                    </p> 
                    <p>
                        Privacy Act Coordinator, National Institute of Nursing Research (NINR), Rockledge II, Room 710, 6701 Rockledge Drive, Bethesda, MD 20892.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>
                        Same as Notification Procedures. Requesters should reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>
                        Contact the appropriate official at the address specified under Notification Procedure, and reasonably identify the record, specify the information being contested, and state corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        The system contains information obtained directly from the subject individual by interview (face-to-face or telephone), written questionnaire, or by other tests, recording devices or observations, consistent with legislation and regulation regarding informed consent and protection of human subjects. Information is also obtained from other sources, including but not limited to: referring medical physicians, mental health/alcohol/drug abuse or other health care providers; hospitals; organizations providing biological specimens; relatives; guardians; schools; and clinical medical research records.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemsExempted">
                <xhtmlContent>
                    <p>
                        None.
                    </p>
                    <p>
                        <i>Appendix I: System Manager(s) and Address(es) </i>
                    </p>
                    <p>
                        Associate Director for Disease Prevention, Office of the Director (OD), Building 1, Room 260, 1 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Computer Systems Analyst, Division of Cancer Treatment and Diagnosis, National Cancer Institute (NCI), Executive Plaza North, Room 344, 6130 Executive Boulevard, Bethesda, MD 20892.
                    </p>
                    <p>
                        American Burkitt's Lymphoma Registry, Division of Cancer Etiology, National Cancer Institute (NCI), Executive Plaza North, Suite 434, 6130 Executive Boulevard, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Genetic Epidemiology Branch, Division of Cancer Epidemiology and Genetics, National Cancer Institute (NCI), Executive Plaza South, Room 7122, 6120 Executive Boulevard, Bethesda, MD 20892-7236.
                    </p>
                    <p>
                        Program Director, Research Resources, Biological Carcinogenesis Branch, Division of Cancer Etiology, National Cancer Institute (NCI), Executive Plaza North, Room 540, 6130 Executive Boulevard, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Environmental Epidemiology Branch, Division of Cancer Etiology, National Cancer Institute (NCI), Executive Plaza North, Room 443, 6130 Executive Boulevard, Bethesda, MD 20892.
                    </p>
                    <p>
                        Associate Director, Surveillance Program, Division of Cancer Prevention, National Cancer Institute (NCI), Executive Plaza North, Room 343K, 6130 Executive Boulevard, Bethesda, MD 20892.
                    </p>
                    <p>
                        Head, Biostatistics and Data Management Section, Center for Cancer Research, National Cancer Institute (NCI), Building 6116, Room 702, 6116 Executive Boulevard, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Clinical Research Branch, Center for Cancer Research, Frederick Cancer Research and Development Center, National Cancer Institute (NCI), 501 W. 7th Street, Room 3, Frederick, MD 21702.
                    </p>
                    <p>
                        Deputy Branch Chief, Navy Hospital, NCI-Naval Medical Oncology Branch, Center for Cancer Research, National Cancer Institute (NCI), Building 8, Room 5101, Bethesda, MD 20814.
                    </p>
                    <p>
                        Chief, Pharmaceutical Management Branch, Cancer Therapy Evaluation Program, Division of Cancer Treatment and Diagnosis, National Cancer Institute (NCI), Executive Plaza North, Room 804, 6130 Executive Boulevard, Bethesda, MD 20892.
                    </p>
                    <p>
                        Director, Extramural Clinical Studies, Frederick Cancer Research and Development Center, National Cancer Institute (NCI), Fort Detrick, Frederick, MD 21702.
                    </p>
                    <p>
                        Clinical Operations Manager, National Eye Institute (NEI), Building 10, Room 10S224, 10 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Director, Division of Biometry and Epidemiology, National Eye Institute (NEI), Building 31, Room 6A52, 31 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Associate Director, Office of Clinical Affairs, National Heart, Lung, and Blood Institute (NHLBI), Building 10, Room 8C104,10 Center Drive, Bethesda, MD 20892-1754.
                    </p>
                    <p>
                        Senior Scientific Advisor, Office of the Director, Division of Epidemiology and Clinical Applications, National Heart, Lung, and Blood Institute (NHLBI), Federal Building, Room 220, 7550 Wisconsin Avenue, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief Laboratory of Epidemiology, Demography and Biometry, National Institute on Aging (NIA), Gateway Building, Room 3C309, 7201 Wisconsin Avenue, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Research Resources Branch, Intramural Research Program, National Institute on Aging (NIA), 5600 Nathan Shock Drive, Baltimore, MD 21224.
                    </p>
                    <p>
                        Clinical Director, National Institute on Aging (NIA), 5600 Nathan Shock Drive, Baltimore, MD 21224.
                    </p>
                    <p>
                        Deputy Director, Division of Biometry and Epidemiology, National Institute on Alcohol Abuse and Alcoholism (NIAAA), Willco Building, Room 514, 6000 Executive Boulevard, Bethesda, MD 20892-7003.
                    </p>
                    <p>
                        Deputy Director, Division of Clinical and Prevention Research, National Institute on Alcohol Abuse and Alcoholism (NIAAA), Willco Building, Room 505, 6000 Executive Boulevard, Bethesda, MD 20892-7003.
                    </p>
                    <p>
                        Chief, Respiratory Viruses Section, Laboratory of Infectious Diseases, National Institute of Allergy and Infectious Diseases (NIAID), Building 7, Room 106, 7 Memorial Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Hepatitis Virus Section, Laboratory of Infectious Diseases, National Institute of Allergy and Infectious Diseases (NIAID), Building 7, Room 202, 7 Memorial Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Biometry Branch, Division of Microbiology and Infectious Diseases, National Institute of Allergy and Infectious Diseases (NIAID), 6700-B Rockledge Drive, Room 3120, Bethesda, MD 20892.
                    </p>
                    <p>
                        Clinical Director, National Institute of Arthritis and Musculoskeletal and Skin Diseases (NIAMS), Building 10, Room 9S205, 10 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Contracts Management Branch, National Institute of Child Health and Human Development (NICHD), Executive Plaza North, Room 7A07, 6130 Executive Boulevard, Bethesda, MD 20892.
                    </p>
                    <p>
                        Director of Intramural Research, National Institute on Deafness and Other Communication Disorders (NIDCD), Building 31, Room 3C02, 31 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Scientific Programs Branch, National Institute on Deafness and Other Communication Disorders (NIDCD), Executive Plaza South, Room 400C, 6120 Executive Boulevard, Bethesda, MD 20892-7180.
                    </p>
                    <p>
                        Clinical Director, National Institute of Dental and Craniofacial Research (NIDCR), Building 10, Room 1N117, 10 Center Drive, Bethesda, MD 20892-1191.
                    </p>
                    <p>
                        Chief, Scientific Review Branch, National Institute of Dental and Craniofacial Research (NIDCR), Building 10, Room 1N117, 10 Center Drive, Bethesda, MD 20892-1191.
                    </p>
                    <p>
                        Research Psychologist, Gene Therapy and Therapeutics Branch, National Institute of Dental and Craniofacial Research (NIDCR), Building 10, Room 1N105, 10 Center Drive, Bethesda, MD 20892-1190.
                    </p>
                    <p>
                        Chief, Clinical Investigations, National Institute of Diabetes and Digestive and Kidney Diseases (NIDDK), Building 10, Room 9N222, 10 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Phoenix Clinical Research Section, National Institute of Diabetes and Digestive and Kidney Diseases (NIDDK), Phoenix Area Indian Hospital, Room 541, 4212 North 16th Street, Phoenix, AZ 85016.
                    </p>
                    <p>
                        Chief, Diabetes Research Section, Division of Diabetes, Endocrinology, and Metabolic Diseases, National Institute of Diabetes and Digestive and Kidney Disease (NIDDK), Natcher Building, Room 5AN18G, 45 Center Drive, Bethesda, MD 20892-6600.
                    </p>
                    <p>
                        Privacy Act Coordinator, Office of Extramural Affairs, National Institute on Drug Abuse (NIDA), 6001 Executive Boulevard, Room 3158, Bethesda, MD 20892-9547.
                    </p>
                    <p>
                        Chief, Epidemiology Branch, National Institute of Environmental Health Sciences (NIEHS), PO Box 12233, Research Triangle Park, NC 27709.
                    </p>
                    <p>
                        Director, Intramural Research Program, National Institute of Mental Health (NIMH), Building 10, Room 4N224, 10 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Privacy Act Coordinator, National Institute of Mental Health (NIMH), Neuroscience Center, Room 8102, 6001 Executive Boulevard, Bethesda, MD 20982.
                    </p>
                    <p>
                        Privacy Act Coordinator, National Institute of Neurological Disorders and Stroke (NINDS), Building 31, Room 8A33, 31 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Chief, Epilepsy Branch, National Institute of Neurological Disorders and Stroke (NINDS), Neuroscience Center, 6001 Executive Boulevard, Suite 2110, Bethesda, MD 20892-9523.
                    </p>
                    <p>
                        Assistant Director, Clinical Neurosciences Program, Division of Intramural Research, National Institute of Neurological Disorders and Stroke (NINDS), Building 10, Room 5N234, 10 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Acting Chief, Laboratory of Central Nervous Systems Studies, Intramural Research Program, National Institute of Neurological Disorders and Stroke (NINDS), Building 36, Room 4A21, 36 Convent Drive, Bethesda, MD 20892-4123.
                    </p>
                    <p>
                        Clinical Director, National Human Genome Research Institute (NHGRI), Building 10, Room 10C101D, 10 Center Drive, Bethesda, MD 20892.
                    </p>
                    <p>
                        Deputy Director, Division of Extramural Research, National Institute of Neurological Disorders and Stroke (NINDS), Neuroscience Center, Room 3307, 6001 Executive Boulevard, Bethesda, MD 20892.
                    </p>
                    <p>
                        Director, Office of Clinical and Regulatory Affairs, Division of Extramural Research and Training, Democracy Plaza II, Room 401, 6707 Democracy Boulevard, Bethesda, MD 20892-5475.
                    </p>
                    <p>
                        Privacy Act Coordinator, National Institute of Biomedical Imaging and Bioengineering (NIBIB), Building 31, Room 1B37, 31 Center Drive, Bethesda, MD 20892-2077.
                    </p>
                    <p>Privacy Act Coordinator, National Center on Minority Health and Health Disparities (NCMHD), Democracy Plaza II, Room 800, 6707 Democracy Boulevard, Bethesda, MD 20892-5465.</p>
                
                </xhtmlContent>
            </subsection>
        </section>
     <section id="09-25-0202" toc="yes">
<systemNumber>09-25-0202</systemNumber>
<subsection type="systemName">Patient Records on PHS Beneficiaries (1935-1974) and Civilly Committed Drug Abusers (1967-1976) Treated at the PHS Hospitals in Fort Worth, Texas, or Lexington, Kentucky, HHS/NIH/NIDA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Intramural Research Program, National Institute on Drug Abuse (NIDA), National Institutes of Health, Johns Hopkins Bayview Medical Center, P.O. Box 5180, Baltimore, Maryland 21224.
</p> <p>Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
</p> <p>Washington National Records Center, 4205 Suitland Road, Washington, D.C. 20409.
</p> <p>Iron Mountain, 8200 Preston Court, Suite One, Jessup, MD 20794.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Civilly committed narcotic addicts (1967-1976) and adult PHS beneficiaries (1935-1974) treated at either the PHS hospital in Fort Worth, Texas, or Lexington, Kentucky.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Administrative records, such as treatment admission and release dates, name and address, and other demographic data; medical records, such as, but not limited to, medical history information, drug abuse/use data as well as treatment information, any laboratory tests, etc.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Narcotic Addict Rehabilitation Act of 1966, and Narcotic Addict Rehabilitation Amendments of 1971, Titles I and III (42 U.S.C. 3411 et seq. and 28 U.S.C. 2901 et seq.), and Public Health Service Act, Sections 321-326, 341(a) and (c) (42 U.S.C. 248-253, 257(a) and (c)).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The records were collected originally to monitor the individual's progress while being treated at either of two PHS hospitals and to ensure continuity of that care. These systems are now inactive. The records are used to respond to requests from subject individuals (or his/her designated representative) to (1) establish eligibility for certain Federal benefits for the individual or his/her dependent(s), and (2) provide information to subsequent health care providers at the request of the individual regarding medical treatment received to ensure continuity of care.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records at National Institute on Drug Abuse (NIDA) are on microfilm and contain only part of the admission and discharge information. The microfilm is stored in a file cabinet in a locked room. Records sent to Federal Records Center are stored in GSA-approved storage containers.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The administrative records and microfilm are filed by patient name. The medical records are filed either by patient name or by patient's hospital number with a cross-reference list at NIDA matching number to name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Only the System Manager and designated staff.
</p> <p>2. Physical Safeguards: The microfilm is in a room which has limited access, or stored at a security coded warehouse. The room is located in a building with a 24-hour security patrol/television surveillance system. Sign in and out procedures are used at all times. The warehouse has security access; records can only be retrieved by the System Manager or designated staff using a confidential code number. The warehouse is patrolled on a 24-hour basis with television surveillance.
</p> <p>3. Procedural Safeguards: Only the System Manager and his/her staff have access to the microfilm information and have been trained in accordance with the Privacy Act.
</p> <p>4. Implementation Guidelines: These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>All administrative and medical records have been retired to a Federal Records Center. The records collected under the Narcotic Addict Rehabilitation Act of 1966 will be destroyed when they are 25 years old, which will be in 2001 because the last patient was released from treatment in 1976. The PHS beneficiaries' records will be destroyed at the same time. The records will be shredded in 2003 upon written request from the system manager.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Medical Records Officer, Intramural Research Program, National Institute on Drug Abuse (NIDA), Johns Hopkins Bayview Medical Center, Box 5180, Baltimore, MD 21224.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the address above. An individual may learn if a record exists about himself or herself upon written request with a notarized signature. The request should include, if known: Patient hospital record number, full name or any alias used, patient's address during treatment, birth date, veteran status (if applicable) and approximate dates in treatment, and social security number.
</p> <p>An individual who requests notification of a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the individual of its content at the representative's discretion.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedures above, and reasonably identify the record, specify the information being contested, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Patients; patients' drug treatment program counselors; court records; hospital personnel.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0203" toc="yes">
<systemNumber>09-25-0203</systemNumber>
<subsection type="systemName">National Institute on Drug Abuse, Intramural Research Program, Federal Prisoner and Non-Prisoner Research Files, HHS/NIH/NIDA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Intramural Research Program, National Institute on Drug Abuse (NIDA), P.O. Box 5180, Baltimore, MD 21224.
</p> <p>NIDA Warehouse, 5550 Eastern Avenue, Baltimore, MD 21224.
</p> <p>Quest, Pathology Building, 1901 Silver Spring Road, Baltimore, MD 21227.
</p> <p>Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
</p> <p>Washington National Records Center, 4205 Suitland Road, Washington, DC 20409.
</p> <p>NOVA, Johns Hopkins Bayview Medical Center, Building C, 5500 Nathan Shock Drive, Baltimore, MD 21224.
</p> <p>Iron Mountain, 8200 Preston Court, Suite One, Jessup, MD 20794.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Volunteers, adult males (from 1968 to present), adult females (beginning in l985) and adolescents (ages 13-18, beginning in 1983) and children (neonate to 12 beginning in 1989). Clinical research projects conducted at the Addiction Research Center (ARC). This system also includes records on adult Federal prisoners involved in research projects at ARC when located at Lexington, Kentucky, from 1968- 1976, and some records from system 09-30-0020 to be used for statistical research only.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The categories of records involved are administrative, medical and research records.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Public Health Service Act, Section 301(a) (42 U.S.C. 241(a)); Sections 341(a) and 344(d) (42 U.S.C. 257(a) and 260(d)); Sections 503 and 515 (42 U.S.C. 290aa-2 and 290cc). These sections authorize the conduct of research in all areas of drug abuse.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To collect and maintain a data base for research activities at NIDA/IRP.
</p> <p>2. To enable Federal drug abuse researchers to evaluate and monitor the subjects' health during participation in a research project. The areas of research include, but are not limited to, biomedical, clinical, behavioral, pharmacological, psychiatric, psycho social, epidemiological, etiological, statistical, treatment and prevention of narcotic addiction and drug abuse.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. The National Institute on Drug Abuse (NIDA) uses a contractor to recruit volunteers and to screen these individuals for their acceptability to participate in specific research projects, and limits the contractor's access to the records to these procedures. NIDA also uses a contractor to perform routine medical laboratory tests on blood and urine samples. These routine tests verify that the subject is in good health. Both contractors disclose records from this system only to NIDA and are required to maintain Privacy Act safeguards with respect to such records.
</p> <p>2. (a) PHS may inform the sexual and/or needle-sharing partner(s) of a subject individual who is infected with the human immunodeficiency virus (HIV) of their exposure to HIV, under the following circumstances: (1) The information has been obtained in the course of clinical activities at PHS facilities carried out by PHS personnel or contractors; (2) The PHS employee or contractor has made reasonable efforts to counsel and encourage the subject individual to provide the information to the individual's sexual or needle-sharing partner(s); (3) The PHS employee or contractor determines that the subject individual is unlikely to provide the information to the sexual or needle-sharing partner(s) or that the provision of such information cannot reasonably be verified; and (4) The notification of the partner(s) is made, whenever possible, by the subject individual's physician or by a professional counselor and shall follow standard counseling practices.
</p> <p>(b) PHS may disclose information to State or local public health departments, to assist in the notification of the subject individual's sexual and/or needle-sharing partner(s), or in the verification that the subject individual has, notified such sexual or needle-sharing partner(s).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Data may be stored in file folders or on an internal EISnet, CDS, computer disk, magnetic tape, or microfilm.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Administrative and medical records are indexed and retrieved by the subject's name and identification code number. Research records are indexed and retrieved by the subject's name and identification code number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Only authorized NIDA Intramural Research Program staff are allowed access to these files.
</p> <p>2. Physical Safeguards: Files and file rooms are locked after business hours. Building has electronic controlled entry at all times with a 24-hour guard/television surveillance system. The computer terminals are in a further secured area.
</p> <p>3. Procedural Safeguards: All users of personal information in connection with the performance of their jobs protect information from unauthorized personnel. Access codes to the research records are available only to the Principal Investigator and his/her research team. Access to the records is strictly limited to those staff members trained in accordance with the Privacy Act. The contractor staff members are required to secure the information in accordance with the Privacy Act. Project Officer and contracting officials will monitor contractor compliance.
</p> <p>4. Access to the Clinical Data Warehouse (EISnet): The NIDA IRP computerized medical and research record is strictly limited. All staff must be authorized to use the system and be granted an access code (user name and password) by the system sponsor (NIDA, IRP Chief of Biomedical Informatics). Passwords are required to be changed every six months. Access is limited by job classification and is on a need to know basis only. Data entered is time and date stamped by the staff member's name. Data is not altered once entered. While logged into the system, the name of the staff member is displayed on the screen. An activity log of each use is kept. Data is backed up on a daily basis.
</p> <p>5. Implementation Guidelines: These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p> <p>In addition, because much of the data collected in these research projects are sensitive and confidential, special safeguards have been established. Certificates of confidentiality have been issued under Protection of Identity--Research Subjects Regulations (42 CFR part 2a) to those projects initiated since February 1980. This authorization enables persons engaged in research on mental health, including research on the use and effect of psychoactive drugs, to protect the privacy of research subjects by withholding their names or other identifying characteristics from all persons not connected with the conduct of the research. Persons so authorized may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding to identify such individuals. In addition, these records are subject to 42 CFR part 2, the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations (42 CFR 2.56), which state: "Where the content of patient records has been disclosed pursuant to these regulations for the purpose of conducting scientific research * * * information contained therein which would directly or indirectly identify any patient may not be disclosed by the recipient thereof either voluntarily or in response to any legal process whether Federal or State."
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be disposed of in accordance with the NIH Records Control Schedule, i.e., when the records are ten years old or no longer required for administrative or research purposes.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Medical Records Officer, Intramural Research Program, National Institute on Drug Abuse (NIDA), Johns Hopkins Bayview Medical Center, Building C, P.O. Box 5180, Baltimore, MD 21224.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the address above. Provide a notarized signature as proof of identity. This can be waived if the request is made through official Federal, state, or local channels. The request should include the patient's register number and/or the number of years of incarceration (for prisoner subjects), full name at time of participation in the research project, date(s) of research participation, and title of research project or name of drug being studied. An individual who requests notification of a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. A parent or legal guardian who requests notification of an adolescent's record shall designate a family physician or other health professional (other than a family member) of the Addiction Research Center staff to whom the record, if any, will be sent. The parent or legal guardian must verify in writing the relationship to the adolescent as well as his/her own identity.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. An individual may also request an accounting of disclosures that have been made of his/her records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedures above and reasonably identify the record, specify the information being contested, and state the corrective action sought and reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The individual; observations and medical recordings (such as blood pressure, dosage of compound administered, etc.) made by the Principal investigator and his/her research team; system of records number 09-30-0020; drug treatment programs; Bureau of Prisons; case workers; psychiatrists; research laboratories; and pharmacies and hospitals. Many of these records are confidential and privileged communication is guaranteed under Section 344(d) of the PHS Act.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0207" toc="yes">
<systemNumber>09-25-0207</systemNumber>
<subsection type="systemName">Subject-Participants in Pharmacokinetic Studies on Drugs of Abuse and on Treatment Medications, HHS/NIH/NIDA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>University of California, San Francisco, Langley Porter Psychiatric Institute, San Francisco, CA 94143.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Normal, healthy adults who voluntarily participate in studies on the pharmacokinetics and pharmacodynamics of psychoactive drugs at Langley Porter Psychiatric Institute, during the period September 1987 through September 2005.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Research records on each subject-participant contain the following information: name; clinician's records including medical history, laboratory test results, physical examinations, psychological profile, and drug use profile; drug study data including records of drugs administered, exposures to radioactivity, and drug reactions; and date of study in which the subject participated.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Public Health Service Act, Sections 301(a), 503 and 405 (42 U.S.C. 241 and 284).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The primary purpose of this system is to support research on the pharmacokinetics and pharmacodynamics of drugs of abuse as well as treatment drugs. The term "pharmacokinetics" refers to the manner in which the human body processes a drug. "Pharmacodynamics" refers to the manner in which the drug affects the human body.
</p> <p>The clinical investigator used data of a medical nature that is contained in the system to make determinations regarding drug dosages and/or radiochemical exposures appropriate to the individual human subject-participants, in order to preserve and protect the health of each. The system also provides baseline data for studying the drug effects.
</p> <p>The Food and Drug Administration (FDA) also may use the records in routine inspections FDA conducts in accordance with its responsibilities to develop standards on the composition, quality, safety, and efficacy of drugs administered to humans, and to monitor experimental usage of drugs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. We may disclose to a congressional office the record of an individual in response to a verified inquiry from the congressional office made at the written request of the individual.
</p> <p>2. NIH contractors, use the records in this system to accomplish the research purpose for which the records are collected. The contractors are required to maintain Privacy Act safeguards with respect to such records.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>The contractor maintains the records on paper in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The contractor indexes and retrieves the records by the subject-participant's name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Only the contract Project Director and his/her research team and the Federal Project Officer and his/her support staff have access to these records.
</p> <p>2. Physical Safeguards: The contractor keeps all records in a locked metal file cabinet in premises with limited accessibility. Only the clinical investigator (Project Director) has the key to the locked files.
</p> <p>3. Procedural Safeguards: Only the contract staff have access to the files. Persons other than subject participants who request individually identifiable data from a record, must provide written consent from the subject participant permitting the requested disclosure. The only exception would be for disclosure to persons or organizations permitted by the Privacy Act, Section 3(B) to obtain personally identifiable data.
</p> <p>4. Implementation Guidelines: These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook. In addition, the contract staff complies with contractor's (University of California, San Francisco) standard procedures for safeguarding data.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records will be kept for at least two years after FDA approves the new drug application for the study medication or the IND is withdrawn. At that time, the NIDA project officer will authorize in writing the clinical investigators to destroy the records by shredding or burning.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Project Officer, Pharmacokinetic Studies on Drugs of Abuse, Medications Development Division, National Institute on Drug Abuse (NIDA), Neuroscience Center, Room 4123, 6001 Executive Boulevard, Bethesda, MD 20892-9551.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager listed above.
</p> <p>Provide the following information: subject-participant's full name and a letter of request (or permission, if the requester is not the subject-participant) with notarized signature of the individual who is the subject of the record, approximate date(s) of experiment(s) in which the individual participated, and drug name (if known). In addition, an individual who requests notification of, or access to, a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its content at the representative's discretion.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address above and reasonably identify the record, specify the information to be contested, the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The subject-participants and the contractor personnel conducting the research studies.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0208" toc="yes">
<systemNumber>09-25-0208</systemNumber>
<subsection type="systemName">Drug Abuse Treatment Outcome Study (DATOS), HHS/NIH/NIDA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Research Triangle Institute, Center for Social Research and Policy Analysis, Research Triangle Park, NC 27709.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Voluntary adult clients of Federally-funded treatment programs, including Treatment Alternative Street Crime (TASC) Programs of the Department of Justice, who requested to be included in TOPS from 1979 through 1986. New data collected from voluntary adults/adolescent clients of public and private funded-treatment programs beginning in 1991 and will continue through 1997.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The categories are: demographic data, treatment outcome data, treatment process data, client locator information, and personal identifiers (name and assigned numerical identifier).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Public Health Service Act, Sections 301 and 405 (42 U.S.C. 241 and 284.)
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purpose of the system is to compile information on drug abusers in drug abuse treatment programs in order to derive information on the treatment environments and abusers' behaviors and characteristics subsequent to treatment. Researchers and drug abuse service providers may use the aggregate data to address issues and generate hypotheses to understand better the interactions among the client and community.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Within the restrictions set forth in HHS regulations concerning the confidentiality of drug abuse patient records (42 CFR 2.56), we may disclose a record for a research purpose, when the Department: (a) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (b) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (c) has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except: (A) In emergency circumstances affecting the health or safety of any individual, (B) for use in another research project, under these same conditions, and with written authorization of the Department, (C) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (D) when required by law; (d) has secured a written statement attesting to the recipient's understanding of, and willingness to, abide by these provisions.
</p> <p>2. The Research Triangle Institute, an NIH contractor, uses the records in this system to accomplish the research purpose for which the records are collected. In the event of followup studies or continuation studies because the contract has been terminated for convenience by the Government, we may disclose records in this system to a subsequent NIH contractor. We would require the new contractor to maintain Privacy Act safeguards with respect to such records.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Interview forms, magnetic tapes, and disks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are indexed and retrieved by unique alpha numerical identifier. In order to relate the data collected to specific individuals, one must use the link file discussed under Safeguards.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Contractor personnel, the agency project officer, and agency employees whose duties require the use of the information in the system.
</p> <p>2. Physical Safeguards: The data management task leader, the project leader, or the project director provide technical supervision of all data collection and processing activities. Individually identified forms are stored in a secure, vault-like room provided for this purpose. Authorized personnel have access to the room by one locked door with controlled entry, i.e., only on the written authority of the professional staff member in charge. Computerized records are kept in a vault area with limited accession.
</p> <p>3. Procedural Safeguards: Because some of the data collected in this study, such as data on drug use, are sensitive and confidential, special safeguards have been established. A Certificate of Confidentiality has been issued under 42 CFR part 2a. This authorization enables persons engaged in research on mental health, including research on the use and effect of psychoactive drugs, to protect the privacy of research subjects by withholding the names or other identifying characteristics from all persons not connected with the conduct of the research. Persons so authorized may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals. In addition, these records are subject to 42 CFR part 2, the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations (42 CFR 2.56), which state: "Where the content of patient records has been disclosed pursuant to (these regulations) for the purpose of conducting scientific research * * *. information contained therein which would directly or indirectly identify any patient may not be disclosed by the recipient thereof either voluntarily or in response to any legal process whether Federal or State."
</p><p>Another safeguard is that the forms containing subject identification information for client followup and data matching purposes do not include any reference to the purpose of the study.
</p> <p>Identification and location information is kept separate from any information that would suggest that the respondent has been in a drug treatment program.
</p> <p>Information on completed forms is entered immediately on the computer. Completed forms and computerized data are released only to authorized persons. Only aggregate data are provided and used in the preparation of necessary and appropriate reports.
</p> <p>A link file system is used. This system has three components: (1) Personal information, (2) data base information, and (3) the link file, which contains identifying number pairs which can be used to match data with individuals. The advantage of this system is that the data base can be used directly for report generation, etc., without the use of decrypting subroutines or access to the personal information or matching link files.
</p> <p>In addition, the computer center being utilized has developed an extensive security system to protect computer account codes and data. This system is described in a publication that is available from the System manager upon request.
</p> <p>We do not anticipate any disclosure of individually identifiable information to other persons or organizations within the Department of Health and Human Services. Nor does the contractor provide individually identification information to the Department of Justice, with which NIDA has a cooperative agreement for this study.
</p> <p>4. Implementation Guidelines: These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook. In addition, project staff complies with the contractor's (Research Triangle Institute) standard procedures for safeguarding data.
</p> <p>The contractor provides only aggregate information to NIDA.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The contractor destroys interview forms by shredding or burning immediately after contractor staff have completed and verified direct entry on magnetic tape or disk storage. The contractor will destroy individual identification and location data by shredding or burning, under the explicit written authorization of the System manager, which is anticipated to be no longer than five years after the termination of the study unless the information is needed for research purposes. We will retain aggregate data tapes for research purposes. These tapes will not have any individually identifiable information. In accordance with the NIH Records Control Schedule, these tapes will be retained for five years after completion of the project (approximately 2002). At that time, the tapes will be retired to the Federal Records Center and destroyed when they are ten years old or when they are no longer needed for research purposes.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Drug Abuse Treatment Outcome Study (DATOS), Project Officer, Services Research Branch, Division of Epidemiology, Services, and Prevention Research, National Institute on Drug Abuse (NIDA), Neuroscience Center, Room 4222, 6001 Executive Boulevard, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the address above. An individual may learn if a record exists about himself/herself upon written request, with notarized signature. The request should include, if known, name of the researcher, location of the research site, approximate date of data collection, any alias used, and subject identification number.
</p> <p>An individual who requests notification of a medical record shall, at the time the request in made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.
</p> <p>A parent or legal guardian who requests notification of an adolescent's record shall designate a family physician or other health professional (other than a family member) of the Division of Clinical Research staff to whom the record, if any, will be sent. The parent or legal guardian must verify in writing the relationship to the adolescent as well as his/her own identity.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p> <p>Persons other than subject individuals, who request individually identifiable data from a record must provide written consent from the subject individual permitting the requested disclosure. The only exception (if not in conflict with confidentiality regulations) would be for disclosure to persons or organizations permitted by the Privacy Act, section 3(b), to obtain personally identifiable data.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedures above and reasonably identify the record, specify the information being contested, the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Research subjects, and staff in participating drug abuse treatment programs, written clinical evaluations, counselors, psychiatrists, psychotherapists, family members, research assistants, hospitals.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0209" toc="yes">
<systemNumber>09-25-0209</systemNumber>
<subsection type="systemName">Subject-Participants in Drug Abuse Research Studies on Drug Dependence and in Research Supporting Investigational New Drug and New Drug Applications, HHS/NIH/NIDA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Veterans Administration Hospital, Cooperative Studies Program, Department of Veterans Medical Center, Perry Point, MD 21902.
</p> <p>Division of Treatment Research and Development, National Institute on Drug Abuse (NIDA), Neuroscience Center, Room 4123, 6001 Executive Boulevard, Bethesda, MD 20892.
</p> <p>Division of Intramural Research Programs, National Institute on Drug Abuse (NIDA), 4940 Eastern Avenue, Baltimore, MD 21224.
</p> <p>Write to the System Manager at the address below for the address of any new locations where records from this system may be stored.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Voluntary clients of Federally funded and other drug abuse treatment programs who have requested to receive investigational new or marketed drugs, such as but not limited to, naltrexone, levo-alpha acetylmethadol (LAAM), buprenorphine, disulfiram, selegiline, bupropion, and GBR-12909 as part of their treatment. Data collection will continue through calendar year 2010.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Demographic data, treatment outcome data, treatment process data, client locator information, and personal identifiers (name and assigned numerical identifier).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Public Health Service Act, Sections 301, 464p, and 405 (42 U.S.C. 241, and 284).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>1. To maintain information on the safety and effectiveness of drugs for treatment of drug dependence with or without abuse potential in various treatment environments and modalities and changes in the behavior and characteristics of drug abusers who received these substances as part of their treatment regimen.
</p> <p>2. To provide data required by the Food and Drug Administration (FDA) to support research on drug dependence, Investigational New Drug Applications (INDs) and potential New Drug Applications (NDAs) for various drugs, and to treat drug dependence with or without abuse potential. A new drug application is a notice to FDA that a pharmaceutical company believes they have enough data to demonstrate the safety and efficacy of a substance to satisfy FDA for marketing the substance. FDA may also use the records in routine inspections that FDA conducts in accordance with its responsibilities to develop standards on the composition, quality, safety and efficacy of drugs administered to humans, and to monitor experimental usage of drugs.
</p> <p>3. To conduct research on the pharmacology, toxicology, and behavioral characteristics of drugs of abuse alone or in combination with proposed treatment drugs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>NIH contractor(s) and/or interagency collaborators (i.e. Department of Veteran's Affairs) use the records in the system to accomplish the research and development purposes for which the records were collected. In the event of a followup study or continuation study, the responsible project officer may disclose records in this system to a subsequent NIH contractor(s). Any new contractor(s) is and would be required to maintain Privacy Act safeguards with respect to such records and to comply with the confidentiality restrictions of 42 CFR part 2.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Interview and assessment forms, video tapes, magnetic tapes, disks and microfiche in boxes in closed cabinets in a locked room with limited accessibility.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The records are indexed and retrieved by subject-participant's name code (i.e., initials--not name) and unique numerical identifier. In order to relate the data collected to specific individuals, however, one must use the link file discussed under safeguards.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: For all of the studies, the System Manager or Federal Project Officer and only authorized contract staff have access to the records (computerized and hard copy files) in the system. The contractor provides only aggregate data in reports to NIDA, FDA, or the public. Only the NIDA personnel mentioned previously and selected authorized contract staff, have access to the stored records. A certificate of confidentiality is issued to researchers conducting these studies under 42 CFR, part 2, Protection of Identity--Research Subjects. This authorization enables persons engaged in research on mental health, including research on the use and effect of psychoactive drugs, to protect the privacy of research subjects by withholding the names or other identifying characteristics from all persons not connected with the conduct of the research. Persons so authorized may not be compelled in any Federal, State or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals. These regulations do not prohibit voluntary disclosure by the researcher. However, the records of these studies also are subject to 42 CFR part 2, the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations (42 CFR part 56), which state: Where the content of patient records has been disclosed. Pursuant to (these regulations) for the purpose of conducting scientific research * * * information contained therein which would directly or indirectly identify any patient may not be disclosed by the recipient thereof either voluntarily of in response to any legal process whether Federal or State." The contractor's institutional review board reviewed and approved the safeguards described above in accordance with 45 CFR part 46 on the Protection of Human Subjects.
</p> <p>2. Physical Safeguards: For the study records, the contractor(s) stored individually identified forms in a locked room with controlled entry, i.e., only on written authority of the professional staff member in charge of data handling and processing). The contractor staff enters the collected information onto computer systems or disks as soon after contact with the subject-participant as possible, and stores the computerized records in a secured area with access limited as above.
</p> <p>For the study records, NIDA stores any individually identified forms in a lockable cabinet in a secure room. Only authorized NIDA personnel (i.e., select members of the Division of Treatment Research and Development professional staff and their support staff have access to the room with controlled entry. The room is in a building which has a 24-hour guard/television surveillance system and has controlled entry (picture identification sign in and out procedures) before and after normal working hours.
</p> <p>Another safeguard for these studies is that the forms containing subject identification information do not include any reference to the purpose of the study. The identification information is separate from any information that would suggest that the respondent is or has been in a drug abuse treatment program. In addition, the computer centers being utilized for data analyses have developed an extensive security system to protect computer account codes and data.
</p> <p>3. Procedural Safeguards: Access to the computerized records of the studies is protected by a computerized password routine which is changed
</p><p>periodically. In addition, the project staff complies with the contractor's standard procedures for safeguarding data. The link file system that identifies individuals with personal data has three components: (1) Identification information, (2) data base information, and (3) the link file, which contains identifying number pairs which match data with individuals. The advantage of this system is that one may use the baseline data directly for report generation, etc., without using the subroutines or accessing the personal information or link files.
</p> <p>4. Implementation Guidelines: These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, sbull I11"Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>NIDA will destroy identifiable information by shredding or burning when it is no longer needed for analysis or research purposes; then the tapes, and/or other electronic media, will be erased. NIDA will destroy individual identification and match-up information from other studies by shredding or burning five years after FDA completes the review and approves the new drug applications or when they are no longer needed for research purposes.
</p> <p>NIDA will retain the aggregate data tapes, and/or other electronic media, and/or paper records from studies for research purposes. These tapes will not have any individually identifiable information. In accordance with the FDA regulations governing new drug applications, the aggregate tapes will be retained for at least two years after FDA approves the new drug applications or the IND is withdrawn. At that time, the tapes will be retired to the Federal Records Center and destroyed when they are five years old or when they are no longer needed for research purposes.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, Regulatory Affairs Branch, Division of Treatment Research and Development, National Institute on Drug Abuse (NIDA), Neuroscience Center, Room 4123, 6001 Executive Boulevard, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual may determine if a record exists about himself/herself upon written request, with notarized signature if request is made by mail, or with suitable identification if request is made in person, to the appropriate system manager at the address above. The following information should be included, if known: subject-participant's full name and a letter of request with notarized signature of the subject- participant of the record, any alias used, subject-participant's identification number, name of the researcher, name of clinic or research center, name of substance, and approximate date of study participation.
</p> <p>An individual who requests notification of a medical record must, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedures above and reasonably identify the record, specify the information being contested, the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Research subject-participants, staff in the participating drug abuse treatment programs, written clinical evaluations, private physicians, counselors, psychiatrists, psychotherapists, family members, research assistants, and hospital records.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0210" toc="yes">
<systemNumber>09-25-0210</systemNumber>
<subsection type="systemName">Shipment Records of Drugs of Abuse to Authorized Researchers, HHS/NIH/NIDA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Chemistry and Physiological Systems Research Branch (CPSRB), Division of Neuroscience and Behavioral Research, National Institute on Drug Abuse (NIDA), Neuroscience Center, Room 4282, 6001 Executive Boulevard, Bethesda, MD 20892-9555.
</p> <p>Research Triangle Institute, Research Triangle Park, NC 27709.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individual researchers and organizations who are registered with the Drug Enforcement Administration (DEA), Department of Justice (DOJ), some since 1966, and who have voluntarily submitted documentation to the National Institute on Drug Abuse (NIDA) in order to obtain, through the NIDA Drug Supply Program (DSP), drugs of abuse for use in a research project.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>While the records in this system are research project-related, they support the eligibility of individual researchers to receive drugs of abuse. Types of information contained in the records are: researcher's name, curricula vitae, research protocol, DEA and (if applicable) Nuclear Regulatory Commission registration numbers (when a radio labeled compound is requested and shipped), business address (location of research project) and telephone number, summary of research project(s), requests for substance(s), name and amount of each compound requested and shipped, dates material is shipped and received, shipment numbers, and order form numbers.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Public Health Service Act, sections 301, and 405 (42 U.S.C. 241 and 284); Controlled Substances Act of 1970 (21 U.S.C. 801 et seq.); Atomic Energy Act of 1954, as amended, section 81 (42 U.S.C 2111); and Energy Reorganization Act of 1974, section 201 (42 U.S.C. 5841).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To facilitate operation of DSP which is a centralized research support service through which the United States Government supplies to the national and international scientific community for research purposes, most Schedule I and many Schedule II-V controlled and noncontrolled substances as specified in the Controlled Substances Act (CSA) of 1970 (21 U.S.C. 801 et seq.). Controlled substances are chemicals and other substances, and their immediate precursors, that the Attorney General has determined to have such potential for abuse as to warrant regulation under the CSA. Some of these substances are radio labeled materials. Radio labeled materials are substances to which a small amount of radioactivity is added for use in various studies, such as drug metabolism and mechanisms of drug actions.
</p> <p>This system of records was established to facilitate DSP by enabling NIDA:
</p><p>1. To verify that requests for drugs of abuse, some of which are radio labeled, are from authorized individuals/organizations for use in a research project;
</p><p>2. To verify that the amounts of the materials requested by researchers for animal, in vivo, and in vitro research are justified and available;
</p><p>3. To supply controlled substances in amounts approved by the Food and Drug Administration (FDA) to researchers conducting research with human subjects;
</p><p>4. To ship these materials securely in accordance with CSA and the Atomic Energy Act; and
</p><p>5. To maintain records of these transactions.
</p> <p>FDA also may use the records in routine inspections in accordance with FDA's responsibilities to develop standards on the composition, safety, and efficacy of drugs administered to humans, and to monitor experimental usage of drugs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. We may disclose the record of an individual to a congressional office in response to a verified inquiry from the congressional office made at the written request of the individual.
</p> <p>2. We may disclose information to DEA, DOJ, to enable DEA to carry out its responsibilities as described in the Controlled Substances Act of 1970.
</p> <p>3. An NIH contractor routinely uses the records in this system to ship controlled substances to authorized recipients. Such contractor is required to maintain Privacy Act safeguards with respect to these records.
</p> <p>4. An NIH contractor may have access to the records in this system in the performance of its software modification/correction tasks specified in its contract. Such contractor is required to maintain Privacy Act safeguards with respect to these records.
</p> <p>5. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>NIDA maintains "hard copy" records in file folders and automated records on computer disk.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Authorized NIDA and contractor personnel index and retrieve the computerized records by a researcher code number assigned by a computer program at the time a new record is established. Authorized NIDA personnel index and retrieve "hard copy" records by researcher's name. NIDA maintains a computerized, alphabetical cross-reference list that matches names and numbers.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: The Chief, CPSR Branch and his or her support staff, program assistant and clerk-typist, and the contracts' project directors and their support staffs have access to the records.
</p> <p>2. Physical Safeguards: The "hard copy" records and main computer are physically located at the Neuroscience Center, Bethesda, Maryland. The computerized records are kept in a room with limited admittance. The room is locked after working hours. The "hard copy" records are stored in locked file cabinets in a room with very limited admittance. This room is also locked after working hours. The Neuroscience Center has a 24-hour guard patrol service.
</p> <p>3. Procedural Safeguards: The terminals are housed in a secured work area with limited admittance. Contract personnel use a password identification system to obtain access; NIDA changes the passwords periodically.
</p> <p>4. Implementation Guidelines: These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>NIDA maintains an individual's record for five years after the researcher's last request for, or shipment of, a drug of abuse. We consider the record inactive after that, and erase it from the computer disk by a delete routine. The delete routine automatically deletes the computerized cross-reference as well. We destroy the "hard copy" record by shredding. The system is checked once a year for inactive records.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Program Director, Drug Supply Program, Chemistry and Physiological Systems Research Branch, Division of Neuroscience and Behavioral Research, National Institute on Drug Abuse (NIDA), Neuroscience Center, Room 4282, 6001 Executive Boulevard, Bethesda, MD 20892-9555.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the address above. An individual may learn if a record exists about himself or herself upon written request. The request should include the researcher's name and business address at the time of last shipment. The request must be signed in ink by the individual researcher. Verifiable proof of identity is required.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedures above and reasonably identify the record, specify the information being contested, the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Initial source is the individual researcher. Some of the DEA registration information provided by a researcher is verified through a DEA computer check. FDA provides information concerning type and amount of controlled substance(s) to be shipped to an individual researcher for research projects involving human subjects.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0211" toc="yes">
<systemNumber>09-25-0211</systemNumber>
<subsection type="systemName">Intramural Research Program Records of In- and Out-Patients with Various Types of Alcohol Abuse and Dependence, Relatives of Patients with Alcoholism, and Healthy Volunteers, HHS/NIH/NIAAA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>A list of specific project sites is available from the System Manager.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>In- and out-patients with alcohol abuse and dependence, alcohol-induced organic brain syndromes; their relatives; and healthy volunteers.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Research data of wide variety including biochemical measures, psychophysiological and psychological tests, questionnaires, clinical and behavioral observations and interviews, physical examinations, and correspondence.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Public Health Service Act, as amended, sections 301 (42 U.S.C. 241) and 510 (42 U.S.C. 290bb). These sections authorize the conduct of general health research and research into alcoholism and alcohol abuse.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>These records are used for diagnosis and treatment of patients with alcohol abuse and dependence and related conditions; behavioral research relating to the causes, diagnoses, and treatment of addictions; and basic research on behavioral and biological processes.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Records in this system are covered by section 527 of the Public Health Service Act (42 U.S.C. 290ee-3) and 42 CFR, chapter I, subchapter A, part 2, on confidentiality of alcohol and drug abuse patient records. In accordance with these regulations, the records are confidential and may only be disclosed with the written consent of the patient with specific restrictions, and without the patient's consent in the following instances: (1) To medical personnel to the extent necessary to meet a bona fide emergency; (2) to qualified personnel for the purpose of conducting scientific research; or (3) if authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefore, after certain considerations, and with appropriate safeguards. Routine uses of information in this system are limited to the following:
</p><p>1. A record may be disclosed for a research purpose, when the Department: (a) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (b) Has determined that the research purpose: (1) Cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (c) has required the recipient to--(1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, and (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except--(A) in emergency circumstances affecting the health or safety of any individual, (B) for use in another research project, under these same conditions, and with written authorization of the Department, (C) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (D) when required by law; (d) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office at the written request of that individual, in accordance with 42 CFR, chapter I, subchapter A, part 2. Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records may be stored in file folders, on index cards, computer tapes and disks, microfiche, microfilm and audio and video tapes. Normally the factual data, with study code numbers, are stored on computer tape or disk, while the key to personal identifiers is stored separately, without factual data, in paper files.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>During data collection stages and followup, retrieval by personal identifier (e.g., name or medical record number) is necessary. During the data analysis stage, data are normally retrieved by variables of interest, e.g., age, diagnosis, etc.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for the particular records maintained in each project. Depending on the sensitivity of the project, additional safeguards may be added.
</p> <p>1. Authorized Users: Only NIAAA medical and research staff have access to these records, as authorized by the system manager.
</p> <p>2. Physical Safeguards: Records are stored in locked rooms, locked file cabinets, and/or secured computer facilities. Personal identifiers and link codes are separated as much as possible and stored in locked files.
</p> <p>3. Procedural Safeguards: Collection and maintenance of data are consistent with legislation and regulations for protection of human subjects, informed consent, confidentiality, and confidentiality specific to drug and alcohol abuse patients. Computer data access is limited through the use of key words, a series of account numbers, and passwords which are changed frequently and known only to authorized personnel.
</p> <p>4. Implementation Guidelines: These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are held for five years after completion of the project, retired to a Federal Records Center, and subsequently disposed of after ten years.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Clinical Director, Laboratory of Clinical Studies, Division of Intramural Clinical and Biological Research, National Institute on Drug Abuse (NIDA), Building 10, Room 3B-19, 10 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the address above. Provide notarized signature as proof of identity. The request should include as much of the following information as possible: (a) Full name; (b) nature of illness (if any); (c) title of study; (d) name of researcher conducting study. An individual who requests notification of or access to a medical/dental record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.
</p> <p>A parent or guardian who requests notification of child's/incompetent  person's record shall at the time the request is made designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The designee will receive the record in all cases and upon review will determine whether the record should be made available to the parent or guardian.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosures of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedures above and reasonably identify the record, specify the information being contested, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information gathered from individuals under study, either patient or normal subject, contract surveys, hospital records, medical and nursing staff notes, and from Privacy Act system of records 09-25-0099, "Clinical Research: Patient Medical Records, HHS/NIH/CC."
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0213" toc="yes">
<systemNumber>09-25-0213</systemNumber>
<subsection type="systemName">Administration: Employee Conduct Investigative Records, HHS/NIH/OD/OM/OA/OMA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Management Assessment, Office of Administration, Office of Management, Office of the Director (OD), 6011 Executive Boulevard, Room 601, Bethesda, MD 20892-7669.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who are alleged or suspected to have violated NIH or Departmental regulations or Federal statutes and are: personnel employed by the Federal Government who are under a career, career conditional, or other type of appointment; personnel working under Intergovernmental Personnel Act assignments; Guest Researchers; Volunteers; Individuals on Temporary Appointments (including student appointments); Fogarty International Center Scholars; Staff Fellows; Intramural Research Training Award Fellows; IC Fellowship Award Recipients; Visiting Associates, Scientists, and Fellows; Commissioned Corps; individuals who receive funding through or have responsibility for NIH sponsored grants, contracts, or cooperative agreements and other individuals who transact or seek to transact business with NIH or HHS or use the facilities of those agencies.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system includes records relating to correspondence concerning an individual's employment status or conduct while employed by or working at NIH. Examples of these records include: Correspondence from employees, members of Congress and members of the public alleging misconduct by an official of NIH. It also contains reports of investigations to resolve allegations of misconduct or violations of statutes, with related exhibits of statements, affidavits or records obtained during the investigation; reports of action taken by management; decisions on any misconduct substantiated by the investigation; and reports of legal action resulting from violations of statutes referred for prosecution.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301, 302; 42 U.S.C. 203, 282; 44 U.S.C. 3101; E.O. 10450
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To document reviews and investigations undertaken by the Office of Management Assessment, NIH to provide management or the Office of Inspector General, Office of the Secretary, HHS with information needed to take action to resolve complaints of misconduct or alleged violations of statutes, regulations, policies, or the terms and conditions of funding.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained, if the disclosure does not compromise the investigative activities of the Office of Management Assessment.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity where the Department of Justice has agreed to represent the employee; or (c) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records by the Department of Justice is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
</p> <p>3. Disclosure may be made to a court or adjudicative body in a proceeding when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity; or (c) any employee of the agency in his or her individual capacity where the agency has agreed to represent the employee; or (d) the United states Government, is a party to the proceeding or has an interest in such proceeding, and by careful review, the agency determines that the records are both relevant and necessary to the proceeding and the use of such records is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
</p> <p>4. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate agency, whether Federal, foreign, State, local, or tribal, or other public authority responsible for enforcing, investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to any enforcement, regulatory, investigative or prosecutorial responsibility of the receiving entity.
</p> <p>5. Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority of any portion of this system of records that contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.
</p> <p>6. Disclosure may be made to Federal, State, local or foreign agency maintaining, civil, criminal, or other relevant enforcement records, or other pertinent records, or to another public authority or professional organization, if necessary to obtain information relevant to an investigation concerning the retention of an employee or other personnel action, the issuance or retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.
</p> <p>7. Where Federal agencies having the power to subpoena other Federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department is authorized to make such records available.
</p> <p>8. Disclosure may be made to agency contractors, experts, or consultants who have been engaged by the agency to assist in the performance of a service related to this system of records and who need to have access to the records in order to perform the activity. Recipients shall be required to comply with the requirements of the Privacy Act of 1974, as amended, pursuant to 5 U.S.C. 552a(m).
</p> <p>9. Disclosure may be made in the course of employee discipline or competence determination proceedings.
</p> <p>10. Disclosure may be made to representatives of an awardee of an NIH grant, contract, or cooperative agreement that is the subject of an investigation by Office of Management Assessment, NIH.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored on paper forms in file folders, file cards, magnetic tapes, magnetic disks, optical disks and/or other types of data storage devices.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by a unique classification number; name of the victim, accused, or complainant, date of birth, social security number; and by the nature of the incident and/or time of occurrence.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Data on computer files is accessed by keyword known only to authorized users who are Office of Management Assessment employees or contractor staff who have a need for the data in the performance of their duties as determined by the system manager.
</p> <p>2. Physical Safeguards: Access to the restricted office area containing the rooms where records are stored is controlled through the use of door locks. Only authorized users have the keys to these locks. During regular business hours, rooms in this restricted area are unlocked but entry is controlled by on-site personnel. Rooms where records are stored are locked when not in use. Individually identifiable records are kept in locked file cabinets or in locked rooms under the direct control of the system manager or his/her delegated representatives.
</p> <p>3. Procedural and Technical Safeguards: Computer records are accessible only through a series of code or keyword commands available from and under direct control of the system manager or his/her delegated representatives. These records are secured by a multiple-level security system which is capable of controlling access to the individual data field level. Persons having access to the computer database can be restricted to a confined application which permits only a narrow "view" of the data. All authorized users of personal information in connection with the performance of their jobs (see Authorized Users, above) protect information from public view and from unauthorized personnel entering an unsupervised area/office. These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, supplementary Chapter PHS hf: 45-13, the Department's Automated Information Systems Security Program Handbook, and the National Institute of Standards and Technology Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31).
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361): item 1700-A-4, which allows records to be kept permanently when involving extensive litigation; five years for minor infractions or improprieties when final recommendation is that no action be taken, or 20 years for all other. Refer to the NIH Manual Chapter for specific retention and disposition instructions.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Office of Management Assessment, Office of Administration, Office of Management, Office of the Director (OD), 6011 Executive Boulevard, Room 601, MSC 7669, Bethesda, Maryland 20892-7669.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>This system is exempt from the notification requirements. However, consideration will be given to requests addressed to the system manager listed above. The requestor must verify his or her identity by providing either a notarization of the request or a written certification that the requestor is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine. The request should include: (a) Full name, (b) address, and, (c) year of records in question.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>This system is exempt from the access requirements. However, consideration will be given to requests addressed to the System Manager listed above. The requestor must verify his or her identity by providing either a notarization of the request or a written certification that the requestor is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine. The request should include: (a) full name, (b) address, and, (c) year of records in question. Requesters should also reasonably specify the record contents being sought. Although the system is exempt, individuals may, upon request, receive records from this system and an accounting of disclosure of their records, if the system manager determines that disclosure would not compromise the investigative activities of the Office of Management Assessment, NIH.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Exempt. However, consideration will be given requests addressed to the System Manager. Requests for corrections should reasonably identify the record and specify the information being contested, and state the corrective action sought with supporting information. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Departmental and other Federal, State, and local government records; subjects of investigations, complaints, witnesses; documents and other material furnished by non-government sources; and personal observations by the investigator.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>This system has been exempted pursuant to 5 U.S.C. 552a(k)(2) of the Privacy Act from the access, notification, correction, and amendment provisions of the Privacy Act (5 U.S.C. 552a(c)(3), (d)(1)-(4), (e)(1), (e)(4)(G) and (H) and (f)), because it consists of investigatory material compiled for law enforcement purposes. Individual access to these files could impair investigations and alert subjects of investigations that their activities are being scrutinized, thereby allowing them time to take measures to prevent detection of illegal action or to escape prosecution. Disclosure of investigative techniques/procedures and the existence and identity of confidential sources of information could jeopardize investigative activities. However, any individual who has been denied any right, privilege, or benefit for which he/she would otherwise be entitled or be eligible, as a result of the maintenance of such material, will be given access to the material, except to the extent that the disclosure of the material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of such source would be held in confidence. The system is also exempted from (k)(5) of the Privacy Act in order to allow the agency to exempt from individual access, investigatory materials compiled for the purpose of determining suitability, eligibility, or qualification for federal employment or financial assistance if release of the material would disclose the identity of a confidential source who furnished information to the Government under an express promise that the identity of the source would be held in confidence.
</p></xhtmlContent></subsection></section>
<section id="09-25-0216" toc="yes">
<systemNumber>09-25-0216</systemNumber>
<subsection type="systemName">Administration: NIH Electronic Directory, HHS/NIH.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Records are maintained in databases located within the NIH computer facilities and the files of NIH functional offices required to identify individuals in order to manage the federal resources and authorities assigned to them. A current list of sites, including the address of any Federal Records Center where records from this system may be stored, is available by writing the system manager listed under Notification Procedure below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Users of NIH resources and services including but not limited to: current and past NIH employees, contractors, tenants of NIH facilities, participants in the NIH visiting programs, registered users of NIH computer facilities, grantees, reviewers, council members, collaborators, vendors, and parking permit holders. This system does not cover patients and visitors to the NIH Clinical Center.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system is a source system that provides identification data to a variety of directory services at NIH that share comparable information and assign or relate dedicated federal resources to individuals. This system provides for a central directory that allows NIH to manage NIH corporate business processes and electronic commerce. The types of personal information in this directory are necessary to ensure the accurate identification of individuals doing business in or with the National Institutes of Health. The types of personal information included in this directory are: Name, alias names, date of birth, place of birth, social security number, gender, home address, home phone number, home FAX number, personal pager number, personal mobile phone number, personal email address, emergency contacts, photograph, digitized written signature, digitized biometrics, and NIH-assigned unique identifier. Public data refers to non-sensitive information readily available to the general public (e.g., name, building, room number, and work phone). Non-public data refers to sensitive/confidential information or data for which access is limited to appropriate staff with a valid need-to-know in the performance of their official job duties, or as outlined in the routine uses for disclosure (e.g., social security number, gender, home address, date of birth, place of birth).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301 and 302, 44 U.S.C. 3101 and 3102, Executive Order 9397.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purpose is to establish a consolidated and centrally coordinated electronic directory to support e-government of administrative business processes; allow effective controls over the creation, maintenance and use of records in the conduct of current business; provide for effective management of costs, operation and interconnectivity of NIH information systems; provide the required structure for network security; and provide an accurate source of directory information at the NIH. Data collected is used to build an NIH centralized source identification directory and provides for directory security system authentication and authorization and supports NIH corporate business processes and electronic commerce. This system of records enables NIH to reliably identify individuals and those federal resources assigned to them. A NIH unique identifier (UID) will be assigned to each individual to permit identification of a single person with their descriptive information and resources throughout their career.
</p> <p>This system allows for the creation of accurate records for individuals in the NIH directory and ensures that duplicate data files are compared, corrected and combined for accuracy, thus eliminating redundancy. It is the central point of coordination for other automated systems that manage or track resources, particularly information security systems.
</p> <p>INTERNAL USE AND ACCESS TO PERSONAL INFORMATION
</p><p>Internal use and access to the personal information in this system will be limited to those with a valid need-to-know in the performance of their official duties. Typical internal uses of the system, including categories of users, uses of the data collected and the need for such use are as follows:
</p><p>1. Trans-NIH Human Resource Personnel, Administrative Officers, and administrative technicians, will access all public and non-public records for employees and/or NIH affiliates within their scope of responsibility to access/track staffing information such as personal/work contact information, physical location, and/or any other information to facilitate current NIH administrative business processes.
</p> <p>2. Information Resources Management staff and Space and Facility Management personnel will have access to view public data (building location and work phone information) to coordinate access for, and the allocation of, telecommunication resources and building space/access.
</p> <p>3. Supervisors, Administrative Officers and Administrative Technicians will have access to emergency contact information to enable them to contact someone in the event of an emergency.
</p> <p>4. NIH central services staff, NIH police, and NIH management will access both public and non-public data to coordinate/track employee data required for other NIH business processes such as card key access, ID badges, parking permits, library resources, census information gathered for reporting requirements, employee development, training, campus security, and other administrative processes.
</p> <p>5. NIH Security Officers, or other incident response personnel will have access to public/non-public data where NIH deems it necessary for official investigations or security incidents involving suspected intrusion, illegal activity, or unauthorized/unethical misuse of the system of records or data therein.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the records of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. Disclosure may be made to representatives of the General Services Administration or the National Archives and Records Administration who are conducting records management inspections under the authority of 44 U.S.C. 2904 and 2906.
</p> <p>3. Disclosure may be made to agency contractors, experts, consultants, or volunteers who have been engaged by the agency to assist in the performance of a service related to this system of records and who need to have access to the records in order to perform the activity. Recipients are required to maintain Privacy Act safeguards with respect to these records.
</p> <p>4. Disclosure may be made to respond to a Federal agency's request made in connection with the hiring or retention of an employee, the letting of a contract or issuance of a security clearance, grant, license, or other benefit by the requesting agency, but only to the extent that the information disclosed is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>5. Disclosure may be made to the Department of Justice, or to a court or other adjudicative body, from this system of records when (a) HHS, or any component thereof; or (b) any HHS officer or employee in his or her official capacity; or (c) any HHS officer or employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the officer or employee; or (d) the United States or any agency thereof where HHS determines that the proceeding is likely to affect HHS or any of its components, is a party to the proceeding or has any interest in the proceeding, and HHS determines that the records are relevant and necessary to the proceeding and would help in the effective representation of the governmental party.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained on electronic media such as computer tape and disk and/or hard-copy. Automated records are stored in controlled computer areas. Both manual and computerized records will be maintained in accordance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records", supplementary Chapter PHS hf: 45-13, and the Department's Automated Information System Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are indexed and retrieved by: name, unique identifier, alias names, and social security number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Non-public data on computer files is accessed by keyword known only to authorized users who are NIH employees or contractor staff who have a legitimate operational responsibility to access the data in the performance of their duties as determined by the System Manager. Staff are only granted access to those directories or fields for which they have operational responsibilities. User activity is recorded. Occurrences of non-routine user or operator activity are recorded. Public data is controlled by user-defined view via a web-based look-up table. View of public data is accessible and controlled via the NIH network.
</p> <p>2. Physical Safeguards: Physical access to the computer systems where records are stored is controlled through the use of door locks and alarms.
</p> <p>3. Procedural and Technical Safeguards: Access to the non-public data will be controlled through: password protection, user authentication, and system administration procedures for user access. User name and password authentication procedures are in place to protect non-public data from public view, and to prevent unauthorized personnel from accessing data. Logical access controls, based on job function, are in place to authorize and/or restrict the user activity and view of the data. Persons having access to data are restricted to a field-by-field confined user interface that permits a controlled, or narrow "view" of the data. Sensitive data transferred between NIH source databases is secured through encryption or similar manner. Digital certificates and automated user audit trail capabilities have been incorporated to ensure data integrity and to detect evidence of data tampering.
</p> <p>These practices are in compliance with standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records", supplementary Chapter PHS hf: 45-13, and the Department's Automated Information Systems Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records may be retired to a Federal Records Center and subsequently disposed of in accordance with the NIH Records Control Schedule. The Records Control Schedule and disposal standard for these records may be obtained by writing to the System Manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chiquita Bennett, Clinical Center (CC), Building 10, Room 1C280, 10 Center Drive, Bethesda, MD 20892.
</p> <p>Ann Ellis, Clinical Center (CC), Building 10, Room B1L410B, 10 Center Drive, Bethesda, MD 20892.
</p> <p>Edith Smith, Center for Information Technology (CIT), Fernwood Building, Room 2NW06F, Bethesda, MD 20892.
</p> <p>Maria Miller, Center for Information Technology (CIT), Fernwood Building, Room 2NW06E, Bethesda, MD 20892.
</p> <p>Nadel Griffith, Center for Scientific Review (CSR), Democracy Plaza I, Room 3028, 6701 Rockledge Drive, Bethesda, MD 20892.
</p> <p>Marilyn Cuzzolina, Center for Scientific Review (CSR), Democracy Plaza I, Room 3028, 6701 Rockledge Drive, Bethesda, MD 20892.
</p> <p>Sharon Nieberding, Office of Administrative Management and International Services, Fogarty International Center (FIC), Building 31, Room B2C08, 31 Center Drive, Bethesda, MD 20892-2220.
</p> <p>Allison Wise, Office of Administrative Operations, National Center for Complementary and Alternative Medicine (NCCAM), Building 31, Room 2B11, 31 Center Drive, Bethesda, MD 20892-2182.
</p> <p>Mike Tucker, National Cancer Institute (NCI), 6116 Executive Boulevard, Room 609, Bethesda, MD 20892.
</p> <p>Mike Floyd, National Cancer Institute (NCI), 6116 Executive Boulevard, Room 609, Bethesda, MD 20892.
</p> <p>Dorothy Keys, National Center for Research Resources (NCRR), Rockledge I, Room 6070, 6705 Rockledge Drive, Bethesda, MD 20892.
</p> <p>Matthew Burr, National Eye Institute (NEI), Building 31, Room 6A19, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Patricia Hylla, National Human Genome Research Institute (NHGRI), Building 49, Room 3A38, 49 Convent Drive, Bethesda, MD 20892.
</p> <p>Christina Roark, National Heart, Lung, and Blood Institute (NHLBI), Democracy Plaza I, Room 7021, 6701 Rockledge Drive, Bethesda, MD 20892 -7921.
</p> <p>Agnes Slamen, National Institute on Aging (NIA), Gerontology Research Center, Johns Hopkins Bayview Campus, 5600 Nathan Shock Drive, Room 1E14A, Baltimore, MD 21224.
</p> <p>Gwen Proctor, National Institute on Aging (NIA), Gerontology Research Center, Johns Hopkins Bayview Campus, 5600 Nathan Shock Drive, Room 1E14A, Baltimore, MD 21224.
</p> <p>Andrea Hobbs, National Institute of (NIAAA), Building 31, Room 1B40, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Lennita Lawson, National Institute of Allergy and Infectious Disease (NIAID), Building 31, Room 7A19, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Kai Lakeman, National Institute of Allergy and Infectious Disease (NIAID), Building 31, Room 7A19, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Andrea Ricche, National Institute of Arthritis and Musculoskeletal and Skin Diseases (NIAMS), Natcher Building, Room 5AS51, 45 Center Drive, Bethesda, MD 20892.
</p> <p>Ruby Akomeah, National Institute of Biomedical Imaging and Bioengineering (NIBIB), Building 31, Room 1B37, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Ivelisse Rodriguez, National Institute of Biomedical Imaging and Bioengineering (NIBIB), Building 31, Room 1B37, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Ruth Maraio, National Institute of Child Health and Human Development (NICHD), Rockledge I, Room 800, 6705 Rockledge Drive, Bethesda, MD 20892.
</p> <p>Donna Tolson, National Institute of Drug Abuse (NIDA), Neuroscience Center, Room 512, 6001 Executive Boulevard, Bethesda, MD 20892.
</p> <p>Anne Sumner, National Institute on Deafness and Other Communication Disorders (NIDCD), Building 31, Room 3C21, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Kathleen Maguire, National Institute of Dental and Craniofacial Research (NIDCR), Natcher Building, Room 4AN12, 45 Center Drive, Bethesda, MD 20892.
</p> <p>Anne Robertson, National Institute of Diabetes and Digestive and Kidney Diseases (NIDDK), Democracy Plaza II, Room 909, 6707 Democracy Boulevard, Bethesda, MD 20892.
</p> <p>Linda Mongelli, National Institute of Diabetes and Digestive and Kidney Diseases (NIDDK), Building 10, Room 9N208, 10 Center Drive, Bethesda, MD 20892.
</p> <p>Donna Byrd, National Institute of Environmental Health Sciences (NIEHS), PO Box 12233, Research Triangle Park, NC 27709.
</p> <p>Gail Grosman, National Institute of General Medical Sciences (NIGMS), Natcher Building, Room 3AN32, 45 Center Drive, Bethesda, MD 20892.
</p> <p>Crystal James, National Institute of General Medical Sciences (NIGMS), Natcher Building, Room 3AS25A, 45 Center Drive, Bethesda, MD 20892.
</p> <p>Pam Fitzgerald, National Institute of Mental Health (NIMH), Building 31, Room 2B34, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Vicki Dobbins, National Institute of Medical Health (NIMH), Building 31, Room 2B34, 31 Center Drive, Bethesda, MD 20892-9657.
</p> <p>Debbie Jarman, Privacy Act Coordinator, National Institute of Neurological Disorders (NINDS), Building 31, Room 8A33, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Ana Ferreira, National Institute of Nursing Research (NINR), Building 31, Room 5B19A, 31 Center Drive, Bethesda, MD 20892.
</p> <p>Patricia Williams, National Library of Medicine (NLM), Building 38, Room 2W05, 8600 Rockville Pike, Bethesda, MD 20894.
</p> <p>Sandy Freund, Office of the Director (OD), 6011 Executive Boulevard, Room 325, Bethesda, MD 20892.
</p> <p>Dinah Huffer, Office of Research Services (ORS), Building 31, Room 4B30, 31 Center Drive, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Write to the System Manager listed above. The requester must verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand- dollar fine. The request should include: (a) Full name, and (b) address, and (c) year of records in question.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Write to the System Manager specified above to attain access to records and provide the same information as is required under the Notification Procedures. Requester should also reasonably specify the record content being sought. Individuals may also request an accounting of disclosure of their records, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Address a petition for amendment to the System Manager. All requests must be in writing. The individual must identify himself/herself, specify the system of records from which the records are retrieved, the particular records to be corrected or amended, whether seeking an addition to or a deletion or substitution for the records, and the reason for requesting correction or amendment of the record.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>NIH employees, contractors, and other persons who are using or performing services on behalf of the NIH, and the NIH human resource databases (i.e., Human Resource Database (HRDB), Fellowship Payment System (FPS), J.E. Fogarty Database of Foreign Visiting Scientists (JEFIC), NIH Telecommunications Database (TELCOM), Parking and Identification Database (PAID), E-mail Directory and Forwarding Service (PH directory), and the Integrated Time.
</p></xhtmlContent></subsection> </section>
<section id="09-25-0217" toc="yes">
<systemNumber>09-25-0217</systemNumber>
<subsection type="systemName">NIH Business System(NBS), HHS/NIH.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>Records are maintained in databases located within the NIH computer facilities and in the files of the NIH functional offices that are required to identify individuals in order to manage the Federal resources and authorities assigned to them. A current list of sites is available by writing the System Manager listed under the Notification Procedure below.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>The proposed system of records covers all persons who receive a payment exclusive of salary or wages, from the NIH, and all persons owing money to the NIH. Persons receiving payments include, but are not limited to, travelers on official business, grantees, contractors, consultants, Fellows and recipients of loans and scholarships. Persons owing monies include, but are not limited to, persons who have been overpaid and who owe the NIH a refund the persons who have received from NIH goods or services for which there is a charge or fee (e.g., Freedom of Information Act requesters).
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Name, Social Security Number (SSN) or EIN/TID, address, email address, phone number, purpose of payment or request for payment, bank account and routing numbers, accounting classification and the amount paid or billed. Also, in the event of an overpayment and for outstanding charges, fees, loans, grants or scholarships, the amount of the indebtedness, the repayment status and the amount to be collected. In the event of an administrative wage garnishment, information about the debtor's employment status and disposable pay available for withholding will be maintained.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301 and 302, 44 U.S.C. 3101 and 3102, Executive Order 9397.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>These records are an integral part of the accounting system at the NIH. The records are used to keep track of all payments to individuals, exclusive of salaries and wages, based upon prior entry into the systems of the official commitment and obligation of government funds. When a person is to repay funds advanced as a loan or scholarship, etc., the records will be used to establish a receivable record and to track repayment status. In the event of an overpayment to a person, the record is used to establish a receivable record for recovery of the amount claimed. The records are also used internally to develop reports for the Internal Revenue Service (IRS) and applicable State and local taxing officials of taxable income.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Records will be routinely disclosed to the Treasury Department in order to effect payment.
</p> <p>2. Records may be disclosed to Members of Congress concerning a Federal financial assistance program in order for members to make informed opinions on programs and/or activities impacting on legislative decisions. Also, disclosure may be made to a Member of Congress or to a Congressional staff member in response to an inquiry from the Congressional office made at the written request of the individual.
</p> <p>3. Disclosure may be made to the Department of Justice for the purpose of obtaining its advice regarding whether particular records are required to be disclosed under the Freedom of Information Act.
</p> <p>4. A record from this system may be disclosed to a Federal, State or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract or the issuance of a license, grant or other benefit by the requesting agency, to the extent that the record is relevant and necessary to its decision on the matter.
</p> <p>5. Where Federal agencies having the power to subpoena other Federal agencies' records, such as the Internal Revenue Service (IRS) or the Civil Rights Commission, issue a subpoena to the NIH for records in this system of records, the NIH will make such records available, provided however, that in each case, the NIH determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>6. Where a contract between a component of HHS and a labor organization recognized under E.O. 11491 provides that the agency will disclose personal records relevant to the organization's mission, records in the system of records may be disclosed to such an organization.
</p> <p>7. A record may be disclosed to the Department of Justice, to a court, or other tribunal, or to another party before such tribunal, when: (1) HHS, or any component thereof; (2) any HHS employee in his or her official capacity; (3) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (4) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to the litigation or has an interest in the litigation, and HHS determines that the use of such records by the Department of Justice, the tribunal, or the other party is relevant and necessary to the litigation and would help in the effective representation of the government party, provided however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>8. A record about a loan applicant or potential contractor or grantee may be disclosed from the system of records to credit reporting agencies to obtain a credit report in order to assess and verify the person's ability to repay debts owed to the Federal Government.
</p> <p>9. When a person applies for a loan under a loan program as to which the OMB has made a determination under I.R.C. 6103(a)(3), a record about his or her application may be disclosed to the Treasury Department to find out whether he or she has a delinquent tax account, for the sole purpose of determining the person's creditworthiness.
</p> <p>10. A record from this system may be disclosed to the following entities in order to help collect a debt owed the United States:
</p><p>a. To another Federal agency so that agency can effect a salary offset;
</p><p>b. To the Treasury Department or another Federal agency in order to effect an administrative offset under common law or under 31 U.S.C 3716 (withholding from money payable to, or held on behalf of, the individual);
</p><p>c. To the Treasury Department to request the person's mailing address under I.R.C. 6103(m)(2) in order to help locate the person or to have a credit report prepared;
</p><p>d. To agents of HHS and to other third parties, including credit reporting agencies, to help locate the person or to obtain a credit report on him or her, in order to help collect or compromise a debt;
</p><p>e. To debt collection agents or contractors under 31 U.S.C. 3718 or under common law to help collect a past due amount or locate or recover a debtors' assets;
</p><p>f. To the Justice Department for litigation or for further administrative action; and
</p><p>g. To the public, as provided by 31 U.S.C. 3720E, in order to publish or otherwise publicly disseminate information regarding the identity of the person and the existence of a non-tax debt. Disclosure under parts (d) and (g) is limited to the individual's name, address, social security number, and other information necessary to identify the person. Disclosure under parts (a)-(c) and (e) is limited to those items; the amount, status, and history of the claim; and the agency or program under which the claim arose. An address obtained from the IRS may be disclosed to a credit reporting agency under part (d) only for the purpose of preparing a credit report on the individual.
</p> <p>11. A record from this system may be disclosed to another Federal agency that has asked HHS to effect an administrative offset under common law or under 31 U.S.C. 3716 to help collect a debt owed the United States. Disclosure is limited to name and address, Social Security number, and other information necessary to identify the individual; information about the money payable to or held for the individual; and other information concerning the administrative offset.
</p> <p>12. Disclosure with regard to claims or debts arising under or payable under the Social Security Act may be made from this system to "consumer reporting agencies" as defined in the Fair Credit Reporting Act (15 U.S.C. 1681a(f)) of the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a)(3)). The purpose of this disclosure is to aid in the collection of outstanding debts owed to the Federal Government. Disclosure is limited to the individual's name, address, Social Security number, and other information necessary to establish the individual's identity; the amount, status and history of the claim; and the agency or program under which the claim arose.
</p> <p>13. Information in this system of records is used to prepare W-2s and 1099 Forms to submit to the Internal Revenue Service and to applicable State and local governments. Items considered to be included as income to a person: certain travel related payments to employees, all payments made to persons not treated as employees (e.g., fees to consultants and experts), and amounts written-off as legally or administratively uncollectible, in whole or in part.
</p> <p>14. A record may be disclosed to banks enrolled in the Treasury Credit Card Network to collect a payment or debt when the person has given his or her credit card number for this purpose.
</p> <p>15. Records may be disclosed to a contractor (and/or to its subcontractor) who has been engaged to perform services on an automated data processing (ADP) system used in processing financial transactions. The contractor may have been engaged to develop, modify and test a new ADP system, including both software and hardware upgrades or enhancements to such a system; perform periodic or major maintenance on an existing ADP system; audit or otherwise evaluate the performance of such an ADP system; and/or operate such a system.
</p> <p>16. Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the NIH but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p> <p>17. A record from this system may be disclosed to any Federal agency or its agents in order to participate in a computer matching of a list of debtors against a list of Federal employees. Disclosure of records is limited to debtors' names, names of employers, taxpayers' identifying numbers, address (including addresses of employers), dates of birth, and other information necessary to establish the person's identity.
</p> <p>18. A record of a person responsible for a current claim may be disclosed to a commercial reporting agency in order to aid in the collection of claims, typically by providing an incentive to the person to repay the claim or a debt timely. Disclosure of records is limited to information about a person that is relevant and necessary to meet the principal purpose(s) for which it is intended to be used under the law.
</p> <p>19. A record from this system may be disclosed to the Treasury Department or to an agency operating a Debt Collection Center designated by the Treasury in order to effect a collection of past due amounts.
</p> <p>20. If HHS decides to sell a debt pursuant to 31 U.S.C. 3711(I), a record from the system may be disclosed to purchasers, potential purchasers, and contractors engaged to assist in the sale or to obtain information necessary for potential purchasers to formulate bids and information necessary for purchasers to pursue collection remedies.
</p> <p>21. If HHS decides to administratively garnish wages of a delinquent debtor under the wage garnishment provision in 31 U.S.C. 3720D, a record from the system may be disclosed to the debtor's employer. This disclosure will take the form of a wage garnishment order directing that the employer pay a portion of the employee/debtor's wages to the Federal Government. Disclosure of records is limited to the debtor's name, address, and social security number.
</p> <p>Disclosure to consumer reporting agencies:
</p><p>Disclosure pursuant to 5 U.S.C. 552a(b)(12): Disclosure may be made from this system to "consumer reporting agencies," as defined in 31 U.S.C. 3701(a)(3). The purpose of this disclosure is to aid in the collection of outstanding debts owed to the Federal Government, by providing an incentive for debtors to repay these debts by making them part of the debtor's credit records. Disclosure of records is limited to the individual's name, address, social security number, and other information necessary to establish the individual's identity; the amount, status and history of the claim; and the agency or program under which the claim arose. The disclosure will be made only after the procedural requirements of 31 U.S.C. 3711(e) have been followed.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file folders and on computer discs and tapes. Automated records are stored in controlled access areas. Hard copy documents and automated records will both be maintained in accordance with Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records", and the HHS Automated Information System Security Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, accounting classification, social security number, voucher number or other identifying numbers or characteristics.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>The NBS will conform to applicable law and policy governing the privacy and security of Federal automated information systems. These include but are not limited to the Privacy Act of 1974, Computer Security Act of 1987, Paperwork Reduction Act of 1995, Clinger-Cohen Act of 1996, and the Office of Management and Budget (OMB) Circular A-130, Appendix III, "Security of Federal Automated Information Resources."
</p><p>Paragraphs A-C of this section highlight some of the specific methods that NIH is using to ensure the security of this system and the information within it.
</p> <p>A. Authorized Users: Personnel having access to the system have been trained in the Privacy Act and systems security requirements. Employees and contractors who maintain records in the system are instructed not to release any data until the intended recipient agrees (as part of the user authentication process) to implement appropriate administrative, technical, procedural, and physical safeguards sufficient to protect the confidentiality of the data and to prevent unauthorized access to the data. To insure security of the data, each individual user's privilege level is managed via authentication and role-based authorizations that ensure minimum and necessary access. This prevents unauthorized users from accessing and modifying critical data.
</p> <p>B. Physical Safeguards: All server sites have implemented the following minimum requirements. Access to all servers is controlled, with access limited to only those support personnel with a demonstrated need for access. Servers are to be kept in a locked room accessible only by specified management and system support personnel. Each server requires a specific log-on process. All entrance doors are identified and marked. A log is kept of all personnel who were issued a security card, key and/or combination that grants access to the room housing the server, and all visitors are escorted while in this room. All servers are housed in an area where appropriate environmental security controls are implemented, which include measures implemented to mitigate damage to automated information system resources caused by fire, electricity, water and inadequate climate controls.
</p> <p>C. Procedural Safeguards: All automated systems must comply with Federal laws, guidance, and policies for information systems security as stated previously in this section. Each automated information system should ensure a level of security commensurate with the level of sensitivity of the data and the risk and magnitude of the harm that may result from the loss, misuse, disclosure, or modification of the information contained in the system.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1--"Keeping and Destroying Records."
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Eric Cole, NBS System Manager, 6707 Democracy Boulevard, Suite 1001, MSC 5470, Bethesda, MD 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager listed above. A written request must contain the name, address and social security number of the requestor and his or her signature that either is notarized to verify his or her identify or contain a written certification that the requestor is who he or she claims to be and understands that the knowing an willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requestors should also specify the record contents being sought. Individuals may also request an accounting of disclosures of their records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedure above, identify the record, and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>All persons who receive a payment other than salary or wages, from the NIH or owe money to the NIH; officials performing services on behalf of HHS; other Federal agencies; consumer reporting agencies/credit bureaus; travel vouchers submitted by individuals to the NIH; grant, contract or loan award documents; delinquent loan, grant or scholarship records; invoices of services rendered to the NIH; applications for a travel advance submitted to the NIH; NIH Human Resource Database (HRDB); NIH electronic Directory (NEDS); and employers of debtors subject to administrative wage garnishment.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-25-0223" toc="yes">
<systemNumber>09-25-0223</systemNumber>
<subsection type="systemName">NIH Records Related to Research Misconduct Proceedings, HHS/NIH.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Unclassified.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This system of records will be located in National Institutes of Health (NIH) facilities and/or in the facilities of contractors and/or other affiliates working on behalf of NIH. Specific location:
</p><p>Office of Intramural Research (OIR), National Institutes of Health (NIH), 9000 Rockville Pike, Bethesda, Maryland 20892.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system will contain records about individuals who are the subject of research misconduct allegations or proceedings, referred to as "respondents." The Public Health Service (PHS) Policies on Research Misconduct ("PHS Policies on Research Misconduct "), 42 CFR Part 93 ("Part 93"), define the term "respondent" to mean "the person against whom an allegation of research misconduct is directed or who is the subject of a research misconduct proceeding." 42 CFR 93.225. This definition has also been incorporated into the NIH Intramural Research Program Policies &amp; Procedures for Research Misconduct Proceedings ("NIH Policy"). Other individuals who may be involved in research misconduct allegations or proceedings (e.g., complainants, witnesses) are not record subjects for purposes of this system.
</p> <p>Consistent with the NIH's responsibilities under Part 93 and the NIH Policy, this system notice applies to alleged or actual research misconduct (fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results) involving research: (1) Carried out in NIH facilities by any person; (2) funded by the NIH Intramural Research Program (IRP) in any location; or (3) undertaken by an NIH employee or trainee as part of his or her official NIH duties or NIH training activities, regardless of location. A person who, at the time of the alleged or actual research misconduct, was employed by, was an agent of, or was affiliated by contract, agreement, or other arrangement with NIH, is subject to the NIH Policy and covered by this system if, for example, he or she is involved in: (1) NIH- or PHS-supported biomedical or behavioral research; (2) NIH- or PHS-supported biomedical or behavioral research training programs; (3) NIH- or PHS-supported activities that are related to biomedical or behavioral research or research training, such as the operation of tissue and data banks and the dissemination of research information; (4) plagiarism of research records produced in the course of NIH- or PHS- supported research, research training or activities related to that research or research training; or (5) an application or proposal for NIH or PHS support for biomedical or behavioral research, research training or activities related to that research or research training, such as the operation of tissue and data banks and the dissemination of research information (regardless of whether it is approved or funded).
</p> <p>The term "research misconduct" is defined to mean "fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results." "Fabrication" is defined to mean "making up data or results and recording or reporting them." "Falsification" is "manipulating research materials, equipment, or processes, or changing or omitting data or results such that the research is not accurately represented in the research record." "Plagiarism " is "the appropriation of another person's ideas, processes, results, or words without giving appropriate credit." Research misconduct does not include honest error or differences of opinion. 42 CFR 93.103.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>This system contains records related to research misconduct proceedings. The term "research misconduct proceeding" is defined in Part 93 and the NIH Policy to mean "any actions related to alleged research misconduct," including, but not limited to, allegation assessments, inquiries, investigations, oversight reviews by the Office of Research Integrity (ORI) of the U.S. Department of Health and Human Services (DHHS, HHS or Department), hearings, and administrative appeals.
</p> <p>The records include all information that NIH receives or generates in overseeing or conducting research misconduct proceedings, including the implementation of research misconduct findings, and all information that NIH submits to, or receives from, ORI or other institutions under Part 93. This information includes, but is not necessarily limited to information about respondents (this may include social security numbers), complainants, and witnesses; the nature of the allegations; the NIH or PHS funding involved, including grant numbers; the offices, Institutes, Centers, and officials responsible for conducting the actions that are part of the research misconduct proceeding; the documentation used in the assessment, inquiry, and investigation, including relevant research data and materials, applications, proposals and documentation related to review and award actions, reports, abstracts, manuscripts and publications by the respondent(s) and other relevant reports, abstracts, manuscripts and publications; correspondence; memoranda of telephone calls, summaries of interviews and transcripts or recordings of interviews; statistical, scientific, and forensic analyses; interim and final reports; and records of findings, administrative actions, and appeal proceedings, if any.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The legal authorities to operate and maintain this Privacy Act records system are Sections 301, 401, 402, and 405 of the Public Health Service Act (42 U.S.C. 241, 281, 282, and 284); 5 U.S.C. 301; 44 U.S.C. 3101; and 42 CFR part 93.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>NIH personnel and any contractors assisting them will use information from this system, on a need-to-know basis, for the following purposes:
</p><p>1. To enable NIH and its Institutes and Centers ("ICs") to protect the health and safety of the public, to promote the integrity of NIH- or PHS-supported research, and to conserve public funds;
</p><p>2. To enable NIH to discharge effectively its responsibilities in managing the NIH intramural research program and in the award and administration of research and training grants, cooperative agreements, and contracts;
</p><p>3. To ensure that research misconduct proceedings are carried out in accordance with the NIH Policy, 42 CFR Part 93, and other applicable Federal statutes and regulations;
</p><p>4. To enable NIH to inform other IC, NIH, ORI, PHS, and other HHS agency officials who have a need for the records in the performance of their duties, of the status and results of research misconduct proceedings; and
</p><p>5. To enable NIH to notify, consult with, and provide assistance to other Federal, State, local, or Tribal governmental agencies to permit them to take action to protect the health and safety of the public, to promote the integrity of NIH- and PHS-supported research, to conserve public funds, or to pursue potential violations of civil and criminal statutes.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A "routine use" is defined in 45 CRF 5b.1(j) to mean "the disclosure of a record outside the Department, without the consent of the subject individual, for a purpose which is compatible with the purpose for which the record was collected." The routine uses for which NIH will disclose information from this system of records are as follows:
</p><p>1. Disclosure may be made to any person able to obtain information or provide information or assistance in a research misconduct proceeding or related proceeding. Recipients of disclosures under this routine use may include: Experts asked to perform statistical, forensic or other analyses or otherwise to provide assistance; institutions with which the respondent(s) was previously or is currently affiliated; Federal, State, local, and Tribal governmental agencies; the respondent(s); the complainant(s); witnesses; and organizations or individuals acting on behalf of those institutions, agencies, and individuals; provided, however, in each case NIH determines whether limited disclosures, confidentiality statements, contractual commitments to comply with the requirements of the Privacy Act of 1974, or similar measures are needed to protect the privacy of respondent(s), complainant(s), witnesses, research subjects, or others who may be identified in the records to be disclosed.
</p> <p>2. Disclosure may be made to NIH/DHHS guest researchers, special government employees (SGEs), trainees, volunteers, former employees, contractors, and other persons engaged to perform a service in support of NIH/DHHS related to this system of records, if such persons need access to the records to perform their assigned task; provided, however, in each case NIH/DHHS determines whether limited disclosures, confidentiality statements, contractual commitments to comply with the requirements of the Privacy Act of 1974, or similar measures are needed to protect the privacy of respondent(s), complainant(s), witnesses, research subjects, or others who may be identified in the records to be disclosed; and NIH/DHHS determines that the disclosure is for a purpose compatible with the purpose for which the agency collected the records.
</p> <p>3. Disclosure may be made to other Federal, State, local, or Tribal governmental agencies and offices, if NIH has reason to believe that a research misconduct proceeding may involve that agency or office.
</p> <p>4. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, disclosure may be made to the appropriate governmental agency, whether Federal, State, local or Tribal, or other public authority responsible for enforcing, investigating or prosecuting such violation, if the information disclosed is relevant to the responsibilities of the agency or public authority.
</p> <p>5. Disclosure may be made to Institutional Review Boards, research-sponsoring institutions, and individual research subjects, regarding information obtained or developed through a research misconduct proceeding that, in NIH's judgment, may have implications for individuals' health or for their participation in a research study.
</p> <p>6. After NIH makes a finding of research misconduct and has informed ORI of the finding, disclosure may be made to responsible officials of NIH- or PHS-supported institutions or organizations, when in connection with a research misconduct proceeding concerning an individual previously or currently employed by, or affiliated with the institution or organization, or when NIH, ORI, or HHS makes a finding or takes an action potentially affecting the institution or organization or its NIH or PHS support for research, research training, or related activities.
</p> <p>7. A record from this system may be disclosed to a Federal, State, local, or Tribal governmental agency maintaining civil, criminal, or other relevant enforcement records, or other pertinent records, or to another public authority or professional organization, if necessary to obtain information relevant to an investigation concerning the employment, clearance, suitability, eligibility or retention of an employee or other personnel action, the retention of a security clearance, the letting of a contract, issuance of a benefit or qualification decision made by HHS or NIH. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No information will be released that would reveal a confidential source.
</p> <p>8. After NIH makes a finding of research misconduct and has informed ORI of the finding, disclosure may be made to research collaborators of the respondent, professional journals, other publications, news media, professional societies, other individuals and entities, and the public concerning research misconduct findings and the need to correct or retract research results or reports that have been affected by research misconduct, unless NIH determines that release of the specific information in the context of a particular case would constitute a clearly unwarranted invasion of personal privacy. No information will be released that would reveal a confidential source.
</p> <p>9. After NIH makes a finding of research misconduct and has informed ORI of the finding, disclosure may be made to a State or other professional licensing board, certifying body, or other similar entity authorized to conduct a review of the respondent, to aid the entity in meeting its responsibility to protect the health of the population in its jurisdiction or the integrity of the profession.
</p> <p>10. After NIH concludes a research misconduct proceeding without a finding of research misconduct or a settlement, disclosure may be made to the respondent, the complainant, witnesses, or other persons involved in or aware of the research misconduct proceeding; provided, however, in each case NIH determines whether limited disclosures, confidentiality statements, contractual commitments to comply with the requirements of the Privacy Act of 1974, or similar measures are needed to protect the privacy of respondent(s), complainant(s), witnesses, research subjects, or others who may be identified in the records to be disclosed.
</p> <p>11. Disclosure may be made to the Department of Justice (DOJ), a court, or other tribunal, when: (a) The agency or any component thereof; (b) any employee of the agency in his or her official capacity; (c) any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee; or (d) the United States Government, is a party to litigation or has an interest in such litigation and, by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records by the DOJ, a court, or other tribunal is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
</p> <p>12. A record may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, if the information disclosed is relevant and necessary for that assistance.
</p> <p>13. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made pursuant to the written request of the individual and if disclosure does not compromise the law enforcement activities of the Office of Research Integrity or other government agency.
</p> <p>14. NIH may disclose information to the National Archives and Records Administration (NARA), General Services Administration (GSA), or other Federal government agencies pursuant to records management inspections conducted under the authority of 44 U.S.C. 2904 and 2906.
</p> <p>15. Records may become accessible to U.S. Department of Homeland Security (DHS) cyber security personnel, if captured in an intrusion detection system used by HHS and DHS pursuant to the Einstein 2 program. Under Einstein 2, DHS uses intrusion detection systems to monitor Internet traffic to and from federal computer networks to prevent malicious computer code from reaching the networks. According to DHS' Privacy Impact Assessment for Einstein 2 (available on the DHS Cybersecurity privacy Web site, <i> http://www.dhs.gov/files/publications/editorial_0514.shtm#4</i>), only personally identifiable information (PII) that is directly related to a malicious code security incident is captured by and accessible to DHS, and DHS does not access PII unless the PII is part of the malicious code.
</p> <p>NIH may also disclose information from this system as authorized directly in the Privacy Act at 5 U.S.C. 552a(b).</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records will be stored in various electronic media and paper form, and maintained under secure conditions in limited access areas or with controlled access. Only authorized users whose official duties require the use of this information will have regular access to the records in this system.
</p> <p>In accordance with established NIH, HHS and other Federal security policies and controls, records may also be located, maintained and accessed from secure servers whenever feasible or located on portable/mobile devices including, but not limited to: Laptops, PDAs, USB drives, portable hard drives, Blackberrys, iPods, CDs, DVDs, electronic readers, and/or other portable/mobile storage devices. Records are maintained on portable/mobile storage devices only for valid, business purposes, with prior approval, and in accordance with all applicable NIH, HHS and Federal security requirements, policies and controls.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records will be retrieved by manual or computer search using a unique case number or the name of the respondent(s) (i.e., the individual or individuals who are the subject of an allegation of research misconduct or of a research misconduct proceeding).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Measures to prevent unauthorized disclosures are implemented as appropriate for each location or form of storage and for the types of records maintained. Site(s) implement personnel and procedural safeguards such as the following:
</p><p><i>Authorized Users:</i>
</p><p>Access is strictly limited to ensure least privilege by authorized personnel whose duties require such access (<i>i.e.,</i> valid, business need-to-know). Records from this system are available to the System Manager, to the Director, NIH, and to other appropriate NIH staff when they have a need for the records in the performance of their duties. Records are also available to the Director, ORI, and to other appropriate HHS officials, including attorneys in the Office of the General Counsel, when there is a need to know in the performance of their duties. All authorized users are informed that the records are confidential and are not to be further disclosed.
</p> <p><i>Physical Safeguards:</i>
</p><p>Controls to secure the data and protect paper and electronic records, buildings, and related infrastructure against threats associated with their physical environment include, but are not limited to the use of the HHS Employee ID and/or badge number and NIH key cards and security guards. Paper records are secured in locked file cabinets, offices and facilities. Electronic media are kept on secure servers or computer systems. Data on computer files is accessed by a password known only to authorized users who have a need for the data in the performance of their duties as determined by the System Manager. During regular business hours, rooms in this restricted area are unlocked but entry is controlled by on-site personnel. Security guards perform random checks on the physical security of the storage locations after duty hours, including weekends and holidays. The NIH main campus in Bethesda, Maryland is protected by perimeter barriers and limited points of access, security personnel, and intrusion alarms. Electronic access to computer files is strictly limited through passwords and user-invisible encryption. Special measures commensurate with the sensitivity of the record are taken to prevent unauthorized copying or disclosure of the records. Individually identifiable records are kept in locked file cabinets or in rooms under the direct control of the System Manager. Contractor interaction with records covered by this system will occur on-site and no physical records (paper or electronic) will be allowed to be removed from the NIH Office of Intramural Research unless authorized. All authorized users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised area/office.
</p> <p><i>Administrative Safeguards:</i>
</p><p>Controls to ensure proper protection of information and information technology systems include, but are not limited to the completion of a Certification and Accreditation (C&amp;A) package and a Privacy Impact Assessment (PIA) for associated information technology systems, a system security plan, a contingency or back-up plan, user manuals, and mandatory completion of annual NIH Information Security and Privacy Awareness training. All authorized users of personal information in connection with the performance of their jobs (see Authorized Users, above) protect information from public view and from unauthorized personnel entering an unsupervised area/office. When the design, development, or operation of a system of records on individuals is required to accomplish an agency function, the applicable Privacy Act Federal Acquisition Regulation (FAR) clauses are inserted in solicitations and contracts.
</p> <p><i>Technical Safeguards:</i>
</p><p>Controls are generally executed by the computer system and are employed to minimize the possibility of unauthorized access, use, or dissemination of the data in the system. They include, but are not limited to user identification, password protection, firewalls, virtual private network, encryption, intrusion detection system, common access cards, smart cards, biometrics and public key infrastructure.
</p> <p><i>Implementation Guidelines:</i> This Privacy Act System of Records Notice conforms to and complies with Office of Management and Budget (OMB) Circular A-130--Appendix I "Federal Agency Responsibilities for Maintaining Records about Individuals" <i> http://www.whitehouse.gov/omb/assets/omb/circulars/a130/a130trans4.pdf,</i> standards outlined in the Health and Human Services (HHS) General Administration Manual (GAM), HHS Chapter 45-10 "Privacy Act--Basic Requirements and Relationships" <i>http://www.hhs.gov/hhsmanuals/gam/chapters/45-10.pdf,</i> HHS Chapter 45-12 "Creation, Alteration, and Termination of Privacy Act Systems of Records and Associated Documentation" (available in paper copy only), HHS Chapter 45-13, " Safeguarding Records Contained in Systems of Records" <i>http://www.hhs.gov/hhsmanuals/gam/chapters/45-13.pdf,</i> and HHS Information Security and Privacy Program Policy.</p>
<p><i>Alleged or Confirmed Security Incidents:</i> NIH will report and take action to remediate security incidents involving the disclosure of personally identifiable information according to law, regulations, OMB guidance, HHS and NIH policies.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Records will be maintained for 7 years in accordance with 42 CFR Part 93 and retained and disposed of under the authority of the NIH Records Control Schedule contained in Manual Chapter 1743, "Keeping and Destroying Records", Appendix 1, item 1700-A- 3. Refer to the NIH Manual Chapter for specific retention and disposition instructions: <i> http://www1.od.nih.gov/oma/manualchapters/management/1743</i>.</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>The agency official responsible for the system policies and practices outlined above is:
</p><p>NIH Agency Intramural Research Integrity Officer (AIRIO), Office of Intramural Research (OIR), National Institutes of Health (NIH), 9000 Rockville Pike, Bethesda, Maryland 20892.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>This system will be exempt from the Privacy Act provision requiring procedures for notifying an individual, upon his or her request, if the system contains a record about him or her. However, consideration will be given to requests addressed to the System Manager listed above. Any individual who wishes to know if this system contains a record about him or her may make a written request to the System Manager.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>This system will be exempt from access. However, because the access exemption is limited and discretionary, consideration will be given to access requests addressed to the System Manager. The requester must verify his or her identity by providing either a notarization of the request or a written certification that he or she is who he or she claims to be and understands that the knowing and willful request of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act, subject to a fine of up to five thousand dollars. If records are requested on behalf of a minor or legally incapacitated person, a statement of guardianship/conservatorship must be included. Requesters should also reasonably specify the record contents being sought. Requests should include (a) full name, (b) address, (c) the approximate date(s) the information was collected, (d) the types of information collected, and (e) the office or official responsible for the collection of information, etc. Individuals may also request an accounting of disclosures that have been made of their records, if any, if the System Manager determines that disclosure would not compromise the law enforcement activities of the NIH Office of Intramural Research  (These access procedures are in accordance with Department regulation (45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>This system will be exempt from redress. However, records that contain factually incorrect information may be amended. To contest such information, write to the System Manager at the address specified above, and reasonably identify the record and specify the information to be contested, the corrective action sought, and the reason(s) for requesting the correction, along with supporting information. The right to contest records is limited to information which is factually inaccurate, incomplete, irrelevant, or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system is received or obtained from many sources, including: (1) Directly from the complainant or respondent or his/her representative; (2) derived from materials supplied by the complainant or respondent or his/her representative; (3) from information supplied by institutions, witnesses, scientific publications or other nongovernmental sources; (4) from observation and analysis made by NIH staff, guest researchers, SGEs, trainees, volunteers, former employees, contractors, and other persons engaged to perform a service in support of NIH; (5) departmental and other Federal, State, local, and Tribal government records; (6) from hearings and other administrative proceedings; and (7) from any other relevant source.
</p></xhtmlContent></subsection>
 <subsection type="exemptionsClaimed"><xhtmlContent><p>Pursuant to 5 U.S.C. 552a (k)(2) and (k)(5) of the Privacy Act, the system will be exempted from the Privacy Act requirements pertaining to providing an accounting of disclosures, access and amendment, notification, and agency procedures and rules (5 U.S.C. 552a (c) (3), (d)(1)-(4), (e)(4)(G)-(H), and (f)). NIH believes that these exemptions are necessary to maintain the integrity of the research misconduct proceedings and to ensure that the NIH's efforts to obtain accurate and objective information will not be hindered. However, any individual who has been denied any right, privilege, or benefit to which he or she otherwise would have been entitled as a result of the maintenance of such material will be given access to the material, unless disclosure of the material would reveal the identity of a source who furnished information to the Government under an express promise of confidentiality.</p></xhtmlContent></subsection> </section>
<section id="09-37-0001" toc="yes">
<systemNumber>09-37-0001</systemNumber>
<subsection type="systemName"> Office of the Assistant Secretary for Health Correspondence Control System, HHS/OASH/OM.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>1. Public Health Service Executive Secretariat, Room 710H, Hubert H. Humphrey Building, 200 Independence Ave. SW, Washington, DC 20201.
</p> <p>2. Staff offices of the Assistant Secretary for Health.  For a list of addresses, please write to: Policy Coordinator, Office of Organization and Management Systems, Office of Management, Room 17-51, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>3. Federal Records Center, 4205 Suitland Road, Washington, DC 20746.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who have contacted either the Assistant Secretary for Health, the Surgeon General, a Deputy Assistant Secretary, or a PHS Staff Office Director, or have been contacted in writing by one of these officials.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Hard copies of the actual correspondence, 3 x 5 card file, and computer or word processor printout and tape or disk control system records of that correspondence.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301 Departmental Regulations.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To control and track all correspondence documents addressed or directed to the Assistant Secretary for Health or his subordinates as indicated above, as well as documents initiated by them, in order to assure timely and appropriate attention.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
</p><p>(a) HHS, or any component thereof; or
</p><p>(b) Any HHS employee in his or her official capacity; or
</p><p>(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,
</p><p>is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Correspondence records are maintained in hard copy. Control records are maintained in 3 x 5 card file and on computer or word processor printout, tape, and disk.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Hard copy records are indexed alphabetically by name of addressee and date of outgoing correspondence; or by name of sender and date of incoming correspondence; or by subject. Records may also be cross-referenced.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Office directors, correspondence assistants, and professional and support staff with designated functional responsibilities directly relating to the purpose of the correspondence.
</p> <p>2. Procedural Safeguards: Confidential and/or sensitive documents are either handcarried or transmitted in sealed envelopes. Employees who handle correspondence are instructed to observe established office procedures to protect correspondence documents from unauthorized access. The computerized subsystem is protected by passwords assigned to specific correspondence assistants; passwords are changed periodically; the password is changed when a correspondence assistant terminates employment.
</p> <p>3. Physical Safeguards: 24-hour guard service in buildings, locked rooms after office hours, lockable file cabinets, word processing disks are off-loaded and stored when not in use.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records may be retired to a Federal Records Center and subsequently disposed of in accordance with the Office of the Assistant Secretary for Health records control schedule. The records control schedule may be obtained by writing to the appropriate System Manager at the address for that official which is indicated under System Location above.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Policy Coordinator:Director, Office of Organization and Management Systems, Office of Management, Room 27-51, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>System manager:1. Director, Public Health Service Executive Secretariat, Room 710H. Hubert H. Humphrey Building, 200 Independence Ave., SW, Washington, DC 20201.
</p> <p>The Director of each Office of the Assistant Secretary for Health staff office is the system manager for the correspondence control system in his/her office.  For the address of the appropriate system manager, please write to the Polciy Coordinator at the above address.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Inquiries should indicate the name of the individual with whom the Office of the Assistant Secretary for Health corresponded, the date of the incoming correspondence, if any, and the date of the outgoing correspondence. Inquiries should be addressed to the appropriate System Manager, listed above, not to the policy coordination official.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters must state that they are who they claim to be, and understand that obtaining information under false pretenses is subject to a maximum statutory penalty of 5,000.00 dollars.
</p> <p>Requesters may also ask for an accounting of disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the appropriate System Manager at the address for that official specified under System Location above, and reasonably identify the record, specify the information to be contested, the corrective action sought, and the reason for seeking the correction, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Records are derived from incoming correspondence to, and the outgoing correspondence of, the Assistant Secretary for Health or his subordinates as indicated above.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-37-0020" toc="yes">
<systemNumber>09-37-0020</systemNumber>
<subsection type="systemName"> Office of Minority Health Grants Records System, HHS/OASH/OMH.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Minority Health, Rockwall II Building, Room 1102, 5600 Fishers Lane, Rockville, Maryland 20857. A current list of contractor sites is available by writing to the address below under SYSTEM MANAGER. Inactive records are located at the Federal Records Center, 4205 Suitland Road, Suitland, Maryland 20746.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Project Grant Program Directors.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Grant files, including grant applications, grant award notices, summary comments of peer reviewers, salary information, staffing lists, general correspondence, and Social Security Numbers (optional).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Public Health Service Act Section 301 (42 U.S.C. 242). This section authorizes support of health-related grants.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The information in this system is used to facilitate day-to-day grants management operations and for purposes of review, analysis, planning and policy formulation by OMH staff members and by other components of DHHS.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>(1) Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>(2) The Department may disclose information from this system of records to the Department of Justice, to a court or other tribunal, when
</p><p>(a) HHS, or any component thereof; or
</p><p>(b) Any HHS employee in his or her official capacity; or
</p><p>(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>(3) Disclosure may be made to a private firm for the purposes of providing services related to grant review, or for carrying out quality assessment, program evaluation, and/or management reviews. Any such contractors will be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>(4) Disclosure may be made to qualified experts not within the definition of Department employees for opinions as a part of the application review and award process.
</p> <p>(5) Disclosure may be made to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit of the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>(6) Where Federal agencies having power to subpoena other Federal agencies' records, such as the Internal Revenue Service or Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>(7) Disclosure may be made to the cognizant Audit Agency for auditing.
</p> <p>(8) In the event that a system of records maintained by the Department indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by statute or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred as a routine use, to the appropriate agency, whether Federal (e.g., the Department of Justice), or State (e.g., the State Attorney General's office) charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto for litigation.
</p> <p>(9) Disclosure may be made to the grantee institution in connection with performance or administration under the terms and conditions of the award.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Manual files (files folders).
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Retrievable by program director name and grant number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Only staff members of the Office of Minority Health (OMH) have regular access. Staff members of other DHHS components have access on a need-to-know basis only.
</p> <p>2. Physical Safeguards: Locked file cabinets, locked offices, general building security.
</p> <p>3. Procedural Safeguards: OMH staff may inspect and review records, with the approval of Grant Management Branch staff. Other DHHS staff will be granted access by the System manager only on a need-to-know basis. Visitors will not be left unattended in the office containing the files. Grant records are either transmitted in sealed envelopes or are hand-carried.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Approved grant applications and their respective files are retained by OMH for one year beyond the termination date of the project. Disapproved grant applications are held for six months. The grant files are then retired to a Federal Records Center and subsequently disposed of in accordance with the PHS/OASH records control schedule. The records control schedule may be obtained by writing to the System Manager at the following address.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Grants Management Officer, Office of Minority Health, PHS, Room 1102, Rockwall II Building, 5600 Fishers Lane, Rockville, MD 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the above address. Specify program director's name and/or grant number.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. Positive identification is required. You may also request an accounting of disclosures that have been made of your record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under System Manager above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Grant applications, reports and correspondence from organizations interested in improving minority health, summary statements from grant review committees and incoming correspondence from project staff.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-37-0021" toc="yes">
<systemNumber>09-37-0021</systemNumber>
<subsection type="systemName">HHS Records Related to Research Misconduct Proceedings, HHS/OS/ORI.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Research Integrity, 1101 Wootton Parkway, Suite 750, Rockville, MD 20852, and Federal Records Centers for inactive, permanent records.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The individuals covered by this system are referred to as "respondents." Part 93 defines the term "respondent" to mean "the person against whom an allegation of research misconduct is directed or who is the subject of a research misconduct proceeding." 42 CFR 93.225.
</p> <p>Part 93 and this system notice apply to an allegation of research misconduct involving: (1) Applications or proposals for PHS support for biomedical or behavioral extramural or intramural research, research training or activities related to that research or research training, such as the operation of tissue and data banks and the dissemination of research information; (2) PHS supported biomedical or behavioral extramural or intramural research; (3) PHS supported biomedical or behavioral extramural or intramural research training programs; (4) PHS supported extramural or intramural activities that are related to biomedical or behavioral research or research training; and (5) plagiarism of research records produced in the course of PHS supported research, research training or activities related to that research or research training.
</p> <p>The term "research misconduct" is defined to mean "fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results." "Fabrication" is defined to mean "making up data or results and recording or reporting them." "Falsification" is "manipulating research materials, equipment, or processes, or changing or omitting data or results such that the research is not accurately represented in the research record." "Plagiarism " is "the appropriation of another person's ideas, processes, results, or words without giving appropriate credit." Research misconduct does not include honest error or differences of opinion. 42 CFR 93.103.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>This system contains records related to research misconduct proceedings. The term "research misconduct proceeding" is defined to mean "any actions related to alleged research misconduct taken under this part, [Part 93] including but not limited to allegation assessments, inquiries, investigations, ORI oversight reviews, hearings, and administrative appeals." 42 CFR 93.223.
</p> <p>The records include all information that must be submitted to ORI by institutions under Part 93 in connection with a research misconduct proceeding, and all information that ORI receives or generates in overseeing or conducting research misconduct proceedings. This information includes, but is not necessarily limited to information about respondents (this may include social security numbers), complainants, and witnesses; the nature of the allegations; the PHS funding involved, including grant numbers; the institutions and officials responsible for conducting the actions that are part of the research misconduct proceeding; the documentation used in the inquiry and investigation, including relevant research data and materials, applications, proposals and documentation related to review and award actions, reports, abstracts, manuscripts and publications by the respondent(s) and other relevant reports, abstracts, manuscripts and publications, correspondence; memoranda of telephone calls, summaries of interviews and transcripts or recordings of interviews; statistical, scientific, and forensic analyses; interim and final institutional reports, and records of institutional appeal proceedings, if any.
</p> <p>The system also includes records relating to: (1) ORI oversight of institutional assessments, inquiries and investigations, ORI findings of research misconduct, and ORI proposals for HHS administrative actions or for settlement of the case; (2) final HHS findings of research misconduct, final HHS decisions regarding administrative actions, and documentation of the implementation of those actions; and (3) ORI coordination with other Federal, State, and local offices/agencies, including the Department of Justice.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authorities for maintaining the system are: Sections 301 and 493 of the Public Health Service Act, 42 U.S.C. 241, and 289b; 5 U.S.C. 552a, 5 U.S.C. 301 and 44 U.S.C. 3101; 42 CFR Part 93; 2 CFR Part 376; 48 CFR Subpart 309.4.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purposes of this system are to:
</p><p>(1) Enable HHS, ORI, and the Federal Government to protect the health and safety of the public, to promote the integrity of PHS supported research, and to conserve public funds;
</p><p>(2) Enable ORI to implement its authority relating to research misconduct proceedings as set forth in 42 U.S.C. 289b and 42 CFR Part 93, and to document HHS and ORI activities in implementing that authority;
</p><p>(3) Ensure that research misconduct proceedings, including institutional implementation of HHS administrative actions, are carried out in accordance with 42 CFR Part 93 and other applicable Federal statutes and regulations;
</p><p>(4) Enable ORI to inform PHS agency officials who have a need for the records in the performance of their duties, of the status and results of research misconduct proceedings; and
</p><p>(5) Enable ORI to notify, consult with, and provide assistance to other Federal, State, or local governmental agencies to permit them to take action to protect the health and safety of the public, to promote the integrity of PHS supported research, to conserve public funds, or to pursue potential violations of civil and criminal statutes.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The HHS Privacy Act regulation lists, at 45 CFR 5b.9(b), disclosures of records that may be made without the consent of the individual who is the subject of the records. Among the permitted disclosures are disclosures to those officers and employees of the Department who have a need for the record in the performance of their duties and routine uses that are listed in the notice of the system of records. A " routine use" is defined in 45 CFR 5.1(j) to mean "the disclosure of a record outside the Department, without the consent of the subject individual, for a purpose which is compatible with the purpose for which the record was collected." The routine uses for this system of records are listed below.
</p> <p>1. Disclosure may be made to any person able to obtain information or provide information or assistance in a research misconduct proceeding or related proceeding, ORI oversight of an institutional research misconduct proceeding, or ORI oversight of the implementation of HHS administrative actions. Recipients of disclosures under this routine use may include experts asked to perform statistical, forensic or other analyses, the relevant PHS supported institution(s), institutions with which the respondent(s) was previously or is currently affiliated, Federal, State and local agencies, the respondent(s), the complainant(s), witnesses, and organizations or individuals acting on behalf of those agencies, institutions and individuals; provided, however, that in each case ORI determines whether limited disclosures or confidentiality agreements are needed to protect the privacy of respondent(s), complainant(s), witnesses, research subjects or others who may be identified in the records to be disclosed.
</p> <p>2. Disclosure may be made to other Federal, State, or local agencies and offices, if ORI has reason to believe that a research misconduct proceeding may involve that agency or office.
</p> <p>3. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, disclosure may be made to the appropriate agency, whether Federal, foreign, State, local or Tribal, or other public authority responsible for enforcing, investigating or prosecuting such violation, if the information disclosed is relevant to the responsibilities of the agency or public authority.
</p> <p>4. Disclosure may be made to responsible officials of PHS-supported institutions or organizations, when in connection with a research misconduct proceeding concerning an individual previously or currently employed by, or affiliated with the institution or organization, or when ORI or HHS makes a finding or takes an action potentially affecting the institution or organization or its PHS support for research, research training, or related activities.
</p> <p>5. After there is a final HHS/ORI finding of research misconduct, disclosure may be made to a Federal, State, local or Tribal agency in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, or the issuance of a license or other benefit by the agency, to the extent that the record is relevant to the agency's decision on the matter.
</p> <p>6. After there is a final HHS/ORI finding of research misconduct, disclosure may be made to professional journals, other publications, news media, other individuals and entities, and the public concerning research misconduct findings and the need to correct or retract research results or reports that have been affected by research misconduct. No information will be released that would reveal a confidential source.
</p> <p>7. After there is a final HHS/ORI finding of research misconduct, disclosure may be made to a State licensing board, certifying body, or other similar entity conducting a review of the respondent, to aid the entity in meeting its responsibility to protect the health of the population in its jurisdiction or the integrity of the profession.
</p> <p>8. After there is an HHS decision to suspend, or a final HHS decision to debar the respondent from Federal procurement and nonprocurement programs, disclosure may be made to GSA for the purpose of adding the respondent to GSA's Excluded Parties List System.
</p> <p>9. Disclosure may be made to volunteers and contractors engaged to perform a service in support of an ORI research misconduct oversight function, if such persons need access to the records to perform their assigned task; provided, however, in each case ORI determines whether limited disclosures or confidentiality agreements are needed to protect the privacy of respondent(s), complainant(s), witnesses, research subjects or others who may be identified in the records to be disclosed; and ORI determines that the disclosure is for a purpose compatible with the purpose for which the agency collected the records.
</p> <p>10. When ORI closes a case without a settlement or finding of research misconduct, disclosure may be made to the respondent, relevant institution, and complainant(s); provided, however, that in each case ORI determines whether limited disclosures or confidentiality agreements are needed to protect the privacy of respondent(s), complainant(s), witnesses, research subjects or others who may be identified in the records to be disclosed.
</p> <p>11. Disclosure may be made to DOJ when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity where the DOJ has agreed to represent the employee; or (c) the United States Government, is a party to litigation or has an interest in such litigation and, prior to disclosure, the agency determines that the records are both relevant and necessary to the litigation and the use of such records by the DOJ is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
</p> <p>12. Disclosure may be made to a court or other tribunal, when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity where the DOJ has agreed to represent the employee; or (c) the United States Government is a party to the proceeding or has an interest in such proceeding and, prior to disclosure, the agency determines that the records are both relevant and necessary to the proceeding and the use of such records is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders, electronic and magnetic media and other types of data storage devices.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by manual or computer search of the case-tracking system using the name of the respondent(s) (i.e., the individual or individuals who are the subject of an allegation of research misconduct or of a research misconduct proceeding).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. <i>Authorized users:</i> Records are available to the system manager, to the Director, ORI, and to other appropriate ORI staff when they have a need for the records in the performance of their duties. Records are also available to the head of intramural research for the PHS agency involved, and to other appropriate HHS officials, including attorneys in the Office of the General Counsel, the Agency Research Integrity Liaison Officer (ARILOs), the Agency Intramural Research Integrity Officer (AIRIOs), the Agency Extramural Research Integrity Officer (AERIOs), and the Research Integrity Officers (RIOs) located in the Institutes and Centers of the National Institutes of Health (NIH) that are involved in the research misconduct proceeding, when there is a need to know in the performance of their duties. All authorized users are informed that the records are confidential and are not to be further disclosed.
</p> <p>2. <i>Procedural safeguards:</i> Access is strictly controlled by the system manager and the Director, ORI, in compliance with the Privacy Act and this system notice. Access to the records is limited to ensure confidentiality. All questions and inquiries from any party should be addressed to the system manager.
</p> <p>3. <i>Physical safeguards:</i> ORI records are kept in locked file cabinets in a room that is locked during non-working hours. Access to this room is restricted to specific personnel. The ORI office suite is protected by access and intrusion alarms at the front and emergency entrances. Access to computer files is strictly limited through passwords and user-invisible encryption. Special measures commensurate with the sensitivity of the record are taken to prevent unauthorized copying or disclosure of the records.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>The files are retained and disposed of in accordance with the General Records Schedule (accessions) and a disposition schedule approved by the National Archives and Records Administration (cases).
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Investigative Oversight, Office of Research Integrity, 1101 Wootton Parkway, Suite 750, Rockville, MD 20852.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>This system is exempt from access; however, consideration will be given to requests addressed to the system manager. The requester must verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act, subject to a five thousand dollar fine. The request should include: (a) Full name, (b) address, and (c) year of records in question.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should reasonably specify the record contents being sought. Although the system is exempt, respondents may, upon request, receive records from this system and an accounting of disclosure of their records, if the system manager determines the disclosure would not compromise the activities of ORI or the confidentiality of information.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Exempt. However, consideration may be given to requests addressed to the system manager. Requests for corrections should reasonably identify the record and specify the information to be contested, the corrective action sought and the reasons for the corrections with supporting justification. The right to contest records is limited to information that is incomplete, irrelevant, incorrect, or obsolete.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system is received or obtained from many sources, including: (1) Directly from the respondent or complainant or his/her representative; (2) derived from materials supplied by the respondent or complainant or his/her representative; (3) from information supplied by the institutions, witnesses, scientific publications and other nongovernmental sources; (4) from observation and analysis made by ORI staff and scientific experts; (5) departmental and other Federal, State, and local government records; (6) from hearings and other administrative proceedings; and (7) from any other relevant source.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>This system is exempted pursuant to 5 U.S.C. 552a(k)(2) and (k)(5) of the Privacy Act from access, notification, correction, and amendment provisions of the Act (5 U.S.C. 552a(c)(3), (d)(1)-(4), (e)(4)(G)-(H), and (f)).
</p></xhtmlContent></subsection></section>

<section id="09-37-0024" toc="yes">
<systemNumber>09-37-0024</systemNumber>
<subsection type="systemName">Studies of Preventive Medicine, Health Promotion, and Disease Prevention, HHS/OASH/ODPHP.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Records are located at the Office of Disease Prevention and Health Promotion (ODPHP) and Contractor research facilities that collect or provide research data for this system. Primary record storage sites are listed in Appendix I. A current list of additional contractor sites is available by writing to the System Manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Patients (adults and children) of the clinicians participating in these studies; individuals who are representative of the general population or of special groups including, but not limited to: Normal controls, normal volunteers, family members and relatives; providers of services.</p>
<p>The system contains records about individuals as relevant to these studies: (1) Medical records (treatment, laboratory screening and diagnostic tests, and preventive services); (2) clinician surveys (use of screening, counseling and preventive services); and (3) patient surveys (height, weight, race/ethnicity, health behavior, health conditions). Examples of information include, but are not limited to: Patient or provider name, study identification number, address, relevant telephone numbers, Social Security Number (voluntary), date of birth, weight, height, sex, race; medical, psychological and dental information, laboratory and diagnostic testing results; registries; social, economic and demographic data; health services utilization; immunization status; insurance and hospital cost data, employers; characteristics and activities of health care providers.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authorization to collect these data is provided under section 301 of the Public Health Service Act (42 U.S.C. 241), General Powers and Duties of Public Health Service.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purpose of this system of records is to enable the study of the impact of preventive medicine interventions and public education efforts of health service delivery, patient behavior, and health outcome. Information from the system of records will be shared within the Department of Health and Human Services (DHHS) with such Public Health Service (PHS) agencies as the Centers for Disease Control and Prevention (CDC) including the National Center for Health Statistics (NCHS), the Health Resource Services Administration (HRSA), the Indian Health Service (IHS), the National Institutes for Health (NIH), the Agency for Health Care Policy and Research (AHCPR), and the Health Care Financing Administration (HCFA).
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. A record may be disclosed for a research purpose, when the Department: (A) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; e.g., disclosure of alcohol or drug abuse patient records will be made only in accordance with the restrictions of confidentiality statutes and regulations (42 U.S.C. 290 (dd-2), 42 U.S.C. 241 and 405, 42 CFR part 2), and where applicable, no disclosures will be made inconsistent with an authorization of confidentiality under 42 U.S.C. 242a and 42 CFR part 2a; (B) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (C) has required the recipient to (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except (a) in emergency circumstances affecting the health or safety of any individual, (b) for use in another research project, under these same conditions, and with written authorization of the Department, (c) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (d) when required by law; and (D) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by, these provisions. Examples of organizations and agencies of which records from this system may be disclosed include, but are not limited to Health Maintenance Organizations (HMOs) and other service providers participating in the studies and various federal and state agencies, such as the Veteran's Administration, branches of the Armed Forces, and state and local health department.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from a congressional office made at the written request of that individual.
</p> <p>3. In the event of litigation, where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example, in defending a claim against the Public Health Service, based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such an individual, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>4. ODPHP may contract with a private firm for the purpose of collecting, analyzing, aggregating, or otherwise refining records in this system. Relevant records may be disclosed to such contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>5. Disclosure may be made to organizations deemed qualified by the Secretary to carry out quality assessments, medical audits or utilization review.</p>
<p>6. Information from this system may be disclosed to Federal agencies, State agencies (including the Motor Vehicle Administration and State vital statistics offices), private organizations, and other third parties (such as current or prior employers, acquaintances, relatives), in order to obtain information on morbidity and mortality experiences and to locate individuals for follow-up studies. Social Security numbers may be disclosed to the Social Security Administration to ascertain disabilities and/or location of participants. Social Security numbers may also be given to other Federal agencies, and State and local agencies for purposes of locating individuals for participation in follow-up studies.
</p> <p>7. Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for PHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records may be stored in hard copy, index cards, file folders, computer tapes and disks (including optical disks), photography media, microfiche, microfilm, and audio and video tapes. Typically, factual data with study code numbers are stored on computer tape or disk, while the key to personal identifiers is stored separately, without factual data, in locked paper files.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>During data collection stages and follow-up retrieval is by personal identifier (e.g., name, Social Security Number, medical record or study identification number etc.). During the data analysis stage, data are normally retrieved by the variables of interest (e.g., diagnosis, age, occupation).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Access to identifiers and to link files is strictly limited to the authorized personnel whose duties require such access. Procedures for determining authorized access to identified data are established as appropriate for each location. Personnel, including contractor personnel, who may be so authorized include those directly involved in data collection and in the design of research studies, e.g., interviewers and interviewer supervisors; project managers, and statisticians involved in designing sampling plans.
</p> <p>Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the System Manager.
</p> <p>Researchers authorized to conduct research will typically access the system through the use of encrypted identifiers sufficient to link individuals with records in such a manner that does not compromise confidentiality of the individual.
</p> <p>2. Physical Safeguards: Records are stored in locked rooms, locked file cabinets, and/or secured computer facilities. Personal identifiers and link files are separated as much as possible and stored in locked files. Computer data access is limited through the use of key words known only to authorized personnel.
</p> <p>A separate key list linking ID codes to respondents will be maintained by the contractor conducting the survey, during the data collection period in order to permit follow-up with non-respondents. This key list will be kept in a locked file when not actively in use. As soon as data cleaning is completed this key list will be destroyed. No data that could be used to identify respondents will be entered on the computer database.
</p> <p>Likewise the name of individual settings will not appear on data collection forms or the computerized database. Again a separate key matching the ID code to the hospital name will be maintained during the course of data collection in order to permit follow-up of non- respondents. They key listing will be kept in a secure location when not actively in use, and destroyed as soon as the data cleaning is completed.
</p> <p>3. Procedural Safeguards: Collection and maintenance of data is consistent with legislation and regulations regarding the protection of human subjects, informed consent, and confidentiality. When anonymous data is provided to research scientists for analysis, study numbers which can be matched to personal identifiers will be eliminated, scrambled, or replaced by the agency or contractor with random numbers which cannot be matched. Contractors who maintain records in this system are instructed to make no further disclosure of the records. Privacy Act requirements are specifically included in contracts for survey and research activities related to this system. The ODPHP project officers and contract officers oversee compliance with these requirements.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records are maintained with individual identifiers only until analysis and follow-up are completed, generally a two- to three-year period. Removal or disposal of identifiers will be done according to the storage medium (e.g., erase computer tape, shred, pulp or burn paper records etc.). A staff person designated by the System Manager or an authorized Contractor will oversee and confirm the disposal in writing. Long-term retention is only in aggregate form without individual identifiers in accordance with the OASH Records Disposition Schedule.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Senior Policy Advisor, Office of Disease Prevention and Health Promotion, 2132 Switzer Building, 330 C Street, SW, Washington, DC 20201.</p>
</xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager listed above. Notification requests should include: Individual's name; current address; date of birth; date, place and nature of participation in the research study; address at the time of participation. The System Manager may accept a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p> <p>An individual who requests notification of, or access to, a medical/dental record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. The representative may be a physician, or other health professional, or other responsible individual. The subject individual will be granted direct access unless it is determined that such access is likely to have a adverse effect on him or her. In this case, the medical/dental record will be sent to the designated representative.
</p> <p>Individuals will be informed in writing if the record is sent to the representative.
</p> <p>A parent or guardian who requests notification of, or access to, a child's or incompetent person's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child or incompetent person as well as his or her own identity.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the appropriate official at the address specified under Notification Procedures above and reasonably identify the record, specify the information being contested, and state the corrective action sought and the reason(s) for requesting the correction, along with supporting justification to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The system contains information obtained directly from the subject individual by interview (face-to-face or telephone), written questionnaire, or observations. Information is also obtained from other sources, including but not limited to: Referring physicians; hospitals; State and local health agencies; relatives; guardians; schools, employers; and clinical research records.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p>
     <p>
         <i>
             Appendix I: System Location Sites
         </i>
     </p>
     <p>
     Office of Disease Prevention and Health Promotion (ODPHP), 2132 Switzer Building, 330 C Street, SW, Washington, DC 20201 </p><p>Battelle Memorial Institute, Centers for Public Health Research and Evaluation, 2101 Wilson Boulevard, Suite 800, Arlington, VA 22201 </p><p>Battelle Memorial Institute, Centers for Public Health Research and Evaluation, Room 100E, 505 King Avenue, Columbus, OH 43201-2693</p><p>Battelle/SRA, 401 North Lindbergh Boulevard, Suite 330, St. Louis, MO 63141-7816.</p></xhtmlContent></subsection></section>
<section id="09-37-0151" toc="yes">
<systemNumber>09-37-0151</systemNumber>
<subsection type="systemName">Public Health Service ALERT Records Concerning Individuals Found to Have Committed Scientific Misconduct in PHS Sponsored Research, HHS/OASH/ORI.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Research Integrity, Public Health Service, Rockwall II, suite 700, 5515 Security Lane, Rockville, Maryland 20852.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Subjects may include (1) researchers currently or formerly employed by the Federal Government; (2) individuals being considered for appointment to Public Health Service (PHS) advisory committees; (3) investigators on research grants, fellowships, cooperative agreements, or contracts awarded by any PHS agency, ("Investigators" may include principal investigators, co-investigators, program directors, trainees, recipients of career awards or fellowships, or other individuals who conduct or are responsible for research or research training funded by PHS); (4) research investigators, such as guest workers, not employed by PHS but who conduct research in PHS facilities or are closely associated with research conducted by PHS; (5) other individuals, such as subgrantees, subcontractors or assistants on research or research training grants, contracts or cooperative agreements, who by training, experience, occupation or other qualifications are potential candidates for research or research training grants, contracts, cooperative agreements or other benefits.
</p> <p>Such individuals would be subjects of records in this system if they fall within the following categories:
</p><p>(1) ORI has made a finding of scientific misconduct concerning the individual;
</p><p>(2) The individual is the subject of administrative actions imposed as a result of a determination that scientific misconduct has occurred. Such administrative actions include but are not limited to: (a) Restrictions on specific activities or expenditures under an active award, (b) a requirement for special reviews of all requests for funding; (c) actions affecting eligibility for appointment as an individual or member of a committee providing advice to PHS; (d) debarment from participation in covered transactions which may include grants, contracts, and cooperative agreements; (e) suspension or termination of an active award; (f) special restrictions on regulated research, such as disqualification by the Food and Drug Administration (FDA) from use of investigational drugs or other products, or other restrictions place on such use; and (g) termination of employment or other disciplinary action against an employee of PHS.
</p> <p>(3) The individual has agreed to a voluntary corrective action as a result of an investigation of scientific misconduct.
</p> <p>(4) ORI has received a report of an investigation by an institution in which there is a finding of scientific misconduct concerning the individual and ORI has determined that PHS has jurisdiction.
</p> <p>(5) The FDA has determined after an investigation that there is sufficient reason to believe that official action is warranted against the individual for violation of FDA regulations governing research.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system contains records relating to findings of scientific misconduct and to actions that PHS has taken in connection with such findings including voluntary exclusion agreements. This information is limited to (1) the ORI Case Reference number, (2) the name of the subject of the investigation, (3) the individual's social security number, (4) the date of birth of the individual, (5) the type of misconduct, (6) the institution that conducted the investigation, (7) a summary of the administrative actions imposed as a result of the misconduct and the effective and expiration dates, (8) the involved PHS support and the involved PHS agencies or funding components including identification of the specific office responsible for the investigation, (9) the record creation date, and (10) the last entry date. Scientific misconduct is defined as fabrication, falsification, plagiarism or other practices that seriously deviate from those that are commonly accepted within the scientific community for proposing, conducting or reporting research. It does not include honest error or differences in interpretations or judgement of data.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for this system comes from the legislation which authorizes PHS to make awards for biomedical and behavioral research and research training, and from PHS's concomitant responsibility to assure both that funds disbursed under awards are spent for authorized purposes and that recipients of such funds conform to all appropriate laws and regulations. (5 U.S.C. 301; 29 U.S.C. 669; 42 U.S.C. 241, 242b, 242c, 2421, 242m, 247c, 281-289h, 285n, 285n-2, 285o, 285o-2, 300a-2, 300b-1-b-3, 300c-12, 300z-7, as these provisions relate to biomedical and behavioral research and research training).
</p></xhtmlContent></subsection>
    <subsection type="purpose">
        <xhtmlContent>
            <p>
                This system of records enables PHS agencies to discharge effectively their responsibilities in the award and administration of research and training grants, cooperative agreements and contracts, while protecting the privacy and other rights of individuals. The PHS ALERT system is used to collect, control and disseminate to PHS agency officials on a need-to-know basis information that: (1) The PHS has made a finding of scientific misconduct or (2) the PHS has imposed administrative action(s) at the conclusion of an investigation for scientific misconduct; or (3) has received a report of an investigation by an institution in which there is a fining of scientific misconduct and ORI has determined that the PHS has jurisdiction, or (4) the FDA has determined after an investigation that there is sufficient reason to believe that official action is warranted against such persons for violation of FDA regulations governing research or (5) an individual has agreed to a voluntary corrective action relative to findings of scientific misconduct.
            </p>
            <p>
                Specifically,
            </p>
            <p>
                (1) PHS records the existence of such administrative actions in the system so that PHS agencies can track and implement the administrative actions, for example by refusing to accept an application or proposal from a debarred person. In addition, PHS informs members of technical merit review groups of actions taken if the disclosure is necessary to ensure an unbiased review by providing an accurate account of the case, for example, when information concerning the conduct investigated has been disclosed by other sources, such as the press or other communications media.
            </p>
            <p>
                (2) The ORI will transmit the names and, if available, the SSN or date of birth of those individuals against whom there was a finding of scientific misconduct and administrative action(s) to the Division of Research Grants (DRG), National Institutes of Health (NIH) and to other appropriate officials within the PHS. DRG will use this file to screen automatically PHS research contract and grant award records; applications for PHS funding of research grants, fellowships and cooperative agreements; and nominations/appointments to PHS advisory committees.
            </p>
            <p>
                (3) If the ORI's review of the institutional investigation findings or the Departmental Appeals Board (DAB) hearing on the findings fail to confirm misconduct (a) the individual's name is removed from the PHS ALERT system of records and the individual is notified in writing; (b) responsible PHS agency officials are notified of the outcome; (c) if any interim administrative actions had been imposed, they are withdrawn.
            </p>
            <p>
                (4) Appropriate agency officials are notified of additions to the PHS ALERT for the purpose of communicating and disseminating information about scientific misconduct.
            </p>
            <p>
                (5) PHS Committee Management Officers are notified of administrative actions restricting or prohibiting PHS advisory service in order to assist in the appointment of candidates for the advisory committees.
            </p>
            <p>
                (6) Upon request, the System Manager may disclose information to PHS agency officials who are considering hiring a subject individual.
            </p>
            <p>(7) Upon request, the System Manager may disclose information in the PHS ALERT to contracting officers in order to assist them in the award of a contract.</p>
    
        </xhtmlContent>
    </subsection>
    <subsection type="routineUsesOfRecords">
        <xhtmlContent>
            <p>
     1. PHS may notify responsible officials of the awardee institutions or organizations when, in connection with an ORI review of an institution's investigation or a finding of scientific misconduct by an individual employed by or affiliated with the institution or organization, a PHS agency takes an action affecting research and research training awards to the institution or organization. Information disclosed will be limited to the name of the subject individual, description of the action and the reason for it.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>3. Disclosure may be made from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity or (c) any HHS employee in his or here individual capacity where the Department of Justice, (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components is a party to litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>4. Disclosure may be made via an electronic bulletin board to institutions, organizations and persons connected to the electronic bulletin boards outside the DHHS and components within the DHHS of the names of individuals against whom there was a finding of scientific misconduct and an imposition of administrative actions including voluntary exclusion agreements. The information will enable applicant institutions to enforce PHS administrative actions within their institutions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders and computer disks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name of the individual who is the subject of an ORI investigation or review of an institution's investigation or subject to an administrative action.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized users: Records are available only to the system manager, Director of Division of Policy and Education (DPE), ORI, or designee. Any disclosure to other individuals must be authorized by the Director, DPE.
</p> <p>2. Procedural safeguards: Access to records is strictly controlled by the system manager and the officials specified under "Authorized Users." Individuals who receive disclosures from this system before there is a final agency finding, are informed that the information is confidential.
</p> <p>3. Physical safeguards: Sensitive records stored in file folder and on computer discs are kept in locked file cabinets in areas which are locked when not in use. Special measures, commensurate with the sensitivity of the records, are taken to prevent unauthorized copying or disclosure of records 4
</p><p>These practices are in compliance with the standards of chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the Department's Automated Information System Security Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained and disposed of in accordance with the OASH Records Control Schedule. If an institutional finding of scientific misconduct is reversed by ORI or DAB, the PHS ALERT records are destroyed. If an investigation results in an official administrative action or voluntary exclusion agreements, a record of such administrative action is maintained for the duration of the administrative action and then destroyed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>PHS ALERT System Manager, Division of Policy and Education, Office of Research Integrity, Rockwall II, suite 700, 5515 Security Lane, Rockville, MD 20852.
</p></xhtmlContent></subsection>
    <subsection type="notificationProcedure">
        <xhtmlContent>
            <p>Individuals are routinely notified in writing when they become the subject of a record in this system, unless a law enforcement agency has instructed PHS not to do so. Subject individuals are also informed routinely when their records are deleted from the system.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="recordAccessProcedures">
        <xhtmlContent><p>
                Individuals may write to the system manager at the address above and provide their full name and the name of this Privacy Act system of records to request a copy of the record. Requesters should also reasonably specify the record contents being sought. Individuals may also request a listings of accountable disclosures that have been made of their records, if any.
            </p>
        </xhtmlContent>
    </subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Individuals may write to the system manager and reasonably identify the record and the information being contested; and state the reasons for requesting the change, along with supporting information to show that the record is untimely, incomplete, irrelevant, or inaccurate. The right to contest records is limited to information which is incomplete, irrelevant, incorrect or untimely (obsolete).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information in these records is obtained from awardee institutions or organizations, and PHS agencies and organizations responsible for investigations.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p></xhtmlContent></subsection></section>
<section id="09-90-0001" toc="yes">
<systemNumber>09-90-0001</systemNumber>

<subsection type="systemName">Telephone Directory/Locator System, HHS/OS/ASMB/OMAS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Operating Offices and Facility Complexes of the Department--Employee Locators and Offices of Administrative or Management Services.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Current employees of the Department and vendor or other Federal employees located in Department operating offices and facility complexes.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Name, title, agency office address, agency mailing address, telephone number, standard administrative code, and social security number.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301, 40 U.S.C. 486(c).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The records are used to develop and maintain current employee locator and directory listings. The locator listings are used by the HHS information centers, mailrooms, and others specifically for the purpose of locating employees and for routing mail. The directory listings are used to produce departmental telephone directories on an as needed basis.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Variously stored in card files, computer printouts, paper forms, magnetic tape.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Alphabetically by employee name in certain instances, also by agency and/or title. Some large systems use the SSN as control to update, change or delete information on individuals no longer within this system of records.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Only authorized personnel have access to master lists which contain social security numbers.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Retained as long as individual is employed by or associated with the Department, then information deleted from files by appropriate method.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Telecommunications management officials of the Department--See Appendix.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Direct inquiries to appropriate systems manager identified in Appendix.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent>
     <p>
         Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)), <i>Federal Register</i>, October 8, 1975, page 47410.)
     </p>
 </xhtmlContent></subsection> <subsection type="contestingRecordProcedures"><xhtmlContent>
                                  <p>
                                      Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7), <i>Federal Register</i>, October 8, 1975, page 47411).
                                  </p> </xhtmlContent></subsection> <subsection type="recordSourceCategories"><xhtmlContent><p>Individual employee.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p>
<p><i>Appendix </i></p><p>Department Policy Coordinator:
</p><p>Telecommunications Management Officer, Department of Health, and Human Services, Office of the Assistant Secretary for Management and Budget, Office of Management Analysis and Systems, 200 Independence Avenue, SW, Washington, DC 20201.
</p><p>PHS Policy Coordinator:
</p><p>Telecommunications Management Officer, Office of the Assistant Secretary for Health, Office of Management, Office of Organization and Management Systems, Division of Management Sciences and Systems, 5600 Fishers Lane, Rockville, MD 20857.
</p><p>Operating System Managers:
</p><p>Office of the Secretary, Deputy Director, Division of Administrative Services, Office of Management Services, 330 Independence Ave., SW, Room 1739, Washington, DC 20201.
</p><p>Human Development Services, Director, Division of Administrative Services, 200 Independence Ave., SW, Room 309B, Washington, DC 20201.
</p><p>Public Health Service, Chief, Communications Section, Administrative Services Center, 5600 Fishers Lane, Rockville, MD 20857.
</p><p>Public Health Service, Centers for Disease Control, Chief, Communications Records and Space Branch, 1600 Clifton Road, Atlanta, GA 30333.
</p><p>Public Health Service, Food and Drug Administration, Chief, Services Management Section, Division of Management Services, 5600 Fishers Lane, Rockville, MD 20857.
</p><p>Public Health Service, Chief, General Services Branch, USPHS Hospital, Carville, LA 70721.
</p><p>Health Care Financing Administration, Director, Division of Communications Services, 591 East High Rise Bldg., 6325 Security Blvd., Baltimore, MD 21207.
</p><p>Social Security Administration, Communications Systems Branch, 6401 Security Boulevard, Room 1-N-9--Annex, Baltimore, MD 21235.
</p><p>Region I, HHS Director, Division of Administrative Services, JFK Federal Building, Boston, MA 02203.
</p><p>Region II, HHS Director, Division of Administrative Services, 26 Federal Plaza, New York, NY 10007.
</p><p>Region III, HHS Director, Division of Administrative Services, 3535 Market Street, Philadelphia, PA 19101.
</p><p>Region IV, HHS Director, Division of Administrative Services, 101 Marietta Tower, Suite 1502, Atlanta, GA 30323.
</p><p>Region V, HHS Director, Division of Administrative Services, 300 South Wacker Drive, Chicago, IL 60606.
</p><p>Region VI, HHS Director, Division of Administrative Services, 1200 Main Tower, Dallas, TX 75202.
</p><p>Region VII, HHS Director, Division of Administrative Services, 601 East 12th Street, Kansas City, MO 64106.
</p><p>Region VIII, HHS Director, Division of Administrative Services, 1961 Stout Street, Denver, CO 80294.
</p><p>Region IX, HHS Director, Division of Administrative Services, 50 United Nations Plaza, San Francisco, CA 94102.
</p><p>Region X, HHS Director, Division of Administrative Services, 1321 Second Avenue, Seattle, WA 98101.
</p></xhtmlContent></subsection></section>
<section id="09-90-0002" toc="yes">
<systemNumber>09-90-0002</systemNumber>
<subsection type="systemName"> Investigatory Material Compiled for Security and Suitability Purposes, HHS/OS/OIG.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None for the system; however, a portion of the records within the system are classified at the level of Confidential and Secret.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Security and Protection Division, Room 523B, Humphrey Building, U.S. Department of Health and Human Services, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Prospective, current, and, former employees and others doing business with the Department.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Personnel security and suitability investigations.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Executive Orders 10450 and 12356.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Records in this system are maintained to assist the Secretary and other responsible officials in determining whether the appointment and retention of HHS employees is clearly consistent with the national security and whether they are otherwise suitable for employment. This system contains records of certain applicants to and employees of each Department component. See also "Retrievability" below.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These records may be used as follows:
</p><p>(1) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(2) A record from this system of records may be disclosed as a "routine use" to a federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>(3) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use to the appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(4) Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>(5) In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>(6)  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>The records are maintained in security type vaults or safes or lock bar file cabinets with manipulation proof combination locks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The records are alphabetically indexed by name and date of birth of the individual subject of the file or by cross reference to another file. Access within HHS is limited to the Secretary, and on a need-to-know basis to other Department officials having program management responsibility.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Direct access is restricted to authorized OIG staff; access within HHS is limited to the Secretary, Under Secretary and other officials and employees on a need-to-know basis. Access to the safes in which the records are stored is limited to those OIG employees with appropriate security clearances and the lock combination.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Security investigative records on individuals who occupy sensitive positions are maintained during the term of their employment. Other security and suitability investigative records are maintained for ten years if subject to EO 10450. Other files may be destroyed after three years.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Security and Protection Division, Office of Investigations, OIG, Room 523B, Humphrey Bldg., U.S. Department of Health and Human Services, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Exempt. However, consideration will be given requests addressed to the system manager. For general inquiries, include the name and date of birth, and employment or other affiliation with the Department.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requestors should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Exempt. However, consideration will be given requests addressed to the systems manager. Requests for correction should reasonably identify the record and specify the information to be contested, the corrective action sought and the reasons for the correction with supporting justification.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Federal, state or local agencies maintaining civil, criminal, suitability or other relevant enforcement information or other pertinent information correspondence and material or data obtained during the course of the conduct of the investigations.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>Exempt from certain provisions of the Act under 5 U.S.C. 552a(k)(5). Pursuant to 45 CFR 5b.11(b)(2)(iv)(A), this system is exempt from the following subsections of the Act: (c)(3), (d)(1)-(4), and (e)(4) (G) and (H).
</p></xhtmlContent></subsection> </section>
<section id="09-90-0003" toc="yes">
<systemNumber>09-90-0003</systemNumber>
<subsection type="systemName">Criminal Investigative Files of the Inspector General HHS/OS/OIG.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Inspector General, HHS, Room 5409, Wilbur J. Cohen Bldg., 330 Independence Avenue, SW., Washington, DC 20201.
</p> <p>Region 1, Office of Investigations (OI), OIG, JFK Federal Building, Room 2475, Boston, Massachusetts 02203.
</p> <p>Region 2, OI, OIG, 26 Federal Plaza, Room 13-124, New York, New York 10278.
</p> <p>Region 3, OI, OIG, Public Ledger Bldg., 150 South Independence Mall West, Suite 326, Philadelphia, Pennsylvania 19106.
</p> <p>Region 4, OI, OIG, Atlanta Federal Office, 61 Forsyth Street, SW., Suite 5T18, Atlanta, Georgia 30303.
</p> <p>Region 5, OI, OIG, 233 North Michigan Avenue, Suite 1330, Chicago, Illinois 60601.
</p> <p>Region 6, OI, OIG, 1100 Commerce Street, Room 629, Dallas, Texas 75242.
</p> <p>Region 7, OI, OIG, 1201 Walnut, Suite 920, Kansas City, Missouri 64106.
</p> <p>Region 9, OI, OIG, 50 United Nations Plaza, Room 174, San  Francisco, California 94102.
</p> <p>Los Angeles Region, OI, OIG, 600 West Santa Ana Blvd., Suite 1100, Santa Ana, California 92701.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals relevant to a criminal investigation, including but not limited to the subjects of an investigation, complainants, and key witnesses where necessary for future retrieval.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Criminal investigative files and extracts from that file consisting of computerized case management and tracking files.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The Inspector General Act of 1978, 5 U.S.C. App. 3, authorizes Inspectors General to conduct, supervise, and coordinate investigations relating to the programs and operations of their respective agencies.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Pursuant to the Inspector General Act of 1978, 5 U.S.C. App. 3, this system is maintained for the purpose of conducting, documenting, and tracking investigations conducted by OIG or other investigative agencies regarding HHS programs and operations, documenting the outcome of OIG reviews of allegations and complaints received concerning HHS programs and operations, aiding in prosecutions brought against the subjects of OIG investigations, maintaining a record of the activities that were the subject of investigations, reporting the results of OIG investigations to other departmental components for their use in operating and evaluating their programs and the imposition of civil or administrative sanctions, and acting as a repository and source for information necessary to fulfill the reporting requirements of 5 U.S.C. App. 3.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>a. Information from this system of records may be disclosed to any other Federal agency or any foreign, State, or local government agency responsible for enforcing, investigating, or prosecuting violations of administrative, civil, or criminal law or regulation where that information is relevant to an enforcement proceeding, investigation, or prosecution within the agency's jurisdiction.
</p> <p>b. Information from this system of records may be disclosed to (1) The Department of Justice in connection with requests for legal advice and in connection with actual or potential criminal prosecutions or civil litigation pertaining to the Office of Inspector General, and (2) a Federal or State grand jury, a Federal or State court, administrative tribunal, opposing counsel, or witnesses in the course of civil or criminal proceedings pertaining to the Office of Inspector General.
</p> <p>c. Information in this system of records may be disclosed to a Federal, State, or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a license, grant or other benefit.
</p> <p>d. Information in this system of records may be disclosed to a Federal agency in response to its request in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.</p>
<p> e. Relevant information may be disclosed from this system of records to the news media and general public where there exists a legitimate public interest, e.g., to provide information on events in the criminal process, such as indictments, and where necessary, for protection from imminent threat to life or property.
</p> <p>f. Where Federal agencies having the power to subpoena other Federal agencies' records, such as the Internal Revenue Service, or issue a subpoena to the department for records in this system or records, the department will make such records available.
</p> <p>g. When the department contemplates that it will contract with a private firm for the purpose of collating, analyzing, aggregating or otherwise refining records in this system, relevant records will be disclosed to such contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>h. Disclosures may be made to organizations deemed qualified by the Secretary to carry out quality assessments.
</p> <p>i. Information from this system of records may be disclosed in the course of employee discipline of competence determination proceedings.
</p> <p>j. Disclosures may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.
</p> <p>k. Information from this system of records may be disclosed to the Department of Justice, to a judicial or administrative tribunal, opposing counsel, and witnesses, in the course of proceedings involving HHS, an HHS employee (where the matter pertains to the employee's official duties), or the United States, or any agency thereof where the litigation is likely to affect HHS, or HHS is a party or has an interest in the litigation and the use of the information is relevant and necessary to the litigation.
</p> <p>l. Information of this system of records may be disclosed to a Federal, State or local agency maintaining pertinent records, if necessary, to obtain a record relevant to a department decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant, or other benefit.
</p> <p>m. Information from this system of records may be disclosed to third party contacts, including public and private organizations, in order to obtain information relevant and necessary to the investigation of potential violations in HHS programs and operations, or where disclosure would enable the OIG to identify violations in HHS programs or operations or otherwise assist the OIG in pursuing on-going investigations.
</p> <p>n. A record may be disclosed to any official charged with the responsibility to conduct qualitative assessment reviews of internal safeguards and management procedures employed in investigative operations. This disclosure category includes members of the President's Council on Integrity and Efficiency and officials and administrative staff within their investigative chain of command, as well as authorized officials of the Department of Justice and the Federal Bureau of Investigation.
</p> <p>o. A record may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>The records, which take the form of index cards, investigative reports, microcomputer disks, drives and/or CDs, files and printed listings are maintained under secure conditions in limited access areas. Written documents and computer disks are maintained in secure rooms, in security type safes or in lock bar file cabinets with manipulation proof combination locks. Computer servers containing files are locked in controlled-access rooms. Laptops that may contain files are protected with whole-disk encryption.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrievable by manual or computer search of indices containing the name or Social Security number of the individual to whom the record applies. Records may be cross-referenced by case or complaint number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Records are maintained in a restricted area and accessed only by Department personnel. Access within OIG is strictly limited to authorized staff members. All employees are given instructions on the sensitivity of such files and the restrictions on disclosure. Access within HHS is strictly limited to the Secretary, Under-Secretary, and other officials and employees on a need-to-know basis. All files and printed materials are safeguarded in accordance with the provisions of the National Institute of Standards and Technology, OMB Memoranda, and HHS Information Security policies and guidelines.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Investigative files are retained for 10 years after completion of the investigation and/or action based thereon. Paper and computer indices are retained permanently. The records control schedule and disposal standards may be obtained by writing to the Systems Manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Inspector General, Room 5250, Wilbur J. Cohen Building, Department of Health and Human Services, 330 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Exempt. However, consideration will be given requests addressed to the system manager. For general inquiries, it would be helpful if the request included date of birth and Social Security number, as well as the name of the individual.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requestors should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the system manager at the address specified above, and reasonably identify the record, specify the information to be contested, and the corrective action sought with supporting justification.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>OIG collects information from a wide variety of sources, including information from the Department and other Federal, State, and local agencies, witnesses, complaints and other nongovernmental sources.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>In accordance with subsection (j)(2) of the Privacy Act, 5 U.S.C. 552a(j)(2), the Secretary has exempted this system from the access, amendment, correction, and notification provisions of the Act, 5 U.S.C. 552a(c)(3), (d)(1)-(4), (e)(3), and (e)(4)(G) and (H).
</p></xhtmlContent></subsection></section>
<section id="09-90-0005" toc="yes">
<systemNumber>09-90-0005</systemNumber>
<subsection type="systemName"> Safety Management Information System (HHS Accident, Injury and Illness Reporting System), HHS/OS/ASMB/OFE/OSOH.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>At Departmental, Regional and Headquarters facilities (see Appendix.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>1. HHS employees, including both civilian and commissioned corps personnel, who are involved in an accident which arises out of and in the course of their employment whether occurring on HHS premises or not and results in:
</p><p>a. A fatality.
</p> <p>b. Lost workdays beyond the day in which the accident occurred.
</p> <p>c. Nonfatal injuries which result in transfer to another job, termination of employment, medical treatment other than first aid, loss of consciousness or restriction of work or motion.
</p> <p>d. A possible tort claim.
</p> <p>e. A claim for compensation.
</p> <p>f. Property damage in excess of 50.00 dollars..
</p> <p>g. Interrupts or interferes with the orderly progress of work of other employees.
</p> <p>h. Radiation over exposure.
</p> <p>i. Biological exposure resulting in lost time of accidental release of biologicals where the public may be over-exposed.
</p> <p>2. Visiting scientists, contractor personnel, hospitalized patients, out-patients, employees of other Federal agencies, state or local governments or members of the public who suffer injury, illness or property damage on or in HHS premises or as a result of HHS activities.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system consists of a variety of information and supporting documentations resulting from the reporting and investigation of accidents which have resulted in injury, illness, property damage or the interruption or interference with the orderly progress of work. The records contain information about individuals involved in or experiencing accidents including but not limited to the severity of the injury, whether consciousness was lost, the type of injury, culmination of any injury, days lost from work if any, the nature of the injury, illness or disease, the body part affected, causal factors, weather factors, agency of accident, whether unsafe mechanical, physical, or personal acts or factors were involved, the accidents area of origin and if fire was involved, the type and form of materials involved. Property damage (both public and private) is noted through the property sequence number, who owned the property involved, property damage and actual or estimated monetary loss, the HHS installation number if appropriate and the year of manufacture or construction if appropriate. Identifiers relating to a particular accident include the organization, case number assigned, date and time of occurrence, state or territory, site, type and classification of accident, estimated amount of tort claims if appropriate, name of individual(s) involved, the social security number, sex, age, grade series and level, CSC series, address, other Departments notified of accident, duty status, activity at time of accident and time on duty before accident. Management's evaluation and corrective action taken or proposed is also noted.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 19 of the Occupational Safety and Health Act of 1970 (Pub. L. 91-596); U.S.C. 7902; 29 CFR part 1960; Executive Order No. 12196.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purpose of the system is to comply with the reporting and statistical analyses requirements of section 19 of the Occupational Safety and Health Act of 1970 (Pub L. 91-596) as amended (29 U.S.C. 668); U.S.C. 7902; 29 CFR part 1960; Executive Order 12196 and such other purposes as are described under routine uses of this system notice. The Safety Management Information System is a Department-wide system utilized by all organizational components of the Department. Thus in addition to the routine uses subsequently noted in this system notice there may be other ad hoc disclosures within the Department on an official business "need to know" basis.
</p> <p>a. Establish a written record of the causes of accidents.
</p> <p>b. Provide information to initiate and support corrective or preventive action.
</p> <p>c. Provide statistical information relating to accidents resulting in occupational injuries, illnesses, and/or property damage.
</p> <p>d. Provide management with information with which to evaluate the effectiveness of safety management programs.
</p> <p>e. Provide the means for complying with the reporting requirements of Section 19 of the Occupational Safety and Health Act of 1970 and such other reporting requirements as may be required by legislative or regulative requirements.
</p> <p>f. Provide such other summary descriptive statistics and analytical studies as necessary in support of the function for which the records are collected and maintained including general requests for statistical information without personal identification of individuals.
</p> <p>g. Information in these records is used by or may be disclosed to: a. The Office of Safety and Occupational Health, Office of the Secretary, HHS in the review of accident experience data to determine the adequacy of corrective actions, the effect of codes, standards and guides, the consolidation, summarization and dissemination of accident experience data throughout HHS and other Government Departments and agencies as needed or required. b. The supervisor, administrative officer or other official initiating and accident report, including each succeeding reviewing official in the chain of command through which the report passes to insure that corrective action, as needed and appropriate, is taken. c. Appropriately appointed Safety Directors, Officers, or others with safety responsibilities within the Department in the verifying, assembling, analyzing, summarizing and disseminating data concerning the accident experience in their areas of responsibility and the initiation of appropriate corrective action.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. To request from a Federal, state, local agency or private sources information relevant to the investigation of an accident and/or corrective action.
</p> <p>B. To respond to an inquiry from a member of Congress made on behalf of a constituent.
</p> <p>C. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim if successful, is likely to directly affect the operations of the Department of any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>D. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>E. In the event that a system of records maintained by this agency to carry out its function indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use to the appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>F.  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are or may be maintained on magnetic tapes, punchcards, lists, forms, discs, computer storage, in file folders, binders and index cards.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>1. At the Department level, the system is completely computerized with no other records normally maintained or retained in the Office of Safety and Occupational Health. Since individual indentifiers such as name, case number, and social security number are not within the computer storage banks, special programming would be required to extract individual records based on case number. Normal output consists of statistical reports and surveys including those required by the Department of Labor and Statistical Analysis in support of the Department occupational safety and health program for dissemination to the Principal Operating Components, Regions and Staff Offices.
</p> <p>2. The Principal Operating Components of the Department, their sub-components, Regional Offices and Staff Offices may maintain original or copies of the accident reports and supporting documentation by name, social security number, case number or cross reference.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Access to and use of those records is made available to those personnel having a legitimate need for the information (those whose duties require review or access) including inspecting or evaluating personnel. Records, which under the law, may not be disclosed such as information pertinent to national security or trade secrets are maintained separately, adequately safeguarded and released only in accordance with the law. When there is doubt regarding the release of information, the matter will be referred, in advance of release, to the Office of the General Counsel, HHS.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>All accident reports, records, logs, and other information relating to an accident are retained by the Principal Operating Components and their agencies, the Regional Offices and the Office of the Secretary for at least five years following the end of the calendar year in which the accident occurred. Specific occupational safety and health standards (such as the standards, covering the handing of carcinogenic chemicals) may be required to be kept for up to twenty years. Records may be retained indefinitely.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Office of Safety and Occupational Health, Department of Health and Human Services, 330 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Individuals wishing to inquire whether this system of records contains information about them should address their inquiries to one of the following as appropriate:
</p><p>1. If employed or formerly employed in a HHS Regional Office, the Regional Occupational Safety and Health Manager of the Region involved (see list and addresses under appendix).
</p> <p>2. If employed or formerly employed in a HHS Principal Operating Component or sub-agency, a staff office or the Office of the Secretary, the Occupational Safety and Health Manager of the component where employed with the exception of the Food and Drug Administration (see list and addresses under appendix). The contact for the Food and Drug Administration is:
</p><p>Privacy Act Coordinator, Food and Drug Administration, 5600 Fishers Lane, Rockville, Maryland 20857.
</p> <p>Individuals requesting information about this system of records should provide their full name, social security number, name and address of office and agency in which currently or formerly employed and the accident(s) case number if known.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Individuals wishing to gain access to or contest their records should contact the following in person or writing as appropriate; with the exception of Food and Drug Administration. See "Notification" above.
</p> <p>1. If employed or formerly employed in an HHS Regional Office, the Regional Occupational and Health Manager of the Region involved (see list and addresses under appendix).
</p> <p>2. If employed or formerly employed in an HHS Principal Operating Component or sub-agency, a staff office or the Office of the Secretary, the Occupational Safety and Health Manager of the component where employed. (See list and addresses under appendix.) Individuals requesting information in this system of records should provide their full name, social security number (on a purely voluntary basis), case number if known, time and brief description of the accident in which they were involved and the name and address of office in which employed. (Access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)), <i>Federal Register</i>, October 8, 1975, page 47410). </p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7), <i>Federal Register</i>, October 8, 1975, page 47411).</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The information in this system is obtained from the following sources: (1) The individual to whom the record pertains; (2) witnesses to the accident; (3) investigation officials (Federal, state, local); (4) medical personnel seeing the individual as a result of the accident; (5) supervisory personnel; (6) reviewing officials; (7) personnel offices; (8) investigative material furnished by Federal, state, or local agencies; (9) on site observations.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p>
<p><i>Appendix </i></p><p>Region I, HHS Regional Safety and Occupational Health Manager, John F. Kennedy Federal Building--Room 1503, Government Center, Boston, Massachusetts 02203.
</p><p>Region II, HHS Regional Safety and Occupational Health Manager, Federal Building--Room 3835, 26 Federal Plaza, New York, New York 10007.
</p><p>Region III, HHS Regional Safety and Occupational Health Manager, 3535 Market Street, Philadelphia, Pennsylvania 19101.
</p><p>Region IV, HHS Regional Safety and Occupational Health Manager, Suite 1503--101 Marietta Tower, Atlanta, Georgia 30323.
</p><p>Region V, HHS Regional Safety and Occupational Health Manager, 300 South Wacker Drive--35th Floor, Chicago, Illinois 60606.
</p><p>Region VI, HHS Regional Safety and Occupational Health Manager, 1200 Main Tower Bldg., Dallas, Texas 75202.
</p><p>Region VII, HHS Regional Safety and Occupational Health Manager, 601 East 12th Street--Room 566, Kansas City, Missouri 64106.
</p><p>Region VIII, HHS Regional Safety and Occupational Health Manager, 1961 Stout Street--Room 11037, Denver, Colorado 80202.
</p><p>Region IX, HHS Regional Safety and Occupational Health Manager, Federal Office Building--Room 8, 50 United Nations Plaza, San Francisco, California 94102.
</p><p>Region X, HHS Regional Safety and Occupational Health Manager, Arcade Plaza--Room 6003, 1321 Second Avenue, Seattle, Washington 98101.
</p><p>Health Care Financing Administration: Safety Officer, A-1 Gwynn Oak Building, 1710 Gwynn Oak Avenue, Woodlawn, Md. 21207.
</p><p>Social Security Administration: Director, Occupational Health Management, Rm. 8, Second Floor, Link Bldg., 6401 Security Boulevard, Baltimore, Maryland 21235.
</p><p>Office of the Secretary, HHS Safety Officer, 1073 HHS-N, Department of Health and Human Services, 330 Independence Avenue SW, Washington, DC 20201.
</p><p>Public Health Service: Director, Division of Health Facilities Planning, Room 18-42--Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857.
</p><p>Alcohol, Drug Abuse, and Mental Health Administration: Safety Officer, Room 12C26--Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857.
</p><p>Center for Disease Control: Chief, Office of Biosafety, Bldg. 4--Room 232, 1600 Clifton Road NE., Atlanta, Georgia 30333.
</p><p>Food and Drug Administration: Privacy Act Coordinator, Rockville, Maryland 20857.
</p><p>Health Resources Administration: Safety Officer, Rm. 129, Federal Center Bldg. 2, 3700 East-West Highway, Hyattsville, Md. 20782.
</p><p>National Institutes of Health: Chief, Occupational Safety and Health Branch, DS, ORS, Building 13, Room 3K04, 9000 Rockville Pike, Bethesda Maryland 20205.
</p></xhtmlContent></subsection></section>

<section id="09-90-0007" toc="yes">
<systemNumber>09-90-0007</systemNumber>
<subsection type="systemName"> Complaints and Inquiries Records--Miscellaneous, HHS/OS/ASPER.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Personnel offices shown in Applicants for Employment Records, HHS System 09-90-0006, Appendix 1 and offices of operating officials in organizational units serviced by those personnel offices.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Current and former employees of the Department.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system consists of records relating to an individual's employment status or conduct while employed by the Department. Examples of these records include: Correspondence from employees, Members of Congress, and members of the public alleging misconduct by an employee of the Department, miscellaneous complaints not covered by the Department's formal or informal grievance procedure, informal complaints handled by labor union officials, and miscellaneous debt correspondence received from creditors.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Executive Orders 11222, 10561 and 11491.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Records in this system are maintained to initiate, investigate and resolve various complaints and inquiries made by or against Department employees. See also "Retrievability" below.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Information in these records may be used:
</p><p>(1) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(2) In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>(3) A record from this system of records may be disclosed as a "routine use" to a federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>(4) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use to the appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(5) Where federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>(6) Where a contract between a component of the Department and a labor organization recognized under E.O. 11491 or 5 U.S.C. Chapter 71 provides that the agency will disclose personal records relevant to the organization's mission, records in this system of records may be disclosed to such organization.
</p> <p>(7) Office of Personnel Management, Merit Systems Protection Board (including its Office of the Special Counsel), Equal Employment Opportunity Commission, the Federal Labor Relations Authority (including the General Counsel of the Authority and the Federal Service Impasses Panel) the Federal Mediation and Conciliation Service, and to an arbitrator, in carrying out their functions.
</p> <p>(8) To respond to Members of Congress and members of the public with regard to complaints or inquiries presented by them.
</p> <p>(9) Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>(10) In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>(11)  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Filed in folders and index cards.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are filed by name. Records are used to produce summary descriptive statistics and analytical studies in support of the functions for which the records are collected and maintained and for related personnel management functions or pay studies; and for other purposes compatible with the intent for which the records system was created.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Access to and use of these records are limited to those persons whose official duties require such access.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained until there is no further administrative need for them, the individual leaves the Department, or one year has elapsed, and are then destroyed. (See HHS Personnel Instruction 293-1, Exhibit X293-1-2, item 7.)
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Personnel Officers shown in Appendix 1 to Applicants for Employment Records. HHS System 09-90-0006, who service organizational units in which individuals are employed.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Operating officials in organizational unit in which employee is employed or personnel officers shown as systems managers in Appendix 1 Applicants for Employment Records, HHS System 09-90-0006. Individuals should provide name, organization in which employed, and date of birth.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)), <i>Federal Register</i>, October 8, 1975, page 47410).</p> </xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction. (These procedures are in accordance with Department Regulations (45 CFR 5b.7), <i>Federal Register</i>, October 8, 1975, page 47411).</p> </xhtmlContent></subsection> <subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records is obtained: (1) Directly from the individual, or (2) derived from information supplied by the individual, or (3) from information supplied by members of the public, other employees, Members of Congress, Department management officials, or (4) from police and court records relevant to the complaint about the employee.
</p></xhtmlContent></subsection></section>
<section id="09-90-0008" toc="yes">
<systemNumber>09-19-0008</systemNumber>
<subsection type="systemName"> Conflict of Interest Records, HHS/OS/ASPER.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.</p></xhtmlContent>
</subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Personnel Offices of the Department (See Applicants for Employment Records, HHS System 09-90-0006, Appendix 1) or authorized approving officials to be identified by those Personnel Offices.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Incumbents of Department positions the duties of which are of such a nature that incumbent's outside activities may come in conflict with the incumbent's official duties.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system consists of a variety of records relating to an employee's conduct and outside activities. In addition to the name of the employee, position title, grade, salary, pay plan, and employing organization, the system includes information about outside employment, outside compensation and related information.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Executive Order 11222.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Records in this system are used to determine whether an employee's financial interests or outside activities are in conflict with the employee's duties as a Federal employee. Records are maintained in each component of the Department. See also "Retrievability" below.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Information in this system of records may be used: (1) By the Office of Personnel Management, Merit Systems Protection Board (including its Office of the Special Counsel), Equal Employment Opportunity Commission, and the Federal Labor Relations Authority (including the General Counsel of the Authority and the Federal Service Impasses Panel) the Federal Mediation and Conciliation Service, and to an arbitrator, in carrying out their functions.
</p> <p>(2) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(3) A record from this system of records may be disclosed as a "routine use" to a federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>(4) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use to the appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(5) Where federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issued a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>(6) The Department contemplates that it will contract with a private firm for the purpose of collating, analyzing, aggregating or otherwise refining records in this system. Relevant records will be disclosed to such a contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>(7) Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>(8) In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>(9)  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Conflict of Interest Records are maintained in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrievable by name. They may be used for production of summary descriptive statistics and analytical studies in support of the functions for which the records are collected and maintained and for other purposes compatible with the intent for which the records system was created.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>These records are treated as controlled for Official Use Only and made available only to persons specifically authorized to receive them.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained until 2 years after the individual discontinues the activity for which approval was required, or until the individual leaves the Department, and are then destroyed. (See HHS Personnel Instruction 293-1, Exhibit X293-1-1, item 25.)
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Personnel Offices of the Department shown in Appendix 1 to Applicants for Employment Records, HHS System 09-90-0006.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For incumbents who are in position under the Executive Schedule; Office of the Secretary Staff Office Heads; or Principal Regional Officials contact: Deputy Assistant Secretary for Personnel, Office of Personnel, Department of Health and Human Services, 200 Independence Avenue, SW, Washington, DC 20201.
</p> <p>For incumbents of positions in the Food and Drug Administration, contact: Director, Policy Management Staff, HFA-20, Food and Drug Administration, 5600 Fisher Lane, Rockville, Maryland 20857.
</p> <p>For incumbents of other positions included in this records system, contact the Personnel Office shown in Appendix 1 to Applicants for Employment Records, HHS System 09-90-0006, which services the organizational units in which the individual is employed. The individual should indicate name, position title, grade and series, and organization in which located.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)), <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction. (These procedures are in accordance with Department Regulations (45 CFR 5b.7), <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records is: (1) Supplied directly by the individual, or (2) derived from information supplied by the individual, or (3) supplied by Department officials or other persons such as trustee, attorney, accountant, relative.
</p></xhtmlContent></subsection></section>
<section id="09-90-0009" toc="yes">
<systemNumber>09-19-0009</systemNumber>
<subsection type="systemName"> Discrimination Complaints Records, HHS/OS/ASPER.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of the Deputy Assistant Secretary for EEO, 200 Independence Avenue, SW, Washington, DC 20201.
</p> <p>Offices of designated EEO Officers.
</p> <p>See Appendix 1 for exact locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals, classes of individuals or organizations which have consulted an EEO Counselor regarding discrimination on the basis of race, color, religion, sex, national origin, physical disability or age because of a determination or decision made by a Department official or which have filed a formal allegation of discrimination.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system of records contains information or documents concerning pre-complaint processing and formal allegations of discrimination. The records consist of counselors' reports, the initial allegations, letters or notices to the individual or organization, materials placed into the record to support or refute the decision or determination, statements of witnesses, investigative reports, instructions about action to be taken to comply with decisions, and related correspondence, opinions, recommendations, and final administrative actions.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Executive Order 11478, 42 USC 2000e and 29 USC 633a.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>These records are used to initiate, investigate, and resolve discrimination complaints within the Department. They are maintained in each component of the Department. See also "Retrievability" below.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These records and information in the records may be used:
</p><p>(1) To respond to a request from a Member of Congress regarding the status of an appeal, complaint or grievance;
</p><p>(2) To refer to Office of Personnel Management, Merit Systems Protection Board (including its Office of the Special Counsel), Equal Employment Opportunity Commission, the Federal Labor Relations Authority (including the General Counsel of the Authority and the Federal Service Impasses Panel) the Federal Mediation and Conciliation Service, and to an arbitrator, in carrying out their functions;
</p><p>(3) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule regulation or order issued pursuant thereto.
</p> <p>(4) In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>(5) A record from this system of records may be disclosed as a "routine use" to a federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>(6) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use to the appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(7) Where federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>(8) Where a contract between a component of the Department and a labor organization recognized under E.O. 11491 or 5 U.S.C. Chapter 71 provides that the agency will disclose personal records relevant to the organization's mission, records in this system of records may be disclosed to such organization.
</p> <p>(9) The Department contemplates that it will contract with a private firm for the purpose of collating, analyzing, aggregating or otherwise refining records in this system. Relevant records will be disclosed to such a contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>(10) Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.
</p> <p>(11) In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>(12)  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>These records are maintained in file folders, binders, and index cards.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>These records are indexed by the names of the individuals or organizations on whom they are maintained. They may be used as a data source for management information for production of summary descriptive statistics and analytical studies in support of the function for which the records are collected and maintained, or for related personnel management functions or manpower studies; and to locate specific individuals for personnel research or other personnel management functions.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Access to and use of these records are limited to those persons whose official duties require such access.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records are retained for four years after final disposition, and are then destroyed. (See HHS Personnel Instruction 293-1, Exhibit X293-1-1, item 26a(1).)
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>See Appendix 1.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Individuals and organizations which consulted an EEO counselor or filed a formal allegation of discrimination are aware of that fact. They may write the appropriate system manager indicated below or the general coordinator if the immediate system manager is unknown, regarding the existence of such records pertaining to them. The inquirers, as appropriate, should provide their name, date of birth, agency in which employed or agency in which the situation arose if different from employing agency, the approximate date, and the kind of action taken, when making inquiries about records.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)), <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reason for the correction. (These procedures are in accordance with Department Regulations (45 CFR 5b.7), <i>Federal Register</i>, October 8, 1975, page 47411.) </p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>a. Individual to whom the record pertains.
</p> <p>b. Department or other officials.
</p> <p>c. Statements from employees or other witnesses.
</p> <p>d. Official documents relating to the counseling or formal allegation.
</p> <p>e. Correspondence from specific organizations or persons.</p>
<p><i>Appendix 1 </i></p><p>List of Locations and System Managers for EEO Matters General Coordinator:
</p><p>Deputy Assistant Secretary for EEO, Room 509F, 200 Independence Avenue, SW, Washington, DC 20201
</p><p>System Managers
</p><p>Office of the Secretary, EEO Officer, Room 541F, Humphrey Building, 200 Independence Ave., SW, Washington, DC 20201
</p><p>Regional Offices
</p><p>Region I
</p><p>EEO Officer, Room 2411, JFK Federal Building, Boston, Massachusetts 02203
</p><p>Region II
</p><p>EEO Officer, Room 3838-D, 26 Federal Plaza, New York, New York 10278
</p><p>Region III
</p><p>EEO Officer, Room 9200, 11460 Market Street, Philadelphia, Pennsylvania 19101
</p><p>Region IV
</p><p>EEO Officer, 19th Floor, 101 Marietta Tower, Atlanta, Georgia 30323
</p><p>Region V
</p><p>EEO Officer, 35th Floor, 300 S. Wacker Drive, Chicago, Illinois 60606
</p><p>Region VI
</p><p>EEO Officer, Room 904, 1114 Commerce Street, Dallas, Texas 75202
</p><p>Region VII
</p><p>EEO Officer, Room 616D, 601 East 12th Street, Kansas City, Missouri 64106
</p><p>Region VIII
</p><p>EEO Officer, Room 1089, Federal Office Building, 1961 Stout Street, Denver, Colorado 80294
</p><p>Region IX
</p><p>EEO Officer, Room 413, 50 United Nations Plaza, San Francisco, California 94102
</p><p>Region X
</p><p>EEO Officer, Room 6132, Arcade Plaza Building, 1321 Second Avenue, Mail Stop 629, Seattle, Washington 98101
</p><p>Operating Divisions and Agencies
</p><p>Social Security Administration, EEO Officer, Room 739, Administration Building, 6401 Security Boulevard, Baltimore, Maryland 21235
</p><p>Health Care Financing Administration, EEO Officer, Room 793, East High Rise Building, 6401 Security Blvd., Baltimore, Maryland 21235
</p><p>Assistant Secretary for Health, EEO Officer, Room 9-A-54, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857
</p><p>Health Resources and Services Administration, EEO Officer, Room 14A-31, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857
</p><p>Food and Drug Administration, EEO Officer, Room 12-B-03, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857
</p><p>Alcohol, Drug Abuse and Mental Health Administration, EEO Officer, Room 17-C-20, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857
</p><p>National Institutes of Health, EEO Officer, Room 2-B-40, Building 31, National Institutes of Health, Bethesda, Maryland 20205
</p><p>Centers for Disease Control
</p><p>EEO Officer, Room 2405, Building 1, 1600 Clifton Road, NE., Atlanta, Georgia 30333
</p><p>Office of Human Development Services, EEO Officer, Room 336E, Humphrey Building, 200 Independence Ave., SW., Washington, DC 20201
</p></xhtmlContent></subsection> </section>
<section id="09-90-0010" toc="yes">
<systemNumber>09-19-0010</systemNumber>
<subsection type="systemName">Employee Assistance Program (EAP) Records, HHS/OS/ASAM/OHR.
</subsection> <subsection type="systemLocation"><xhtmlContent><p>Offices designated to provide counseling and/or other EAP services for employees of HHS and their family members and employees of other Federal agencies contracting with HHS for EAP services and their family members. Since there are thousands of counselors available to provide EAP services, contact the appropriate system manager in Appendix 1 for more details about specific locations.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>This system covers the records of all HHS employees and their family members using the services of the EAP. It also covers the records of other Federal employees and their family members using the EAP through a contractual agreement between HHS and their organizations. (The remainder of this notice will refer to all persons covered by the system as "EAP client(s)".) </p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system contains a written or electronic record on each EAP client. These records will contain the following information: client name, date of birth, grade, job title, home address, telephone numbers, and (when appropriate) supervisor name and telephone number. The system includes records of services provided by HHS staff as well as services provided by contractors.
</p> <p>Certain clinical information is also normally maintained in each record including a psychosocial history, assessment of personal concerns, information regarding referrals to facilities in the community, and all intervention outcomes. It may contain correspondence with program clients, including electronic mail and word processing applications.
</p> <p>If the client is referred to the EAP by a supervisor due to work performance or conduct problems or if there is another reason to be concerned about these issues, the record may contain information such as leave usage, work quality, inappropriate behavior, and reason for referral. It may also contain information about previous and on-going supervisory/organizational interventions to correct the problem.
</p> <p>When the client is referred to the EAP because of a positive drug or alcohol test (as required by the drug-free workplace provisions or Department of Transportation regulations), the record will also contain information about substance abuse assessment, treatment, aftercare, and substance use monitoring results.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 7361, 7362, 7901, 7904; 44 U.S.C. 3101.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The information contained in each record is a documentation of the nature and extent of the client's concerns. This information is necessary for the clinician to formulate and implement an intervention plan for resolving the concerns. When the intervention plan includes referral(s) to treatment or other facilities outside the EAP, the record also documents this referral information.
</p> <p>The information contained in each record is also used for monitoring the client's progress in resolving the concern(s).
</p> <p>Anonymous information from each record is also used to prepare statistical reports and to conduct research that helps with program management.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>(1) HHS may transfer records to contractors (e.g. private organization, individual, or other group such as an EAP consortium) for the purpose of providing EAP services for HHS employees and their family members and/or for employees of other Federal agencies and their family members.
</p> <p>(2) HHS may transfer records to contractors or employees of other Federal agencies for the purpose of destroying records at the end of the required period of maintenance, but only in accordance with contracts and inter-agency agreements requiring that:
</p><p>(A) A witness trained in the proper handling of confidential records will be present when any records are destroyed,
</p><p>(B) Records will be destroyed by shredding or burning,
</p><p>(C) Records stored on hard drives will be destroyed using software tools which ensure the protection of the confidential information by making reconstruction or compromise by reuse impracticable, and
</p><p>(D) Records located away from the destruction site shall be transferred to the destruction site in a confidential manner.
</p> <p>(3) HHS may disclose information from this system of records for litigation purposes when
</p><p>(A) HHS, or any of its components, or
</p><p>(B) Any HHS employee in his or her official capacity, or
</p><p>(C) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee, or
</p><p>(D) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components is a party to litigation, and HHS determines that such use of records is relevant and necessary to the litigation and would help in the effective representation of the government party. The disclosure may be made to the Department of Justice. Except where the records are covered by the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 CFR Part 2, the disclosure may be made to a court or other tribunal, or to another party before such tribunal. Any disclosure of records covered by 42 CFR part 2 must be pursuant to a qualified service organization agreement that meets the requirements of that part and must also comply with all other aspects of those regulations. The EAP Director (in ASAM) must personally approve any disclosure made under this routine use based on his or her determination that it is compatible with the purpose for which the records were collected.
</p> <p>(4) Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p> <p>Addendum: HHS may release statistical data (non-personal identifiers) derived from these records.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in written folders, computers, and on index type cards. They are stored according to a number of physical safeguards described below.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by a case code number, unique to the client utilizing the program. these numbers are cross-indexed by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>(1) Authorized Users: Access to these records is limited to EAP Administrators who work directly with clients of the program and their immediate staffs (including counselors, secretaries, and contract or consortia administrators, counselors or secretaries). HHS EAP Administrators and HHS EAP headquarters staff in OS/ASAM/OHR, as well as EAP Administrators and Coordinators from other Federal agencies who contract with HHS, whether or not they directly provide clinical services, may have access to the records for the purposes of program evaluation, destroying records at the end of the period of maintenance, and transferring records from one contractor to another. HHS may also contract with either a private organization or other Federal agency to destroy these records. The personnel of these record destruction organizations or agencies may have access to the records at the end of their period of maintenance for the purpose of transferring records from the EAP office to a destruction site and subsequently destroying the records.
</p> <p>(2) Physical Safeguards: All paper records are stored in metal filing cabinets equipped with at least combination locks and preferably locking crash bars. These file cabinets are in secured areas, accessible only to the EAP staff outlined above, and are locked when not in use. These records are always maintained separate from other systems of record. Computer containing records are discrete from other computer systems and/or are password protected. Computers are also stored in secured areas, accessible only to the EAP staff outlined above.
</p> <p>(3) Procedural Safeguards: All persons having access to these records shall already have been trained in the proper handling of records covered by the Privacy Act and 42 CFR part 2 (Confidentiality of Alcohol and Drug Abuse Patient Records). These acts restrict disclosures to unique situations, such as threats of physical harm, medical emergencies, and suspected child abuse, except where the client has consented in writing to such disclosure. Clients of the EAP will be informed in writing of the confidentiality provisions. Secondary disclosure of released information is prohibited without client consent.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained until three years after the client has ceased contact with the EAP or until any litigation is finally resolved. This will be true whether or not the client has terminated employment with HHS or another agency contracting with HSS for EAP services. Individual states may require longer retention. The rules in this system notice should not be construed to authorize any violation of such state laws that have greater restrictions.
</p> <p>Some HHS EAPs provide Substance Abuse Professional evaluations as part of Department of Transportation regulations. These records will be retained for five years after contact with the program has ceased or any litigation is completed. Individual states may require longer retention. The rules in this system notice should not be construed to authorize any violation of such state laws that have greater restrictions.
</p> <p>Files will be destroyed only after the required period of maintenance, with a witness present, by either (1) an HHS EAP Administrator or an EAP Administrator from another organization that contracts with  HHS for EAP services, or (2) by designated staff of a private or governmental organization under contract with HHS to provide document destruction services. The witness must be trained in the proper handling of records covered by the Privacy Act and 42 CFR part 2.
</p> <p>Written records will be destroyed by shredding or burning. Records stored on hard drives will be destroyed using software tools which ensure the protection of the confidential information by making reconstruction or compromise by reuse impracticable. Records contained on back-up tapes/diskettes will be disposed by either physically destroying the tapes/diskettes or be deleting them using software tools which ensure the protection of the confidential information by making reconstruction or compromise by reuse impracticable.
</p> <p>Records located away from the destruction site shall be transferred to the destruction site in the confidential manner required by HHS and GSA policies. The name and case coding number of the destroyed record will be maintained on a list of other destroyed records. No other information about EAP clients may be maintained once these files have been destroyed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The EAP records of HHS employees and their family members are managed by the EAP Administrators in the various regional and headquarters offices (Appendix 1). The EAP records of employees from other organizations contracting with HHS and their family members are managed by EAP administrators designated in their agreements with HHS.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>If an HHS employee and/or family member wishes to inquire about his or her record, a written inquiry should be addressed to the HHS system manager, responsible for the area where the counseling was provided (see Appendix 1). The individual should provide his or her name, organization where employed, date of birth, location of counseling, and approximate date of counseling. If a third party is making the request, a written consent from the client must accompany the request.
</p> <p>If an inquiry is made from an employee and/or family member from another Federal agency serviced by the HHS EAP, a written inquiry shall be made using the same procedures described above. It should be addressed to the HHS contact person found in Appendix A. If the contract to obtain services from HHS has terminated, the request should be made through the designated EAP representative at the other Federal agency.
</p> <p>In some limited situations, an EAP record is considered a medical record. A client requesting notification or access to a medical record shall, at the time the request is made, designate in writing a responsible individual who would be willing to review the record. Upon receiving a request, the EAP system manager shall weigh the need for disclosure against the potential injury to the EAP client, to other affected persons, to the physician-patient relationship, and to the treatment services. The EAP manager will then determine whether to disclose the record directly to the client or to the designated individual. If disclosed to the designated individual, he or she will inform the client of its content but only at his or her discretion.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requestors should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the EAP Administrator at the address found in Appendix 1, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records is: (1) Supplied directly by the individual using the program, or (2) supplied by a member of the employee's family, or (3) derived from information supplied by the employee, or (4) supplied by sources to/from whom the individual has been referred for assistance, or (5) supplied by Department officials (including drug testing officers), or (6) supplied by EAP counselors, or (7) supplied by other sources involved with the case.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p>
 <p><i>Appendix 1 </i></p><p>All HHS Regional Offices and Those in the Rockville, MD; Hyattsville, MD; and College Park, MD Areas </p><p>(except those listed below) and any other office not listed here
</p><p>Employee Assistance Program Director, Office of the Secretary, ASAM, 200 Independence Avenue, SW., Room 5-36E, Washington, DC 20201.</p>
<p>Centers for Disease Control and Prevention </p><p>(offices in the Atlanta, GA area)
</p><p>CDC Employee Assistance Program Administrator, Personnel Management Office, 1600 Clifton Road, NE., Mail Stop F05, Atlanta, GA 30333.</p>
<p>Southwest DC Complex </p><p>Employee Assistance Program Administrator, Program Support Center, 330 C Street, SW., Room 1250, Washington, DC 20201</p><p>Centers for Medicare and Medicaid Services </p><p>(all locations)
</p><p >HCFA Employee Assistance Program Administrator, 7500 Security Boulevard, S1-23-27, Baltimore, MD 21244</p><p>National Institutes of Health </p><p>(headquarters location)
</p><p>NIH Employee Assistance Program Administrator, Building 31, Room 1C02, 9000 Rockville Pike, Bethesda, MD 20892</p><p>All Other Organizations Contracting With HHS </p><p>Program Support Center, Federal Occupational Health, Employee Assistance Program, Two Illinois Center, 233 North Michigan Avenue, Suite 270, Chicago, IL 60601-5519</p><p>
</p></xhtmlContent></subsection> </section>


<section id="09-90-0014" toc="yes">
<systemNumber>09-19-0014</systemNumber>
<subsection type="systemName"> Grievances filed under part 771 of 5 CFR, HHS/OS/ASPER.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Personnel Systems Integrity, Department of Health and Human Services, Room 2046, Switzer Building, 330 Independence Ave., SW, DC 20201. Personnel Offices shown in Applicants for Employment Records, HHS System 09-90-0006, Appendix 1 and offices of operating officials in organizational units serviced by those personnel offices.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Department employees individually or as a group who have requested personal relief in a matter of concern or dissatisfaction which is subject to the control of Department management.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Information or documents relating to the grievance and personal relief sought; documented materials used in consideration of the grievance, and correspondence related to disposition of the grievance.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 1302, 3301, 3302; Executive Order 10577.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Records in this system are used to initiate, consider, and resolve employee grievances filed under part 771 of 5 CFR. These records are maintained in each component of the Department. See also "Retrievability" below.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Information in this system of records may be used:
</p><p>(1) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(2) In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>(3) A record from this system of records may be disclosed as a "routine use" to a federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>(4) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use to the appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(5) Where federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>(6) Where a contract between a component of the Department and a labor organization recognized under E.O. 11491 provides that the agency will disclose personal records relevant to the organization's mission, records in this system of records may be disclosed to such organization.
</p> <p>(7) The Department contemplates that it will contract with a private firm for the purpose of collating, analyzing, aggregating or otherwise refining records in this system. Relevant records will be disclosed to such a contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>(8) By the Office of Personnel Management, Merit Systems Protection Board (including its Office of the Special Counsel), Equal Employment Opportunity Commission, and the Federal Labor Relations Authority (including the General Counsel of the Authority and the Federal Service Impasses Panel) in carrying out their function.
</p> <p>(9) Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>(10) In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>(11)  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>The records are maintained in file folders, binders and index cards.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are indexed by name of individual filing the grievance. Information from this system may be used by Department officials for preparing statistical summary or management reports.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Records maintained by management are stored in secured rooms with access limited to those whose official duties require access.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained for 3 years after the grievance case is closed, and are then destroyed. (See HHS Personnel Instruction 293- 1, Exhibit X293-1-1, item 31a.)
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Heads of personnel offices which service organizational units in which employees who submit informal grievances are located. See Applicants for Employment Records, HHS System 09-90-0006, Appendix 1.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Individuals who have filed grievances are aware of that fact and have been provided information in writing concerning the disposition of the grievance. They may contact the official who signed the written notice, or the System Manager indicated above. They should provide their name, organization in which employed and date of birth and approximate date of the filing of the grievance.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested and state the corrective action sought and the reasons for the correction. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records is: (1) Supplied directly by the individual, or (2) derived from information supplied by the individual, or (3) supplied by Department officials.
</p></xhtmlContent></subsection></section>
<section id="09-90-0015" toc="yes">
<systemNumber>09-19-0015</systemNumber> <subsection type="systemName"> Grievance Records Filed Under Procedures Established by Labor-Management Negotiations, HHS/OS/ASPER.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Personnel offices shown in Applicants for Employment Records, HHS System 09-90-0006, Appendix 1 and offices of operating officials in organizational units serviced by those personnel offices.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Current Federal employees of the Department covered by a collective bargaining agreement.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system of records consists of a variety of records relating to an employee's grievance filed under procedures established by labor-management negotiations. Examples of information which may be included in this system of records are the employee's name, SSN, grade, job title, testimony of witnesses, material placed into the record to support the decision, the arbitrator's decision, the arbitrator's report, and a record of an appeal to the Federal Labor Relations Authority.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Title 5, United States Code, Chapter 71.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Records in this system are used to initiate, consider, and resolve employee grievances filed under procedures established by labor- management negotiations. These records are maintained in each component of the Department. See also "Retrievability" below.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Information in this system may be released to:
</p><p>(1) The Office of Personnel Management, Merit Systems Protection Board (including its office of the Special Counsel), and the Equal Employment Opportunity Commission, in carrying out their functions.
</p> <p>(2) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(3) In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>(4) A record from this system of records may be disclosed as a "routine use" to a federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concering the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>(5) In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use to the appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>(6) Where federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>(7) Where a contract between a component of the Department and a labor organization recognized under E.O. 11491 or 5 U.S.C. Chapter 71 provides that the agency will disclose personal records relevant to the organization's mission, records in this system of records may be disclosed to such organization.
</p> <p>(8) The Department contemplates that it will contract with a private firm for the purpose of collating, analyzing, aggregating or otherwise refining records in this system. Relevant records will be disclosed to such a contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>(9) The Department of Labor.
</p> <p>(10) The Federal Labor Relations Authority including the General Counsel of the Authority and the Federal Service Impasses Panel.
</p> <p>(11) Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>(12) In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>(13)  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrievable by name. Information from this system may be used by Department officials for preparing statistical summary or management reports.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Records maintained by management are stored in secured rooms with access limited to those whose official duties require access.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>As negotiated by the local parties to the contract. If not covered by contract, records are retained for 3 years after the grievance case is closed and are then destroyed. (See HHS Personnel Instruction 293-1, Exhibit X293-1-1, item 31a.)
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Personnel Officers shown in Applicants for Employment Records, HHS System 09-90-0006, Appendix 1 who service the organizational unit in which the individual is employed.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Same as above. Individuals should include their name, grade, title and organizational unit when contacting the system manager.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410).</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411).</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records is: (1) Supplied directly by the individual, or (2) derived from information supplied by the individual, or (3) supplied by testimony of witnesses, or (4) supplied by union officials, or (5) supplied by Department officials.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>


<section id="09-90-0020" toc="yes">
<systemNumber>09-19-0020</systemNumber>
<subsection type="systemName"> Suitability for20Employment Records, HHS/OS/ASPER.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Personnel Offices listed in "Applicants for Employment Records" HHS System 09-90-0006, Appendix I.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Employees of the Department and applicants for employment.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system consists of a variety of records relating to an individual's suitability for employment in terms of character, reputation and fitness, including letters of reference, and responses to pre-employment inquiries. National Agency Checks and inquiries material received from the Office of Personnel Management, the Merit Systems Protection Board, and the U.S. Office of Special Counsel relating to nonsensitive positions, qualifications and character investigations, and other information which may relate to the suitability of the individual for the position.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 3301, 3302, 7301; Executive Order 10577; Executive Order 11222.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Records in this system are used by the designated appointing and selecting authorities to make determinations concerning the individual's suitability for employment. These records are maintained at ASPER, OPDIV Headquarters and field offices, and Regional Personnel Offices.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Information in these records may be used by the Office of Personnel Management, Merit Systems Protection Board, U.S. Office of Special Counsel, Equal Employment Opportunity Commission, and the Federal Labor Relations Authority (including the General Counsel of the Authority and the Federal Service Impasses Panel) in carrying out their functions.
</p> <p>2. In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, state, local, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>3. In the event the Department deems it desirable or necessary in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>4. A record from this system of records may be disclosed as a "routine use" to a federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>5. When federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>6. When a contract between a component of the Department and a labor organization recognized under 5 U.S.C. Chapter 71 provides that the agency will disclose personal records relevant to the organization's mission, records in this system of records may be disclosed to such organization.
</p> <p>7. The Department contemplates that it will contract with a private firm for the purpose of collating, analyzing, aggregating or otherwise refining records in this system. Relevant records will be disclosed to such a contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>8. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>9. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>10.  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file folders and in electronic form.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are indexed by any combination of name, date of birth, Social Security Number, or identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Data in electronic form are accessed by passwords known only to those whose official duties require access.
</p> <p>2. Physical Safeguards: File cabinets and rooms where records are stored are locked when not in use. During regular business hours, rooms are unlocked but are controlled by on-site personnel.
</p> <p>3. Procedural and Technical Safeguards: A password is required to access files maintained in electronic form. Passwords are changed frequently. All users of the information (see Authorized Users, above) protect information from public view and from unauthorized personnel entering an unsupervised office.
</p> <p>These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," and the Department's Automated Information System Security Program Handbook, and the National Institute of Standards and Technology Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31).
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records from the Office of Personnel Management, the Merit Systems Protection Board, and the U.S. Office of Special Counsel concerning applicants for or incumbents of nonsensitive positions, are retained until a decision is reached on whether to hire or retain the applicant or incumbent, and are then destroyed. Other records in this system are retained until there is no further administrative need for them, the individual leaves the Department, or three years have elapsed, whichever is later, and are then destroyed. Paper copies are destroyed by shredding. Computer files are destroyed by deleting the record from the file.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Heads of personnel offices which service organizational units in which the individual is employed or in which he/she applied for employment. See Applicants For Employment Records, HHS, System 09-90-0006, Appendix 1.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager as indicated above. The requester must verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be. The request should include the requester's name, date of birth, and organization in which employed or to which he or she applied for employment. The requester must understand that knowing and willful request for a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>To obtain access to records, write to the System Manager as indicated above to obtain access to records and provide the same information as is required under the Notification Procedures. Requesters should reasonably specify the record contents being sought. Individuals may also request an accounting of disclosure of their records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Records that contain information that is inaccurate, incomplete, untimely, or irrelevant may be contested. To contest such information, individuals should contact the System Manager specified above. They should reasonably identify the record, specify the information contested, the corrective action sought, and state their reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information contained in the system is obtained from:
</p><p>&#149;Applications and other personnel and security forms furnished by the individual.
</p> <p>&#149;Information furnished by other Federal agencies.
</p> <p>&#149;Information provided by sources such an employers, schools, references, former employers.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>Individuals will be provided information from the above system except when in accordance with the provisions of 5 U.S.C. 552a(k)(5): 1. disclosure of such information would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence; or 2. if the information was obtained prior to the effective date of section 3, Pub. L. 93-579, disclosure of such information would reveal the identity of a source who provided information under an implied promise that the identity of the source would be held in confidence. (45 CFR 5b.11.) </p></xhtmlContent></subsection>
</section>

<section id="09-90-0024" toc="yes">
<systemNumber>09-19-0024</systemNumber>
<subsection type="systemName">HHS Financial Management System Records.
</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified</p>
</xhtmlContent>
</subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>Servers for the electronic systems are located in Bethesda, Maryland (primary facility) and Sterling, Virginia (backup facility).  Beginning approximately December 2015, the primary hosting locations will be Austin, Texas, and Bethesda, Maryland, and the backup locations will be Colorado Springs, Colorado and Sterling, Virginia. </p>

<p>Source documents used to enter data into the electronic systems, and supporting records providing additional background information, are maintained in finance offices and/or in the relevant administrative and/or program office(s), or by a designated claims officer apart from the finance office.  See Appendix 1 for finance office locations.</p>

</xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>Records pertain to individuals who receive or are entitled to a payment from HHS, and individuals who pay or owe money to HHS.  Individuals receiving payments include, but are not limited to, members of the public who have established a claim against HHS, such as under the Federal Tort Claims Act; HHS employees who receive award payments, reimbursements for official travel and training expenses, subsidies for mass transit expenses, and similar payments; HHS grantees, contractors and consultants; Fellows; and recipients of HHS loans and scholarships.  Individuals owing monies include, but are not limited to, individuals who have been overpaid and who owe HHS a refund, and individuals who have received goods or services from HHS for which there is a charge or fee (e.g., Freedom of Information Act requesters).</p>
</xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>The records consist of accounts payable records and accounts receivable records pertaining to individual payees/obligees and individual payors/obligors, excluding payroll records and records used to collect and manage delinquent federal debts, which are covered in separate systems of records.  The records contain the individual"s name, identification number/Social Security Number (SSN) or EIN/TIN, mailing address, e-mail address, phone number, purpose of payment or request for payment, bank account and routing numbers, accounting classification, and the amount paid.  Accounts receivable records pertaining to an overpayment or outstanding charge, fee, loan, grant, or scholarship will also include the amount of the indebtedness, the repayment status, and the amount to be collected.  </p>

</xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>31 U.S.C. 3512, 3711, 3716, 3721, 1321 note; E.O. 13520</p>

</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>Relevant HHS personnel use the records on a need-to-know basis to process and track payments made and monies owed to or by individuals and HHS, and to ensure that payments by HHS are based on an official commitment and obligation of government funds.  When an individual is required to repay funds that have been advanced to him (e.g., as a loan or scholarship), records are used to establish a receivable record and to track repayment status.  In the event of an overpayment to an individual, records are used to establish a receivable record for recovery of the amount claimed. Records of payments and uncollectible debts are also used to develop reports of taxable income to the Internal Revenue Service (IRS) and applicable state and local taxing officials.  </p>

<p>Records in this system of records that pertain to overdue and delinquent federal debts are also used for debt collection purposes, as described in the SORN published for System of Records No. 09-40-0012 "Debt Management and Collection System."</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>Records from this system of records may be disclosed to the following parties outside HHS, without the individual"s consent, for these purposes:</p>
<p>1. Records will be routinely disclosed to the Treasury Department for purposes of verifying payment eligibility using Treasury"s "Do Not Pay" (DNP) system and effecting payments.  Records may also be disclosed to Treasury pursuant to a DNP computer matching agreement between HHS and Treasury for purposes authorized by 31 USC 3321 note and E.O. 13520, if the matching program requires data from this system of records.</p>
<p>2. Records may be disclosed to Members of Congress concerning a federal financial assistance program in order for Members to make informed opinions on programs and/or activities impacting legislative decisions. Also, disclosure may be made to a Congressional office from an individual's record in response to a written inquiry from the congressional office made at the written request of the individual in order to be responsive to the constituency.</p>
<p>3. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate public authority, whether federal, foreign, state, local, tribal, or otherwise, responsible for enforcing, investigating, or prosecuting the violation or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to the enforcement, regulatory, investigative, or prosecutorial responsibility of the receiving entity.</p>
<p>4. A record from this system may be disclosed to a federal, foreign, state, local, tribal or other public authority of the fact that this system of records contains information relevant to the hiring or retention of an employee, the issuance or retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant or other benefit.  The other agency or licensing organization may then make a request supported by the written consent of the individual for further information if it so chooses.  HHS will not make an initial disclosure unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another federal agency for criminal, civil, administrative, personnel, or regulatory action. </p>
<p>5. Where federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service (IRS) or the U.S. Commission on Civil Rights, issue a subpoena to HHS for records in this system of records, HHS will make such records available; provided, however, that in each case, HHS determines that the disclosure is compatible with the purpose for which the records were collected.</p>
<p>6. Information may be disclosed to a labor organization recognized under E.O. 11491 or 5 USC Chapter 71, when a contract between a component of the Department and the labor organization provides that the agency will disclose personal records when relevant and necessary to the organization's duties of exclusive representation concerning civilian personnel policies, practices, and matters affecting working conditions. </p>
<p>7. A record may be disclosed to the Department of Justice (DOJ) or to a court or other tribunal when:</p>
<p>a. HHS, or any component thereof; </p>
<p>b. any HHS employee in his/her official capacity; </p>
<p>c. any HHS employee in his/her individual capacity where DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or </p>
<p>d. the United States Government, </p>
<p>is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that, therefore, the use of such records by the DOJ, court, or other tribunal is deemed by HHS to be compatible with the purpose for which HHS collected the records.</p>
<p>8. A record about a loan applicant or potential contractor or grantee may be disclosed from the system of records to credit reporting agencies to obtain a credit report in order to determine the individual"s creditworthiness and ability to repay debts to the federal government.</p>
<p>9. When an individual applies for a loan under a loan program as to which the Office of Management and Budget (OMB) has made a determination under I.R.C. 6103(a)(3), a record about his/her application may be disclosed to the Treasury Department to find out whether he/she has a delinquent tax account, for the sole purpose of determining the individual"s creditworthiness.</p>
<p>10. Information from this system of records is used to report, to the Internal Revenue Service and applicable state and local governments, items considered to be income to an individual; for example, certain travel-related payments to employees, and all payments made to individuals not treated as employees (e.g., fees to consultants and experts).</p>
<p>11. A record may be disclosed to banks enrolled in the Treasury Credit Card Network to collect a payment or debt by credit card when the individual has given his/her credit card number for this purpose.</p>
<p>12. Information may be disclosed to federal agencies and Department contractors, grantees, consultants, or volunteers who have been engaged by HHS to assist in accomplishment of an HHS function relating to the purposes of the system of records and that need to have access to the records in order to assist HHS in performing the activity.  Any contractor will be required to comply with the requirements of the Privacy Act of 1974.</p>
<p>13. Information may be disclosed to the Office of Management and Budget (OMB) at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular A-19.</p>
<p>14. Information may be disclosed to a public or professional auditing organization for the purpose of conducting financial or compliance audits.</p>
<p>15. Information may be disclosed to insurance companies and parties such as common carriers and warehousemen in the course of settling an employee"s claim against the Department for lost or damaged property.</p>
<p>16. Information from this system may become available to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.</p>
<p>17. Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance. </p>

<p>Records may also be disclosed to parties outside HHS, without the individual"s consent, for any of the purposes authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(b)(12).  See System of Records No. 09-40-0012 "Debt Management and Collection System" for additional routine use disclosures that may be made from that system, with respect to records of federal debts from this system that are used for debt management and collection purposes.</p>

<p>Disclosure to consumer reporting agencies:</p>
<p>Disclosure pursuant to 5 USC 552a(b)(12):  Disclosure may be made from this system to "consumer reporting agencies" as defined in 31 USC 3701(a)(3), reflecting that an individual is responsible for a claim (whether current or overdue), in order to aid in the collection of the claim, typically by providing an incentive to the individual to repay the claim or debt timely, by making it part of the individual"s credit record.  Disclosure of records is limited to the individual"s name, address, Social Security Number, and other information necessary to establish the individual"s identity; the amount, status and history of the claim; and the agency or program under which the claim arose.  The disclosure will be made only after the procedural requirements of 31 USC 3711(e) have been followed. </p>
</xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p>
<p>Electronic records are stored on computer disc pack and magnetic tape at central computer sites.  Hard copy documents are stored in paper file folders.</p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Records are retrieved by an individual"s name, Social Security Number (SSN) or Taxpayer Identification Number (TIN); and/or by document or batch identifier.</p>

</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>&#8226;?Physical Safeguards: Hard-copy records and electronic storage media are secured during nonbusiness hours in locked file cabinets or locked storage areas, in buildings protected by cameras and security guards. </p>
<p>&#8226;?Procedural Safeguards: Authorized users are limited to employees and officials who are directly responsible for programmatic or fiscal activity, including administrative personnel, financial management personnel, computer personnel, and managers who have responsibilities for implementing HHS-funded programs.  User access is restricted based on role and is controlled by unique user name and password.  Passwords are required to be complex and to be changed at least every 60 days.  Users protect information from the view of unauthorized persons entering the workspace while the records are in use. </p>
<p>&#8226;?Technical Safeguards: Electronic records are secured with password protection and encryption. The electronic system is secured with firewalls and intrusion detection systems.  </p>
</xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p> Records are retained and disposed of in accordance with General Records Schedule (GRS) 1.1, Financial Management and Reporting Records, which provides for records to be retained for six years after final payment or cancellation, or longer if required for business use.  </p>
</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>The System Manager for the overall system of records is the HHS Assistant Secretary for Financial Resources, 200 Independence Avenue, SW " Room 514G, Washington, DC 20201.</p>

<p>The System Manager for records pertaining to a particular component of HHS is the Finance Officer in the relevant finance office listed in Appendix 1. </p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>An individual who wishes to know if this system contains records about him or her may make a notification request.  The request must be made in writing or in person and must be addressed to the relevant System Manager. The individual must show proof of identity and must provide his or her name and Social Security Number, purpose of payment or collection (travel, grant, etc.), and, if possible, the agency accounting classification.</p>
</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Same as notification procedure.  To request access to his or her record, the individual must clearly specify the record contents being sought.  The individual may also request an accounting of disclosures that have been made of his or her records, if any. </p>

</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>Same as notification procedure.  To contest information about him or her, the individual must reasonably identify the record; specify the information being contested, the corrective action sought, and the reasons for requesting the correction; and provide supporting justification showing how the record is inaccurate, incomplete, untimely, or irrelevant.</p>
</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>Information is obtained directly from individual record subjects; from contractors, private companies, or other government agencies; and from documents submitted to or received from a budget, accounting, travel, training, or other program office.</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.</p></xhtmlContent></subsection></section>

<section id="09-90-0025" toc="yes">
<systemNumber>09-19-0025</systemNumber>
<subsection type="systemName"> Central Registry of Individuals Doing Business With HHS, HHS/OS/ASMB 2.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Division of Financial Operations and Fiscal Procedures, Room 739D1, Humphrey Building, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who are the recipients of Federal Domestic Assistance Grants, or of contracts awarded by HHS.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>An index of names, addresses and identification number (SSN) of the individual doing business with HHS. No other personally identifiable data are maintained. The index is termed public information since data relative to Federal Domestic Assistance and Contracts are public information.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>This registry is maintained to provide a standard code to uniquely identify entities, including individuals, together with mailing address and other characteristic data to all principal operating components, agencies, regional offices and staff offices of the Department. The use of a single code per entity in all Departmental data systems enhances communication with an entity, as well diminishing the need to maintain duplicative data and files at various locations. Major categories of entities in the central file are those awarded contracts and awarded grants under Federal Domestic Assistance programs. Only those persons in the Department with a "need to know" have access to the published registry and to the automated records.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>a. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>b. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>c. In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>d. A record from this system of records may be disclosed as a "routine use" to a federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>e. Where federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>f. Where a contract between a component of the Department and a labor organization recognized under E.O. 11491 provides that the agency will disclose personal records relevant to the organization's mission records in this system of records may be disclosed to such organization.
</p> <p>g.  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Hard copy code booklets are manually filed at agency and regional office sites; and on disc pack and magnetic tapes at central computer sites.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Record may be found in the Code Book by either name or social security number; record in the disc pack and on magnetic tape is indexed by social security number. The Code Book provides a listing of data processing numbers for grant, contract and financial transactions. These numbers are used to access the name and address of the individual in the Automated Library (Central Registry). The information is used for check preparation, reports, mailings, etc.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Safeguards to insure integrity of records, and that required to provide protection against loss by accident or carelessness.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are purged from the automated file each two years; only persons actively dealing with HHS remain on file. Code Books are replaced each year. Inactive books are destroyed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Deputy Assistant Secretary, Finance, Department of HHS, Office of the Secretary, Room 705D1, Humphrey Building, 330 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Inquiries are to be made, either in writing or in person, to the organization listed under "location". Give name and social security number.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under System Location, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Grant and Contract documents. Names, social security numbers and addresses are provided by the individual when applying for a grant or contract from the Department.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>

<section id="09-90-0027" toc="yes">
<systemNumber>09-19-0027</systemNumber>
<subsection type="systemName"> Congressional Correspondence Unit, HHS/OS/ASL.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Room 435G Humphrey Building, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>Members of Congress indexed by name.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Control information recording, direct inquiries and referrals of constituents' inquiries from Members of Congress, and responses to those inquiries, regarding the Department's activities, including, but not necessarily limited to: a. General program activities of the Department; b. individual case problems of named persons, families or institutions; c. employment or appointment interests. Control slips identifying the correspondent, the constituent on whose behalf the inquiry is made, the constituent's social security number if inquiry relates to a social security case, and a summary of the subject matter of the inquiry.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To provide response to inquiries from a member of Congress made on behalf of a constituent regarding the Department's activities, including, but not limited to general program activities of the Department.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Inquiries which do not pertain to HHS, but fall under the jurisdiction of another Federal Agency, are transferred to that Agency with a request that a direct response be provided to the correspondent. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Maintained on magnetic (floppy) disks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are indexed alphabetically by name of the Members of Congress. Inquiries are forwarded to the HHS Agency which has jurisdiction over the subject matter for preparation of a response.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Records are kept in office with access limited to those whose official duties require access.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are reviewed biannually, and maintained for two years.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Congressional Liaison Office, Office of the Assistant Secretary for Legislation, Room 417 H Humphrey Bldg, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>System Manager; address same as above. The name of the person who corresponded with the Department with reference to the constituent and the approximate date of that correspondence must be provided.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The information in CCU files is provided by the correspondent and by the agency which prepares the final response.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>


<section id="09-90-0037" toc="yes">
<systemNumber>09-19-0037</systemNumber>
<subsection type="systemName"> Secretariat Correspondence Control System, HHS/OS/ES.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Room 602C, Humphrey Bldg., 200 Independence Avenue SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who have contacted the Secretary, the Under Secretary, or other HHS officials, or who have been contacted in writing to them.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Control information from the Secretary's, Under Secretary's, or other HHS officials' correspondence to include a subject narrative, organization drafting the response, and type of action required from the Department. This information is contained on hardcopy printouts, computer magnetic tape, and computer disk units.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To provide for the Secretary, the Assistant Secretaries, and the Operating Divisions the capability to control, track and update document records as the documents are processed within the Department.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained as follows: Hardcopy printouts are stored in standard file cabinets in a locked area; computer records are stored on either magnetic tape resident in a computer tape library, or, an on-line computer disk unit at the operational computer site.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are indexed chronologically by date of correspondence and also by name, subject and numerical control number. Records are available to staff responsible for preparation of responses to inquiries and to the staff of the Executive Secretariat(s). Records are used for control and reference purposes in staffing out issues and correspondence of concern to the Secretary, the Under Secretary, or operational divisions/staff office heads.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Direct access is limited to the staff of the Executive Secretariat and OP DIV. staff control personnel to both hardcopy and computer resident records. Access is limited during non-working hours to the hardcopy records to these individuals with keys to both the file cabinets and rooms where the records are stored. Remote computer terminal locations are protected with individual user identification numbers and passwords to the computer system. Where possible, computer terminal locations are locked during non-working hours.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Hard copy records are retired to the National Archives after three years. Control records are maintained for three years. Computer records are purged after correspondence is finalized to a history file.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Executive Secretary to the Department, Room 636G, Humphrey Bldg., 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Inquiries should be addressed to the System Manager. The inquirer should indicate the individual with whom the Secretary, Under Secretary, or OP DIV. staff office head corresponded, the date of the incoming correspondence and the date of the outgoing correspondence from the Secretary, the Under Secretary, of OP DIV. staff office head. Address is same as above.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Computer records are derived from the incoming correpondence for the Secretary and the Under Secretary.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0038" toc="yes">
<systemNumber>09-19-0038</systemNumber>
<subsection type="systemName"> Secretary's Official Files, HHS/OS/ES.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Room 636G, Humphrey Building, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who have contacted the Secretary or the Under Secretary or who have been contacted in writing by them.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Hard copies of documents signed or initialed by the Secretary or the Under Secretary.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The Secretary's Official Files are maintained to preserve the historical record of actions taken by the decisions made by the Secretary and the Under Secretary of the Department of Health and Human Services.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. In the event of litigation where the defendant is (a) the Department, and component of the Department, or any employee of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>The records are maintained in hard copy filed in standard file cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are indexed by subject, name, organization, and key words. Records are available to the staff of the Executive Secretariat and the Immediate Office of the Secretary for reference purposes in staffing out issues of concern to the Secretary of the Under Secretary.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Direct access is limited to the staff of the Executive Secretariat. Access is limited during non-working hours to individuals with keys to the file room.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained for three years and are then sent to the National Archives.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Executive Secretary to the Department, Room 636G, Humphrey Building, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Inquiries should be addressed to the system manager at the above address. The inquirer should indicate the subject matter of the issue involved, the date of the subject documents, and the author and/or addresses.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as above.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Same as above. In addition indicate corrective action sought and reason for corrections with supporting justification.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Records are derived from documents signed or initialed by the Secretary of the Under Secretary.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None. </p></xhtmlContent></subsection> </section>
<section id="09-90-0039" toc="yes">
<systemNumber>09-19-0039</systemNumber>
<subsection type="systemName">National Disaster Claims Processing System.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection><subsection type="systemLocation"><xhtmlContent><p>Office of Emergency Preparedness (OEP), 12300 Twinbrook Parkway, Rockville, MD 20852.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals requiring definitive medical care at an NDMS hospital as the result of a medical condition caused by, or exacerbated by, a natural or technical disaster, or a terrorist act.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Medical claims data will be in uniform claim forms accepted by the Health Care Financing Administration (HCFA) for institutional and non-institutional claims. Records will include: Beneficiaries Name, Social Security Number, Address, Dates of Care, DRG/CPT, Provider Name, Provider Address, HIPAA Provider Number, Amount Billed, Amount Allowed, Other Insurance Payment, and Amount to be paid. In addition information from the providing hospital including the Employer Identification Number (EIN) and information for submitting electronic payment will be collected.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authority for maintaining this system of records is from 42 U.S.C. 243(c)(1).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To justify and document reimbursement payments for services provided in connection with the National Disaster Medical System (NDMS).
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1.To a Congressional Office from the records of an individual in response to an inquiry made from the Congressional Office made at the request of that individual.
</p> <p>2. To the Department of Justice (DOJ), court or other tribunal, or to another party before such tribunal, when:
</p><p>a. HHS or any component thereof; or
</p><p>b. Any HHS employee in his or her official capacity; or
</p><p>c. Any HHS employee in his or her individual capacity where the Department of Justice (or HHS where it is authorized to do so) has agreed to represent employee; or
</p><p>d. The United States or any Agency thereof, where HHS determines that the litigation is likely to affect HHS or any of it's components; is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the tribunal, or other party is relevant and necessary to the litigation and would help in the effective representation of the governmental party, however, that in each case, HHS determines that each disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. To a contractor for the purpose of collating, analyzing, aggregating, or otherwise refining or processing records in this system, or for developing, modifying, and/or manipulating it with automatic data processing (ADP) software. Data would also be available to users incidental to consultation, programming, operation, user assistance, or maintenance for an ADP or telecommunications system containing or supporting records in the system.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Paper and computer form.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information will be retrieved by beneficiary's name; and may be sorted by medical diagnosis, geographical area, or medical provider.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Only HHS personnel or HHS contract personnel whose duties require the use of the system may access the data. In addition, such HHS personnel or contractors are advised that the information is confidential and the criminal sanctions for unauthorized disclosure of private information may be applied.
</p> <p>2. Physical Safeguards: Physical paper records are stored in locked files cabinets or secured areas.
</p> <p>3. Procedural Safeguards: Employees who maintain records in the system are instructed to grant access only to authorized users. Data stored in computers are accessed through the use of passwords known only to authorized personnel. Contractors who use records in this system are instructed to make no further disclosure of the records except as authorized by the system manager and permitted by the Privacy Act. Privacy Act language is in contracts related to this system.
</p> <p>4. Implementation Guidelines: HHS Chapter 45-13 of the General Administration Manual, "Safeguarding Records Contained in Systems of Records and the HHS Automated Information Systems Security Program Handbook, Information Resources Management Manual."
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Disposition of records is according to the National Archives and Records Administration (NARA) guidelines, as set forth in the Office of Emergency Preparedness Records Management Manual.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, National Disaster Medical System Branch, Office of Emergency Preparedness, 12300 Twinbrook Parkway, Suite 360, Rockville, Maryland 20852.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Inquiries and requests for system records should be addressed to the system manager at the address indicated above. The requestor must specify the name, address, and health insurance number.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. These procedures are in accordance with HHS Regulations at 45 CFR 5b.5(a)(2) and 45 CFR 5b.6
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the system manager named above and reasonably identify the record and specify the information to be contested. State the reason for contesting the record (e.g., why it is inaccurate, irrelevant, incomplete, or not current), the corrective action being sought, and give any supporting justification. (These procedures are in accordance with HHS Regulations 45 CFR 5b.7.)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information contained in these records will be obtained from NDMS hospitals seeking reimbursement for treatment provided to disaster victims.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-90-0040" toc="yes">
<systemNumber>09-19-0040</systemNumber>
<subsection type="systemName">"National Disaster Medical System (NDMS) Patient Treatment and Tracking," HHS/ASPR/OPEO.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Unclassified.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>For a specified period and in accordance with the archiving rules, the paper records will be resident at NDMS headquarters, located at 409 3rd Street SW., Suite 330, Washington, DC 20024. The electronic copy of the record will be resident at the data center at the Unisys Corporation, 11720 Plaza America Drive, Reston, VA 20190.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The individuals covered by the system are all persons and owners of animals treated by NDMS and other HHS medical personnel when the NDMS Disaster Medical Assistance Teams (DMATs), National Veterinary Response Teams (NVRTs), or other HHS medical personnel are activated to respond to emergency situations, or as a response to any other situation for which they are activated.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>All records pertaining to treatment and movement of patients to include the following (both in hard copy and electronic format):
</p><p>Category A: Completed Patient Treatment Record form that includes:
</p><p>1. NDMS Team Identification.
</p> <p>2. Chart Number.
</p> <p>3. Time and Date Patient seeks treatment.
</p> <p>4. Triage Category and health status.
</p> <p>5. Location where Patient is seen and transferred.
</p> <p>6. Patient Identification--Name, Address, City, State, Zip, Date of Birth, Phone Number, Employment, Weight, Next of Kin.
</p> <p>7. Complaints/Symptoms.
</p> <p>8. Vital Signs/Treatment Recommended and/or Prescribed.
</p> <p>9. Discharge--Time, Date, Disposition, Recommendations.
</p> <p>10. Patient Authorization--Requires Patient Signature in Front of Witness and Witness Verification through Signature.
</p> <p>11. Any potential attachments such as X-rays and laboratory reports showing test results.
</p> <p>Category B: Veterinarian Treatment Records on animals:
</p><p>1. Privacy Act Data such as the name, address and telephone contact information of owners of animals will be maintained to be associated with the animal patient. However, animal treatment records themselves are not subject to the Privacy Act protections.</p>
</xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>NDMS Statute, 42 U.S.C. 300hh-11; Title VI of the Civil Rights Act of 1964; and Section 504 of the Rehabilitation Act of 1973. Records disposition of this medical SOR is determined under laws governing federal records through the National Archives, 44 U.S.C. 3303a.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Medical and demographic information is collected on all patients seen and/or treated by NDMS or other HHS personnel. This SOR will also provide the location, time, and date the patient was transported during an evacuation.  The information collected will include but not be limited to the patient's (1) Medical treatment history, (2) their pre-existing conditions, (3) their described symptoms, (4) any medical opinion rendered by an attending medical professional(s), (5) medications that were prescribed, or (6) any other medical advice provided.  The collection of data contained in medical records provides a mechanism by which teams can have the ability to conduct medical quality assurance and establish a quality improvement process (QIP).  Through QIP, teams can analyze and judge their performance on a specific deployment and if necessary enable them to better plan for future deployments.  These patient records are also important sources of information to be used for research projects related to the prevention of disease or disability as a result of a disaster.  Most importantly, these patient records document medical treatment rendered, especially if questions of liability arise about the treatment or the subsequent condition of the patient while he/she is under the care of NDMS.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, all or a portion of the records or information contained in this system may be disclosed outside HHS as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:
</p><p>1. NDMS is a coordinated effort between HHS, the Department of Homeland Security (DHS), the Department of Defense (DoD), and the Department of Veterans Affairs (VA). As such, the medical treatment and movement of patients is a shared responsibility between these partnership agencies. The medical and demographic information collected during the treatment of a patient is shared with the partners to ensure that patients treated through NDMS receive the appropriate level of health care. The health information disclosed among the partners is limited to what is needed for continuity of health care operations.
</p> <p>2. Disclosure to a member of Congress or a Congressional staff member in response to an inquiry from the Congressional office made at the behest of the constituent about whom the record is maintained.
</p> <p>3. Disclosure to the Department of Justice (DOJ), court, or adjudicatory body when the following situations arise:
</p><p> a. The agency or any component thereof, or
</p><p>b. Any employee of the agency whether in his/her official or individual capacity, where DOJ has agreed to represent the employee, or
</p><p>c. The United States government is a party to litigation or has an interest in such litigation and after careful review, the agency deems that the records requested are relevant and necessary to the litigation and that the use of such records by DOJ, court, or adjudicatory body is compliant with the purpose for which the agency collected the records.
</p> <p>4. Disclosure to agency contractors, consultants, grantees, or volunteers who have been engaged by the agency to assist in the performance of a service related to this collection and who have a need to have access to the records in order to perform the activity.
</p> <p>5. To assist another Federal and/or State agency, agency of a state government, an agency established by State law, or its fiscal agent:
</p><p>a. To establish the benefit entitlement of the patient.
</p> <p>b. To establish the relationship between the existing state benefit and the benefit funded in whole or part with Federal funds, such as the one associated with the NDMS definitive care.
</p> <p>c. To collaborate with the state and state agencies on behalf of family members regarding the current location and placement of their evacuated family member or patient population.
</p> <p>6. Disclosure of a patient's location or status is not permitted when there is a reasonable belief that disclosing such information could endanger the life, safety, health, or well-being of the patient.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Category A: <i>Patient Care Forms or other Medical Records:</i>
</p><p>Records in this system will be retained in accordance with the records disposition authority approved by the National Archives and Records Administration (NARA) for the Office of Public Health and Emergency Preparedness (OPHEP) in compliance with N1-468-07-1. The Pandemic and All Hazards Preparedness Act (Pub. L. 109-417), established the ASPR to serve in a similar capacity as OPHEP for medical disaster response. The records disposition authority used for these records will N1-468-07-1.
</p> <p><i>Disposition authority:</i>
</p><p>Patient Care Forms or other Medical Records created by the Federal Medical Station(s) (FMS) or by any component of HHS/ASPR inclusive of NDMS during a response to an event while caring for victims of that event are cutoff at the end of the response activity by the Federal Medical Station(s) or HHS/ASPR component for a particular event. Cutoff refers to breaking, or ending files at regular intervals, usually at the close of a fiscal or calendar year, to permit their disposal or transfer in complete blocks and, in this case, cutoff is at the end of the response activity. The cutoff date marks the beginning of the records retention period. Destroy 75 years after cutoff. This disposition instruction is media neutral; it applies regardless of media or format of the records.
</p> <p>Category B--The information collected on animals and their owners will not be destroyed until NARA approves a disposition schedule for those records.
</p> <p>Storage:
</p> <p>Paper records from this system are stored in the NDMS headquarters at 409 3rd Street, SW., Suite 330, Washington, DC 20024. The electronic database or server where information is entered and stored is maintained at the HHS data center located at Unisys Corporation, 11720 Plaza America Drive, Reston, VA 20190. During deployments, NDMS stores the records securely in their deployed location, the electronic data is stored in a secured server, and all procedures required for protection of Privacy Act documents are implemented as identified in "Safeguards" section below.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>NDMS Patient Treatment and Tracking Records in electronic and paper copy are organized by event, location, and date of treatment. Data from the records are stored in an electronic database enabling data from the records to be retrievable by name and other demographic information provided by the patient (or for veterinary records, by pet owner), as well as by location of treatment, diagnosis, and other data fields within the database.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>NDMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements for both paper copies and electronically stored information. Information in this system is safeguarded in accordance with applicable laws, rules and policies, including the HHS Information Technology Security Program Handbook, all pertinent National Institutes of Standards and Technology publications and OMB Circular A-130, Management of Federal resources. All records are protected from unauthorized access through appropriate administrative, physical, and technical safeguards. These safeguards include restricting access to authorized personnel who have a need-to-know, using physical locks in the office environment, and the process of authentication using user IDs and passwords function as protection identification features. HHS file areas are locked after normal duty hours and the facilities are protected from the outside by security personnel.</p>
</xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The NDMS Chief Medical Officer located at 409 3rd Street, SW., Washington, DC 20024. Mailing address: 330 Independence Avenue, SW., Room G-644, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Requests for Privacy Act protected information generally are governed by HHS regulations found at 45 CFR, Part 5b. They must be made in writing and clearly marked as a "Privacy Act Request" on the envelope and letter. Inquiries regarding this SOR should be addressed to the System Manager. Inquiries related to patient medical records should include the full name of the individual, the appropriate personal identification, and the current address, and should be sent to the Chief Medical Officer, NDMS, 330 Independence Avenue, SW., Room G- 644, Washington, DC 20201. The name of the requester, the nature of the record sought, and the verification of identify must be clearly indicated, as required by HHS regulations at 45 CFR 5b.5. Requests may also be sent to: HHS Privacy Act Officer 200 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as Notification Procedure above.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Same as the Notification Procedure above. The letter should state clearly and concisely what information you are contesting, the reasons for contesting it, and the proposed amendment to the information that you seek pursuant to HHS Privacy Act regulations, 45 CFR 5b.7.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Sources for providing data for NDMS Patient Treatment Records will only be provided by patients, medical personnel treating the patients or by accessing their personal health records (PHR). In the case of minors or other individuals unable to explain symptoms, information may be sought from a parent or guardian. For animals, information will be gathered by NDMS veterinary personnel and/or owners or caretakers of animals.
</p></xhtmlContent></subsection>
 <subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0041" toc="yes">
<systemNumber>09-19-0041</systemNumber>
<subsection type="systemName"> Consumer Mailing Lists, HHS/OS/OCA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>1009 Premier Bldg., 1725 Eye Street, NW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individual consumers media representatives, academicians, librarians, business and government officials.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Names and address of individuals and organizations.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Executive Order 011583 of February 24, 1971 and Reorganization Plan 01 of 1953.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Used by the United States Office of Consumer Affairs Consumer Information staff to distribute information on current consumer topics to consumers, academicians, librarians, business, government and the media.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Used by the OCA, Consumer Information staff to distribute information on current consumer topics to consumers, academicians, librarians, business, government and the media. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. In the event of litigation the defendant, is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Conventional file cabinets and computers.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>By name, organization, and Zip Code.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Personnel screening during working hours and secured building after working hours.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Files are updated periodically and disposed of through normal trash and erasure of computer tapes.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Consumer Information, 1009 Premier Bldg., 1725 Eye Street, NW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Director, Office of Management and Consumer Complaints, 1009 Premier Bldg., 1725 Eye Street, NW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Correspondence and telephone calls from individual consumers, business, academicians, librarians, and government officials.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0046" toc="yes">
<systemNumber>09-19-0046</systemNumber>
<subsection type="systemName"> Consumer Complaint Correspondence System, HHS/OS/OCA.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>1009 Premier Bldg., 1725 Eye Street, NW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individual consumers.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Correspondence concerning consumer complaints referred to OCA by Congressional offices or White House and other consumer complaint correspondence.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Executive Order 011583, February 24, 1981; Reorganization Plan 01 of 1953.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Resolution of individual citizen complaints through referral to other Federal agencies, non-Federal governments, voluntary groups and private business firms.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Resolution of individual citizen complaints through referral to other Federal agencies, non-Federal governments, voluntary groups and private business firms. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. In the event of litigation the defendant is (a) the Department, any Component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Individual files in cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Correspondence referred to other Federal offices is not maintained. Correspondence referred to non-Federal parties is stored only by sequential file number. Correspondence referred from Congressional offices is retrievable by name of member of Congress and reference to a sequential file number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Personnel screening during working hours and secured building after working hours.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained for not less than one or more than two years.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Office of Management and Consumer Complaints, 1009 Premier Bldg., 1725 Eye Street, NW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>System manager. Address is same as above.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Correspondence and telephone calls from individual consumers.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0048" toc="yes">
<systemNumber>09-19-0048</systemNumber>
<subsection type="systemName">Medicare Appeals Council Records.
</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>6th Floor, 800 North Capitol Street, NW., Washington, DC 20002.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>All individuals who appeal an action of an Administrative Law Judge (ALJ) concerning a claim for payment under Title XVIII or XI of the Social Security Act or concerning entitlement to Medicare benefits. Also individuals whose cases are referred to the Medicare Appeals Council (MAC) by the Centers for Medicare &amp; Medicaid Services (CMS) pursuant to the MAC's discretionary review authority.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The system contains information concerning Medicare beneficiaries; physicians, providers, suppliers, and other persons or entities involved in furnishing healthcare items or services to Medicare beneficiaries; and third-party appellants such as State Medicaid agencies. Information on beneficiaries may include: name, address, health insurance claim number, medical records, items or services for which Medicare reimbursement is requested, and material used to determine the amount of benefits allowable under Medicare. Information on physicians, providers, suppliers and other persons may include: name, address, specialty, identification number, items or services for which Medicare reimbursement is requested, and material used to determine the amount of benefits allowable under Medicare. This system contains some information that is about entities, rather than individuals, and that information is not covered by the Privacy Act.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Sections 1852(g), 1869, 1876(c)(5), and 1155 of the Social Security Act, as amended.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The records contain information used in processing an appellant's request for review of an ALJ decision or dismissal (or for other MAC action) or information used in considering a CMS referral; information used in tracking and ascertaining the status of the request or referral; information used to reply to correspondence; and information the MAC used to reach a decision on the request or referral.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosures may be made to:
</p><p>1. Student volunteers, individuals working under a personal services contract, and other individuals performing functions for HHS but technically not having the status of agency employees, if they need access to the records to perform their assigned agency functions.
</p> <p>2. A congressional office from the record of an individual or entity whose case is pending, in response to an inquiry from the congressional office at the request of that individual or entity.
</p> <p>3. Components of the Social Security Administration and authorized hearing offices that provide information/inquiry services to individuals or entities pursuing appeals or provide hearings on request of individuals or entities.
</p> <p>4. The Department of Justice, a court or other tribunal, or another party before such tribunal, when--
</p><p>a. HHS, or any component thereof; or
</p><p>b. Any HHS employee in his or her official capacity; or
</p><p>c. Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>d. The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the tribunal or the other party is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>5. HHS contractors who have been engaged by HHS to assist in the performance of a service related to this system of records and who have a need to access the records in order to perform the activity.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>These records are maintained in file folders, computer disks, and on password-protected computers or servers.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are normally retrieved numerically by the "M Number," a number assigned by the MOD when it receives a record. Records will be cross-referenced by the beneficiary's health insurance claim number; beneficiary's, physician's, provider's, supplier's, or other appellant's name; or ALJ appeal number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>a. <i>Authorized Users</i>: Only agency employees and contractor personnel whose duties require the use of information in the system. In addition, such agency employees and contractor personnel are advised that the information is confidential and of criminal sanctions for unauthorized disclosure of information.
</p> <p>b. <i>Physical Safeguards</i>: Paper records are maintained in file cabinets, offices, and other secure areas to which only authorized individuals have access. Computer terminals are in secured areas that only authorized individuals may use.
</p> <p>c. <i>Procedural Safeguards</i>: Employees who maintain records in the system are instructed to grant regular access only to authorized users. Data stored in computers or on servers are accessed through the use of passwords known only to authorized personnel. Contractors who maintain records in this system are instructed to make no further disclosure of the records except as authorized by the system manager and permitted by the Privacy Act. Privacy Act language is included in contracts related to this system.</p></xhtmlContent></subsection><subsection type="retentionAndDisposal"><xhtmlContent><p>The period of retention of the paper case file depends upon the final action taken by the MAC. If the final action requires the CMS contractor to effectuate a decision, the case file is sent to the contractor immediately after the MAC has entered its final decision. When a case is remanded to an ALJ, the case file is forwarded with the order of remand to the appropriate hearing office. If the MAC enters an unfavorable decision or a denial of review of an ALJ decision, the case file is stored and maintained in the MAC file room for 6 months. If the MAC enters an order of dismissal or a denial of review of an ALJ dismissal, the case file is stored and maintained for 3 months. At the end of the applicable period, the case file is sent to the designated CMS contractor or SSA. If a case is appealed to Federal District Court, the case file is stored and maintained for 3 months after the certified copy of the record has been furnished to the Court and at that point is sent to the contractor or SSA.
</p> <p>Workpaper documents created by the MAC or MOD are not included in the case file and are destroyed at the time the MAC final action is released. Electronic versions of case disposition documents are saved on the computer database for four years and then deleted. Electronic case tracking records are maintained indefinitely on the computer database, with daily updating to the storage area network.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Chief, Medicare Operations Division, Departmental Appeals Board, Department of Health and Human Services, Office of the Secretary, MS 6127, 330 Independence Avenue, SW., Cohen Building, Room G-644, Washington, DC 20201.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>Individuals inquiring whether this system of records contains information about them should contact the System Manager indicated above. The requester must specify the appellant's name, social security number, health insurance claim number, or docket number.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
    <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address specified above, reasonably identify the record, and specify the information to be contested and corrective action sought with the supporting justification.
</p></xhtmlContent></subsection> <subsection type="recordSourceCategories"><xhtmlContent><p>The DAB obtains the identifying information in this system from the request for review or referral. Claim file records are obtained from Medicare contractors and ALJ hearing offices.
</p></xhtmlContent></subsection>
 <subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0049" toc="yes">
<systemNumber>09-19-0049</systemNumber>
<subsection type="systemName">Departmental Appeals Board Case and Appeal Records, HHS/OS/DAB.
</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>6th Floor, 800 North Capitol Street, NW., Washington, DC 20002.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who are parties in matters before the Departmental Appeals Board (DAB), or who are requesting review or consideration of a matter by the DAB.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The DAB's system of records contains correspondence, pleadings, legal briefs, documentary evidence, and other paper or computer-stored records relevant to the issues being adjudicated, mediated, or considered by the DAB or its personnel. This system also contains some information that is about entities, rather than individuals, and that information is not covered by the Privacy Act.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>The DAB provides ALJ hearings and/or Board reviews in cases in which an individual has a right to a hearing pursuant to the following statutory authorities and/or the regulations implementing them:
</p><p>&#149; 42 U.S.C. 1320a-7a(c),
</p><p>&#149; 42 U.S.C. 1320a-8(b),
</p><p>&#149; 42 U.S.C. 1395cc(h) and (j),
</p><p>&#149; 42 U.S.C. 1395ff(f),
</p><p>&#149; 31 U.S.C. 3801 <i>et seq</i>.,
</p><p>&#149; 5 U.S.C. 5514(a)(2),
</p><p>&#149; 42 U.S.C. 216, 241, and 289b, and
</p><p>&#149; Any other authorities that are cited when new cases are added to the DAB's jurisdiction.
</p> <p>The DAB also mediates disputes pursuant to the federal Administrative Dispute Resolution Act, 5 U.S.C. 571-584.
</p> <p>The system of records has been created for the purpose of tracking, adjudicating, and mediating matters that come before the DAB. Information about the types of matters that come before the DAB can be obtained by contacting the DAB at 202-565-0200 or by visiting the DAB Web site at the following Internet addresses: <i>http://www.hhs.gov/dab/civil/overview.html</i>, <i> http://www.hhs.gov/dab/appellate,</i> and <i>http://www.hhs.gov/dab/adr</i>.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>The system of records is used to docket, track, adjudicate, mediate, or conclude matters before the DAB and, in those matters before the Appellate and Civil Remedies Divisions, to develop a body of case law that can guide persons and agency components in the future with respect to matters that are before or might come before the DAB.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The following are the routine uses of records or information contained in the DAB's system of records:
</p><p>(1) To apprise the public of the basis on which the DAB makes its decisions, the DAB may disclose records or parts of records not subject to a Freedom of Information Act exemption to persons who request the records or who attend DAB hearings.
</p> <p>(2) The DAB will disclose the status of a pending or past matter, and similar docket information, to any person making an inquiry about such information in order to apprise the public of the status and progress of matters before the DAB.
</p> <p>(3) The DAB may make disclosures to the Department of Justice, to a court or other tribunal, or to another party before such tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Justice Department (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to the litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the tribunal, or the other party is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>(4) The DAB may make disclosures to a Congressional office in response to an inquiry made by that office at the request of an individual who is a party in a matter before the DAB.
</p> <p>(5) The DAB may make disclosures to the public and to commercial reporters of DAB decisions and rulings for the purpose of distributing and publishing the decisions and rulings.
</p> <p>(6) The DAB may make disclosures to third parties, including public and private organizations, in order to obtain from them (by subpoena or other means) information relevant or necessary to the proceedings before the DAB.
</p> <p>(7) The DAB may make disclosures to HHS contractors who have been engaged by the agency to assist in the performance of a service related to this system of records and who have a need to access the records in order to perform the activity.
</p> <p>(8) The DAB may make disclosures to student volunteers, individuals working under a personal services contract, and other individuals performing functions for HHS but technically not having the status of agency employees, if they need access to the records to perform their assigned agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:</p><p>Records in the system are maintained in file folders and binders, and on password-protected computers or computer servers.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Individuals who wish to inquire about whether the DAB's system of records contains information about them should contact the appropriate System Manager indicated above. When making such an inquiry, it is necessary to provide the following information regarding the individual:
</p><p>(1) Full name;
</p><p>(2) Date of birth;
</p><p>(3) Kind of action taken by the agency;
</p><p>(4) Date and location of the filing of the case, appeal or other matter before the DAB; and
</p><p>(5) If appropriate, the DAB docket or decision number.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the appropriate System Manager at the address specified under notification procedures, reasonably identify the record, and specify the information to be contested and corrective action sought with the supporting justification.
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system is obtained from:
</p><p>(1) The individuals to whom the record pertains;
</p><p>(2) Agency officials and documents;
</p><p>(3) The testimony, affidavits and statements of witnesses;
</p><p>(4) The documents, received testimony, exhibits and submissions of the parties involved in the matter.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0050" toc="yes">
<systemNumber>09-19-0050</systemNumber>
<subsection type="systemName"> Case Information Management System, HHS/OS/OCR.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>See System Manager and Appendix 1.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Persons filing complaints with the Office for Civil Rights.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Name, characteristics of the complaint and critical events in OCR's processing of the complaints.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Title VI of the 1964 Civil Rights Act; Sections 799A and 855 of the Public Health Service Act; Section 504 of the 1973 Rehabilitation Act; the Age Discrimination Act; The Equal Employment Opportunity Provisions of the Public Telecommunications Financing Act of 1978; Title VI and Title XVI of the Public Health Service Act (the "community services obligation" of facilities funded under the Act); Title IX of the 1972 Education Amendments; Section 407 of the Drug Abuse Office and Treatment Act; and Section 321 of the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The system is designed to report the status of all complaints currently being investigated by OCR.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Magnetic disc and tape.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are indexed by case or complaint number, but may be recalled by name, address, or any other recipient characteristic by OCR staff engaged in compliance activities.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>The physical data processing storage is controlled by HHS which enforces appropriate security measures. This agency references data through communication terminals with access controlled by passwords. The Department's ADP Systems Manual, Part 6, ADP Systems Security, govern the control.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Indefinite retention. Disposal by electronic erasure.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Deputy Director, Office for Program Operations, Office for Civil Rights, 330 Independence Avenue SW, Washington, DC 20201.
</p> <p>And, Regional Directors, see Appendix 1.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Contact System Manager (above), or Regional Director (see Appendix 1). Include name and address of complainant, and name of the recipient against which the allegation was filed.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. Request should be made to the system manager in the regional office where the record is most likely to be kept (determined by location of the institution or facility against which the allegation was originally filed). When this location is in doubt request should be made to the Deputy Director, Office of Compliance and Enforcement, (see above, System Manager).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official(s) at the address specified under system manager or Appendix 1, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Information in complaint investigation files.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p>
<p><i>Appendix Number 1- System Locations </i></p><p>This system is located at HHS offices in the following cities.
</p><p>Region I, Regional Director, OCR/DHHS, 140 Federal Street--14th Floor, Boston, MA 02110.
</p><p>Region II, Regional Director, OCR/DHHS, 26 Federal Plaza--Room 3900, New York, NY 10278.
</p><p>Region III, Regional Director, OCR/DHHS, 3535 Market Street--Post Office Box 13716, Philadelphia, PA 19101.
</p><p>Region IV, Regional Director, OCR/DHHS, 101 Marietta Street--Suite 2806, Atlanta, GA 30323.
</p><p>Region V, Regional Director, OCR/DHHS, 300 South Wacker Drive--32nd Floor, Chicago, IL 60606.
</p><p>Region VI, Regional Director, OCR/DHHS, 1200 Main Tower Bldg.--Room 1900, Dallas, TX 75202.
</p><p>Region VII, Regional Director, OCR/DHHS, 601 E. 12th Street--Room 248, Kansas City, MO 64106.
</p><p>Region VIII, Regional Director, OCR/DHHS, Federal Office Building, 1961 Stout Street--Room 1326, Denver, CO 80294.
</p><p>Region IX, Regional Director, OCR/DHHS, 1275 Market Street--14th Floor, San Francisco, CA 94103.
</p><p>Region X, Regional Director, OCR/DHHS, 1321 Second Avenue--MS/723, Seattle, WA 98101.
</p></xhtmlContent></subsection> </section>
<section id="09-90-0051" toc="yes">
<systemNumber>09-19-0051</systemNumber>
<subsection type="systemName"> Complaint Files and Log, Office of Management and Administration, HHS/OS/OCR.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>See Appendix 1, System 09-90-0050.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who file complaints alleging discrimination under the statutes identified below (Authority for Maintenance).
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Complaint allegations, information gathered during the complaint investigation, findings, and results of the investigation, and correspondence relating to the investigation.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Title VI of the 1964 Civil Rights Act; Sections 799 A and 855 of the Public Health Service Act; Section 504 of the 1973 Rehabilitation Act; the Age Discrimination Act; The Equal Employment Opportunity Provisions of the Public Telecommunications Financing Act of 1978; Title VI and Title XVI of the Public Health Service Act Title IX of the 1972 Education Amendments; Section 407 of the Drug Abuse Office and Treatment Act; and Section 321 of the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>This file system is designed to store the results of all OCR regional investigations, for retrieval of information on the resolutions of complaints. Files are maintained to record the results of the complaint investigations so that OCR can determine if there was discrimination as charged in the original complaint.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Files may be reviewed by the Department of Justice, the Equal Employment Opportunity Commission, or other Federal and State agencies when necessary to complete an investigation, enforce the statutes, or assure proper coordination.
</p> <p>OCR may contract with a private firm for the purpose of collating, analyzing, aggregating, or otherwise refining records in this system. Relevant records will be disclosed to such a contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>In the event of litigation where the defendant is (a) the Department, any component of the Department or any employee of the Department in his or her official capacity (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any its components or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>File folders and file cards.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>By name for use by OCR staff in complaint investigations.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Printed materials are filed in lockable cabinets. The Department's ADP Systems Manual, Part 6, ADP Systems Security, govern the control. Categories of users include OCR investigators, team leaders, branch chiefs, division directors, PRMs unit staff, Office of Compliance and Enforcement staff.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>2 years from date complaint is closed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Deputy Director, Office for Program Operations, Office for Civil Rights, 330 Independence Avenue, SW, Washington, DC 20201.
</p><p>And Regional Directors, see Appendix 1 to Case Information Management System HHS OS/OCR System 09-90-0050.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Contact system manager (above) or Regional Directors (see Appendix 1). Include name and address of complainant, a copy or summary of allegations contained in the original complaint, name of the institution against which the allegation was filed, and the date of the original allegation.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. Request should be made to the system manager in the regional office where the record is most likely to be kept (determined by location of the institution or facility against which the allegation was originally filed.) When this location is in doubt request should be made to the Deputy Director, Office of Compliance and Enforcement, Washington, DC (see above, System Manager).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official(s) at the address specified under system manager or Appendix 1, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) T4Federal Register, October 8, 1975, page 47411.)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Complaint and information filed with the Department by or on behalf of the individual complainant, also data provided by the alleged discriminator and other parties.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0052" toc="yes">
<systemNumber>09-19-0052</systemNumber>
<subsection type="systemName">"Program Information Management System" (PIMS) (09-90-0052) HHS/OS/OCR.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The automated portion of the system is maintained at OCR Headquarters. Paper files are maintained in headquarters and regional offices as noted in Appendix I.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Covered individuals include persons who file complaints alleging discrimination or violation of their rights or other violations under the statutes identified below (Authority for Maintenance) and covered entities (<i>e.g.,</i> health care providers) that are individuals and not organizations or institutions, investigated by OCR as a result of complaints filed or through reviews conducted by OCR. Covered individuals also include persons who submit correspondence to OCR related to other compliance activities (<i>e.g.,</i> outreach and public education), and other correspondence unrelated to a complaint or review and requiring responses by OCR. Covered individuals also include covered entities and business associates (that are individuals and not organizations or institutions), as defined in 45 CFR 160.103, who report breaches of protected health information by submitting a breach report through the HHS Web site. In addition, OCR employees that use the system to record the status of their work are covered by the system.</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The system encompasses a variety of records having to do with complaints, reviews, correspondence, and reports of breaches of protected health information. For example, the system includes records containing individual names, Social Security numbers (SSN), tax identification numbers (TIN), addresses, dates of birth, provider names and addresses, physicians' names, prescriber identification numbers, assigned provider numbers (facility, referring/servicing physician), and/or other identification numbers of HIPAA covered entities.
</p> <p>The complaint files and log include complaint allegations, information gathered during the complaint investigation, findings and results of the investigation, and correspondence relating to the investigation, as well as status information for all complaints. This component of PIMS is exempt from the notification, access, correction and amendment provisions of the Privacy Act (<i>see below:</i> Systems Exempted From Certain Provisions of the Act). Equivalent types of information are maintained for reviews and correspondence activities--namely, information gathered, findings, results, correspondence and status.</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for the collection, maintenance, and disclosures from this system is given under Title VI of the 1964 Civil Rights Act; Sections 533, 542, 794, 855, 1947 and 1908 of the Public Health Service Act; Sections 504 and 508 of the Rehabilitation Act of 1973; Title II of the Americans with Disabilities Act of 1990; the Age Discrimination Act of 1975; the Equal Employment Opportunity Provisions of the Public Telecommunications Financing Act of 1978; Title VI and Title XVI of the Public Health Service Act (the "community services obligation " of facilities funded under the Act); Title IX of the 1972 Education Amendments; Section 407 of the Drug Abuse Office and Treatment Act; Section 321 of the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970; Section 508 of the Social Security Act; the Family Violence Prevention and Services Act; Low-Income Home Energy Assistance Act of 1981; Section 1808 of the Small Business Job Protection Act of 1996; the Health Insurance Portability and Accountability Act of 1996; the Patient Safety and Quality Improvement Act of 2005 (Patient Safety Act); and section 13402 of the Health Information Technology for Economic and Clinical Health (HITECH) Act.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>PIMS is used by OCR staff and consists of an electronic repository of information and documents, and supplementary paper document files. PIMS effectively combines and replaces OCR's two previous systems of records, the "Case Information Management System (CIMS), HHS/OS/OCR, 09-90-0050," and the "Complaint File and Log, HHS/OS/OCR 09-00-0051," into a single, integrated system with enhanced electronic storage, retrieval and tracking capacities that allows OCR to manage more effectively the information it collects.
</p> <p>The system is designed to allow OCR to integrate all of OCR's various business processes, including all its compliance activities, to allow for real time access and results reporting and other varied information management needs. PIMS provides: (1) A single, central, electronic repository of all significant OCR documents and information, including investigative files, correspondence, administrative records, policy and procedure manuals and other documents and information developed or maintained by OCR; (2) easy, robust capability to search all the information in OCR's repository; (3) better quality control at the front end with simplified data entry and stronger data validation; (4) tools to help staff work on and manage their casework, and (5) supplementary paper document files. The system has the capacity to generate reports concerning the status of all current and closed complaints, reviews, and correspondence; track outreach, training, and other activities; and to locate and retrieve information, and report results, in order to manage more efficiently OCR's work. In addition, PIMS allows for the tracking of work assignments to employees to facilitate workload balancing, timely response to complaints and completion of reviews, and outreach and public education initiatives focused on organizations and individuals.
</p> <p>PIMS also is used by OCR: (1) To collect, maintain, and post on the HHS Web site a list of covered entities that experience breaches of unsecured protected health information affecting more than 500 individuals using information reported to the Secretary by covered entities (or a business associate on behalf of a covered entity) as required by section 13402(e) of the HITECH Act; (2) to develop an annual report to Congress, as required by section 13402(i) of the HITECH Act, regarding breach notification using information reported to the Secretary by covered entities (or a business associate on behalf of a covered entity) pursuant to section 13402(e) of the HITECH Act; and (3) to provide technical assistance, training, and guidance regarding breaches of protected health information.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use ". The routine uses in this system meet the compatibility requirement of the Privacy Act. The following are the routine use disclosures of information maintained in the PIMS system:
</p><p>I. The first routine use for this system, permitting disclosure to a congressional office, allows subject individuals to obtain assistance from their representatives in Congress, should they so desire. Such disclosure would be made only pursuant to the request of the individual.
</p> <p>II. The second routine use allows disclosure to the Department of Justice or a court in the event of litigation.
</p> <p>III. The third routine use allows referral to the appropriate agency, in the event that a System of Records maintained by this agency to carry out its functions indicates a violation or potential violation of law.
</p> <p>IV. The fourth routine use allows disclosure of records to contractors for the purpose of processing or refining records in the system.
</p> <p>V. The fifth routine use allows records to be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p> <p>VI. The sixth routine use allows referrals of Age Discrimination Act complaints to the Federal Mediation and Conciliation Service (FMCS) for purposes of mediation.
</p> <p>VII. The seventh routine use allows OCR to post on its Web site, as required by section 13402(e)(4) of the HITECH Act, information reported by a covered entity (or a business associate on behalf of a covered entity) to the Secretary pursuant to section 13402(e)(3) of the HITECH Act that identifies covered entities that experience breaches of unsecured protected health information affecting more than 500 individuals.
</p> <p>VIII. The eighth routine use allows OCR to disclose information regarding breaches of unsecured protected health information in an annual report to Congress, as required by section 13402(i) of the HITECH Act, regarding the number and nature of the breaches reported to the Secretary and actions taken in response to such breaches.
</p> <p>IX. The ninth routine use allows OCR to disclose information regarding breaches of unsecured protected health information to the public and to appropriate Federal agencies and Department contractors to provide technical assistance, training, and guidance materials, after OCR determines that the disclosure would not constitute an unwarranted invasion of personal privacy.
</p> <p>X. The tenth routine use allows OCR to disclose information to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p> <p>XI. The eleventh routine use allows OCR to disclose information to third party contacts, including public and private organizations, to investigate violations and potential violations, as well as to conduct compliance reviews, of the Federal laws and regulations that OCR has legal authority to enforce.
</p> <p>XII. The twelfth routine use allows OCR to disclose relevant information to the public to inform the public of the results of investigations and compliance reviews of the Federal laws and regulations that OCR has legal authority to enforce, after OCR determines that the disclosure would not constitute an unwarranted invasion of personal privacy.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Automated records are maintained on magnetic disc and tape back-up. Paper records are kept in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are indexed by transaction number, but may be retrieved by name, street address, and other complainant, covered entity, or business associate characteristic (such as type of entity, city, state, and type of service provided).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>The PIMS system conforms to applicable law and policy governing the privacy and security of Federal automated information systems. These include but are not limited to: the Privacy Act of 1974, Federal Information Security Management Act of 2002, Computer Security Act of 1987, the Paperwork Reduction Act of 1995, the Clinger-Cohen Act of 1996, and OMB Circular A-130, Appendix, III, "Security of Federal Automated Information Resources." OCR has prepared a system security plan as required by OMB Circular A-130, Appendix III. This plan conforms fully to guidance issued by the National Institute for Standards and Technology (NIST) in NIST Special Publication 800 -18, "Guide for Developing Security Plans for Information Technology Systems." The plan includes conduct of a risk assessment that addresses the confidentiality and integrity of the data. Only authorized users have access to the information in the system.</p><p>Categories of users include: OCR investigators, regional and headquarters managers, team leaders, OCR budget and Government Performance and Results Act planning staff, program and policy staff, and data analysts. Specific access is structured around need and is determined by the person's role in the organization. Access is managed through the use of electronic access control lists, which regulate the ability to read, change, and delete information in the system. Each OCR user has read access to designated information in the system, with the ability to modify only their own submissions or those of others within their region or group. Data identified as confidential is so designated and only specified individuals are granted access. The system maintains an audit trail of all actions against the data base.
</p><p>All electronic data is stored on servers maintained in locked facilities with computerized access control allowing access to only those support personnel with a demonstrated need for access. A database is kept of all individuals granted security card access to the room, and all visitors are escorted while in the room. The server facility has appropriate environmental security controls, including measures to mitigate damage to automated information system resources caused by fire, electricity, water, and inadequate climate controls.
</p> <p>Access control to servers, individual computers, and databases includes a required user log-on with a password, inactivity lockout to systems based on a specified period of time, legal notices and security warnings at log-on, and remote access security that allows user access for remote users (<i>e.g.,</i> while on government travel) under the same terms and conditions as for users within the office. System administrators have appropriate security clearance. Printed materials are filed in secure cabinets in secure Federal buildings with access based on need as described above for the automated component of the PIMS system.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Documents related to breaches are retained at OCR for two years from the date the breach is reported and then are archived at the National Archives and Records Administration for 15 years. Correspondence is retained for one year following the end of the fiscal year in which processed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>PIMS Project Manager, Management Operations Division, Office for Civil Rights, 200 Independence Ave., SW., Room 509F, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Contact System Manager (above). Include name and address of complainant, and name of the recipient against which the allegation was filed. The Department is exempting all investigative records from this provision (see below: Records Exempted).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters also should reasonably specify the record contents being sought. Requests should be made to the system manager (above). The Department is exempting all investigative records from this provision. (<i>See below:</i> Records Exempted)
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official(s) at the address specified under System Manager, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) The Department is exempting all investigative records from this provision (<i>see below:</i> Records Exempted).</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Information is provided by complainants, covered entities, and business associates.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>OCR investigative records maintained in PIMS, either as paper records or electronic documents, are records compiled for law enforcement purposes and are exempt under subsection (k)(2) from the notification, access, correction, and amendment provisions of the Privacy Act.
</p><p> <i>APPENDIX NUMBER 1--SYSTEM LOCATIONS: </i></p><p>This system is located at HHS offices in the following cities:
</p><p>Headquarters, PIMS Project Manager, Management Operations Division, Office for Civil Rights, 200 Independence Ave., SW., Room 509F, Washington, DC 20201.
</p> <p>Region I, Regional Manager, OCR/HHS, J.F. Kennedy Federal Building--Room 1875 Boston, MA 02203.
</p> <p>Region II, Regional Manager, OCR/HHS, 26 Federal Plaza--Suite 3312, New York, NY 10278.
</p> <p>Region III, Regional Manager, OCR/HHS, 150 S. Independence Mall West, Suite 372, Public Ledger Building, Philadelphia, PA 19106-9111.
</p> <p>Region IV, Regional Manager, OCR/HHS, Atlanta Federal Center, Suite 3B70, 61 Forsyth Street, SW., Atlanta, GA 30303-8909.
</p> <p>Region V, Regional Manager, OCR/HHS, 233 N. Michigan Ave, Suite 240, Chicago, IL 60601.
</p> <p>Region VI, Regional Manager, OCR/HHS, 1301 Young Street, Suite 1169, Dallas, TX 75202.
</p> <p>Region VII, Regional Manager, OCR/HHS, 601 E. 12th Street--Room 248, Kansas City, MO 64106.
</p> <p>Region VIII, Regional Manager, OCR/HHS, Federal Office Building, 1961 Stout Street--Room 1426 FOB, Denver, CO 80294-3538.
</p> <p>Region IX, Regional Manager, OCR/HHS, 90 7th Street, Suite 4-100, San Francisco, CA 94103.
</p> <p>Region X, Regional Manager, OCR/HHS, 2201 Sixth Avenue-- M/S: RX-11, Seattle, WA 98121-2290.
</p></xhtmlContent></subsection> </section>

<section id="09-90-0058" toc="yes">
<systemNumber>09-19-0058</systemNumber>
    <subsection type="systemName">Tracking Records and Case Files for FOIA and Privacy Act Requests and Appeals</subsection>
    <subsection type="securityClassification">
        <xhtmlContent>
            <p>Classified and Unclassified</p>
        </xhtmlContent>
    </subsection>
    <subsection type="systemLocation">
        <xhtmlContent>
            <p>Physical locations for the case files and tracking records covered by this SORN include:</p>
            <p>&#8226;The HHS Freedom of Information/Privacy Acts Division within the Office of the Assistant Secretary for Public Affairs (ASPA) in Washington, DC;</p>
            <p>&#8226;HHS FOIA Requester Service Centers in Washington, DC; Baltimore, MD; Bethesda, MD; Research Triangle, NC; Rockville, MD; and Atlanta, GA;</p>
            <p>&#8226;Any contractor locations that support FOIA and/or Privacy Act request processing (for example, the Centers for Medicare &amp; Medicaid Services (CMS) uses contractors located near its Regional Offices in Boston, MA; New York, NY; Philadelphia, PA; Atlanta, GA; Chicago, IL; Dallas, TX; Kansas City, MO; Denver, CO; San Francisco, CA; and Seattle, WA);</p>
            <p>&#8226;Server locations for electronic systems used by HHS FOIA offices, System Managers, and/or related privacy personnel (for example, server locations for agency-developed FOIA systems include Bethesda, MD for the system used by National Institutes of Health; White Oak, MD and Ashburn, VA for the system used by the Food and Drug Administration; and Baltimore, MD for the system used by CMS and PSC; locations for commercial off-the-shelf FOIA systems include Gaithersburg, MD for FOIAXpress and Washington, DC for the Request Management System);</p>
            <p>&#8226;Security office locations where classified records responsive to FOIA and Privacy Act requests may be stored, including the Office of Security and Strategic Information (OSSI) in Washington, DC; and</p>
            <p>&#8226;System Manager locations identified in each SORN posted at http://www.hhs.gov/foia/privacy/sorns.html, where any tracking records and case files used by System Managers and related privacy personnel to process Privacy Act requests and appeals would be maintained.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="categoriesOfIndividuals">
        <xhtmlContent>
            <p>The records in this system of records pertain to individual FOIA and Privacy Act requesters and appellants only.  Individual FOIA and Privacy Act requesters and appellants include:</p>
            <p>&#8226;Any individual who the agency treated as the requester or appellant for an access request or appeal that was received in or referred to a HHS FOIA office for processing under FOIA (and under the Privacy Act, if applicable), excluding individual representatives who requested records under FOIA on behalf of an entity; and</p>
            <p>&#8226;Any individual who made any type of Privacy Act request or appeal that was received by or referred to the System Manager (or related privacy personnel) for the relevant HHS Privacy Act system of records for handling—but only if the System Manager’s (or related privacy personnel’s) Privacy Act tracking records and case files are retrieved by requester or appellant identifier.</p>
            <p>For a FOIA request or appeal involving non-Privacy Act records, the individual treated as the requester or appellant may have made the FOIA request or appeal personally, through a representative, or as a representative for another individual.  For a Privacy Act request or appeal, the individual requester or appellant may have made the request or appeal personally, or as the parent of or court-appointed guardian for a minor or legally-declared incompetent who is the subject of the records, or with the prior, written consent of the record subject.  When any of the aforementioned individual requesters or appellants seeks to exercise Privacy Act rights under this SORN with respect to the tracking record and case file pertaining to his or her FOIA or Privacy Act request or appeal, the information in the tracking record and case file must be about him, as required by 5 U.S.C. § 552a(a)(4) (i.e., not merely be retrieved by his identifier), for the individual to be afforded Privacy Act rights with respect to those records.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="categoriesOfRecords">
        <xhtmlContent>
            <p>Records consist of tracking records and case files for FOIA and Privacy Act requests and appeals made by individuals.  This system of records excludes tracking records and case files for FOIA requests and appeals made by or on behalf of entities.  </p>
            <p>Tracking records typically include the requester/appellant’s name and contact information, case tracking number, date of request or appeal, a brief description of the request or appeal, processing status, and response date or appeal decision date.  A tracking record for a FOIA request may include additional information, such as the requester’s fee category and whether expedited processing or a fee waiver or reduction was sought and was granted or denied.</p>
            <p>A case file typically includes a copy of the request and any appeal, which would include the requester/appellant’s name; contact information; a description of the records that were the subject of the access, correction, or other request; issues raised on appeal; copies of any documents included with the request or appeal; the case tracking number; the agency’s response letter and any appeal decision letter; copies of records responsive to the request; correspondence about the request or appeal with the requester and with other involved parties and agencies; and any fee-related information.  A case file also may include identity verification documents and information (such as photocopies of the requester’s driver’s license, passport, alien or voter registration card, or union card; identifying particulars about the records sought, such as an account number; or a statement certifying that the requester is the individual who he or she claims to be) if the case file pertains to a first-party request; a consent form signed by an individual record subject, authorizing HHS to provide records about that individual to a third party; and photocopies of documents establishing a parent, guardian, or other legal relationship (such as a court order or birth certificate) if the request or appeal was made by a legal representative.  Any classified records responsive to a FOIA request or appeal are considered to be part of the FOIA case file, even if maintained in a security office instead of in the FOIA case file.</p>
            <p>Note that the scope of this system of records excludes the following related records:</p>
            <p>&#8226;Litigation files maintained in the HHS Office of General Counsel related to requests covered in this system of records (see instead the SORN for System No. 09-90-0064 "Litigation Files, Administrative Complaints and Adverse Personnel Actions");</p>
            <p>&#8226;Records pertaining to Privacy Act violation claims (see instead the SORNs for System Nos. 09-90-0062 "Administrative Claims" and 09-90-0064 "Litigation Files, Administrative Complaints and Adverse Personnel Actions"); and</p>
            <p>&#8226;Records about agency personnel who process FOIA and Privacy Act requests (see instead SORNs covering personnel records; e.g., 09-90-0018 "Personnel Records in Operating Offices," 09-40-0001 "Public Health Service (PHS) Commissioned Corps General Personnel Records," and OPM/GOVT-2 "Employee Performance File System Records").</p>
        </xhtmlContent>
    </subsection>
    <subsection type="authorityForMaintenance">
        <xhtmlContent>
            <p>5 U.S.C. 552, 552a; 44 U.S.C. 3301.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="purpose">
        <xhtmlContent>
            <p>FOIA and Privacy Act tracking records and case files are used on a need-to-know basis within the agency, primarily by FOIA office personnel, FOIA Coordinators and subject matter experts in program offices who locate and provide records responsive to requests, attorneys in the Office of General Counsel, Privacy Officers, and System Managers for Privacy Act systems of records.  HHS uses the tracking records and case files to:</p>
            <p>&#8226;track, process, and respond to the requests and any related administrative appeals, litigation, and mediation actions and communicate with the requesters and appellants;</p>
            <p>&#8226;locate records responsive to requests and appeals and verify the identity of first-party requesters and appellants;</p>
            <p>&#8226;identify related requests and records frequently requested under FOIA and generate publicly-releasable versions of FOIA request logs; </p>
            <p>&#8226;provide aggregate and statistical data for reports and facilitate management and oversight reviews of FOIA and Privacy Act operations; and</p>
            <p>&#8226;share relevant information with other HHS offices that manage related matters arising from processing FOIA and Privacy Act requests and appeals, such as investigating erroneous release incidents and responding to lawsuits alleging Privacy Act violation claims or other claims.  (Records used for such purposes, if retrieved by personal identifier, would be covered under other SORNs.)</p>
        </xhtmlContent>
    </subsection>
    <subsection type="routineUsesOfRecords">
        <xhtmlContent>
            <p>The Privacy Act allows us to disclose information without an individual’s consent to parties outside the agency if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a ‘‘routine use.’’ The proposed routine uses in this system meet the compatibility requirement of the Privacy Act.  To the extent this system contains Protected Health Information (PHI) as defined by HHS regulation ‘‘Standards for Privacy of Individually Identifiable Health Information’’ (45 CFR parts 160 and 164, 65 FR 82462 (December 28, 2000), Subparts A and E), disclosures of such PHI that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the ‘‘Standards for Privacy of Individually Identifiable Health Information."  This system may make the following routine use disclosures:</p>
            <p>1. Records may be disclosed to the Department of Justice (DOJ) for the purpose of obtaining DOJ’s advice as to whether or not records are required to be disclosed under FOIA and/or the Privacy Act in response to an access request.</p>
            <p>2. Records may be disclosed to federal agencies and Department contractors that have been engaged by HHS to assist in accomplishing an HHS function related to the purposes of the system and that need to have access to the records in order to assist HHS.  Any contractor will be required to comply with the requirements of the Privacy Act of 1974 and appropriately safeguard the records.  These safeguards are explained in the "Safeguards" section.</p>
            <p>3. Records may be disclosed to student volunteers and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
            <p>4. Records may be disclosed to a Member of Congress or to a congressional staff member in response to a written inquiry of the congressional office made at the written request of the constituent about whom the record is maintained.  The Member of Congress does not have any greater authority to obtain records than the individual would have if requesting the records directly.</p>
            <p>5. Records may be disclosed to the Department of Justice (DOJ) or to a court or other tribunal when:</p>
            <p>a. the agency or any component thereof, or</p>
            <p>b. any employee of the agency in his or her official capacity, or</p>
            <p>c. any employee of the agency in his or her individual capacity where DOJ has agreed to represent the employee, or</p>
            <p>d. the United States Government,</p>
            <p>is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that, therefore, the use of such records by the DOJ, court, or other tribunal is deemed by HHS to be compatible with the purpose for which the agency collected the records.</p>
            <p>6. Records may be disclosed to another federal, foreign, state, local, tribal, or other public agency with an interest in or control over information  in records responsive to or otherwise related to an access or amendment request, for the following purposes:</p>
            <p>a. consulting the other agency for its views about providing access to the information or assistance in verifying the identity of an individual or the accuracy of information sought to be amended or corrected;</p>
            <p>b. informing the other agency of HHS’ response or intended response to the request; or</p>
            <p>c. referring the request to the most appropriate federal agency for response.</p>
            <p>7. The identity of the requester or appellant may be disclosed to a submitter of business records that are sought by that requester or appellant, when obtaining the submitter’s views concerning release of the submitter’s business information under FOIA.</p>
            <p>8. Records may be disclosed to the National Archives and Records Administration, Office of Government Information Services (OGIS), to the extent necessary to fulfill its responsibilities under 5 U.S.C. 552(h) to review administrative agency policies, procedures, and compliance with FOIA, and to facilitate OGIS’ offering of mediation services to resolve disputes between persons making FOIA requests and administrative agencies.</p>
            <p>9. Records may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.</p>
            </xhtmlContent>
    </subsection>
    <subsection type="policiesAndPractices">
        <xhtmlContent>
            <p>Storage:</p>
            <p>Electronic records are stored in secure electronic tracking and/or storage applications, and on compact disks, DVDs, and network drives.  Hard-copy files are stored at office locations, in file rooms, shelves, safes, cabinets, bookcases or desks.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="retrievability">
        <xhtmlContent>
            <p>Records are retrieved by personal identifier (i.e., requester or appellant name).</p>
        </xhtmlContent>
    </subsection>
    <subsection type="safeguards">
        <xhtmlContent>
            <p>Safeguards conform to the HHS Information Security and Privacy Program, http://www.hhs.gov/ocio/securityprivacy/index.html and HHS Office of Security and Strategic Information (OSSI) policies regarding classified information, and include the following:</p>
            <p>Administrative Safeguards: Authorized users are limited to HHS employees and officials who are responsible for processing FOIA and Privacy Act requests and appeals, authorized personnel of any contractors or federal agencies assisting HHS with those functions, and any other authorized individuals who work for HHS and assist HHS with those functions but technically do not have the status of agency employees.  Only personnel with a "need to know" and appropriate security clearances issued by OSSI or the Office of Inspector General (OIG) regarding OIG personnel are allowed to access classified records.  Each user’s access is limited, based on the user’s role, to the records that are essential to the user’s duties.  Security safeguards are imposed on contractors through inclusion of Privacy Act-required clauses in contracts and through monitoring by contract and project officers.</p>
            <p>Technical Safeguards: Access to electronic systems and records is controlled and protected by a secure log-in method (using passwords that are unique, complex, and frequently changed), time-out features, NSA and/or NIST-approved encryption methods, firewalls, intrusion detection systems, and cybersecurity monitoring systems.</p>
            <p>Physical Safeguards:  Hard-copy records and records displayed on computer screens are protected from the view of unauthorized individuals while the records are in use by an authorized employee.  Hard-copy records and electronic storage media are secured during nonbusiness hours in locked file cabinets, locked desk drawers, locked offices, or locked storage areas.  Office buildings are protected by cameras and uniformed guards.  When records are photocopied, printed, scanned, or faxed for authorized purposes, care is taken to ensure that no copies are left where they can be read by unauthorized individuals.</p>
            <p>When eligible for destruction, records are securely disposed of using destruction methods prescribed by NSA and/or NIST SP 800-88.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="retentionAndDisposal">
        <xhtmlContent>
            <p>Records are retained and disposed of in accordance with General Records Schedule (GRS) 4.2 "Information Access and Protection Records" (superseding GRS 14 "Information Services Records"), which prescribes retention periods ranging from approximately two years to six years after final agency action or adjudication by a court, date of closure, or last entry.  For specific periods, see GRS 4.2 Items 020 access and disclosure request files; 030 general administrative (tracking) records; 050 Privacy Act accounting of disclosure files; and 090 Privacy Act amendment request files.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="systemManager">
        <xhtmlContent>
            <p>HHS Privacy Act Officer, Freedom of Information/Privacy Acts Division, OS/ASPA, Hubert H. Humphrey Building – Suite 729H, 200 Independence Avenue, S.W., Washington, DC, 20201.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="notificationProcedure">
        <xhtmlContent>
            <p>An individual who wishes to know if this system contains tracking records and case files for FOIA and Privacy Act requests or appeals in which he was the requester or appellant must submit a written request to the System Manager identified above.  The request should include the full name of the individual, information to verify the individual’s identity, and the individual’s current address.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="recordAccessProcedures">
        <xhtmlContent>
            <p>An individual requester or appellant may request access to tracking records and case files about his FOIA or Privacy Act request or appeal by making a written request to the System Manager identified above, and by identifying or describing the records sought, providing information to verify his identity, and including his current address.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="contestingRecordProcedures">
        <xhtmlContent>
            <p>An individual may contest information in tracking records and case files about his FOIA or Privacy Act request or appeal by contacting the System Manager identified above, and by identifying the information contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="recordSourceCategories">
        <xhtmlContent>
            <p>Information is obtained from individual requesters and appellants, responsive records, program offices that provide responsive records, and personnel at HHS, other agencies, and outside organizations (e.g., consultants and business submitters) who provide information relevant to processing the requests.</p>
        </xhtmlContent>
    </subsection>
    <subsection type="exemptionsClaimed">
        <xhtmlContent>
            <p>This system of records is not a type of system eligible to promulgate exemptions under subsections (j) and (k) of the Privacy Act (5 U.S.C. 552a(j), (k)); however, any record in this system that is from another Privacy Act system of records that has promulgated exemptions will be exempt from access and other requirements of the Privacy Act if and to the same extent that the record is exempt from such requirements in the source system.  Records in this system that are from a system described in 5 U.S.C. 552a(j)(2) may be exempt from the requirements in these subsections of the Privacy Act: (c)(3), (c)(4), (d), (e)(1), (e)(2), (e)(3), (e)(4)G), (e)(4)(H), (e)(4)(I), (e)(5), (e)(8), (e)(12), (f), (g), and (h).  Records in this system that are from a system described in 5 U.S.C. 552a(k) may be exempt from the requirements in these subsections of the Privacy Act: (c)(3), (d), (e)(1), (e)(4)G), (e)(4)(H), (e)(4)(I), and (f).  Any records compiled in reasonable anticipation of a civil action or proceeding are excluded from the Privacy Act access requirement in all systems of records, as provided in 5 U.S.C. 552a(d)(5). </p>
        </xhtmlContent>
    </subsection>
</section>


<section id="09-90-0059" toc="yes">
<systemNumber>09-19-0059</systemNumber>
<subsection type="systemName"> Federal Advisory Committee Membership Files, HHS/OS/ASPER.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Department and component committee management offices. See Appendix 1.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who have been or are presently members of or are being considered for membership on advisory committees within the jurisdiction of the Department of Health and Human Services. Additionally the system of records contains information about members of the public who have requested that they receive various publications through the inclusion of their names and addresses on various mailing lists.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Information maintained on those individuals who have requested participation on mailing lists is limited to name and mailing address. Information maintained on individuals who are past, present, or recommended members of advisory committees subject to this notice consists of one or more of the following name, title, sex, place and date of birth, home address, business address, organizational affiliation, phone number, degrees held, general educational background, ethnic background, resume, curriculum vitae, dates of term on advisory committee, status on advisory committee, reason for leaving advisory committee, previous or current membership on other advisory committees, special qualifications of the individual for the advisory committee membership, source who recommended the individual for membership on advisory committee and miscellaneous correspondence. Additionally, memoranda justifying the individual's selection are included in the file in cases in which the individual has served repetitively on advisory committees, has not had a one-year break in service on advisory committees, or where various statutory or other requirements for advisory committee membership cannot be met.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Federal Advisory Committee Act (5 U.S.C. App. I et seq.).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Records in this system are used in the administration and management of Federal advisory committees in the Department, including the preparation of reports; quarterly alphabetical listings of past, present, and recommended advisory committee members; lists of vacancies, acceptances, and separations; and documentation of nominations. These records are maintained in each component of the Department. See also "Retrievability" below.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Annual Report to the President; administrative reports to OMB and GSA.
</p> <p>In the event that this system of records indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of is components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in hard-copy filed in file cabinets, on index cards, on magnetic tape, or in computer storage.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>For the most part records are maintained in an alphabetical index by name of the individual. Certain files are based on other factors, e.g., Advisory Committee name, with a cross index based on an alphabetical listing of individuals. Certain other records are retrievable by individually identifiable computer identification codes. Certain of the mailing lists which are maintained are indexed by ZIP Code and within zone by alphabetical listing by name of the individual. Records from the system are available to the staffs of the respective Advisory Committees, the Committee Management Officers, the Departmental Committee Management Officer and other Departmental staff on a need-to-know basis.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Direct access to records is restricted to authorized personnel through locked files, rooms, and buildings as well as building pass and security guard sign-in systems. Certain facilities are also protected by closed circuit television systems. Computer systems are secured through locked magnetic tape libraries as well as lockword-password computer access systems.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Retention is variable from one year to permanent retention depending upon the type of record, e.g., names of former members of advisory committees are retained permanently. Certain records are disposed of by referral to the Federal Records Center. Others are disposed of as trash by the system manager or office of security depending upon the confidentiality of the information contained on the record.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>See Appendix 1.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Same as above with the exception of Food and Drug Administration, contact: FDA Privacy Coordinator (HF-50), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20852.
</p> <p>Verification of identification of individuals inquiring as to information contained in this System shall be in accordance with the procedures outlined in regulations published by the Department of Health and Human Services to implement the Privacy Act.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested, and state the corrective action sought and the reasons for the correction. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The vast majority of information contained in records on individuals is obtained directly from the individual. Other information in the form of references and recommendations is obtained from other private individuals, program personnel, biographical reference books, private organizations, former employers, regional office of HHS, Members of Congress, and other government sources.</p>
<p><i>Appendix 1 </i></p><p>Department of Health and Human Services, Department Committee Management Officer, Mary Switzer Building, Room 2319, 330 Independence Ave., SW, Washington, DC 20201
</p><p>Alcohol, Drug Abuse, and Mental Health Administration, Office of the Administrator, Committee Management Officer, Room 13-103, 5600 Fishers Lane, Rockville, Maryland 20857
</p><p>Centers for Disease Control, Committee Management Officer, Management Analysis Branch, Building 4, Room 225, 1600 Clifton Road, NE, Atlanta, Georgia 30333
</p><p>Food and Drug Administration, Office of Management and Operations, Division of Management Systems and Policy, Committee Management Office, Room 12-21, 5600 Fishers Lane, Rockville, MD 20857
</p><p>Health Care Financing Administration, Records Committee Management Officer, Bay A-1, 1710 Gwynn Oak Avenue, Baltimore, Maryland 21235
</p><p>Health Resources and Services Administration, Office of Program Policy Coordination, Committee Management Officer, Parklawn Building, Room 14-05, 5600 Fishers Lane, Rockville, Maryland 20857
</p><p>National Institutes of Health, Committee Management Officer, National Institutes of Health, Building 01, Room 303, Bethesda, Maryland 20205
</p><p>Social Security Administration, OMBP, Office of Management, Budget and Personnel, Committee Management Officer, Room 828, Altmeyer Building, 6401 Security Boulevard, Baltimore, Maryland 21235
</p><p>Office of the Assistant Secretary for Health, OASH Committee Management Officer, Parklawn Building, Room 17-69, 5600 Fishers Lane, Rockville, Maryland 20857
</p><p>Office of the Assistant Secretary for Planning and Evaluation, Committee Management Officer, Room 405-F, HHH Building, 200 Independence Ave., SW, Washington, DC 20201
</p><p>Office of the Assistant Secretary for Human Development Services, Committee Management Officer, Room 308-E, HHH Building, 200 Independence Ave., SW, Washington, DC 20201 
</p></xhtmlContent></subsection> </section>
<section id="09-90-0062" toc="yes">
<systemNumber>09-19-0062</systemNumber>
<subsection type="systemName">Administrative Claims, HHS/OS/OGC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>See Appendix.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>HHS employees, recipients of Federal assistance under HHS funded programs, and members of the public who have a claim against HHS or against whom HHS has a claim--Federal Torts Claims Act, Military Personnel and Civilian Employees Claims Act, Federal Claims Collection Act, Federal Medical Care Recovery Act, Act for Waiver of Overpayment of Pay.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Information that is pertinent to the particular claim being asserted, including accident reports, hospital records, charges for medical services, certifications of overpayment, certifications of indebtedness, audits of payroll accounts during periods of overpayments, earning and leave statements, claims officers memoranda, final determinations made on claims (including Early Offers Pilot records), identify of debtors and information pertaining to how debts arose.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Federal Tort Claims Act, 28 U.S.C. 261-2680, 1346(b); Waiver of Overpayment of Pay Act, 5 U.S.C. 5584; Military Personnel and Civilian Employees Claims Act, 31 U.S.C. 240-243; Federal Claims Collection Act, 31 U.S.C. 951-953; Federal Medical Care Recovery Act, 42 U.S.C. 2651-2653.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To adjudicate claims asserted by or against the Department.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Records maintained for the Early Offers Pilot may be disclosed only for Routine Use Nos. 1 (to the extent the disclosure is to the HHS contractor who maintains the records for the Early Offers Pilot), 3 (in the event of Freedom of Information Act litigation), 5, and 13 below.
</p> <p>Records from this system may be disclosed as follows:
</p><p>1. Federal, State, and local government agencies, private individuals, private and public hospitals, allegedly negligent parties, private attorneys, insurance companies, individual law enforcement officers, tribal officials, and other persons with relevant information for the purpose of investigating, settling, or adjudicating claims and subsequent litigation action.
</p> <p>2. To a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>3. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provide such disclosure is compatible with the purpose for which the records were collected.
</p> <p>4. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statue, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether local, state, federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>5. In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>6. To a federal, state or local agency maintaining civil, criminal or other pertinent records, such as current licenses, if necessary to obtain a record relevant to a DHHS decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>7. To a federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>8. To the Department of Justice or other appropriate federal agencies in defending claims against the United States when the claim is based upon an individual's mental or physical condition and is alleged to have arisen because of activities of the Public Health Service in connection with such individual.
</p> <p>9. A record from this system may be disclosed to the following entities in order to help collect a debt owed the United States.
</p> <p>a. To another Federal agency so that agency can effect a salary offset;
</p><p>b. To another Federal agency so that agency can effect an administrative offset under common law or under 31 U.S.C. 3716 (withholding from money payable to, or held on behalf of, the individual);
</p><p>c. To the Treasury Department to request his/her mailing address under I.R.C. 6103(m)(2) in order to locate him/her or in order to have a credit report prepared;
</p><p>d. To agents of the Department and to other third parties to help locate him/her in order to help collect or compromise a debt;
</p><p>e. To debt collection agents under 31 U.S.C. 3718 or under common law to help collect a debt; and
</p><p>f. To the Justice Department for litigation or further administrative action. Disclosure under part (d) of this use is limited to the individual's name, address, Social Security Number, and other information necessary to identify him/her. Disclosure under parts (a)-(c) and (e) is limited to those items; the amount, status, and history of the claim; and the agency or program under which the claim arose. An address obtained from IRS may be disclosed to a credit reporting agency under part (d) only for purposes of preparing a commercial credit report on the individual. Part (a) applies to claims or debts arising under or payable under the Social Security Act if and only if the employee consents in writing to the offset.
</p> <p>10. A record from this system may be disclosed to another federal agency that has asked the Department to effect an administrative offset, under common law or under 31 U.S.C. 3716, to help collect a debt owed the United States. Disclosure under this routine use is limited to: Name, address, Social Security Number, and other information necessary to identify the individual; information about the money payable to or held for the individual; and other information concerning the administrative offset.
</p> <p>11. Disclosures with regard to claims or debts arising under or payable under the Social Security Act may be made from this system to "consumer reporting agencies" as defined in the Fair Credit Reporting Act (15 U.S.C. 1681a(f)) or the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a)(3)). However, this disclosure will not be made with regard to debts from overpayments to beneficiaries under Title II (Old- Age, Survivors, and Disability Insurance) and Title XVI (Supplemental Security Income) of this Act. The purpose of this disclosure is to aid in the collection of outstanding debts owed to the Federal Government. Disclosure of records is limited to the individual's name, address, Social Security number, and other information necessary to establish the individual's identity; the amount, status, and history of the claim; and the agency or program under which the claim arose.
</p> <p>12. When a debt becomes legally or administratively uncollectible in whole or in part, a record may be disclosed to the Internal Revenue Service to report the written-off part as income.
</p> <p>13. Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p> <p>Disclosure to consumer reporting agencies:
</p><p>Disclosures pursuant to 5 U.S.C. 552a(b)(12): Disclosures may be made from this system to "consumer reporting agencies" as defined in the Fair Credit Reporting Act (15 U.S.C. 1681a(f) or the Federal Claims Collections Act of 1966 (31 U.S.C. 3701(a)(3)). The purpose of this disclosure is to aid in the collection of outstanding debts owed to the Federal Government, typically, to provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records. Disclosure of records is limited to the individual's name, address, Social Security number, and other information necessary to establish the individual's identity; the amount, status, and history of the claim; and the agency or program under which the claim arose. This disclosure will be made only after the procedural requirements of 31 U.S.C. 3711(f) have been followed.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Legal size files in filing cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>These records are manually retrieved by name of the non-Government party, whether claimant, plaintiff, or alleged debtor. In some instances, these records are retrievable by computer using name of the party involved.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Office buildings in which files are kept are locked after the close of the business day. These files are only accessible to General Counsel staff, to designated claims program specialists in the Public Health Service, and with respect to the Early Offers Pilot records, to HHS's contractor.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records are maintained for an indefinite duration.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The agency official responsible for the system policies and practices outlined above is: The General Counsel, Department of Health and Human Services, Office of the General Counsel, Room 713F, Humphrey Building, 200 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>Any inquiries regarding this system of records should be addressed to the System Manager.
</p> <p>(These notification and access procedures are in accordance with Department Regulations (45 CFR 5b.5).)
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)), <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under System Manager(s) Address above, and reasonably identify the record, specify the information to be contested, and specify the corrective action sought, with supporting justification (i.e., how it is inaccurate, irrelevant, not timely, or incomplete). (These procedures are in accordance with Department Regulations (45 CFR 5b.7), <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The information in this system comes from a number of sources including private individuals, private and public hospitals, doctors, law enforcement agencies and officials, private attorneys, accident reports, third parties, claimants or beneficiaries and their relatives, other Federal agencies, State and local governments, agencies and instrumentalities.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p><p><i> Appendix</i> </p>
<p>Office of the General Counsel--Headquarters Offices, Department of Health and Human Services, Humphrey Building, Room 713F, 200 Independence Avenue, SW., Washington, DC 20201</p>
<p>Office of the General Counsel, Regional Attorney--Region I, Department of Health and Human Services, John F. Kennedy Federal Building, Room 2250, Government Center, Boston, Massachusetts 02203</p>
<p>Office of the General Counsel, Regional Attorney--Region II, Department of Health and Human Services, Jacob K. Javitz Federal Building, Room 3908, 26 Federal Plaza, New York, New York 10278</p>
<p>Office of the General Counsel, Regional Attorney--Region III, Department of Health and Human Services, The Public Ledger Building, Suite 418, 150 S. Independence Mall West, Philadelphia, Pennsylvania 19106-3499</p>
<p>Office of the General Counsel, Regional Attorney--Region IV, Department of Health and Human Services, Suite 5M60, 61 Forsyth Street, Atlanta, Georgia 30303</p>
<p>Office of the General Counsel, Regional Attorney--Region V, Department of Health and Human Services, Suite 700, 233 North Michigan Avenue, Chicago, Illinois 60601-5519</p>
<p>Office of the General Counsel, Regional Attorney--Region VI, Department of Health and Human Services, Room 1138, 1301 Young Street, Dallas, Texas 75202</p>
<p>Office of the General Counsel, Regional Attorney--Region VII, Department of Health and Human Services, Room 1711, 601 East 12th Street, Kansas City, Missouri 64106</p>
<p>Office of the General Counsel, Regional Attorney--Region VIII, Department of Health and Human Services, Room 300, 1961 Stout Street, Denver, Colorado 80294</p>
<p>Office of the General Counsel, Regional Attorney--Region IX, Department of Health and Human Services, Room 420, 50 United Nations Plaza, San Francisco, California 94102-4912</p>
<p>Office of the General Counsel, Regional Attorney--Region X, Department of Health and Human Services, Blanchard Plaza, Suite 702, 2201 Sixth Avenue, Seattle, Washington 98121-1833</p>
<p>Director, Division of Public Health Service Claims, Room 17A-17, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857</p>
<p>For records related to the Early Offers Pilot, Professor David A. Hyman, University of Illinois College of Law, 504 East Pennsylvania Avenue, Champaign, Illinois 61820-6909
</p></xhtmlContent></subsection> </section>
<section id="09-90-0064" toc="yes">
<systemNumber>09-90-0064</systemNumber>
<subsection type="systemName"> Litigation Files, Administrative Complaints, and Adverse Personnel Actions, HHS/OS/OGC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>See Appendix on the Administrative Claims System, 09-90-0062.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The individuals on whom records are maintained in this system are individuals who are involved in litigation with the Department or the United States (regarding matters within the jurisdiction of the Department) either as plaintiffs or as defendants in both civil and criminal matters, and individuals who either file administrative complaints with the Department or are the subjects of administrative complaints initiated by the Department, except claims which are the subjects of records maintained in the Administrative Claims System, 09 -90-0062.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>These records contain information pertaining to the subject matter of the litigation, administrative complaint, or adverse personnel action. Such records would include complaints, litigation reports, administrative transcripts, various litigation documents, investigative materials, correspondence, briefs, court orders and judgments, and in cases where personal injury is involved, principally malpractice cases, evaluations by physician specialists (Public Health Service, Armed Forces, Institute of Pathology).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authority for maintaining this system are the various statutes, regulations, rules or orders pertaining to the subject matter of the litigation, administrative complaint or adverse personnel action, (e.g., Public Health Service Act, Social Security Act, Civil Rights Act, Federal Food, Drug and Cosmetic Act).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To represent the Department and its components in court cases and administrative proceedings.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>A record from this system of records may be disclosed as a "routine use" to a Federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a Federal agency, response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>In the event that a system of records maintained by this agency to carry out its function indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use to the appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>To the Department of Justice or other appropriate Federal agencies in defending claims against the United States when the claim is based upon an individual's mental or physical condition and is alleged to have arisen because of activities of the Public Health Service in connection with such individual.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>These records consist of legal size files stored in file cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>These records are retrievable by name of the plaintiff or the first plaintiff if there is more than one, or by the name of the first defendant if the plaintiff is the United States. In the case of adverse personnel actions, records are retrievable by name of the individual involved.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Office buildings in which these records are maintained are locked after the close of the business day. These records are only accessible by General Counsel staff.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>These records are maintained for an indefinite duration.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The agency official responsible for the system policies and practices outlined above is:
</p><p>The General Counsel, Department of Health and Human Services, Office of the General Counsel, Hubert H. Humphrey Building, Room 722A, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Any inquiries regarding these systems of records should be addressed to the System Manager. An individual who requests notification of or access to a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. (These notification and access procedures are in accordance with Department Regulations (45 CFR 5b.6) <i>Federal Register</i>, October 8, 1975, page 47411.).</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.).</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address System Manager(s) and Address above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.).</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The information for this system is obtained through a number of sources including the exchange of legal pleadings, documents, formal and informal discovery, program offices and component agencies, private attorneys, State and local governments, their agencies and instrumentalities, and officers of other Federal agencies and the individuals involved.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0065" toc="yes">
<systemNumber>09-90-0065</systemNumber>
<subsection type="systemName"> Conflict of Interest--Standards of Conduct Records, HHS/OS/OGC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>See appendix on the Administrative Claims System, 09-90-0062.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information about current and past HHS employees who are or have been the subject of conflict of interest or standards of conduct inquiries or determinations.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>These records include information relating to acceptance or offer of gifts, entertainment and favors, outside employment; financial interests; use of government funds, property or official information; partisan political activity; or other matters relating to ethical standards of conduct.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>18 U.S.C. 202, 203, 205, 207, 208, 209; Executive Order 11222; and, 5 CFR 735.104, 45 CFR part 73.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To maintain such information about employees or former employees of the Department who have been the subjects of standards of conduct or conflict of interest inquiries.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal, or foreign charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>A record from this system of records may be disclosed as a "routine use" to a Federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>In the event that a system of records maintained by this agency to carry out its function indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use to the appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>To the Department of Justice or other appropriate Federal agencies in defending claims against the United States when the claim is based upon an individual's mental or physical condition and is alleged to have arisen because of activities of the Public Health Service in connection with such individual.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>These records are kept in legal size files in filing cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>These records are retrievable by name in most cases. In some instances, these records are retrievable by cross reference to index cards containing the name of the party involved and the subject matter.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>These records are only accessible to General Counsel staff. Office buildings in which these records are maintained are locked after the close of the business day.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records are maintained for an indefinite duration.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The agency official responsible for the systems policies and practices outlined above is:
</p><p>The General Counsel, Department of Health and Human Services, Office of the General Counsel, Humphrey Building, Room 722A, 200 Independence Ave., SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Any inquiries regarding these system of records should be addressed to the System Manager.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the System Manager(s) and Address procedures above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The information contained in this system comes from the individuals involved and from appropriate Department officials.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0066" toc="yes">
<systemNumber>09-90-0066</systemNumber>
<subsection type="systemName"> OGC-Attorney Applicant Files, HHS/OS/OGC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>See Appendix on the Administrative Claims System. 09-90-0062.
</p></xhtmlContent></subsection>
    <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Current Attorney Applicants for positions in the Office of the General Counsel.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The Attorney Applicant system consists of a variety of records relating to persons applying for attorney positions. These records contain information about an individual's birth date; home address; telephone number; social security number; educational background (e.g., law schools attended and grades); past work experience; writing samples furnished on request; recommendations from past employers and academic officials.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 3301 et seq.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To maintain current information concerning individuals interested in employment with the Office of General Counsel.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>These records are maintained in file folders, alphabetized by name, and in some cases the records are separated by individual law school affiliation and by the date the application is received. In some instances records are located in lockable conserva-file cabinets and in a locked secured room with access limited to those officials whose duties require access. In other instances records are maintained in file rooms or with other Office of the General Counsel files.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>These records are retrievable by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Access is limited to those HHS officials whose duties require access.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>These records are retained in a current system for one year, and in some instances two years, after which time they are discarded.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The agency official responsible for the systems policies and practices outlined above is:
</p><p>The General Counsel, Department of Health and Human Services, Office of the General Counsel, Humphrey Building, Room 722A, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Any inquiries regarding these systems of records should be addressed to the System Manager.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410).</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under System Manager(s) and Address above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411).</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records comes from the individual to whom it applies law school officials and past employers.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0067" toc="yes">
<systemNumber>09-90-0067</systemNumber>
<subsection type="systemName"> Invention Reports Submitted to the Department of Health and Human Services by its Employees, Grantees, Fellowship Recipients, and Contractors, HHS/OS/OGC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of the General Counsel, Patent Branch, Westwood Building--Room 5A03, 5333 Westbard Avenue, Bethesda, Maryland 20016.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Department employees, investigators funded under HHS research grants, fellowship awardees, investigators funded under HHS research contracts.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Invention reports.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>45 CFR parts 6, 7, and 8, E.O. 9865, E.O. 10096.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To maintain the information and patent records for the entire Department.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Department of Justice Claims Section for purpose of defending the Government in litigation.
</p> <p>Scientific personnel, both in this agency, and other Government agencies, and in non-Governmental organizations such as Universities, who possess the expertise to understand the invention and evaluate its importance as a scientific advance.
</p> <p>Contract patent counsel and their employees and foreign contract personnel retained by the Department for patent searching and prosecution in both the United States and foreign Patent Offices.
</p> <p>All other Government agencies whom we contact regarding possible use, interest in, or ownership rights in our inventions.
</p> <p>Prospective licensees or technology finders who may further make the invention available to the public through sale, use or publication.
</p> <p>Parties, such as supervisors of inventors, whom we contact to determine ownership rights, and those parties contacting us to determine the Government's ownership.
</p> <p>The United States and foreign Patent Offices for our filing of patent applications. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, if likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>These records are kept in individual file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Indexed by both inventor's name and case identification number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>During normal business hours a member of the staff of the Patent Section regulates the availability of the files. During evening and weekend hours, the building is closed, with a guard at the front entrance, and only personnel authorized to be in the building are permitted entry.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records are maintained here for the life of any patent issued (seventeen years), for seven years for any invention which is not patented, and they are sent to the Federal Records Center for retention when they are no longer required here.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Patent Counsel, Department of Health and Human Services, Westwood Building--Room 5A03, 5333 Westbard Avenue, Bethesda, Maryland 20016.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual is required to provide his own name together with that of any other individual who contributed to the making of an invention, on which the system contains a record. Any inquiries regarding these systems of records should be addressed to the System Manager.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under System Manager(s) and Address above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The information comes from the inventors, their supervisors, other scientists with expertise in the particular area of the invention, scientific publications, newspapers, contract patent counsel who have searched and/or prosecuted the invention, and commercial organizations.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0068" toc="yes">
<systemNumber>09-90-0068</systemNumber>
<subsection type="systemName"> Federal Private Relief Legislation, HHS/OS/OGC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This system is located in the:
</p><p>Division of Legislation,
</p><p>Office of the General Counsel,
</p><p>Office of the Secretary,
</p><p>Room 427 D, Humphrey Building,
</p><p>Department of Health and Human Services,
</p><p>200 Independence Ave., SW,
</p><p>Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Private individuals, groups, or institutions for whom a United States Congressman or Senator has introduced a private relief bill.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Background which gives rise to the individual's, group's or institution's claim for private relief legislation.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301; OMB Circular A-19.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To respond to Congressional requests for information regarding private relief legislation.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The information is used to prepare reports to the Congress, most commonly to the Judiciary Committees of the Senate and the House of Representatives, which reports are thereafter made available to the public under the provisions of 5 U.S.C. 552. In connection with the preparation of those reports, the information contained in this system of records will, as a routine use be disclosed to officers and employees of the Office of Management and Budget in connection with the review of private relief legislation as set forth in OMB Circular No. A-19 at various stages of the legislative coordination and clearance process as set forth in that Circular, and may, as a routine use, be disclosed to officers or employees of agencies (as defined in 5 U.S.C. 551(i) and 552(e) other than the agency that maintains the record. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Paper records in file folders kept in legal size filing cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>By bill number using card systems maintained by name and by subject.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Immediate access to these records are only by authorized staff. Building is locked at close of business.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Retained indefinitely either at System Location or at Federal Record Center where files are sent on a regular predetermined schedule.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, Legislative Reference and Control Service,
</p><p>Division of Legislation,
</p><p>Office of the General Counsel,
</p><p>Department of Health and Human Services,
</p><p>Room 427 D, Humphrey Building, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Any inquiries regarding the records in question should be made to the System Manager.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the offical at the address specified under System Managers and Address above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The information in this system comes from the Operating Divisions of the Department, the Public Health Service Agencies, the Office of the Secretary, Congressional Committees, individual Congressmen and Senators, and, in some cases, the subject individual, group, or institution.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0069" toc="yes">
<systemNumber>09-90-0069</systemNumber>
<subsection type="systemName"> Unfair Labor Practice Records, HHS/OS/ASPER.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Personnel Offices of the Department shown in Applicants for Employment Records, HHS System 09-90-0006, Appendix 1 and offices of operating officials in organizational units serviced by those Personnel Offices.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Current HHS employees and union officials.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system of records consists of a variety of records relating to an unfair labor practice charge. Examples of information which may be included in this system are the employee's name, Social Security Number, grade, job title, employment history and a variety of work and personnel records associated with the charges and required under proceedings established by Title 5, United States Code, Chapter 71 and Department of Labor Regulations.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Executive Order 11491, as amended, 5 U.S.C. Chapter 71.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>These records are used to initiate, make a determination on, and document a decision made on unfair labor practice charges filed by an employee or union official. These records are maintained in each component of the Department. See also "Retrievability" below.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Information in this system may be released to:
</p><p>1. Office of Personnel Management, Merit Systems Protection Board (including its Office of the Special Counsel), Equal Employment Opportunity Commission, and the Federal Labor Relations Authority (including the General Counsel of the Authority and the Federal Service Impasses Panel) in carrying out their functions;
</p><p>2. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>3. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosures is compatible with the purpose for which the records were collected.
</p> <p>4.  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file folders.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrievable by name. Information from this system may be used by Department officials for preparing statistical summary or management reports.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Records are stored in lockable metal file cabinets. Access to and use of these records are limited to personnel who have a need for the records in performance of official duties.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The case files are maintained as long as they may be pertinent for purposes of precedent or as management information devices. When no longer useful for such purposes, they are destroyed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Personnel Officer shown in Appendix 1 of Applicants for Employment Records, HHS System 09-90-0006, who services the organizational unit in which the individual is employed.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Contact the systems manager and provide name, approximate date of record, the unfair labor practice charge as specified by the complainant, and management component in which the charge was filed.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) <i>Federal Register</i>, October 8, 1975, page 47410.)</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above, and reasonably identify the record and specify the information to be contested and state the corrective action sought and the reasons for the correction. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) <i>Federal Register</i>, October 8, 1975, page 47411.)</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records is:
</p><p>1. Supplied directly by the individual, or
</p><p>2. Derived from information supplied by the individual, or
</p><p>3. Supplied by testimony of witnesses, or
</p><p>4. Supplied by union officials, or
</p><p>5. Supplied by Department officials.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0071" toc="yes">
<systemNumber>09-90-0071</systemNumber>
<subsection type="systemName"> Social Security Code Cards, HHS/OS/OGC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of the Regional Attorney, Department of Health and Human Services, 19th and Stout Streets, Denver, Colorado 80294.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals referred to in this system are Social Security claimants or wage-earners who have been the subject of Social Security Precedent opinions.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The information in this system consists of the name of the individual on a 3x5 card and a code which cross references to the location of the actual opinion. These cards are separate and distinct from the digest cards which are distributed nationally by the Office of the General Counsel.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>44 U.S.C. 3101.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To enable a researcher to obtain the appropriate Social Security precedent opinion which may be cited in subsequent opinions.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>The subject information is kept on 3x5 cards which are kept in an office locked after the close of the business day. The opinions which are cross-referenced by the cards are kept in the files in the same office.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Retrievable by name. These cards are used to enable the researcher to obtain the appropriate Social Security precedent opinion which may then be cited in subsequent opinions distributed within OGC and SSA.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Office locked at the close of the business day.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Retained indefinitely either at system location or at Federal Records Center where files are sent on a regular predetermined schedule.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The agency official responsible for the system policies and practices outlined above is:
</p><p>Regional Attorney, Department of HHS, 19th and Stout Streets, Denver, Colorado 80294.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Any inquiries regarding the records in question should be made at the above address where the records are kept. Required identifying information will be in keeping with Departmental requirements.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department Regulations (45 CFR 5b.5(a)(2)) Federal Register, October 8, 1975, page 47410.)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under System Managers and Address above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7) Federal Register, October 8, 1975, page 47411.)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The information on the cards is gleaned from precedent opinions nationwide as well as those issued from Region VIII.
</p></xhtmlContent></subsection></section>
<section id="09-90-0072" toc="yes">
<systemNumber>09-90-0072</systemNumber>
<subsection type="systemName"> Congressional Grants Notification Unit, HHS/OS/ASL.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Room 417, H Humphrey Building, 200 Independence Avenue, SW, Washington, DC 20201.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>Members of Congress.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Notification form of grants or contract awards made by HHS. The form contains the name and address of the project director, the purpose of the grant or contract, and the HHS program involved.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To provide timely notification to members of Congress of HHS grants and contract awards being made in their Districts.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity, (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components, or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Paper files are maintained in standard file cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Files are indexed by States Congressional Districts with the name of the Congressional Representative of that District on the file. Records are retrieved by name. The staff uses this system for the following purposes: (1) To answer questions in the short term about amounts of HHS grant funds going into areas of the country according to congressional districts. (2) To verify that actual notification to members offices of awards has been made.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>These records are public information and available on request.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Grant notification files are discarded after two calendar years.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Congressional Liaison, Office of the Assistant Secretary for Legislation, Room 417H, HHH Bldg., 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Same as above. The Congressional District or name of the Congressional Representative of that district and the approximate date of the award must be provided.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Address same as above.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Address same as above.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Agencies within the Department making the grant/contract awards.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>

<section id="09-90-0076" toc="yes">
<systemNumber>09-90-0076</systemNumber>
<subsection type="systemName">Administrative Files, HHS/OS/OIG/OCIG.
</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>Office of Inspector General (OIG), Department of Health and Human Services, Room 5527, Wilbur J. Cohen Building, 330 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system consists of information concerning persons mentioned in opinions, memoranda, correspondence, testimony, and other writings relevant to the Office of Counsel to the Inspector General (OCIG) within OIG. Individuals mentioned may include:
</p><p>&#149; Staff members and authors whose names are mentioned in memoranda, opinions, correspondence, testimony, and other writings;
</p><p>&#149; Individuals addressed in memoranda, opinions, correspondence, testimony, and other writings;
</p><p>&#149; Attendees at meetings and conferences described in memoranda, opinions, correspondence, testimony, and other writings; or
</p><p>&#149; Any individual identified in connection with questions presented to OCIG.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system will consist of memoranda, opinions, correspondence, testimony, and other writings.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authority for maintaining this system is found in the various statutes, regulations, rules, or orders pertaining to the subject matter of the memoranda, opinions, correspondence, testimony, and other writings of the office, (<i>e.g.</i>, Inspector General Act (5 U.S.C. App.)).</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>In accordance with the Inspector General Act of 1978, this system is maintained for the purposes of maintaining a searchable record of memoranda, opinions, correspondence, testimony, and other writings.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>a. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>b. In the event of litigation, information from the system of records may be disclosed to the Department of Justice, to a judicial or administrative tribunal, opposing counsel, and witnesses, in the course of proceedings involving HHS, any HHS employee (where the matter pertains to the employee's official duties), or the United States, or any agency thereof where the litigation is likely to affect HHS, or HHS is a party or has an interest in the litigation and the use of the information is relevant and necessary to the litigation.
</p> <p>c. In the event that a system of records maintained by OIG to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal, State, local, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>d. In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>e. A record from this system of records may be disclosed to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>f. The system of records may be disclosed to student volunteers and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p> <p>g. A record may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in electronic form and paper, and maintained under secure conditions in limited access areas. Computer server containing files are locked in controlled-access rooms. Laptops that may contain files are protected with whole-disk encryption.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>These records are retrievable by certain personal identifiers, such as by name, of the individuals covered by this system of record.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Office buildings in which these records are maintained are secured by a variety of security systems. The computer terminals used to access the records are secured with passwords, encryptions, and other security devices, comply with all relevant computer security procedures, are kept in rooms that are locked at the close of the business day, and are generally accessible only to OCIG staff. Paper files are stored in locked cabinets, in locked offices and are accessible to limited members of OCIG on a need-to-know basis.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The agency official responsible for the system policies and practices outlined above is:  The Chief Counsel, Office of Counsel to the Inspector General, Department of Health and Human Services, Wilbur J. Cohen Building, Room 5527, 330 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the system manager.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department regulations (45 CFR 5b.5(a)(2).)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address in the System Manager(s) and Address section above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7).)
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The information for this system is obtained through a number of sources including OCIG attorney, exchange of legal pleadings, documents, formal and informal discovery, program offices and component agencies, private attorneys, State and local governments, their agencies and instrumentalities, and officers of other Federal agencies and the individuals involved.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p></xhtmlContent></subsection></section>

<section id="09-90-0077" toc="yes">
<systemNumber>09-90-0077</systemNumber>
<subsection type="systemName">Litigation Files, Administrative Complaints, and Personnel Actions, HS/OS/OIG/OCIG.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Counsel to the Inspector General (OCIG), Department of Health and Human Services, Room 5527, Wilbur J. Cohen Building, 330 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The individuals on whom records are maintained in this system are individuals who are involved in civil, criminal, or administrative litigation with the Department or the United States (regarding matters within the jurisdiction of the Department) either as plaintiffs or as defendants, and individuals who either file administrative complaints with the Department or are the subjects of administrative complaints initiated by the Department.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>These records contain information pertaining to the subject matter of the litigation, administrative complaint, or personnel action. Such records would include complaints, litigation reports, administrative transcripts, various litigation documents, investigative materials, correspondence, briefs, court orders, and judgments.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authority for maintaining this system is found in the various statutes, regulations, rules, or orders pertaining to the subject matter of the litigation, administrative complaint, or adverse personnel action, (e.g., Inspector General Act and the Social Security Act).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To advise and represent the Office of Inspector General and its components in court cases and administrative proceedings.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>a. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>b. In the event of litigation, information from the system of records may be disclosed to the Department of Justice, to a judicial or administrative tribunal, opposing counsel, and witnesses, in the course of proceedings involving HHS, any HHS employee (where the matter pertains to the employee's official duties), or the United States, or any agency thereof where the litigation is likely to affect HHS, or HHS is a party or has an interest in the litigation and the use of the information is relevant and necessary to the litigation.
</p> <p>c. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.
</p> <p>d. In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>e. A record from this system of records may be disclosed as a "routine use" to a Federal, State, or local agency maintaining civil, criminal, or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant, or other benefit.
</p> <p>f. A record from this system of records may be disclosed to a Federal agency, response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>g. Information in this system of records may be disclosed to a Federal, State, or local agency maintaining civil, criminal, or other relevant enforcement records, or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency concerning the hiring or retention of an employee, the issuance of a license, grant, or other benefit.
</p> <p>h. To student volunteers and other individuals performing functions for the Department, but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.
</p> <p>i. A record may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in electronic form and paper files are stored in locked file cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>These records are retrievable by name of the plaintiff or the first plaintiff if there is more than one, or by the name of the first defendant if the plaintiff is the United States. In the case of personnel actions, records are retrievable by name of the individual involved.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Office buildings in which these records are maintained are secured by a variety of security systems. The computer terminals used to access the records are secured with passwords, encryptions, and other security devices, comply with all relevant computer security procedures, and are kept in rooms that are locked at the close of the business day, and are generally accessible only to OCIG staff.</p>
</xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>These records are maintained for an indefinite duration.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The agency official responsible for the system policies and practices outlined above is: The Chief Counsel, Office of Counsel to the Inspector General, Department of Health and Human Services, Wilbur J. Cohen Building, Room 5527, 330 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Any inquiries regarding these systems of records should be addressed to the System Manager. An individual who requests notification of or access to a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. (These notification and access procedures are in accordance with Department regulations (45 CFR 5b.6).)
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department regulations (45 CFR 5b.5 (a)(2).)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address System Manager(s) and Address above, and reasonably identify the record and specify the information to be contested and corrective action sought with supporting justification. (These procedures are in accordance with Department regulations (45 CFR 5b.7).)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The information for this system is obtained through a number of sources including the exchange of legal pleadings, documents, formal and informal discovery, program offices and component agencies, private attorneys, State and local governments, their agencies and instrumentalities, and officers of other Federal agencies and the individuals involved.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>

<section id="09-90-0083" toc="yes">
<systemNumber>09-90-0083</systemNumber>
<subsection type="systemName"> JOBS Evaluation Data System.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Manpower Demonstration Research Corporation (MDRC), 3 Park Avenue, New York, NY 10016
</p><p>Deloitte and Touche, 2 Oliver Plaza, Pittsburgh, PA 15222
</p><p>Response Analysis Corporation, 377 Wall Street, Princeton, NJ 08542-0158
</p><p>Participating Sites (See list below).
</p></xhtmlContent></subsection><subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system will include records on a sample of approximately 48,000 individuals in 7 to 9 sites who were AFDC recipients or applicants at the time of selection of the research sample and who were eligible to receive JOBS services. Certain categories of records will be collected for all sample members, while others will be collected only for subsamples in selected sites.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>In each of the evaluation sites, clients will be randomly assigned to either treatment or control groups through a computerized assignment system by the contractor. Similar data will be collected for members of both treatment and control groups in the research sample. Categories of records collected from administrative records, surveys, and testing include client identifiers (including name, social security number, etc.); demographic characteristics; family status; labor market status; educational status; public assistance status; program status; total income and poverty status; attitudes toward work, welfare, parenting, and jobs; motivational, self-descriptive, and work-related factors; program participation; educational and training utilization; school performance and developmental status of children; and factors related to child care use.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority is provided by the Family Support Act, Pub. L. 100-485, section 203(c), 42 U.S.C. 681 note, which calls for an evaluation to determine the effectiveness of different approaches to assisting welfare applicants and recipients.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purpose of the JOBS Evaluation Data System is to build and expand on prior and in-progress research in order to determine which program approaches work best for different subgroups of welfare applicants and recipients. The evaluation will contain three main study areas: an impact analysis, an implementation and process study, and a benefit-cost analysis. Other analyses, such as studies of performance standards, will also be conducted. Numerous reports on the findings (in aggregate form only) will be issued over the course of the multi-year evaluation.
</p> <p>The impact study will examine the effects of various JOBS program approaches on individuals' employment status and earnings levels, receipt and amount of AFDC payments, income levels, and educational attainment, in up to ten sites (and on literacy, basic mathematics achievement, and the development of children in three of the ten sites). The research will provide important information to policy makers who need to decide which services to emphasize for which populations in JOBS in the future.
</p> <p>The implementation and process analysis--the second major evaluation study area--is intended to inform the impact analysis and assess the feasibility and replicability of different approaches. It will do this by examining how various JOBS approaches are implemented in each site, individuals' patterns of participation in JOBS and other services available in the community, the relationship between participation and individuals' baseline characteristics, and the site contexts.
</p> <p>The cost-effectiveness study--the third major study area--will estimate the total costs of the various JOBS approaches in each site as well as the costs of particular activities or components within each approach. These costs will then be compared to program benefits, as estimated through the impact study, to determine the relative cost-effectiveness of different JOBS approaches.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The following routine uses for the system are proposed:
</p><p>1. Information may be disclosed to the Department of Justice, to a court or other tribunal, or to another party before such tribunal, when
</p><p>&#149;DHHS, or any component thereof; or
</p><p>&#149;Any DHHS employee in his or her official capacity; or
</p><p>&#149;Any DHHS employee in his or her individual capacity where the Department of Justice (or DHHS, where it is authorized to do so) has agreed to represent the employee; or
</p><p>&#149;The United States or any agency thereof where DHHS determines that the litigation is likely to affect DHHS or any of its components, is a party to litigation or has an interest in such litigation, and DHHS determines that the use of such records by the Department of Justice, the tribunal, or the other party is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, DHHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>3. The evaluation project is being performed under a contract. Records may be disclosed to employees of the contractor who need the record in performing their duties related to the contract. The contractor will be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>4. Records may be disclosed to the contractor and its subcontractors for purposes of collecting, collating, analyzing, aggregating or otherwise refining records in this system. The contractor and its subcontractors shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>5.  Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Magnetic tape and disk, paper records.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The research sites will provide DHHS's contractor with identifying information on each sample member at the time of random assignment, which will be maintained in automated and paper files at the contractor's location. For all sample members, these identifiers will be used to access administrative records, as described above, and to add to files containing survey and test data.
</p> <p>The contractor will assign a sample identifier to each sample member and any personal identifiers will be encrypted on the research files. Thus, the identifiers will be used only for data collection and validation purposes. Once the files are created, the sample ID will be used for maintenance of the research files, with the identifiers encrypted. A master "decryption" routine will be maintained to link the files. Access to this file will be restricted to contractor staff who need to use this routine to validate data.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>The following safeguards are routinely employed by DHHS and the contractor to insure confidentiality:
</p><p>&#149;All contract staff sign an agreement to comply with the corporate policies on data security and confidentiality;
</p><p>&#149;All data, both paper files and computerized files, are kept in secure areas, with access limited on a need to know basis, using locked files, password controls and encryption routines;
</p><p>&#149;Merged data sources will have identifying information encoded to preclude overt identification of individuals;
</p><p>&#149;All reports, tables and printed materials will present only aggregate information;
</p><p>&#149;Compilations of individualized data will not be provided to agencies at the research sites; and
</p><p>&#149;Confidentiality agreements will be executed with any participating subcontractors and consultants who must obtain access to the detailed files.
</p> <p>Any users of the files in the future will be held to the same confidentiality and use restrictions outlined above.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Data will be maintained for at least seven years or as long as it serves legitimate research purposes related to the evaluation.
</p> <p>Data disposal will consist of shredding all individual records (and certifying) and destroying computer files, other than the Public Use File, which will not contain identifiable individual data.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Assistant Secretary for Planning and Evaluation, Department of Health and Human Services, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the system manager at the address indicated above. Provide notarized signature as proof of identity. The request should specify the name or identification number and the time period of association with the JOBS Evaluation.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedure. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Departmental Regulations (45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager named above, reasonably identify the record(s), and specify the information to be contested. State the reason for contesting it (e.g., why it is inaccurate, irrelevant, incomplete, or not current). (These procedures are in accordance with Departmental Regulations (45 CFR 5b.7)).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information for individuals will be collected from local social services agency records, including benefit payment and claims files, from service providers and from interviews with sample members and their children.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p>
<p><i>List of Participating Sites: </i></p><p>Michigan--Kent and Wayne Counties:
</p><p>Director, Bureau of Employment Services, Michigan Department of Social Services, 235 South Grand Avenue, Lansing, MI 48909 </p><p>Ohio--Franklin County:
</p><p>Director, Ohio Department of Human Services, Office of Welfare Reform, 30 East Broad Street, 31st floor, Columbus, OH 43266 </p><p>Georgia--Fulton County:
</p><p>Director, Division of Family and Children Services, Georgia Department of Human Resources, 878 Peachtree Street, NE., Atlanta, GA 30309 </p><p>Oklahoma--Oklahoma City, Cleveland and Pottawatomie Counties:
</p><p>Program Support Supervisor, Oklahoma Department of Human Services, Family Support Services Division, PO Box 25352, Oklahoma City, OK 73125 </p><p>California--Riverside County:
</p><p>Associate Program Analyst, GAIN and Employment Operations Bureau, California Department of Social Services, 744 P Street, MS-6136, Sacramento, CA 95814 </p><p>Oregon--Washington and Multnomah Counties:
</p><p>Program Analyst--JOBS unit, Adult and Family Services Division, Oregon Department of Human Resources, 415 Public Service Building, Salem, OR 97310.</p></xhtmlContent></subsection> <subsection type="systemsExempted"><xhtmlContent><p>None.</p></xhtmlContent></subsection> </section>
<section id="09-90-0085" toc="yes">
<systemNumber>09-90-0085</systemNumber>
<subsection type="systemName">Partnership for Long Term Care Data Set.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Thomson Reuters, 610 Opperman Drive, Eagan, Minnesota 55123.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Purchasers of long term care insurance policies certified by a selected state (Medicaid state plan amendment approved after May 14, 1993) insurance commissioner as meeting the state's Partnership's requirements for certification.</p>
</xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>&#8226;  Name
</p><p>&#8226; Address
</p><p>&#8226; Social Security Number
</p><p>&#8226;  Date of Birth
</p><p>&#8226; Long Term Care Insurance Policy Information
</p><p>&#8226; Long Term Care Insurance Company
</p><p>&#9675; Long Term Care Insurance Policy Number
</p><p>&#9675; Type of Policy (Group, Individual and Comprehensive, Nursing Home Only)
</p><p>&#9675; Policy Issue State
</p><p>&#9675; Lifetime Maximum Benefit
</p><p>&#9675; Duration of Insurance Benefits (dollars or days)
</p><p>&#9675; Daily Benefit Amount
</p><p>&#9675; Inflation Protection Feature (required by DRA for select ages)
</p><p>&#8226;Claims Information
</p><p>&#9675; Qualifying Condition for Claim (ADL, Cognitive Impairment, Other)
</p><p>&#9675; Benefits Payment by Type of Service (institutional or home)
</p><p>&#9675; Remaining Lifetime Maximum Benefits (by service type when multiple pools)
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authority for this system of records is contained in Section 6021 of the Deficit Reduction Act of 2005, Public Law 109-171, 42 U.S.C. 1396p note.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of the system of records is to support Medicaid eligibility determinations for persons participating in a Partnership for long term care program.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Section 552a(b)(3) of the Privacy Act permits an agency to establish disclosures not anticipated by the statute itself, compatible with the purpose for which the information was collected, under which the information may be released without the consent of the individual to whom the information pertains. ASPE is identifying the following routine disclosures for information held in the Partnership for Long Term Care Data Set. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including, but not limited to, ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. Disclosure may be made under the following circumstances.
</p> <p>1. Disclosure may be made to a State, local, tribal or other public authority for the purpose of verifying Partnership program participation and calculation of the amount of the Medicaid Partnership asset disregard.
</p> <p>2. Disclosure may be made to the Department of Justice when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity; (c) any employee of the agency in his or her individual capacity where agency or the Department of Justice has agreed to represent the employee; or (d) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records by the Department of Justice is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
</p> <p>3. Disclosure may be made to a court or adjudicative body in a proceeding when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity; (c) any employee of the agency in his or her individual capacity where agency or the Department of Justice has agreed to represent the employee; or (d) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
</p> <p>4. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate public authority, whether Federal, foreign, state, local, tribal, or otherwise responsible for enforcing, investigating, or prosecuting such violation or charged with enforcing, or implementing the statute, rule, regulation, or order issued pursuant hereto, if the information disclosed is relevant to any enforcement, regulatory, investigative or prosecutorial responsibility of the receiving entity.
</p> <p>5. Disclosure may be made to a Member of Congress or to a congressional staff member in response to an inquiry of the congressional office made at the written request of the constituent about whom the record is maintained. The Member of Congress does not have any greater authority to obtain records than the individual would have if requesting the record directly.
</p> <p>6. Disclosure may be made to agency contractors, grantees, or volunteers who have been engaged to assist the agency in the performance of a contract service, grant, cooperative agreement or other activity related to this system of records and who need to have access to the records in order to perform the activity. Recipients shall be required to comply with the requirements of the Privacy Act of 1974, as amended 5 U.S.C 552a.
</p> <p>7. Disclosure may be made to an individual or organization conducting a research, demonstration, or evaluation project related to long term care financing generally, the performance of long term care insurance or Partnership programs, or for the purposes of determining, evaluating, assessing cost effectiveness, or quality of the long term care services provided through a Partnership program.
</p> <p>8. To another Federal or state agency for the purpose of operating the Medicaid program or otherwise assisting states in the administration of those portions of the Medicaid program with direct connection to state Partnership programs.</p>
<p>9. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on paper or magnetic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The records are retrieved by the long term care insurance policy number, name, social security number, or a combination of these.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>For computerized records, safeguards established in accordance with Department standards and National Institute of Standards and Technology guidelines (e.g., security codes) will be used, limiting access to authorized personnel. System security policy and practices are established in accordance with HHS, Information Resources Management (IRM) Circular #10, Automated Information Systems Security Program; HCFA Automated Information System (AIS) Guide, Systems Security Policies; and OMB Circular No. A-130 (revised), Appendix III.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>We are working with the National Archives and Records Administration (NARA) to determine the appropriate retention schedule. Due to the nature of these records, we expect them to be preserved for at least 20 years after the death of the policyholder. When the retention period has been approved by NARA, we will amend this notice.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Hunter McKay, Office of the Assistant  Secretary for Planning and Evaluation, U.S. Department of Health and Human Services, 200 Independence Ave, SW., Room Number 424E, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of notification, individuals may write the system manager, who will require the insured's name, insurance company name, insurance policy number, and, for verification purposes, date of birth, to ascertain whether or not the individual's record is in the system. (These notification procedures are in accordance with Department regulation 45 CFR part 5b.)
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requestors should also reasonably specify the record contents being sought. (These access procedures are in accordance with the Department regulation 45 CFR 5b.5(a)(2).)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information is reported by private long term care insurance companies selling policies that have been certified by a state insurance commissioner as Partnership qualified in a state that had obtained a Medicaid state plan amendment approved after of May 14, 1993.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>

<section id="09-90-0100" toc="yes">
<systemNumber>09-19-0100</systemNumber>
<subsection type="systemName"> Civil and Administrative Investigative Files of the Inspector General.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of the Inspector General, Department of Health and Human Services, 330 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>HHS employees and former employees; HHS grantees; contractors, sub-contractors and their employees; employees of state agencies and Medicare carriers and intermediaries; Medicare and Medicaid providers; recipients under programs administered or funded by the Department; and others doing business with the Department.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Civil and administrative investigative records.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Pub. L. 94-505; sec. 1128A of the Social Security Act.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Pursuant to Pub. L. 94-505, this system is maintained for the purpose of conducting and documenting civil and administrative investigations conducted by OIG or other investigative agencies regarding HHS programs and operations, documenting the results of OIG reviews of allegations and complaints received concerning HHS programs, HHS personnel or former personnel, aiding in administrative proceedings or civil suits brought against the subjects of OIG investigations, maintaining a record of the activities which were the subject of civil and administrative investigations, reporting the results of civil and administrative investigations to other departmental components for their use in evaluating their programs and in imposition of civil or administrative sanctions, and acting as a repository and source for information necessary to fulfill the reporting requirements of 42 U.S.C. 3524. This system is also maintained for the purpose of conducting and documenting the results of reviews, including computer matches, which identify individuals who are not entitled to benefits under programs financed by the Department, whether administered by federal, state or local government agencies, or who are delinquent on loan payments due under federally funded programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These records may be used as follows:
</p><p>(1) In the event that this system of records maintained by this Agency to carry out its functions, indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether federal, foreign, state, or local, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto where such responsibility rests outside of OIG.
</p> <p>(2) Disclosures may be made to federal, state, or local agencies where disclosure is necessary in order to obtain records relevant and necessary to a civil or administrative investigation of the Office of Inspector General.
</p> <p>(3) Disclosures may be made to a federal agency where records in this system of records pertain to an applicant for employment, or to a current employee of that agency where the records are relevant and necessary to an agency decision with regard to the hiring or retention of an employee or disciplinary or other administrative action concerning an employee.
</p> <p>Disclosures may be made to a federal agency in response to its request in connection with the issuance of a security clearance, the award of a contract, or the issuance of a license, grant, or other benefit by the requesting agency to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>(4) Disclosures may be made to the Office of Personnel Management or the Merit Systems Protection Board (including the Office of the Special Council) of information relevant and necessary to carrying out their functions.
</p> <p>(5) Disclosures may be made to third party contacts where the party contacted may have information needed to establish or verify information relevant and necessary to a civil or administrative investigation by the OIG or in preparation for proceedings pursuant to section 1128A of the Social Security Act, and "Civil Money Penalties".
</p> <p>(6) Disclosures may be made to federal, state, or local agencies, or to other entities administrating federally funded programs where necessary to take action based on an OIG investigation or audit which identifies individuals not entitled to program benefits or individuals delinquent on loan payments under federally funded programs.
</p> <p>(7) Disclosures may be made when the Department contemplates that it will contract with private firms for the purpose of collating, analyzing, aggregating or otherwise refining records. Disclosures will also be made to independent auditors who by contract carry out audits on behalf of the Department. Such contractors will be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>(8) Where federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>(9) In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>(10) In event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems necessary to the Department of Justice to enable that Department to present an effective defense.
</p> <p>(11) Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>(12) A record may be disclosed to any official charged with the responsibility to conduct qualitative assessment reviews of internal safeguards and management procedures employed in investigative operations.  This disclosure category includes members of the President's Council on Integrity and Efficiency and officials and administrative staff within their investigative chain or command, as well as authorized officials of the Department of Justice and the Federal Bureau of Investigation.</p>
</xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>The records, which take the form of index cards, investigtive reports, printed material, computer tape files, computer-generated printouts and other audit and investigative workpapers are stored in (1) secured areas, (2) locked rooms, and/or (3) locked cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by manual or computer search of alphabetical or numerical indices or cross-indices.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Direct access is restricted to authorized staff members of the OIG; access within HHS is limited to the Secretary, Under Secretary, and other officials and employees on a need to know basis. All computer files are safeguards as described under Storage and in accordance with the provisions of the National Bureau of Standards Federal Information Processing Standards 41, and HHS Information Processing Standards, HHS ADP Systems Manual, Part 6,"ADP Systems Security". We protected all computer tapes by the use of passwords to prohibit unauthorized access.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Investigative files are retained for 6 years after completion of the investigation and/or actions based thereon. Index and cross- reference cards are retained permanently. In instances of computer matching of files, only those records which meet predetermined criteria for investigation are maintained. All records which do not meet these criteria are destroyed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Inspector General/Deputy Inspector General, Room 5250, North Building, U.S. Department of Health and Human Services, 330 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Exempt. However, consideration will be given requests addressed to the system manager. For general inquires, include the name and date of birth of the individual.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requestors should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Exempt. However, consideration will be given requests addressed to the systems manager. Requests for correction should reasonbly identify the record and specify the information to be contested, the corrective action sought and the reasons for the correction with supporting justification.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Department and other federal, state, and local government records; interviews of witnesses; documents and other materials furnished by nongovernmental sources. Sources may include confidential sources.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>Exempted from certain provisions of the Act under 5 U.S.C. 552a(k)(2). Pursuant to 45 CFR 5b.11(b)(2)(ii)(D, this system is exempt from the following subsections of the Act: (c)(3), (d) (1)-(4), and (e)(4) (G) and (H).
</p></xhtmlContent></subsection></section>
<section id="09-90-0101" toc="yes">
<systemNumber>09-19-0101</systemNumber>
<subsection type="systemName">Health Care Program Violations.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>This system is located in the Office of Inspector General, Department of Health and Human Services, 330 Independence Avenue, SW., Washington, DC 20201. The database for this system, known as the List of Excluded Individuals/Entities (LEIE), is on a local area network in the Wilber H. Cohen Building, 330 Independence Avenue, SW., Washington, DC. The system is operated by the Office of Inspector General.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals and entities covered by this system are employees and former employees, HHS grantees, contractors, sub-contractors and their employees; employees of State agencies and Medicare carriers and intermediaries; Medicare and Medicaid providers; recipients under programs administered or funded by the Federal and State programs; and others involved in health care. It includes individuals and entities who have been excluded from participation in the Medicare, Medicaid, and all Federal health care programs as defined in section 1128B(f) of the Social Security Act. The individuals would include physicians, nurses, pharmacists, dentists, therapists, suppliers and private citizens receiving Federal payments for the furnishing of items or services covered by any Federal or private program.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The Health Care Program Violations System contains public information on individuals and entities which have been excluded from participation in the Medicare, Medicaid, and all other Federal health care programs (after August 1997, in accordance with Pub. L. 105- 33), including names, publicly available Social Security numbers, individual Social Security numbers (and Employer Identification numbers, if applicable), aliases and "doing-business-as," addresses, and other available unique identifiers related to fraud, waste and abuse; occupations and specialties, and institutional affiliations; type and date of exclusion.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. App. 3.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The Health Care Program Violations System is used to protect program beneficiaries and to reduce fraud and abuse in Federal health care programs by providing a clearinghouse of public information on individuals and entities excluded from health care programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Information maintained by this system may be disclosed, as a routine use, to Federal, State, local, public and private agencies and organizations, as follows:
</p><p>a. Agencies or organizations which reimburse or regulate individuals or entities with respect to the furnishing of health-related services or items.
</p> <p>b. Agencies or organizations which license, certify, or otherwise regulate the health-related activities of individuals and entities which provide health care services or items, to alert them to possibly disqualifying actions, practices or conditions.
</p> <p>c. Agencies or organizations charged with investigating or prosecuting possible violations indicated in items a and b.
</p> <p>d. Agencies and their agents or representatives enforcing debarments, suspensions and exclusions under the Federal Acquisition Streamlining Act of 1994.
</p> <p>e. Upon written request, agencies and/or their contractors or organizations seeking information in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the awarding of a contract, or the issuance of a license, grant or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>f. Professional and business organizations concerned with standards and conduct of individuals and entities engaged in providing health care items and services.
</p> <p>g. Scholars or other researchers investigating trends and characteristics in the health care field.
</p> <p>2. Disclosure may be made to a Congressional office from the record of an individual or entity in response to an inquiry from the Congressional office made at the request of that individual or entity.
</p> <p>3. In the event of litigation, information from the system of records may be disclosed to the Department of Justice, to a judicial or administrative tribunal, opposing counsel, and witnesses, in the course of proceedings involving HHS, any HHS employee (where the matter pertains to the employee's official duties), or the United States, or any agency thereof where the litigation is likely to affect HHS, or HHS is a party or has an interest in the litigation and the use of the information is relevant and necessary to the litigation.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Paper records, which includes program exclusion case files, are kept in files and file folders. Electronic records are stored on hard or floppy disks and tapes.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The agency retrieves records from files indexed alphabetically by geographic region. Both paper records and electronic records are retrievable by agency-assigned internal case control numbers, name, personal identifier fields such as date of birth, UPIN, Social Security or Employer Identification number, address, specialty/occupation, program violated, date of exclusion, and type of exclusion.
</p> <p>Indirect access to the database on public records fields is available to the general public on the OIG's Internet site ( http://www.dhhs.gov/progorg/oig).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Paper records are stored in secured cabinets behind a locked door with access limited to authorized personnel. Computer based records are available only to authorized users and are safeguarded in accordance with the provisions of the National Bureau of Standards Federal Information Processing Standards 41 and 31, and the HHS Information Processing Standards, HHS ADP Systems Manual, Part 6, "ADP Systems Security." All computer tapes are password protected prohibiting unauthorized access.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The OIG maintains the hardcopy records and files for one year, after which they are transferred to the Federal Records Center for an additional 5 years. The electronic records system is maintained for an indefinite period of time.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The Systems Manager is an employee of Office of Investigations, Office of Inspector General, Department of Health and Human Services, 330 Independence Avenue, SW., Washington, DC 20201. The OIG web site is managed by the Office of Information Technology, Office of Inspector General, at this same address.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual who wishes to be notified whether the system contains a record should make a request electronically to the OIG web site at http://www.dhhs.gov/progorg/oig. Media inquiries should be directed to the HHS/OIG External Affairs Office, 330 Independence Avenue, SW., Washington, DC 20201. Requests for written documentation should be submitted in writing, together with a printout from the OIG web site identifying the individual or entity, to the Office of Investigations, Health Care Administrative Sanctions, Room N2-01-26, 7500 Security Boulevard, Baltimore, MD 21244-1850.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedure.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>An individual who wishes to contest the record procedures should contact the Office of Health Care Administrative Sanctions, Office of Investigations, Office of Inspector General, Department of Health and Human Services, Room N2-01-26, 7500 Security Boulevard, Baltimore, MD 21244-1850. The individual or entity should reasonably identify the record and specify the information to be contested, the corrective action sought and the reasons for the correction, with supporting documentation.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The sources are Government and private agencies and organizations.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0103" toc="yes">
<systemNumber>09-19-0103</systemNumber>
<subsection type="systemName">Healthcare Integrity and Protection Data Bank (HIPDB), HHS/OIG.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The HIPDB will always be operated and maintained by a contractor. The SRA Corporation (the Contractor) currently operates and maintains the HIPDB under contract with the Bureau of Health Professions (BHPr), Health Resources and Services Administration (HRSA) who, under a memorandum of understanding with the Office of Inspector General (OIG), will operate the system. Records are found at the following address: Healthcare Integrity and Protection Data Bank, 4350 Fairs Lakes Court North, Suite 400, Fairfax, Virginia 22033. The program will publish any changes in the location of the system in the <i>Federal Register</i>.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system of records will cover the following categories of individuals:
</p><p>Health care practitioners, including physicians, dentists, and all other health care practitioners (such as nurses, optometrists, pharmacists, and podiatrists), licensed or otherwise authorized by a State to provide health care services.
</p> <p>Health care suppliers who furnish or provide access to health care services, supplies, items or ancillary services (including, but not limited to, individuals who deliver health care services and are not required to obtain State licensure or authorization, durable medical equipment suppliers and manufacturers; pharmaceutical suppliers and manufacturers; health record services which prepare and store medical, dental and other patient records; health data suppliers; and billing and transportation service suppliers), and any individual under contract to provide health care supplies, items or ancillary services, and any individual providing health benefits whether directly, or indirectly through insurance, reimbursements or otherwise (including insurance producers, such as agents, brokers, and solicitors).
</p> <p>These individuals must be the subject of the following final adverse actions: (1) Civil judgments in Federal or State court related to the delivery of a health care item or service; (2) Federal or State criminal convictions related to the delivery of a health care item or service; (3) actions by Federal or State agencies responsible for the licensing and certification of health care providers, suppliers, or practitioners; (4) exclusion from participation in Federal or State health care programs; and (5) other adjudicated actions or decisions, such as the removal of a physician from a health plan network via an adjudicated action.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>This system will contain the following types of records:
</p><p>1. Information on an individual who is the subject of a civil judgment or criminal conviction related to the delivery of a health care item or service includes--
</p><p>Full name; other name(s) used, if known; Social Security number; date of birth; gender; home address; occupation; organization name and type, if known; work address, if known; National Provider Identifier (NPI) (when issued by HCFA); Unique Physician Identification number(s), if known; Drug Enforcement Administration (DEA) registration number(s), if known; name of each professional school attended and the year of graduation, if known; for each professional license, certification or registration: the license, certification, or registration number, the field of licensure, certification, or registration, and the name of the State or Territory in which the license, certification or registration is held, if known;
</p><p>With respect to the judgment/sentence: The court or judicial venue in which action was taken; docket or court file number; name of the primary prosecuting agency or Civil Plaintiff; prosecuting agency's case number; statutory offense and counts; date of judgment/sentence; length of the sentence; amount of judgment, restitution or other orders; nature of offense upon which the action was based; description of acts or omissions and injuries upon which the action was based; investigative agencies involved, if known, and investigative agencies' case/file number, if known; whether such action is on appeal; and
</p><p>With respect to the reporting entity: Name; title; address, and telephone number of the reporting entity.
</p> <p>2. Information on an individual who is the subject of a licensure action taken by Federal or State licensing and certification agencies, an adjudicated action or decision, or an individual excluded from participation in a Federal or State health care program. This information includes--
</p><p>Full name; other name(s) used, if known; Social Security number or Federal Employer Identification number; date of birth; date of death, if deceased; gender; home address; occupation; organization name and type, if known; work address, if known; physician specialty, if applicable; NPI (when issued by HCFA); Unique Physician Identification number(s), if known; DEA registration number(s), if known; name of each professional school attended and the year of graduation, if known; for each professional license, certification or registration: The license, certification, or registration number, the field of licensure, certification, or registration, and the name of the State or Territory in which the license, certification or registration is held, if known;
</p><p>With respect to final adverse action: A description of the acts or omissions or other reason for the action; date the action was taken, its effective date and duration; classification of the action in accordance with a reporting code adopted by the Secretary; amount of monetary penalty, assessment or restitution, and name of the office or program that took the adverse action; and
</p><p>With respect to the reporting entity: Name; title; address, and telephone number of the reporting entity.
</p> <p>3. Inquiry file includes copies of all inquiries received by the HIPDB.</p>
</xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 1128E(b)(5) of the Social Security Act (the Act) authorizes the collection and maintenance of records of civil judgments against a health care provider, supplier or practitioner in Federal or State court related to the delivery of a health care item or service; Federal or State criminal convictions against a health care provider, supplier or practitioner related to the delivery of a health care item or service; actions by Federal or State agencies responsible for the licensing and certification of health care providers, suppliers or practitioners; exclusion of a health care provider, supplier or practitioner from participation in Federal or State health care programs; and any other adjudicated actions or decisions established by the Secretary in regulation (45 CFR part 61).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purposes of the system are to:
</p><p>1. Receive from Government agencies and health plans information on certain final adverse actions (excluding settlements in which no findings of liability have been made) taken against health care providers, suppliers, or practitioners; and
</p><p>2. Disseminate such data to Government agencies and health plans, as authorized by the Act.
</p> <p>A government agency includes, but is not limited to (1) the Department of Justice; (2) the Department of Health and Human Services; (3) any other Federal agency that either administers or provides payment for the delivery of health care services (including, but not limited to, the Department of Defense and the Department of Veterans Affairs); (4) State law enforcement agencies; (5) State Medicaid Fraud Control Units; and (6) other Federal or State agencies responsible for the licensing and certification of health care providers, suppliers, or licensed health care practitioners.
</p> <p>Health plan means a plan, program or organization that provides health benefits, whether directly or through insurance, reimbursement or otherwise, and includes, but is not limited to (1) a policy of health insurance; (2) a contract of a service benefit organization; (3) a membership agreement with a health maintenance organization or other prepaid health plan; (4) a plan, program or agreement established, maintained or made available by an employer or group of employers, a practitioner, provider or supplier group, third-party administrator, integrated health care delivery system, employee welfare association, public service group or organization, or professional association; and (5) an insurance company, insurance service, self-insured employer or insurance organization which is licensed to engage in the business of selling health care insurance in a State and which is subject to State law that regulates health insurance.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Data may be disclosed to:
</p><p>1. A health plan requesting data concerning a health care provider, supplier, or practitioner for the purposes of preventing fraud and abuse activities and/or improving the quality of patient care, and in the context of hiring or retaining providers, suppliers and practitioners that are the subjects of reports.
</p> <p>2. Government agencies, as defined in 45 CFR 61.3, requesting data concerning a health care provider, supplier or practitioner for the purposes of preventing fraud and abuse activities and/or improving the quality of patient care, and in the context of hiring or retaining the providers, suppliers and practitioners that are the subject of reports to the system. This would include law enforcement investigations and other law enforcement activities.
</p> <p>Storage:
</p> <p>Records are maintained in electronic folders, on magnetic tape, and/or disks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Retrieval will be by use of personal identifiers, including a unique identifier assigned by the HIPDB.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Access to records is limited to designated employees of the Contractor and to designated HRSA and the OIG staff. The Contracting Officer's Technical Representative (COTR) and AIS Security Officers are among the HRSA staff who are authorized users. Both HRSA and the contractor maintain lists of authorized users. Other Departmental employees will have access to the records on an official "need to know" basis.
</p> <p>2. Physical Safeguards: Magnetic tapes, disks, computer equipment and hard copy files are stored in areas where fire and environmental safety codes are strictly enforced. All automated and non-automated documents are protected on a 24-hour basis. Perimeter security includes intrusion alarms, random guard patrols, monitors, key/passcard/combination controls, receptionist controlled area and reception alarm button.</p>
<p>3. Procedural and Technical Safeguards: A password is required to access the system, and additional identification numbers and passwords to limit access to data to only authorized users. All users of personal information, in connection with the performance of their jobs, protect information from public view and from unauthorized personnel entering an unsupervised area. All authorized users will sign a nondisclosure statement. To protect the confidentiality of information contained in the system, when a person leaves or no longer has authorized duties, the Security Officer deletes his or her identification number and password, retrieves all-electronic access cards, and changes all combinations to which the departing employee had access. The system automatically logs all access to data resources.
</p> <p>Access to records is limited to those authorized personnel trained in accordance with the Privacy Act and automatic data processing (ADP) security procedures. The Contractor is required to assure the confidentiality safeguards of these records and to comply with all provisions of the Privacy Act. All individuals who have access to these records must have the appropriate ADP security clearances. Privacy Act and ADP system security requirements are included in the contract for the operations and maintenance of the system. In addition, the HIPDB Project Officer and the System Manager oversee compliance with these requirements. HRSA staff who are authorized users will make site visits to the Contractor's facilities to assure compliance with security and Privacy Act requirements.
</p> <p>The safeguards described above were established in accordance with DHHS Chapter 45-13 and supplementary Chapter PHS hf: 45-13 of the General Administration Manual, and the DHHS Information Resources Management Manual, Part 6. "ADP Systems Security."
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>All records in this system are retained permanently.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Tony Marziani, Director, Information Systems and Investigative Support Staff, Office of Investigations, OIG, Room 5046, Cohen Building, 330 Independence Avenue, SW., Washington, DC 20201, (202) 205-5200.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Exempt from certain requirements of the Act. However, an individual is informed when a record concerning himself or herself is entered into the Healthcare Integrity and Protection Data Bank.
</p> <p>Requests by mail: Practitioners, providers or suppliers may submit a "Request for Information Disclosure" to the address under system location for any report on themselves. The request must contain the following: Name, address, date of birth, gender, Social Security Number, professional schools and years of graduation, and the professional license(s). For license, include: The license number, the field of licensure, the name of the State or Territory in which the license is held, and Drug Enforcement Administration registration number(s). Practitioners must sign and have notarized their requests. Submitting a request under false pretenses is a criminal offense subject to, at a minimum, a $5,000 fine under provisions of the Privacy Act.
</p> <p>Requests in person: Due to security considerations, the HIPDB cannot accept requests in person.
</p> <p>Request by telephone: Individuals may provide all of the identifying information stated above to the HIPDB Helpline operator. Before the data request is fulfilled, the operator will return a paper copy of this information for verification, signature and notarization.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters also should reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The HIPDB routinely mails a copy of any report filed in it to the subject. The subject may contest the accuracy of information in the HIPDB concerning himself, herself, or itself and file a dispute. To dispute the accuracy of the information, the individual must notify the HIPDB by:
</p><p>(1) Identifying the record involved; (2) specifying the information being contested; (3) stating the corrective action sought and reason for requesting the correction; and (4) submitting supporting justification and/or documentation to show how the record is inaccurate. At the same time, the individual must attempt to enter into discussion with the reporting entity to resolve the dispute. Additional detail on the process of dispute resolution can be found at 45 CFR 61.15 of the HIPDB regulations.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Entities that have submitted records on individuals and organizations contained in the system; State Licensing Boards, including State Medical and Dental Boards, Federal and State Agencies as defined in the Act, and health plans as defined in the Act who take a final adverse action (not including settlements in which no findings of liability have been made) taken against a health care provider, supplier, or practitioner. (See PURPOSE section above)
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>The Secretary has exempted this system from certain provisions of the Act. In accordance with 5 U.S.C. 552a(k)(2) and 45 CFR 5b.11(b) (ii)(F), this system is exempt from subsections (c)(3), (d)(1)-(4), and (e)(4)(G) and (H) of the Privacy Act.
</p></xhtmlContent></subsection> </section>

<section id="09-90-0151" toc="yes">
<systemNumber>09-19-0151</systemNumber>
<subsection type="systemName">Temporary Assistance for Needy Families (TANF) Data System, Administration for Children and Families, Department of Health and Human Services.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The TANF data are reported by the individual States for each (Federal) fiscal quarter. (The term State is used in this notice to refer to the 50 States, the District of Columbia, and the jurisdictions of Puerto Rico, the U.S. Virgin Islands, and Guam). States (CIT) of the National Institutes of Health (NIH) located at Building 12A, Bethesda, MD 20892. The State data are pooled to create a national database for each quarter, which is also kept in the computer system of CIT. The whole system is maintained under the technical and management control of: (1) The Office of Information Systems, Office of Administration, Administration for Children and Families, 370 L'Enfant Promenade, SW., Washington, DC 20447; and (2) the Office of Planning, Research, and Evaluation (OPRE), Administration for Children and Families, 370 L'Enfant Promenade, SW., Washington, DC 20447.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The TANF Data System (TDS) contains information on: (1) Members of families (as defined by regulation at 45 CFR 265.2) who received assistance under the TANF program in any month, and (2) members of families (as defined by regulation at 45 CFR 265.2) in which an individual was assisted by a Separate State Program (SSP) which is not subject to Federal work or time limit requirements but for which expenditures are or will be claimed by the State to satisfy TANF Maintenance of Effort (MOE) requirements.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>There are three distinct groups of data in the TDS: family-level data; adult-level or minor-child-head-of-household data; and child data.
</p> <p>Family level data maintained in the TDS may include the following items of information on every family that received assistance during one or more months: State Federal Information Processing Standard (FIPS) code; Region code; county FIPS code; report year and month; stratum code; case identification number (assigned by the State); Zip code; funding stream; disposition status; new applicant status; number of family members; type of family for work participation; receipt of subsidized housing; receipt of medical assistance; receipt of food stamp assistance; amount of food stamp assistance; receipt of subsidized child care; amount of subsidized child care; amount of child support; amount of family's cash resources; cash, or cash equivalent, amount of assistance and number of months of that assistance; TANF child care (amount, number of children covered, and number of months of assistance); transportation assistance (amount and number of months of assistance); transitional services (amount and number of months of assistance); other assistance (amount and number of months of assistance); amount of reductions in assistance; reason for assistance reductions (sanctions, recoupment of prior over payment, and other); waiver evaluation experimental and control group status; exemption status from the federal time-limit provisions; and new child-only-family status.
</p> <p>Adult-level or minor child-head-of-household data maintained in the TDS may include: Case identification number (same as the family's identification number); report year and month, State FIPS code; family affiliation; non-custodial parent indicator; date of birth; SSN; race and ethnicity; gender; receipt of disability benefits; marital status; relationship to head of household; parent-with-minor-child-in-the- family status; needs of a pregnant woman; education level; citizenship; cooperation with child support; number of months countable towards Federal time-limit; number of countable months remaining under State's time-limit; exemption status of the reporting month from the State's time-limit; employment status; work participation status; unsubsidized employment hours; subsidized private and public sector employment hours; work experience hours; on-the-job training hours; job search and job readiness assistance hours; community service program hours; vocational educational training hours; hours of job skills training directly related to employment; hours of education directly related to employment for individuals with no high school diploma or certificate of high school equivalency; hours of satisfactory school attendance for individuals with no high school diploma or certificate of high school equivalency; hours of providing child care services to an individual who is participating in a community service program; hours of additional work activities permitted under a Waiver demonstration; hours of other work activities; required hours of work under a Waiver demonstration; amount of earned income; and amount of unearned income (earned income tax credit, Social Security benefit, Supplemental Security Income (SSI), worker's compensation, and other unearned income).
</p> <p>Child data (i.e., data pertaining to every child in a recipient TANF family) may include: Case identification number (same as the family's identification number); State FIPS code; report year and month; family affiliation; date of birth; SSN; race and ethnicity; gender; receipt of disability benefits; relationship to head of household; parent-with-minor-child-in-the-family status; education level; citizenship; amount of unearned income (SSI and other).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Legal authority for the collection and maintenance of the system is contained in Title IV-A of the Social Security Act (Act), 42 U.S.C. 601-619. TANF data collection and reporting regulations are found in 45 CFR part 265. Legal authority for the collection of information for the High Performance Bonus award program is found in section 403 of the Social Security Act and in 45 CFR part 270.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>Information in the TANF Data System is used for three major purposes: (1) To determine whether States are meeting certain requirements prescribed by the Act, including prescribed work and time-limit requirements; (2) to compile information used to report to Congress on the TANF program; and, (3) to compute State scores on work measures and rank States on their performance in assisting TANF recipients to obtain and retain employment in connection with the award of High Performance Bonus funds.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Records containing data collected pursuant to section 411 of the Social Security Act may be disclosed :
</p><p>1. To supply raw or tabulated data without personal identifiers in response to specific requests from private and public entities.
</p> <p>2. To supply raw (untabulated) data for research purposes in response to requests from researchers who have agreed in writing not to use such data to identify any individual whose information is included therein.
</p> <p>Disclosure to consumer reporting agencies:
</p><p>None.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>States electronically transmit the TANF data for each fiscal quarter to a computer in the Center for Information Technology (CIT) of the National Institute of Health. The data sets received from the States in accordance with the requirements of section 411 of the Social Security Act and 45 CFR part 265 are pooled to create a national database for each fiscal quarter. The national database thus created for a given fiscal year is also kept in a computer disk on the mainframe of the CIT for up to 24 months after the end of such fiscal year. Afterwards, the database is copied to compact discs (CDs) and securely kept in ACF under lock and key or on personal computers by individuals whose access to the CDs has been authorized by OPRE and/or the ACF's Office of Information Services, Office of Administration.
</p> <p>Although SSNs of adult TANF recipients collected from States which have chosen to compete for High-Performance bonuses are stored on the CIT as well, they are also provided to Office of Child Support Enforcement for matching with records of individual employment information contained in the National Directory of New Hires portion of OCSE's Location and Collection System, No. 09-90-0074, last published at <i>Federal Register</i>, Vol. 65, No. 187, pages 57817-57820, dated September 26, 2000. Thereafter, match results are transmitted back to OPRE without SSNs in a form which is not individually identifiable and the SSNs supplied to perform the match are destroyed by OCSE.</p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent><p>The national database kept in the CIT is accessed by authorized users of the data following established procedures. The authorized users are selected individuals in the Office of Administration, ACF (including its contractors who may handle processing of the data and the creation of the national database), and selected individuals in the Division of Data Collection and Analysis, Office of Planning, Research, and Evaluation, ACF (who perform analyses of the data). The database is accessed and downloaded by authorized individuals to secure personal computers (PCs). Sharing of the data downloaded to individual PCs is allowed only with permission of the System Manager. Although all data elements in the database can be retrieved, the SSNs are not generally included in any retrieval, since they are not used in the routine analyses of the data.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Physical security: The CIT of NIH, as a U.S. government facility, abides by all U.S. government policies with regard to the physical security of the data kept there. The CIT has the following: an uninterruptible power supply; climate control; a central backup and recovery system; a disaster recovery program; security procedures for data access; and normal physical and system security procedures (restricted physical access to computer machine rooms and output handling areas, which is enforced by a round-the-clock security guard stationed at the main entrance to the area, valid government identification (ID) badge or photo identification and registration with the security guard to obtain a temporary entry badge for a specifically authorized purpose, such as maintenance service or repair of equipment, etc.). The outputs generated at the facility are placed in locked boxes that can be accessed only by users knowing the correct box access code. To ensure physical security of data kept on tapes or other portable media, the CIT requires that the sponsor of an account authorize the removal of them from the CIT. When such items are taken out, the person receiving the items provides the following to the production unit staff of the CIT: name and signature; ID badge number; driver's license number and State; and organization's (which is represented by the person) name and phone number. Only after confirming these items of information by the production unit staff will the items be given to the person. Data older than 24 months is downloaded by authorized individuals to secure PCs, then copied to CDs which are then kept under lock and key. After copying the data to CDs, the data on the PCs are deleted.
</p> <p>2. Authorized access: Access to the data is strictly regulated with passwords and other controls. Only individuals whose work responsibilities specifically include accessing the data system (either for processing or for analysis) are allowed to access these data. They include designated individuals (including contractors) in the Division of Application Development Services, Office of Information Services, Office of Administration, ACF (mostly for processing incoming data and database creation), and designated individuals in the Division of Data Collection and Analysis, OPRE, ACF.
</p> <p>3. Procedural and technical safeguards: The individuals who are authorized to access the data have been adequately instructed on the privacy and confidentiality of the data, and they have been trained to handle the data in such a manner as to protect its privacy and confidentiality. Release of any personal identification particulars by these individuals is strictly forbidden, and release of even tabulated data is allowed only under specific authorization. Established clearance procedures must be observed before any release of the information contained in the data system.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The data transmitted by a State for a fiscal quarter to the CIT's computer are backed up to a computer tape after the initial processing of the data. The backed-up version of the data is kept only for a period of 30 days.
</p> <p>The data transmitted by the States for a fiscal quarter, after processing and acceptance, are pooled to create a national database for the quarter. The national database is stored in the CIT's computer for up to 24 months after the end of the fiscal year. Afterwards, the database is copied to a compact disc, and the original data in CIT's computer is scratched. The data on the compact disc is securely maintained by ACF for up to 20 years in order to facilitate research on caseload trends, changes in the characteristics of TANF recipients, or other pertinent research. The eventual disposal of the data will be by means of physical destruction of the CD's containing the data. The Office of Information Systems of the Office of Administration and OPRE, ACF, are responsible for the retention and disposal of the data system.
</p> <p>The SSNs obtained for the HPB award program for a performance year, although initially kept in an electronic file in the CIT, are erased after identifying the States that merited awards for that performance year. The erasing of these SSN data file will be done within a year after the award year, which immediately follows the performance year. Aggregate data files based on information provided for the HPB award program are also erased.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>1. Director, Division of Applications Development Services, Office of Information Services, Office of Administration, Administration for Children and Families, 370 L'Enfant Promenade, SW., Washington, DC 20447.
</p> <p>2. Director, Division of Data Collection and Analysis, Office of Planning, Research, and Evaluation, Administration for Children and Families, 370 L'Enfant Promenade, SW., Washington, DC 20447.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to either of the System Managers noted above. The Privacy Act provides that, except under certain conditions specified in the law, only the subject of the records may have access to them. All requests must be submitted in the following manner: Identify the system of records that is desired to be searched; have the request for search notarized certifying the identity of the requestor; and indicate that the requestor is aware that the knowing and willful request for or acquisition of Privacy Act record under false pretenses is a criminal offense subject to a $10,000 fine. The letter of request should also provide sufficient particulars to enable the System Manager to distinguish among records on subject individuals with the same name.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Write to either of the System Managers listed above to obtain access to the records. Requestors should provide a detailed description of the record contents they are seeking.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Write to either of the System Managers listed above, at the address noted, identifying the record and specifying the information to be contested and corrective action sought, together with supporting justification to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>All items of information contained in the system of records are obtained from the States.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-0160" toc="yes">
<systemNumber>09-19-0160</systemNumber>
<subsection type="systemName">Medical Reserve Corps Unit Information, HHS/OPHS/OSG.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>System manager is located in Medical Reserve Corps (MRC) program office, Office of Force Readiness and Deployment (OFRD), Office of the Surgeon General (OSG), Office of Public Health and Science (OPHS), Department of Health and Human Services (HHS), 5600 Fishers Lane, Room 18C-14, Rockville, MD 20857. Website server is located in Z-Tech Corporation, 1803 Research Boulevard., Suite 301, Rockville, MD 20850.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>Medical Reserve Corps leaders who have registered their units with the OSG/MRC program office. MRC volunteers who have indicated their willingness/ability to be utilized outside their local jurisdiction.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The collected information will include, but is not limited to name of  unit, community/jurisdiction served, defining characteristics and population of jurisdiction, name and type of sponsoring organization, contact information for primary contacts (name, mailing address, phone number, e-mail address, website address), emergency contact information for MRC unit leader (phone number, e-mail address), description of MRC unit, activation procedure, unit goals and objectives, unit activities and accomplishments, unit partnerships and affiliations, information on MRC units volunteers, including but not limited to names, contact information, medical or public health specialty, license information, and total number of volunteers, description of volunteer recruitment activities, description of credentialing process, description of training, description of policies and procedures, forms, partnership agreements, organizational charts, and any other organizational documents, and photographs of MRC unit/volunteers involved in exercises, deployments, or other activities.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The MRC program is authorized by sections 311(c)(1) and 319A of the Public Health Service Act, as amended, 42 U.S.C sections 243(c)(1) and 247d-1.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain information about MRC units, including unit demographics, contact information (regular and emergency), volunteer numbers, activity updates and samples of best practices/lessons learned. MRC unit leaders are asked to update this information at least quarterly. In addition, information pertaining to MRC members who are able and willing to be utilized outside their local jurisdiction will be collected, as a "PHS Auxiliary" component of the MRC is being developed to further meet White House recommendations.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The Privacy Act allows for disclosure of information without an individuals consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use."  The following proposed routine uses in this system meet the compatibility requirement of the Privacy Act:
</p><p>1. Disclosure may be made to U.S. Government employees in order to accomplish the purposes for which the records are collected. The users are required to comply with the requirements of the Privacy Act with respect to such records.
</p> <p>2. Disclosure may be made to contractors, consultants or grantees, who have been engaged by the Department to assist with the MRC program and who need access to the records in order to perform the activity.
</p> <p>3. Disclosure may be made to a congressional office from the record of any individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>4. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage: </p><p>Records are maintained in file folders and in computer data files.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The collected data are retrieved by MRC unit name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Authorized users: Access to records is limited to MRC program staff, and contractors, consultants or grantees who have been engaged by the Department to assist with the MRC program and who need access to the records in order to perform the activity.
</p><p> Physical safeguards:</p> <p>All computer equipment and files are stored in areas where fire and life safety codes are strictly enforced. All documents are protected on a 24-hour  basis. Perimeter security includes intrusion alarms, on-site guard force, random guard patrol, passcard/combination controls, and receptionist controlled area. Computer networks and web-accessible systems are password protected.
</p><p> Procedural safeguards: </p><p>A password is required to access computer files. System users protect information from public view and from unauthorized personnel entering an unsupervised area. Access to records is limited to authorized personnel.
</p><p> Technical safeguards: </p><p>Computer networks and web-accessible systems are password protected. All computers have virus protection/detection software in place.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records may be retired to a Federal Records Center and subsequently disposed of in accordance with the OPHS records control schedule. The records control schedule and disposal standard for these records may be obtained by writing to the System Manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Medical Reserve Corps Program, Office of the Surgeon General, Department of Health and Human Services (HHS), 5600 Fishers Lane, Room 18C-14, Rockville, MD 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the System Manager at the address above. The requester must verify his or her identify by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act subject to a fine.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>To obtain access to a record, write to the System Manager at the address above. Requesters should provide the same information as is required under the Notification Procedures. Requesters should also reasonable specify the record contents being sought.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>To contest the contents of a record, write to the System Manager at the address above, reasonably identify the record, and specify the information being contested, the corrective action sought, and your reasons for requesting the correction. Include supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Data is collected from the MRC unit leaders and MRC volunteers who have indicated their willingness/ability to be utilized outside their local jurisdiction.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.</p></xhtmlContent></subsection> </section>
<section id="09-90-0161" toc="yes">
<systemNumber>09-19-0161</systemNumber>
<subsection type="systemName">"Minority Health Information Service," HHS/OS/OPHS/OMH.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The system is located at OMHRC, 1101 Wootton Parkway, Suite 650, Rockville, MD 20852 and OMH, 1101 Wootton Parkway, Suite 600, Rockville, MD 20852.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information is collected on members of the general public, health professionals, faculty of academic institutions, students, representatives of government agencies, community organizations and private businesses who seek health information from OMH or its Resource Center, and those who ask to or agree to participate in OMH-sponsored health programs.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system of records includes the following subsystems:
</p><p>7. <i>Mailing List:</i> Individuals who have asked to receive OMH's electronic newsletter and intermittent e-mail updates. Information collected: Name, business address, organizational affiliation, telephone, and e-mail.
</p> <p>8. <i>Resource Persons Network:</i> Individuals with health expertise who have volunteered to provide some pro bono technical assistance to community organizations of government agencies working on aspects of minority health. Information collected: Name, business address, organizational affiliation, title, telephone, e-mail, fax, resume, race/ethnicity, areas in which individual offers expertise, health topics or populations with which the individual wishes to work.
</p> <p>9. <i>Training Institute File:</i> Individuals who have applied to and are participating in a leadership development course for emerging and future leaders of community organizations. Information collected: Name, business address, organizational affiliation, title, telephone, e- mail, fax, resume, race/ethnicity, areas in which individual offers expertise, health topics or populations with which the individual wishes to work.
</p> <p>10. <i>Campaign File:</i> Individuals who have volunteered to participate in an OMH campaign, currently comprising individuals who have volunteered to train peers on healthy living and pre-conception care. Information collected: Name, business address, organizational affiliation, title, telephone, e-mail, fax, resume, race/ethnicity, areas in which individual offers expertise, health topics or populations with which the individual wishes to work.
</p> <p>11. <i>Organizational Databases:</i> Business contact information for official representatives of organizations working on minority health or participating in OMH initiatives, along with organizational descriptions. Information collected: Name of organization and key contact person, business address, telephone, e-mail, Web site URL, description of organization.
</p> <p>12. <i>Inquiry Tracking System:</i> Details, by customer name, of information requests directed to OMH Resource Center and data on fulfillment of these requests. Information collected: Name of requestor, organizational affiliation, business address, telephone, e-mail, fax, occupational category (health professional, academic, etc.), source of referral, information requested, fulfillment details (date shipped etc.).</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory basis for the maintenance of this system is 42 U.S.C. 300u-6.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of the system is to (1) Identify individuals who have volunteered to provide pro bono technical assistance to community organizations or government agencies on aspects of minority health; (2) identify key officials at national, state, regional and local organizations who serve as public points of contact for that organization or work specifically on minority health issues; and (3) allow the OMH Resource Center contractor to operate, maintain and safeguard the data system.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>7. To identify one or more individuals who have volunteered to provide pro bono technical assistance to a community organization or government agency on aspects of minority health in response to a specific request for assistance. OMHRC staff provide one or more names and associated contact information to requesting organizations when OMHRC staff finds a match between an assistance request and a Resource Persons Network member with relevant expertise, experience and background, and when the request matches the activities, health topics, or populations for which the network member has specified that he or she is available to assist.
</p> <p>8. To identify key officials at national, state, regional and local organizations who serve as public points of contact for that organization or its work specifically on minority health. Information searches are provided on request. Contact information for OMH campaign and initiative partners may be posted on the OMH Web site.
</p> <p>9. To allow the OMH Resource Center contractor to operate this data system. OMH uses a contractor to operate the OMH Resource Center, which maintains the Minority Health Information Service. This contractor collects the information, maintains the data system and safeguards the data under the provisions outlined in this notice and applicable law and regulation. The contractor is prohibited from using these data for any purpose other than described in the contract and is required to return all data to the government or deliver it securely to a government- designated successor contractor, at the completion of the contract.
</p> <p>10. To appropriate Department contractors to enable conduct of evaluation studies or administration of OMB-approved customer satisfaction surveys.
</p> <p>11. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in the system of records, and the information disclosed is relevant and necessary for the assistance.
</p> <p>12. To the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:
</p><p>i. The Agency, or any component thereof; or
</p><p>ii. Any employee of the Agency in his or her official capacity; or
</p><p>iii. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency has agreed to represent the employee; or
</p><p>iv. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation; provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in file folders, electronic media and other types of data storage devices.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Data are retrievable by name, business address, telephone, e-mail, organizational affiliation, and type of technical assistance provided (for the Resource Persons Network)
</p><p>PROTECTIONS: </p><p>The system conforms to all applicable Federal laws and regulations and Federal and HHS policies and standards for information security and data privacy. The OMH system manager, OMHRC senior leadership and OMHRC technology manager confer to review and ensure compliance with provisions of this notice and any changes in security requirements.
</p> <p>Records are available to the system manager and OMH staff when they have a need for the records in the performance of their duties. Records are also available to OMHRC technology staff, OMHRC director and deputy director, OMHRC communications staff, OMHRC information specialists (mailing list, organizational databases, inquiry tracking system), OMHRC knowledge center/library staff (organizational data bases and resource persons network), OMHRC data entry staff, who need access in order to perform their duties.
</p> <p>Data systems are in a secured office space with a carded entrance. Servers are located in a locked rack. Data are backed up nightly with a one-month daily snapshot available at any time and monthly snapshots for a year. Annual training is required and conducted for authorized users regarding proper handling and safeguarding of personally identifiable information. OMH and OMHRC staff are trained on HHS policies regarding personal use of health information technology.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>1. <i>Mailing List:</i> Records are maintained until removed by the individual on whom information is maintained or until the individual requests removal.
</p> <p>2. <i>Resource Persons Network:</i> Records are maintained for as long as the individual indicates a willingness to serve as a Resource Person by responding affirmatively to update requests.
</p> <p>3. <i>Training Institute File:</i> Records are maintained for three years following the end of the specific training course.
</p> <p>4. <i>Campaign File:</i> Contact information on individuals is maintained for the duration of the campaign. Resumes are retained for one year.
</p> <p>5. <i>Organizational Databases:</i> Records are maintained until the organization about which information is maintained no longer works in minority health, or until the contact person for the organization changes.
</p> <p>6. <i>Inquiry Tracking System:</i> Records are maintained for three years following order fulfillment.
</p> <p>Records no longer maintained are disposed of by deletion from electronic media and shredding of hard copy records. Electronic records deleted from active files are maintained in system back-up files on tape media for one year.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Information and Education, Office of Minority Health, 1101 Wootton Parkway, Suite 600, Rockville, MD 20852.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine whether the system contains a record on you, please write to the system manager at the address above, providing name, address, e-mail, telephone and organizational affiliation.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>To determine whether the system contains a record on you, please write to the system manager at the address above, providing name, address, e-mail, telephone and organizational affiliation.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contesting Records: Mailing list members may unsubscribe from the mailing list or correct their entry by clicking on a link in an e- mail received from the system. Unsubscribing will remove subscriber information from the system. For all other deletions and corrections, please write, call, e-mail or fax Office of Minority Health Resource Center, 1101 Wootton Parkway, Suite 650, Rockville, MD 20852, telephone 800-444-6472, e-mail <i>info@omhrc.gov,</i> fax 240-453-2883. The identity of the requestor will be verified by comparison with information contained in the existing record. An individual may request accounting of disclosures outside the department. The right to contest records is limited to information that is incomplete, irrelevant, incorrect, or untimely.
</p><p>Information is collected via mail, e-mail, Web form, telephone or in person at conferences and meetings from individuals who receive some type of communication from OMH. Listings in the organizational database are generally drawn from publicly available documents such as directories, newsletters, and organizational Web sites and are confirmed through direct contact with the organization. Names of contact individuals at organizations partnering with OMH on an initiative, project or campaign are provided by the organization.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>


<section id="09-90-0250" toc="yes">
<systemNumber>09-90-0250</systemNumber>
<subsection type="systemName">Early Retirement Reinsurance Program (ERRP), OCIIO, OS/HHS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Level Three Privacy Act Sensitive.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Consumer Information and Insurance Oversight, U.S. Department of Health &amp; Human Services, 200 Independence Avenue, SW., Suite 738F, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information in this system is maintained on individuals associated with plan sponsors who perform key tasks on behalf of the sponsor, so that the sponsor can participate in and get reimbursement under the program. Information in this system is also maintained on early retirees and their spouses, surviving spouses, and dependents that are enrolled in employment-based plans that participate in the program. With respect to medical claims submitted by plan sponsors for reimbursement, information in this system is maintained on early retirees and their spouses, surviving spouses, and dependents with respect to those medical claims, including the health benefit provided, the provider or supplier, the incurred date, the individual for whom the health benefit was provided, the date and amount of payment net any known negotiated price concessions, and the employment-based plan and benefit option under which the health benefit was provided.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Information in this system is maintained on early retirees and their spouses, surviving spouses, and dependents that are enrolled in employment-based plans that participate in the program. Information maintained in this system includes, but is not limited to, first name, last name, middle initial, date of birth, Social Security Number (SSN), gender, standard data for identification such as Plan Sponsor Identification Number, Application Identification Number, Benefit Option Identifier, and relationship to early retiree. Information in this system is maintained on individuals associated with plan sponsors who perform key tasks on behalf of the sponsor, so that the sponsor can participate in and get reimbursement under the program. Information maintained in the system regarding these individuals includes, but is not limited to, standard data for identification such as Plan Sponsor Identification Number, Application Identification Number, Benefit Option Identifier, the individual's first name, middle initial, last name, job title, date of birth, social security number, e-mail address, telephone number, fax number, employer name, and business address. With respect to medical claims submitted by plan sponsors for reimbursement, information in this system is maintained on early retirees and their spouses, surviving spouses, and dependents with respect to those medical claims, including the health benefit provided, the provider or supplier, the incurred date, the individual for whom the health benefit was provided, the date and amount of payment net any known negotiated price concessions, and the employment-based plan and benefit option under which the health benefit was provided.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for the collection, maintenance, and disclosures from this system is given under provisions of &#167; 1102 of the Affordable Care Act and its implementing regulations codified at Title 45 Code of Federal Regulations (CFR) Part 149.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system is to collect and maintain information on individuals who are early retirees (and spouses, <i>etc.</i>), to collect and maintain information on individuals who are associated with plan sponsors who perform key tasks on behalf of the sponsor, and to collect and maintain information on medical claims submitted to the U.S. Department of Health &amp; Human Services (HHS) for reimbursement, so that accurate and timely reimbursements may be made to plan sponsors who continue to offer qualifying health benefits to such individuals. Information maintained in this system will also be disclosed to: (1)Support regulatory, reimbursement, and policy functions performed by an HHS contractor, consultant or grantee; (2) assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) support litigation involving the Department; (4) combat fraud and abuse in certain health benefits programs; and (5) assist efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records.</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent><p><i>B. Entities Who May Receive Disclosures Under Routine Use</i>
</p><p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which HHS may release information from the ERRP without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish or modify the following routine use disclosures of information maintained in the system:
</p><p>1. To support Agency contractors, consultants, or HHS grantees who have been engaged by the Agency to assist in accomplishment of an HHS function relating to the purposes for this SOR and who need to have access to the records in order to assist HHS.
</p> <p>2. To assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent pursuant to agreements with HHS to:
</p><p>a. Contribute to the accuracy of HHS's reimbursement to sponsors under the ERRP,
</p><p>b. Enable such agency to administer a Federal health benefits program, or as necessary to enable such agency to fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds, and/or
</p><p>c. Assist Federal/State Medicaid programs which may require ERRP information for purposes related to this system.
</p> <p>3. To the Department of Justice (DOJ), court, or adjudicatory body when:
</p><p>b. The Agency or any component thereof, or
</p><p>e. Any employee of the Agency in his or her official capacity, or
</p><p>f. Any employee of the Agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>g. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, HHS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>4. To assist an HHS contractor (including, but not limited to fiscal intermediaries and carriers) that assists in the administration of an HHS-administered health benefits program, or to a grantee of an HHS-administered grant program, when disclosure is deemed reasonably necessary by HHS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
</p> <p>5. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by HHS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
</p> <p>6. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information disclosed is relevant and necessary for that assistance.
</p><p><i> C. Additional Circumstances Affecting Routine Use Disclosures </i></p><p>Our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>We will be storing records in hardcopy files and various electronic storage media (including DB2, Oracle, and other relational data structures).
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information is most frequently retrieved by first name, last name, middle initial, date of birth, or Social Security Number (SSN).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>HHS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal, HHS, and HHS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the E-Government Act of 2002, and the Clinger-Cohen Act of 1996. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and HHS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; and the HHS Information Systems Program Handbook. HHS will give a contractor, consultant, or HHS grantee the information necessary for the contractor or consultant to fulfill its duties. In these situations, safeguards are provided in the contract prohibiting the contractor, consultant, or grantee from using or disclosing the information for any purpose other than that described in the contract and requires the contractor, consultant, or grantee to return or destroy all information at the completion of the contract. Contractors are also required to provide the appropriate management, operational, and technical controls to secure the data.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained with identifiers for all transactions after they are entered into the system for a period of 10 years. Records are housed in both active and archival files in accordance with HHS data and document management policies and standards. All sponsor applications, claims, and other program-related records are encompassed by the document preservation order and will be retained until notification is received from the Department of Justice.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>David Gardner, Acting Director, Early Retiree Reinsurance Division, Office of Insurance Programs, Office of Consumer Information and Insurance Oversight, U.S. Department of Health &amp; Human Services, 200 Independence Avenue, SW., Suite 738F, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purpose of notification, the subject individual should write to the system manager who will require the system name, and the retrieval selection criteria (<i>e.g.,</i> name, SSN, <i>etc.</i>)</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Record source categories include program participants, individuals on whose behalf reimbursements are being sought, and those who voluntarily submit data and personal information for the ERRP program.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-90-0275" toc="yes">
<systemNumber>09-90-0275</systemNumber>
<subsection type="systemName">"Pre-Existing Condition Insurance Plan (PCIP)," OCIIO, OS/HHS.
</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent><p>Office of Consumer Information and Insurance Oversight, U.S. Department of Health &amp; Human Services, 200 Independence Avenue, SW., Suite 738F, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information in this system is maintained on individuals who apply to enroll in the Pre-Existing Condition Insurance Plan.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Information in this system is maintained on individuals who enroll in the Pre-Existing Condition Insurance Plan. Information maintained in this system includes, but is not limited to, the applicant's first name, last name, middle initial, mailing address or permanent residential address (if different than the mailing address), date of birth, Social Security Number (if the applicant has one), gender, email address, telephone number. The system will also maintain information to make a decision about an applicant's eligibility. We collect and maintain information that the applicant submits pertaining to (1) his or her citizenship or immigration status, since only individuals who are citizens or nationals of the U.S. or lawfully present are eligible to enroll; (2) coverage an individual had during the prior twelve months from the date of application in order to establish that such individual has been without creditable coverage for at least six months are eligible to enroll and to assess whether insurers are discouraging an individual from remaining enrolled in prior coverage due to health status; and (3) an insurance company's denial of coverage, offer of coverage with a medical condition exclusion rider, or, for an applicant is guaranteed an offer of coverage, coverage that is medically underwritten. Information will also be maintained with respect to the applicant's premium amount and payment history.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>Authority for the collection, maintenance, and disclosures from this system is given under provisions of Section 1101 of the Patient Protection and Affordable Care Act (Pub. L. 111-148).
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of this system of records is to collect and maintain information on individuals who apply for enrollment in the program. This information will enable HHS acting through NFC, OPM, and any third-party administrator(s) to determine applicants' eligibility, enroll eligible individuals into the program, adjudicate appeals of eligibility and coverage determinations, bill and collect premium payments, and process and pay claims for covered health care items and services furnished to eligible individuals. Information maintained in this system will also be disclosed to: (1) Support regulatory, reimbursement, and policy functions performed by an HHS contractor, consultant or grantee; (2) assist another Federal or State agency, agency of a State government, an agency established by State law, or its fiscal agent; (3) support litigation involving the Department; (4) combat fraud and abuse in certain health benefits programs; and (5) assist efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>B. Entities Who May Receive Disclosures Under Routine Use
</p><p>These routine uses specify circumstances, in addition to those provided by statute in the Privacy Act of 1974, under which HHS may release information from the PCIP without the consent of the individual to whom such information pertains. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected. We propose to establish the following routine use disclosures of information maintained in the system:
</p><p>1. To support HHS contractors, consultants, or HHS grantees who have been engaged by HHS to assist in accomplishment of an HHS function relating to the purposes for this SOR and who need to have access to the records in order to assist HHS.
</p> <p>2. To assist another Federal or state agency, agency of a state government, an agency established by state law, or its fiscal agent pursuant to agreements with HHS to determine applicants' eligibility for the Pre-existing Condition Insurance Plan, enroll eligible individuals into the plan, adjudicate appeals of eligibility and coverage determinations, bill and collect premium payments, and process and pay claims for covered health care items and services furnished to eligible individuals.
</p> <p>3. To support the Department of Justice (DOJ), court, or adjudicatory body when:
</p><p>e. The Department or any component thereof, or
</p><p>f. Any employee of HHS in his or her official capacity, or
</p><p>g. Any employee of HHS in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>h. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, HHS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>4. To assist an HHS contractor that assists in the administration of an HHS-administered health benefits program, or to a grantee of an HHS-administered grant program, when disclosure is deemed reasonably necessary by HHS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such program.
</p> <p>5. To assist another Federal agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency), that administers, or that has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by HHS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
</p> <p>6. To assist appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and unnecessary for the assistance.
</p> <p>C. Additional Circumstances Affecting Routine Use Disclosures
</p><p>Our policy will be to prohibit release even of data not directly identifiable, except pursuant to one of the routine uses or if required by law, if we determine there is a possibility that an individual can be identified through implicit deduction based on small cell sizes (instances where the patient population is so small that individuals could, because of the small size, use this information to deduce the identity of the beneficiary).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>We will be storing records in hardcopy files and various electronic storage media (including DB2, Oracle, and other relational data structures).
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Information is most frequently retrieved by first name, last name, middle initial, date of birth, or Social Security Number (SSN).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>HHS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable Federal laws and regulations and Federal and HHS policies and standards as they relate to information security and data privacy. These laws and regulations include but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the E-Government Act of 2002, and the Clinger- Cohen Act of 1996; OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal and HHS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; and the HHS Information Systems Program Handbook.
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained with identifiers for all transactions after they are entered into the system for a period of 10 years. Records are housed in both active and archival files in accordance with HHS data and document management policies and standards.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Anthony Culotta, High Risk Pool Program Division, Office of Insurance Programs, Office of Consumer Information and Insurance Oversight, U.S. Department of Health &amp; Human Services, 200 Independence Avenue, SW., Suite 738F, Washington, DC 20201.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>For purpose of notification, the subject individual should write to the system manager who will require the system name, and the retrieval selection criteria (<i>e.g.,</i> name, SSN, etc.).</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system manager named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Record source categories include applicants who voluntarily submit data and personal information for the PCIP program.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-90-0411" toc="yes">
<systemNumber>09-90-0411</systemNumber>
<subsection type="systemName">HHS Consolidated Acquisition Solution (HCAS), HHS/ASFR.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>NIH Center for Information Technology, 10401 Fernwood Road, Bethesda, MD 20817.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Information is collected on HHS Contracting Officers and HHS vendors who are service fellows or sole proprietorships that provide vendor services as individuals.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>HCAS records include HHS statements of work, purchase requests, requests for proposals (RFPs), bids, proposals, vendor invoices, requisitions, contract awards, contract modifications, progress reports, financial status reports, audit reports, and contract deliverables.
</p> <p>Individual Information in Identifiable Form (IIF) contained in these records includes names of HHS contracting officers, vendor names, mailing addresses, phone numbers, financial account information, legal documents, Web URLs, and e-mail addresses and may include Social Security numbers when a vendor Tax Information Number (TIN) is not available.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>As an IT investment, HCAS is governed by the HHS IT Investment Review Board (ITIRB), as part of the HHS Capital Planning and Investment Control (CPIC) process, as managed by the HHS Office of the Chief Information Officer (OCIO). CPIC is mandated by the Clinger-Cohen Act which requires agencies to use a disciplined process to acquire, use, maintain and dispose of information technology. The OCIO exercises authorities delegated by the Secretary to the Deputy Assistant Secretary for Information Technology, as the CIO for HHS. These authorities derive from the Clinger-Cohen Act of 1996, the Paperwork Reduction Act of 1995, the Computer Matching and Privacy Act of 1988, the Computer Security Act of 1987, the Federal Information Security Management Act (FISMA), the National Archives and Records Administration Act of 1984, the Competition in Contracting Act of 1984, the Federal Records Act of 1950, OMB Circulars A-130 and A-11, Government Printing and Binding Regulations issued by the Joint Committee on Printing, and Presidential Decision Directive 63.
</p> <p>In addition to the ITIRB oversight, HCAS falls within the governance of the HHS Office of Grants and Acquisition Policy and Accountability (OGAPA).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>HHS has acquisition offices across 10 Operating/Staff Divisions, which conduct and process thousands of procurement transactions annually. The HHS acquisition community requires a transaction-based, integrated procurement system that is consistent across the entire HHS.
</p><p>Except for the Centers for Disease Control and Prevention (CDC), HHS utilizes the acquisition processing and management functionality of Purchase Request Information System (PRISM), a commercial off-the-shelf (COTS) application from Compusearch Software Systems. Except for CDC and Centers for Medicare and Medicaid Services (CMS), HHS utilizes the requisitioning functionality in Oracle i-Procurement, a package available within Oracle Federal Financials, the software utilized by the Unified Financial Management System (UFMS), the HHS enterprise financial management system.
</p> <p>The HHS Consolidated Acquisition System delivers a standardized global PRISM for all operational contracting components within HHS (except CDC) that utilize UFMS (referred to as HCAS clients). HHS deployed HCAS to the following seven HCAS client contracting offices: Agency for Healthcare Research and Quality (AHRQ), Assistant Secretary for Preparedness and Response (ASPR), Food and Drug Administration (FDA), Program Support Center (PSC), Health Resources and Services Administration (HRSA), Indian Health Service (IHS) and Substance Abuse and Mental Health Services Administration (SAMHSA). (CMS and National Institutes of Health (NIH), which use other distinct Oracle Federal Financial instances for financial management that are not UFMS, are not considered HCAS clients and are outside the scope of this system.) CDC, while using UFMS, does not use the HCAS PRISM environment but uses their own procurement system Integrated Contracts Expert (ICE). HCAS PRISM was fully implemented across its HHS clients on February 8, 2009.
</p> <p>The enterprise PRISM configuration via HCAS allows HHS to standardize acquisition business processes across the department. A consolidated PRISM facilitates and enables a single solution for integrating acquisition with financial management (one interface between HCAS and UFMS) and other mixed financial management systems.
</p> <p>The HCAS system itself collects information necessary to support a procurement relationship between HHS and the vendor community. There are limited instances where an individual's information in identifiable form (IIF) will be collected in order to facilitate a transaction in HCAS. HCAS collects and maintains IIF for service fellows and sole proprietorships that provide vendor services as individuals.
</p> <p>Acquisition processes supported by HCAS include acquisition planning, solicitation, contract creation and approval, contract award and award closeout. To support these business processes, IIF contained in HCAS may include the following: Vendor and contracting officer names, vendor mailing addresses, phone numbers, vendor financial account information, legal documents, Web URLs, e-mail addresses, vendor education records, and vendor tax ID numbers (TIN) or Social Security numbers. HCAS users will be able to retrieve data records by vendor or contracting officer name, among other identifiers. For example, names of contracting officer who act as buyers for HHS may be used to retrieve request for proposals or other HHS solicitation materials or purchase requests. Users may also use a contracting officer's name to retrieve associated contact information such as business e-mail or phone number when creating a solicitation or contract. Similarly, users may retrieve solicitation and contract materials, such as proposals, progress reports, and contract modifications by vendor name.
</p> <p>Social Security numbers of vendors may be captured within HCAS under certain circumstances where a Tax Identification Number (TIN) is not available. The HCAS system will comply with all provisions of section 7 of the Privacy Act, including compliance with the following paragraph:
</p><p>Any Federal, State or local government agency which requests an individual to disclose his Social Security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.
</p> <p>When vendor SSN information is collected by HCAS, it is required for vendors to obtain the benefit of contracting with HHS. Provision of this information by the vendor is elective and again, is only used when a vendor TIN is not available.
</p> <p>HCAS is integrated with UFMS and information is exchanged in both directions between the two systems. Information retrieved from HCAS may be shared/disclosed within and across the HHS contracting and financial management communities to: (1) Specify the Contracting Officer conducting an HHS solicitation or purchase request; (2) to specify vendor information in contract documentation, including award, modifications, and task progress reports; and (3) to validate and approve payments to HHS vendors. Information on vendors pertaining to specific HHS contract transactions captured in HCAS is not shared or disclosed to agencies outside of HHS. Names of contracting officers who act as buyers for HHS are contained in solicitation materials that are released to the public for competitive procurements.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The Privacy Act allows information disclosure without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a "routine use".  The proposed routine uses in this system meet the compatibility requirement of the Privacy Act. We are proposing to establish the following routine use disclosures of information maintained in the system:
</p><p>(1) To agency contractors or consultants who have been engaged by the agency to assist in the accomplishment of the HCAS/FESM Operations and Maintenance function (O&amp;M) relating to the purposes for this system and who need to have access to the records in order to assist the OGAPA and HCAS/FESM O&amp;M Federal leadership.
</p> <p>(2) To the Department of Justice (DOJ), court or adjudicatory body when the agency or any component thereof, or any employee of the agency in his or her official capacity, or any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or the United States Government is a party to litigation or has an interest in such litigation, and by careful review, the HHS OGAPA determines that the records are relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>All records are stored on electronic media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Identifiers used to retrieve records may include names of contracting officers and vendors. Names of contracting officers who act as buyers for HHS may be used to retrieve RFPs, statements of work, purchase requests, contract awards or contract modifications. Vendor names may be used to retrieve proposals, contract awards, contract modifications, progress reports, financial status reports, invoices, and contract deliverables. In the limited instance that a vendor is a service fellow or a sole proprietorship that provides services to HHS as an individual, HCAS will allow users to use the individual's name to retrieve vendor related procurement records.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p><i>ADMINISTRATIVE CONTROLS: </i></p><p>The following Administrative Controls have been in place for HCAS:
</p><p><i>ACCOUNT MANAGEMENT/USER IDENTIFICATION AND AUTHENTICATION: </i></p><p>Users must have a UFMS account prior to creation of the PRISM account. User's supervisor or another UFMS user submits a request for access on behalf of the prospective user through the User Provisioning Automated (UPA) process. The UPA process is the on-line UFMS user provisioning module. The UPA process is a workflow process that requires supervisor approval, responsibility approval, SOD approval, and security verification of background investigation. Reports can be generated detailing the approvals for user provisioning. Inactive accounts are locked after 60 days of inactivity. The use of temporary and emergency accounts is prohibited.
</p><p><i>AUTHENTICATOR MANAGEMENT: </i></p><p>Users are required to change their password upon initial login. If users do not log in and change their passwords within 30 days of account generation, then the account is made inactive. Users are responsible for understanding and complying with all password use requirements including the need for adequate (difficult to decipher) passwords. Users are required to use passwords of a mix of eight (8) alpha, numeric and special characters, with at least one uppercase letter, one lower case letter, and one number. Users are automatically required to change their passwords every 90 days. Users are instructed to keep their passwords confidential and not share them with anyone. Upon notification that a password has been forgotten or compromised, the password is immediately reset to a unique (non-default) password and the user is notified. Upon login, after a password reset, the user is required to change their password within 2 days to prevent the account from being deactivated.
</p><p><i>ACCESS ENFORCEMENT: </i></p><p>User access to the application functions are granted through the UPA process based upon the role that has been assigned to the user and approved through the workflow. Privileges assigned to users of the system/application are granted based upon the role that has been assigned to the user. This includes administrative privileges that can be performed within the system.
</p><p><i>INFORMATION FLOW ENFORCEMENT--NIH/CIT SECURITY MECHANISMS: </i></p><p><i>Carbon Copy (CC):</i> The UFMS application resides on hardware located within the National Institutes of Health, Center for Information Technology (NIH/CIT) general support system (GSS). The flow of information within the system and between interconnected systems is controlled by various NIH/CIT network firewalls, and authentication mechanisms HHS-Net Certification and Accreditation (C&amp;A)-- The flow of information within the system traverses the HHS-Net network which includes routers, switches, network firewalls, and authentication mechanisms.</p><p><i>LEAST PRIVILEGE: </i>
</p><p>Privileges assigned to users of the system/application are granted based upon the role that has been assigned to the user.
</p><p><i>UNSUCCESSFUL LOGIN ATTEMPTS: </i></p><p>The system contains functionality that prevents user access when the maximum number of unsuccessful login attempts is exceeded.
</p> <p>The HCAS system automatically locks an account until released by an administrator when three (3) unsuccessful login attempts occur.
</p><p><i>TECHNICAL CONTROLS: </i></p><p>Access to the system is controlled by HCAS Systems Security Officer, which authenticates the user prior to granting access. Access level and permissions are controlled by the system and based on user, role, organizational unit, and status of the report. All servers have been configured to remove all unused applications and system files and all local account access except when necessary to manage the system and maintain integrity of data.
</p><p><i>PHYSICAL CONTROLS: </i></p><p>The servers will reside in the NIH CIT Computer Room where policies and procedures are in place to restrict access to the machines.
</p> <p>This system will conform to all applicable Federal laws and regulations and HHS/Office of the Secretary policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the E-Government Act of 2002; the Clinger-Cohen Act of 1996; and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal and HHS/Office of the Secretary policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications and the HHS Information Systems Program Handbook.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>HCAS is governed by the HHS Records Management and Disposition guidelines for the retention and destruction of IIF. The guidelines reference the National Archive and Records Administration Act of 1984 (Pub. L. 98-497, 44 U.S.C. Chapter 21). The HCAS FESM/O&amp;M will retain identifiable information maintained in the HCAS system of records in accordance with the National Archives and Records Administration General Records Schedules and Federal Acquisition Regulation (FAR 4.805).
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Information and Systems Management Services (ISMS), U.S. Department of Health and Human Services, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Inquiries should be made in writing to the System Owner, Deputy Assistant Secretary, Office of Grants and Acquisition Policy and Accountability, Assistant Secretary for Financial Resources, U.S. Department of Health and Human Services, 200 Independence Avenue, SW., Washington, DC 20201. The individual making the inquiry must show proof of identity before information is released and give name and social security number, purpose of inquiry, and if possible, the document number.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual should contact the system owner named above, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulations 45 CFR 5b.7).
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information in HCAS will be collected, in part, from the data transmitted from i-Procurement which includes: Requisition number; date of request; object class, appropriation code and Central Accounting Number (CAN) of the item requested; HHS requesting organization name; and location, HHS point of contact name and business contact phone number within the requesting organization; a description of the item requested and corresponding quantity and cost required. Other information collected includes; proposal, solicitation, market research, and contract award documentation.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p></xhtmlContent></subsection></section>
<section id="09-90-0777" toc="yes">
<systemNumber>09-90-0777</systemNumber>
<subsection type="systemName">Facility and Resource Access Control Records.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Most identity records are not classified. However, in some cases, records of certain individuals, or portions of some records, may be classified in the interest of national security.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Data covered by this system are maintained at the following locations: Department of Health and Human Services (HHS), Office of the Secretary, 200 Independence Avenue, SW., Washington, DC 20201; HHS Operating Divisions and regional offices around the country; Qwest Datacenter in Sterling, Virginia; and the Qwest CyberCenter in Highlands Ranch, Colorado. Some data covered by this system will be accessed at HHS locations, both federal buildings and federally-leased space, and at the physical security office(s) or computer security offices of those locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>(1) Individuals who require or are under consideration to obtain regular, ongoing access to HHS facilities, information technology systems, or information classified in the interest of national security, such as applicants for employment or contracts with HHS, federal employees, tribal members, contractors, students, interns, volunteers, affiliates such as individuals authorized to perform or use services provided in HHS facilities (<i>e.g.,</i> HEW Credit Union, fitness center, etc.) and individuals formerly in any of these positions. (2) PIV card holders from other agencies who visit HHS facilities or use HHS computer systems. (3) Occasional visitors or short-term employees or guests who do not carry PIV cards and do not require certificates for using encryption with a Public Key Infrastructure (PKI), to whom HHS will issue temporary identification and low assurance credentials.</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>(1) Records maintained on individuals issued credentials by HHS include the following: Full name, Social Security number; date and place of birth; citizenship; signature; image (photograph); fingerprints; hair color; eye color; height; weight; sex; race; scars, marks, or tattoos; organization/office of assignment, location and contact information; PIV card issue and expiration dates; personal identification number (PIN); PIV request form; PIV sponsor, enrollment, registrar and issuance information; PIV card serial number; emergency responder designation; foreign national designator; contractor designator; information derived from documents used to verify identity such as document title, issuing authority, or expiration date; position sensitivity; level of national security clearance and expiration date; computer system user name; user access and permission rights; authentication certificates; digital signature information; employment category; position title; dates, times, and locations of entries and exits.
</p> <p>(2) HHS maintains the following categories of records about PIV card holders from other agencies entering HHS facilities or using HHS systems: Name, PIV card serial number; dates, times, and locations of entries and exits; organization name; level of national security clearance and expiration date; digital signature information; computer networks, applications, and data accessed.
</p> <p>(3) HHS maintains the following categories of records about occasional visitors and short term guests: name, photograph, date and time of entry and exit, facility to which admitted, and name of person visiting.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 301; Information Technology Management Reform Act of 1996 (Pub. L. 104-106, sec. 5113); Electronic Government Act (Pub. L. 104-347, sec. 203); Paperwork Reduction Act of 1995 (44 U.S.C. ch. 35); Government Paperwork Elimination Act (Pub. L. 105-277, sec. 1701, 44 U.S.C. 3504); Homeland Security Presidential Directive (HSPD) 12, Policy for a Common Identification Standard for Federal Employees and Contractors, Aug. 27, 2004; Federal Property and Administrative Act of 1949, as amended.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The primary purposes of the system of records are to (1) Ensure the safety and security of HHS facilities, systems, or information, and our occupants and users; (2) to verify that all persons entering federal facilities, using federal information resources, or accessing classified information are authorized to do so; and (3) to track and control PIV cards and other identity credentials issued to persons entering and exiting the facilities, using systems, or accessing classified information.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Information about covered individuals may be disclosed without consent as permitted by the Privacy Act of 1974, 5 U.S.C. 552a(b), and:
</p><p>(1) To the Department of Justice when: (a) The agency or any component thereof; or (b) any employee of the agency in his or her official capacity; (c) any employee of the agency in his or her individual capacity where agency or the Department of Justice has agreed to represent the employee; or (d) the United States government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records by DOJ is therefore deemed by the agency to be for a purpose compatible with the purpose for which the agency collected the records.
</p> <p>(2) To a court or adjudicative body in a proceeding when: (a) The agency or any component thereof; (b) any employee of the agency in his or her official capacity; (c) any employee of the agency in his or her individual capacity where agency or the Department of Justice has agreed to represent the employee; or (d) the United States government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.
</p> <p>(3) Except as noted on Forms SF 85, 85-P, and 86, when a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate public authority, whether federal, foreign, state, local, or tribal, or otherwise, responsible for enforcing, investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to any enforcement, regulatory, investigative or prosecutorial responsibility of the receiving entity.
</p> <p>(4) To a federal, state, or local agency, or other appropriate entities or individuals, or through established liaison channels to selected foreign governments, in order to enable an intelligence agency to carry out its responsibilities under the National Security Act of 1947 as amended, the CIA Act of 1949 as amended, Executive Order 12333 or any successor order, applicable national security directives, or classified implementing procedures approved by the Attorney General and promulgated pursuant to such statutes, orders or directives.
</p> <p>(5) To a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.
</p> <p>(6) To the National Archives and Records Administration or to the General Services Administration for records management inspections conducted under 44 U.S.C. 2904 and 2906.
</p> <p>(7) To agency contractors who have been engaged to assist the agency in the performance of a contract service, grant, cooperative agreement, or other activity related to this system of records and who need to have access to the records in order to perform the activity. Recipients shall be required to comply with the requirements of the Privacy Act of 1974, as amended, 5 U.S.C. 552a.
</p> <p>(8) To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p> <p>(9) To a federal, state, local, foreign, or tribal or other public authority the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another federal agency for criminal, civil, administrative personnel or regulatory action.
</p> <p>(10) To another federal agency to notify that agency when, or verify whether, a PIV card is no longer valid.
</p> <p>Note:
</p><p>Disclosures of data pertaining to date and time of entry and exit of an agency employee working in the District of Columbia may not be made to supervisors, managers or any other persons (other than the individual to whom the information applies) to verify employee time and attendance record for personnel actions because 5 U.S.C. 6106 prohibits federal Executive agencies (other than the Bureau of Engraving and Printing) from using a recording clock within the District of Columbia, unless used as a part of a flexible schedule program under 5 U.S.C 6120 <i>et seq.</i></p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are stored in electronic media and in paper files.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrievable by name, date of birth, Social Security number, photographic identifiers, biometric identifiers, HHS Identification Number, and PIV card serial numbers.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>HHS has safeguards in place for authorized users and monitors such users to ensure against excessive or unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access.
</p> <p>This system will conform to all applicable federal laws and regulations and federal and HHS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: the Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, and HHS policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications and the HHS Information Systems Program Handbook.
</p> <p>Paper records are kept in locked cabinets in secure facilities and access to them is restricted to individuals whose role requires use of the records. The computer servers in which records are stored are located in facilities that are secured by alarm systems and off-master key access. The computer servers themselves are two-factor protected with Public Key Infrastructure (PKI) credentials, Personal Identification Numbers (PINs) and passwords. Access to individuals working at guard stations, operating enrollment stations, issuance stations, or the portal for sponsorship and adjudication will be two-factor protected using PKI and PIN; each person granted access to the system at guard stations, enrollment stations, issuance stations or through the portal must be individually authorized to use the system. A notice warning users that they are responsible for protecting the information in accordance with the Privacy Act, the Computer Security Act, and the Federal Information Security Management Act appears on the monitor screen when records containing information on individuals are first displayed. Data exchanged between the servers and the personal computers at the guard stations and badging office are encrypted. Backup tapes are stored in a locked and controlled room in a secure, off-site location.
</p> <p>An audit trail is maintained and reviewed periodically to identify unauthorized access. Persons given roles in the PIV process must complete training specific to their roles to ensure they are knowledgeable about how to protect individually identifiable information.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records relating to persons' access covered by this system are retained in accordance with General Records Schedule 18, Item 17 approved by the National Archives and Records Administration (NARA). Unless retained for specific, ongoing security investigations, for maximum security facilities, records of access are maintained for five years and then destroyed. For other facilities, records are maintained for two years and then destroyed.
</p> <p>All other records relating to individuals are retained and disposed of in accordance with General Records Schedule 18, item 22, approved by NARA. In accordance with HSPD-12, PIV cards are deactivated within 18 hours of cardholder separation, loss of card, or expiration. PIV cards are destroyed by cross-cut shredding no later than 90 days after deactivation.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Ken Calabrese, HHS Chief Technology Officer, Office of the HHS Chief Information Officer, Department of Health and Human Services, 200 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual can determine if this system contains a record pertaining to himself or herself by sending a request in writing, signed, to HHS Privacy Act Officer, Room 2221, Mary E. Switzer Building, Department of Health and Human Services, 330 "C" Street, SW., Washington, DC 20201. When requesting notification of or access to records covered by this Notice, an individual should provide his/her full name, date of birth, agency name, and work location. An individual requesting notification of records in person must provide identity documents sufficient to satisfy the custodian of the records that the requester is entitled to access, such as a government-issued photo ID. Individuals requesting notification via telephone must furnish, at a minimum, name, date of birth, social security number, and home address in order to establish identity. Individuals requesting notification via mail shall submit a notarized request to the responsible Department official to verify his or her identity or shall certify in his or her request that he or she is the individual who he or she claims to be and that he or she understands that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act subject to a $5,000 fine.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>In addition to the procedures above, requesters should reasonably specify the record contents being sought. If additional information or assistance is required, contact the HHS Privacy Act Officer, Room 2221, Mary E. Switzer Building, Department of Health and Human Services, 330 "C" Street, SW., Washington, DC 20201. Write the words "Privacy Act Request" on the envelope and on the letter. For purpose of access, use the same procedures outlined in the Notification Procedures above. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a) (2).)
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>In addition to the procedures above, requesters should also reasonably identify the record, specify the information they are contesting, state the corrective action sought and the reasons for the correction along with supporting justification showing why the record is not accurate, timely, relevant, or complete. Rules regarding amendment of Privacy Act records appear in 45 CFR part 5a. If additional information or assistance is required, contact the HHS Privacy Act Officer, Room 2221, Mary E. Switzer Building, Department of Health and Human Services, 330 "C" Street, SW., Washington, DC 20201. Write the words "Privacy Act Request" on the envelope and on the letter.
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Employee, contractor, or applicant; sponsoring agency; former sponsoring agency; other federal agencies; contract employer; former employer.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-90-1000" toc="yes">
<systemNumber>09-90-1000</systemNumber>
<subsection type="systemName">Consolidated Data Repository-HHS-OIG.</subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Records will be maintained at the following computer site locations:
</p><p>&#149; HHS-OIG, 330 Independence Avenue, SW., Washington, DC 20201.
</p> <p>&#149; HHS-OIG, N2-01-02, 7500 Security Boulevard, Baltimore, MD 21244.
</p> <p>And the following HHS-OIG Regional/Field Office locations:
</p><p>&#149; JFK Federal Building, Boston, MA 02203.
</p> <p>&#149; J.K. Javits Federal Building, 26 Federal Plaza, New York, NY 10278.
</p> <p>&#149; 150 South Independence Mall West, Public Ledger Building, Philadelphia, PA 19106.
</p> <p>&#149; Atlanta Federal Center, Forsyth Street South, Atlanta, GA 30303.
</p> <p>&#149; 8659 Baypine Road, Suite 203 Jacksonville, FL 32256.
</p> <p>&#149; 233 North Michigan Avenue, Room 1360, Chicago, IL 60601.
</p> <p>&#149; 3815 West Street, Joseph Hwy, Lansing, MI 48917.
</p> <p>&#149; Galtier Plaza, 380 Jackson Street, Suite 727, St. Paul, MN 55101.
</p> <p>&#149; 1124 Rickard Road, Suite C, Springfield, IL 62704.
</p> <p>&#149; 1100 Commerce Street, Dallas, TX 75242.
</p> <p>&#149; 1201 Walnut Street, Kansas City, MO 64106.
</p> <p>&#149; 90 7th Street, San Francisco, CA 94103.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The records include information concerning Medicare beneficiaries and Medicaid recipients.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The categories of records in the system will include Medicare beneficiaries' names, addresses, dates of birth, Medicare HIC numbers, SSNs, enrollment information and eligibility information, and claims information relating to the following types of services: Inpatient, skilled nursing facility, outpatient, physician/supplier, home health, hospice, durable medical equipment, prescription drug, and Medicare Advantage. The records will also include names, addresses, dates of birth, and SSNs on Medicaid recipients from State enrollment and eligibility files and claims information relating to the following types of services: Inpatient, long-term care, professional, dental, pharmacy, and Medicare cross-over. The National Provider Identification database and the Unique Provider Identification Number (UPIN) directory will be stored in this system of records.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Inspector General Act of 1978 (5 U.S.C. App.).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purpose of this system of records is to conduct audits, evaluations and inspections, and investigations of the Medicare and Medicaid programs.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The Privacy Act permits OIG to disclose information outside HHS without an individual's consent if the information is to be used for a purpose that is compatible with the purposes for which the information was collected. Any such disclosure of data is known as a routine use. Accordingly, we are proposing to establish the following routine use disclosures of records maintained in the system:
</p><p>a. Disclosure may be made to Federal, State, and local agencies for the purpose of better identifying the total current health care usage of the Medicare and Medicaid patient population.
</p> <p>b. Disclosure may be made to Federal, State, and local government agencies and national health care organizations to assist in the development of programs that will be beneficial to claimants and to protect their rights under law and assure that they are receiving all benefits to which they are entitled.
</p> <p>c. Disclosure may be made to a Federal department or agency or to a contractor of a Federal department or agency to permit it to conduct Federal audits, evaluations and inspections, or investigations necessary to accomplish a statutory purpose of an agency. OIG must be able to disclose information for purposes needed to accomplish a statutory purpose of a Federal agency.
</p> <p>d. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>e. In the event of litigation, information from the system of records may be disclosed to the Department of Justice, to a judicial or administrative tribunal, opposing counsel, and witnesses, in the course of proceedings involving HHS, any HHS employee (where the matter pertains to the employee's official duties), or the United States, or any agency thereof where the litigation is likely to affect HHS, or HHS is a party or has an interest in the litigation and the use of the information is relevant and necessary to the litigation.
</p> <p>f. In the event that a system of records maintained by OIG to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal, State, local, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p> <p>g. In the event that the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>h. A record from this system of records may be disclosed to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>i. The system of records may be disclosed to student volunteers and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records to perform their assigned agency functions.
</p> <p>j. A record may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Data are maintained on magnetic tape, disk, or laser optical media.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records may be retrieved by name, name and one or more criteria (e.g., dates of birth, death, and service), SSN, Medicare HIC number, Medicaid Identification Number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>The computers that process these data are protected by technical, managerial, and operational controls that follow Federal policies and guidelines. The computers are protected by a combination of physical security by being located in Federal offices; access controls such as passwords and identification numbers; and technical protections such as encryption, firewalls, and anti-virus software. These controls allow only authorized users to access the data.
</p> <p>Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational, and technical safeguards sufficient to protect the confidentiality, integrity, and availability of the information and information systems and to prevent unauthorized access. This system will conform to all applicable Federal laws and regulations and Federal, HHS, and OIG policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the eGovernment Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Prescription Drug, Improvement, and Modernization Act of 2003, and the corresponding implementing regulations; and OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and OIG policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook; and OIG Information Security Handbooks.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>These records may be maintained for an indefinite duration.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The agency official responsible for the system policies and practices outlined above is: The Chief Information Officer, Office of Management and Policy, Office of Inspector General, Department of Health and Human Services, Wilbur J. Cohen Building, Room 5230, 330 Independence Avenue, SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Any inquiries regarding these systems of records should be addressed to the System Manager. An individual who requests notification of or access to a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. (These notification and access procedures are in accordance with Department regulations (45 CFR 5b.6).)
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. (These access procedures are in accordance with Department regulations (45 CFR 5b.5(a)(2).)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address in the System Manager and Address section above, and reasonably identify the record and specify the information to be contested and the corrective action sought with supporting justification. (These procedures are in accordance with Department Regulations (45 CFR 5b.7).)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Sources of information in this records system include: Federal, State, and local government records regarding Medicare, Medicaid, and other benefit programs; Department documents and records; materials regarding service providers in Federal health care programs furnished by nongovernmental sources; and public source materials.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>

<section id="09-90-1200" toc="yes">
<systemNumber>09-90-1200</systemNumber>
<subsection type="systemName"> Workplace Violence Prevention Team (WVPT) Records, HSS/OS/ASMB/OHR.</subsection>
<subsection type="securityClassification"><xhtmlContent><p> None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p> Records are located throughout HHS in offices designated to provide workplace violence prevention services. Since there are numerous sites around the country available for these services, contact the appropriate system manager in Appendix A for more details about specific locations.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p> Individuals covered by this system include: persons who report potential or actual workplace violence; persons accused of threatening to commit, or committing workplace violence; and persons interviewed or investigated in connection with reports or allegations of potential or actual workplace violence.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p> This system contains written and electronic records on each person who contacts the WVPT for assistance. It also contains records on individuals who are being interviewed and investigated by the WVPT. The records typically contain demographic data such as the individual's name, pay plan, grade level, employing organization, office location, duty hours, telephone number, and name of supervisor.
</p> <p>Information is also maintained about the workplace violence situation that is concerning the person who contacts the WVPT. This includes descriptions of events related to the workplace violence situation, others involved, as well as dates and locations of events. Each record will also contain an assessment of the situation by the WVPT, information regarding any interviews that were conducted, and the recommended interventions.
</p> <p>If the WVPT is interviewing a person because of someone else's report, the record of the person being interviewed may also contain information that was obtained through interviews with the supervisor, Federal or local law enforcement personnel, HHS security staff, co- workers, and any others involved in the situation.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 7901 (Health Services Programs);
</p><p>5 U.S.C. 7902 (Safety Programs)
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The agency maintains this system of records to:
</p><p>1. Administer health programs related to workplace violence prevention activities;
</p><p>2. Administer and support safety programs that help reduce accidents and injuries among employees;
</p><p>3. Monitor or follow up on violent or potentially violent situations in HHS;
</p><p>4. Help WVPT members make assessments of violent or potentially violent situations and then make recommendations regarding interventions to those persons involved with the situations;
</p><p>5. Prepare administrative reports, conduct evaluations, or audit the activities of the teams; and
</p><p>6. Inform management, medical personnel and security staff in HHS of potential and actual dangerous situations that require action to assure the safety and health of employees.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These records or information from these records may be released:
</p><p>1. To a congressional office when it has received a written inquiry from an individual about whom a record is maintained in this system. This request will be verified before disclosure from the individual's record will be made to the congressional office.
</p> <p>2. When a person or property is harmed, or when threats of harm to a person or property are reported, disclosure will be made, as appropriate, to law enforcement authorities, medical treatment authorities, and those persons being threatened or harmed.
</p> <p>3. To the Department of Justice, a court or other tribunal, when: (a) HHS, or any component, thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records are collected. The local System Manager will approve any disclosure made under this routine use.
</p> <p>4. To student volunteers, interns, individuals working under a personal services contract, organizations working under contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records to perform their assigned duties. This includes those performing threat or risk assessments. Contractors will be required to maintain Privacy Act safeguards with respect to such records. These safeguards are explained in the section entitled "Safeguards."
</p><p>5. To qualified personnel for research, audit, or evaluation purposes.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>These records are maintained in file folders and on password-protected computers, and computer disks. Folders and computer disks, when not in use, are stored in a secured area accessible only to members of the WVPT.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>These records are retrieved by employee name (those who reported a violent or potentially violent event and those who were reported), event date, and event location.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users:  Access to these records is limited to members of the WVPT. Others working with the WVPT, such as outside consultants, when approved by the team, may have access for the purpose of investigating  a situation, preparing reports, or conducting evaluations and audits.
</p> <p>2. Physical Safeguards: All paper records are stored in metal filing cabinets equipped with locks, preferably combination. The file cabinets are stored in secure areas with access limited to the WVPT members. Computer records are stored on disks or computers that are password protected or are systems discreet from other computer systems. Disks are stored in the same manner as paper records.
</p> <p>3. Procedural Safeguards: Information will only be released from this system of records in accordance with the routine uses described above or as provided by the Privacy Act's disclosure provisions. Those who are serviced by the WVPT will be informed in writing about the WVPT's confidentiality procedures when they begin the process. Consultants must not disclose records. Secondary disclosure of information is prohibited unless permitted by a routine use or other of the Privacy Act's disclosure provisions.
</p> <p>4. Contractor Guidelines: Contractors who are given records under routine use 1B3 must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent unauthorized persons from gaining access to the records, and return records to the System Managers immediately upon completion of the work specified in their contracts. Contractor compliance is assured through inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records are instructed to make no disclosure of the records except as authorized by the System Managers and as stated in the contracts.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are destroyed two years after the incident/situation has been closed by the WVPT or until any litigation/third party action about it has been resolved. Files will be destroyed only by a WVPT team member and with a witness present. Paper records will be destroyed by shredding or burning. Information stored on computers will be destroyed by deleting all appropriate portions of floppy disks, hard drives, tapes, and other electronic media that may contain the record. Consultant and contractor records will be transferred to the local WVPT for destruction.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The records of individuals served by the WVPT are managed by local System Managers in the various HHS sites listed in Appendix A.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>For purposes of notification, the subject individual, and/or the individual's legal representative should write to the local System Manager who will require the system name, requestor name, address, and Social Security Number to ascertain whether the individual's record is in the system.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>For purposes of access, use the same procedures outlined in Notification Procedures above. Requestors must also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2).)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>The subject individual shall contact the System Manager and reasonably identify the record and specify the information being contested. State the corrective action sought (addition to, deletion of, or substitution of) and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.)
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records is supplied by the individual contacting the WVPT, this individual's coworkers (including the supervisor), a member of the individual's family, sources to/from whom the individual has been referred for assistance, Departmental officials involved in the situation (such as security staff), or other sources involved with the situation and its resolution.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.</p>
<p><i>Appendix A </i></p><p>1. For employees in the Southwest DC  area, contact: Workplace Violence Prevention Team Leader, PSC Work/Life Center, 330 C Street, SW, Room 1250, Washington, DC  20201.
</p> <p>2. For employees on the MIH Campus in Bethesda, MD, contact: Critical Incidents Violence Intervention League (CIVIL) Team Leader, OHRM/OD, 31 Center Drive, Room 1C39, Bethesda, MD 20892.
</p> <p>3.  For employees at HCFA headquarters in Baltimore, MD, contact: Crisis Management Team Leader, 7500 Security Boulevard, Room S1-23 -27, Baltimore, MD 21244.
</p> <p>4. For  employees at CDC headquarters in Atlanta, GA, contact: Crisis Management Team Chair, Associate Director for Management and Operations, 1600 Clifton Road, NE, MS-D15, Atlanta, GA 30333, or, Crisis Management Team Co-Chair, Employee Relations Specialist, 4770 Buford Highway, MS-K17, Atlanta, GA 30341-3274.
</p> <p>5. For employees in SAMHSA, contact: SAMHSA Crisis Intervention Team Leader, SAMHSA, Division of Human Resources Management, 5600 Fishers Lane, Room 14C17, Rockville, Maryland 20857, 301-443-4006.
</p></xhtmlContent></subsection></section>
<section id="09-90-1201" toc="yes">
<systemNumber>09-90-1201</systemNumber>
<subsection type="systemName">ONC Health IT Dashboard, HHS/OS/ONC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>Unclassified.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The server infrastructure for the system will be located at Managed Application Hosting Facility (MAHC Core Site), Reston Virginia.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system will contain information about individual office-based health care providers who are enrolled with the ONC Health IT Regional Extension Centers (REC) and/or participate in other Federal health IT-related grant programs, including the CMS EHR Incentive Programs.</p>
</xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system will contain the following records about individual health care providers:
</p><p>&#149; IT implementation information, such as the functionalities that are being used within a provider's electronic health record system;
</p><p>&#149; Demographic records, such as gender and ethnicity;
</p><p>&#149; Contact information, such as name, address, and phone number; and
</p><p>&#149; National Provider Identifier (NPI).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5), codified at 42 U.S.C. 300jj.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>HHS/ONC personnel will use the system to create and use datasets to assess, improve, and publicize the effectiveness of ONC health IT grants made to States and State-designated entities. Some of the datasets will contain individually identifying information about health care providers who are registered to receive health IT implementation assistance from ONC grantees. HHS/ONC personnel will use individually identifying information in the system, on a need to know basis, to (1) Evaluate the state of health IT implementation by parties registered to receive electronic health record implementation assistance from ONC grantees, (2) compare grantees' progress reports in order to validate claims submitted for grant payments, (3) share the evaluations with the grantees to help improve grant performance, and (4) make aggregate data (<i>e.g.,</i> national and State-level implementation estimates) publicly available on ONC's Web site.</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent><p>The ONC Health IT Dashboard system will or may disclose datasets containing individually identifying information about providers to the following parties outside the agency, for the following routine uses:
</p><p>1. To ONC grantees to help them improve grant performance and to ONC contractors that help evaluate the effectiveness of Federal health IT- related grants to States and State-designated entities. The group of ONC grantees with whom this data will be shared is available on the ONC Web site at <i>http://www.healthit.gov.</i> An ONC grantee will only receive individually identifying data about health care providers that are within the grantee's geographic service area.
</p> <p>2. To agency contractors, consultants, or HHS grantees who have been engaged by the agency to assist in accomplishment of an HHS function relating to the purposes of this system of records and who need to have access to the records in order to assist HHS.
</p> <p>3. To another Federal or State agency, agency of a State government, agency established by State law, or its fiscal agent, pursuant to agreements with HHS, as necessary to enable such agency to:
</p><p>&#149; Contribute to the accuracy of HHS's reimbursements to grantees;
</p><p>&#149; Administer a Federal health benefits program or fulfill a requirement of a Federal statute or regulation that implements a health benefits program funded in whole or in part with Federal funds; and/or
</p><p>&#149; Assist Federal/State Medicaid programs which may require ONC Health IT Dashboard information for purposes related to this system.
</p> <p>4. To the Department of Justice (DOJ), a court or an adjudicatory body when:
</p><p>&#149; The agency or any component thereof, or
</p><p>&#149; Any employee of the agency in his or her official capacity, or
</p><p>&#149; Any employee of the agency in his or her individual capacity where the DOJ has agreed to represent the employee, or
</p><p>&#149; The United States Government, is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>5. To another Federal agency or an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency), that administers or has the authority to investigate potential fraud, waste or abuse in a health benefits program funded in whole or in part by Federal funds, when disclosure is deemed reasonably necessary by HHS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
</p> <p>6. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.
</p> <p>7. To the Department of Justice (DOJ) and/or the Office of Government Information Services (OGIS) for the purposes of determining whether disclosure is required under the Freedom of Information Act (FOIA), resolving disputes between FOIA requesters and Federal agencies, and reviewing agencies' FOIA policies, procedures and compliance in order to recommend policy changes to Congress and the President.
</p> <p>8. To the National Archives and Records Administration (NARA) in records management inspections conducted under the authority of 44 U.S.C 2904 and 2906.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Records will be retrieved, compared and cross-checked using the National Provider Identifier (NPI).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Appropriate physical, technical, and administrative safeguards will be in place to protect against unauthorized access to or disclosure of individually identifiable information from this system. The system will be secured and protected using standards established through the Federal Information Security Management Act of 2002 (44 U.S.C. 3541) and standards established by the National Institutes for Standards in Technology (NIST) for certifying and accrediting IT systems. Furthermore, access to the system's internal ONC interface (which provides the only available access to individually-identifying data) will be limited to a small group of authorized HHS/ONC researchers, and within that group, individual datasets will be micromanaged to ensure that access is restricted to the subset of ONC staff with the bona fide need to use the information. Access to any portion of the internal ONC system and or source datasets is predicated on successful user registration with the HHS IT help desk and the user's ability to abide by the HHS IT security terms of use.
</p> <p>Datasets created in the system for provided to an ONC grantee or contractor will contain only data specifically pertaining to that entities grant or contract purpose. Further, an ONC grantee or contractor will only receive or have access to individually-identifiable data about health care providers who are within the grantee's geographic area. An ONC partner or ONC grantee will be able to access datasets created in the system via a secure login to an internet portal. No records will be maintained in hard-copy files.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>The records are currently unscheduled; the records disposition schedule will provide for records to be destroyed approximately two years after the completion of the applicable ONC health IT-related grant program that was evaluated using the records.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>ONC Dashboard Administrator, Office of the National Coordinator for Health IT, 200 Independence Avenue SW., Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual provider who wishes to know if this system contains records about him or her should write to the System Manager and include his or her National Provider Identifier (NPI).
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>An individual provider seeking access to records about him or her in this system should follow the same instructions indicated under "Notification Procedure." The request should reasonably identify the record contents to which access is sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5 (a)(2).)
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>An individual provider seeking to contest the content of information about him or her in this system should follow the same instructions indicated under "Notification Procedure." The request should reasonably identify the record, specify the information contested, state the corrective action sought, and provide the reasons for the correction, with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7.) The right to contest records is limited to information that is incomplete, irrelevant, incorrect, or untimely (<i>i.e.,</i> obsolete).</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>The system will use data procured from private vendors that monitor health IT adoption trends and activity and grant administrative data already collected or generated in administering ONC and other Federal health IT-related grant programs. Datasets created by this system, from those sources, will be cross-checked against certain data in other HHS systems (such as the PECOS system), to ensure the datasets are valid, accurate and reliable for use in evaluating ONC grants. Most of the data used will come from records collected directly from participants in the grant programs.
</p></xhtmlContent></subsection>
 <subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-90-1202" toc="yes">
<systemNumber>09-90-1202</systemNumber>
<subsection type="systemName">Think Cultural Health </subsection>
<subsection type="securityClassification"><xhtmlContent><p>Unclassified .</p></xhtmlContent></subsection> <subsection type="systemLocation"><xhtmlContent><p>Servers: The servers hosting the system will be housed at Equinix Data Center 2, Ashburn, VA. Portals: This system will be accessed via the Internet at <i>www.ThinkCulturalHealth.hhs.gov.</i> System Software: System software is maintained by Astute Technology in Reston, Virginia.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>The system will contain PII about individual health professionals who register to receive a monthly newsletter distributed via email through the site or to take training offered on the site.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system will contain the following categories of records and PII data elements:
</p><p>&#149; <i>Newsletter registration records and E-learning registration records,</i> including registrant's first and last name, email address, User ID number, user name, street address, degree, certificate type, gender, age, race/ethnicity, practice setting, level of seniority, primary role, years in profession, notification information, and current and future contact information.
</p> <p>&#149; <i>E-learning training and test records,</i> including registrant's first and last name, evaluation data, pretest and posttest scores, and E-learning registration information.</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>The statutory authority for maintenance of the system is Section 5307 of the Affordable Care Act of 2010, Public Law 111-148, codified at 42 U.S.C. 293e and 42 U.S.C. 296e-1.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>HHS/OS/OASH/OMH personnel will use PII in the system, on a "need to know" basis, for the following purposes:
</p><p>&#149; To identify individuals who request to receive the Think Cultural Health newsletter;
</p><p>&#149; To identify individuals who enroll in the Think Cultural Health E-learning program and receive continuing education credits;
</p><p>&#149; To report the fulfillment of continuing education credits to the accrediting bodies; and
</p><p>&#149; To evaluate statistics showing how, where, and by whom the program is utilized; for HHS research, marketing, and quality improvement purposes directed at ensuring the site is used by individuals representing a variety of skills and backgrounds.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>The system may disclose records containing PII to parties outside HHS for the following routine uses:
</p><p>1. Certain E-learning test records, consisting of the registrant's name, evaluation data, pretest and posttest scores, and registration information, will be disclosed to accrediting bodies (such as Cine-Med and Indian Health Services), for their use in reporting continuing education credits for health professionals who complete all or part of the training program.
</p> <p>2. Records may be disclosed to agency contractors, consultants, or HHS grantees who have been engaged by the agency to assist in accomplishment of an HHS function relating to the purposes of this system of records and who need to have access to the records in order to assist HHS.
</p> <p>3. Records may be disclosed to the Department of Justice (DOJ), a court, or an adjudicatory body when:
</p><p>&#149; The agency or any component thereof; or
</p><p>&#149; Any employee of the agency in his or her official capacity, or
</p><p>&#149; Any employee of the agency in his or her individual capacity where DOJ has agreed to represent the employee, or
</p><p>&#149; The United States Government,
</p><p>is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court, or adjudicatory body is compatible with the purpose for which the agency collected the records.
</p> <p>4. Records may be disclosed to another Federal agency or an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency) that administers, or that has the authority to investigate potential fraud, waste, or abuse in federally funded programs, when disclosure is deemed reasonably necessary by HHS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.
</p> <p>5. Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.
</p> <p>6. Records may become accessible to U.S. Department of Homeland Security (DHS) cyber security personnel, if captured in an intrusion detection system used by HHS and DHS pursuant to the Einstein 2 program. Under Einstein 2, DHS uses intrusion detection systems to monitor Internet traffic to and from federal computer networks to prevent malicious computer code from reaching the networks. According to DHS' Privacy Impact Assessment for Einstein 2 (available on the DHS Cybersecurity privacy Web site, <i> http://www.dhs.gov/files/publications/editorial_0514.shtm#4</i>), only PII that is directly related to a malicious code security incident is captured and accessible to DHS, and DHS does not access any captured PII; however, accessibility alone may constitute a disclosure under the Privacy Act.
</p> <p>The system may also disclose PII data for any of the uses authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)- (11).
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Registration and training records will be retrieved by registrant/user name, email address, or User ID number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>Access to the records in the Think Cultural Health database will be limited to agency contractors, consultants, or HHS grantees who have been engaged by the agency to assist in accomplishment of an HHS function utilizing password security, encryption, firewalls and secured operating system.</p>
</xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Information about newsletter recipients will be maintained until requested to be removed by the individual on whom the information is maintained. Information about training registrants will be maintained for a minimum of six years after the contract is no longer funded.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Guadalupe Pacheco, Senior Health Advisor to the Director, Office of Minority Health, 1101 Wootton Parkway, Suite 600, Rockville, MD 20852.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Individuals wishing to know if this system contains records about them should write to the System Manager and include the email address used for registration.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Individuals seeking access to records about them in this system should follow the same instructions indicated under " Notification Procedure" and indicate the record(s) to which access is sought (e.g., newsletter registration, E-learning registration, or training record).
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Individuals seeking to contest the content of information about them in this system should follow the same instructions indicated under "Notification Procedure." The request should reasonably identify the record, specify the information contested, state the corrective action sought, and provide the reasons for the correction, with supporting justification.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>All information will be collected directly from the Web site registrants/users themselves when they complete one or more than one of the following information collection forms:
</p><p>&#149; Center for Linguistic and Cultural Competency in Health Care (CLCCHC) Registration Form
</p><p>&#149; A Physician's Practical Guide to Culturally Competent Care Registration Form
</p><p>&#149; Culturally Competent Nursing Care: A Cornerstone of Caring Registration Form
</p><p>&#149; Cultural Competency Curriculum for Disaster Preparedness and Crisis Response Registration Form
</p><p>&#149; Health Care Language Services Implementation Guide Registration Form
</p></xhtmlContent></subsection>
 <subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-90-1401" toc="yes">
 <systemNumber>09-90-1401</systemNumber>
<subsection type="systemName">Records About Restricted Dataset Requesters.

</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified </p>

</xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>Electronic files are maintained at the following server locations:</p>
<p>AHRQ: Social &amp; Scientific Systems Data Center, Ashburn, Virginia</p>
<p>CMS:  CMS Data Center, Baltimore, Maryland</p>
<p>SAMHSA: Substance Abuse and Mental Health Data Archive, Rockville, Maryland </p>
<p>Hard-copy files are maintained at the System Manager locations; see "System Manager(s)" section below.</p>

</xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>Individuals within and outside HHS who request restricted datasets and software products that HHS makes proactively available to qualified members of the public, usually for health-related scientific research and study purposes.  Examples include individual researchers and records custodians, project officers, or other representatives of entities such as universities, government agencies, and research organizations. </p>
</xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>Categories of records include:</p>
<p>1. Request records, containing the requester"s name and contact information (telephone number, mailing address, email address), affiliated entity (e.g., if making the request as a records custodian or other employee), and a description of the dataset requested. </p>
<p>2. Order fulfillment records, containing user registration information such as email address and IP address (if the requester is provided access to the dataset electronically through a public access web portal or link) or mailing information (if the dataset is mailed to the requester on a disk or other media), and tracking information (providing proof of delivery). </p>
<p>3. Data use restriction records, containing the requester"s identification, contact, and affiliated entity information, qualifications, intended use of the data (e.g., study name, contract number), confidentiality training documentation (e.g., a coded number indicating the individual completed required confidentiality training), signed and notarized data use agreement documents (e.g., Affidavit of Nondisclosure; Declaration of Nondisclosure; Confidential Data Use and Nondisclosure Agreement (CDUNA); Individual Designations of Agent; DUA number and expiration date), tracking information, and any on-site inspection information. </p>
<p>4. Payment records (if a fee is charged), consisting of the requester"s credit card account name, number, and billing address, or bank routing number and checking account name, address, and number.</p>

</xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>AHRQ: 42 USC 299-299a; 42 USC 299c-2</p>
<p>CMS: 5 USC 552a(e)(10); 45 CFR 164.514(e); 44 USC 3544; 42 USC 1306</p>
<p>SAMHDA: 42 USC 290aa(d)(1); 44 USC 3501(8)</p>
<p>See also: CIPSEA, codified at 44 USC 3501 note.
</p>
</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>The purposes of this system of records is to provide restricted datasets and software products to qualified data requesters in a timely and efficient manner and consistent with applicable laws, and to enable HHS to enforce data requesters" compliance with use and security restrictions that apply to the data.  Relevant HHS personnel use the records on a need-to-know basis for those purposes; specifically:</p>
<p>Contact and user registration information is used to communicate with the requester, enable the requester to access requested data electronically (for example, the requester"s email address would be used to register the requester to use a public access web portal or link, and to notify the requester when data has been delivered electronically to his registered account), locate the requester (e.g., for on-site inspections or to otherwise check compliance with the data use agreement), and deliver and track data provided by mail (e.g., to document receipt for enforcement purposes and report lost shipments to security personnel). </p>
<p>Qualifications, planned use of the data, confidentiality training information, signed data use agreement, data receipt information, on-site inspection information, and information about data breaches or contract violations is used to grant the request (consistent with data use restrictions) or deny the request, bind the requester to the applicable data use restrictions and other security requirements, conduct on-site inspections or otherwise check the requester"s compliance with the data use agreement, enforce the agreement if breached, and share information about data breaches and contract violations with other HHS components administering restricted dataset requests involving the same requesters.</p>
<p>Payment information is used to collect any applicable fee.  Any payment information shared with HHS accounting and debt collection systems is also covered under the accounting and debt collection systems" SORNs and is subject to the routine uses published in those SORNs (see, e.g., United Financial Management System, SORN #09-90-0024; and Debt Management and Collection System, SORN #09-40-0012).</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>Information about an individual data requester may be disclosed to parties outside HHS without the individual"s prior, written consent pursuant to the following routine uses:  </p>
<p>1. Disclosures may be made to federal agencies and Department contractors that have been engaged by HHS to assist in accomplishment of an HHS function relating to the purposes of this system of records and that have a need to have access to the records in order to assist HHS in performing the activity.  Any contractor will be required to comply with the requirements of the Privacy Act. </p>
<p>2. Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions relating to the purposes of this system of records for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions. </p>
<p>3. CMS records may be disclosed to a CMS contractor (including but not limited to Medicare Administrative Contractors, fiscal intermediaries, and carriers) that assists in the administration of a CMS-administered health benefits program, or to a grantee of a CMS-administered grant program, when disclosure is deemed reasonably necessary by CMS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste, or abuse in such program.</p>
<p>4. Records may be disclosed to another federal agency or an instrumentality of any governmental jurisdiction within or under the control of the United States (including any state or local governmental agency) that administers federally funded programs, or that has the authority to investigate, potential fraud, waste or abuse in federally funded programs, when disclosure is deemed reasonably necessary by HHS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy or otherwise combat fraud, waste or abuse in such programs. </p>
<p>5. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate public authority, whether federal, foreign, state, local, tribal, or otherwise, responsible for enforcing, investigating or prosecuting the violation or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to the enforcement, regulatory, investigative, or prosecutorial responsibility of the receiving entity.</p>
<p>6. Information may be disclosed to the U.S. Department of Justice (DOJ) or to a court or other tribunal, when:</p>
<p>the agency or any component thereof, or</p>
<p>any employee of the agency in his or her official capacity, or </p>
<p>any employee of the agency in his or her individual capacity where DOJ has agreed to represent the employee, or</p>
<p>the United States Government,</p>
<p>is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that, therefore, the use of such records by the DOJ, court or other tribunal is deemed by HHS to be compatible with the purpose for which the agency collected the records.</p>
<p>7. Records may be disclosed to a federal, foreign, state, local, tribal, or other public authority of the fact that this system of records contains information relevant to the hiring or retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant or other benefit.  The other agency or licensing organization may then make a request supported by the written consent of the individual for further information if it so chooses.  HHS will not make an initial disclosure unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another federal agency for criminal, civil, administrative, personnel, or regulatory action.</p>
<p>8. Information may be disclosed to a Member of Congress or Congressional staff member in response to a written inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.  The Congressional office does not have any greater authority to obtain records than the individual would have if requesting the records directly. </p>
<p>9. Records may be disclosed to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents. </p>
<p>10. Disclosures may be made to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department"s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary to that assistance.</p>
<p>Information about an individual data requester may also be disclosed from this system of records to parties outside HHS without the individual"s consent for any of the uses authorized directly in the Privacy Act at 5 USC 552a(b)(2) and (b)(4)-(11).  </p>
</xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>

<p>Storage:</p>
<p>Records are stored in electronic databases and hard-copy files.  DADSS, and its successors", records may also be stored on portable media. </p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent>
<p>Records are retrieved by the data requester"s name, registrant/user name, User ID number, or data use agreement (DUA) number.
</p>
</xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent>
<p>Records are safeguarded in accordance with applicable laws, rules and policies, including the HHS Information Technology Security Program Handbook, all pertinent National Institutes of Standards and Technology (NIST) publications, and OMB Circular A-130, Management of Federal Resources.  Records are protected from unauthorized access through appropriate administrative, physical, and technical safeguards.  Safeguards conform to the HHS Information Security and Privacy Program, </p>
<p>http://www.hhs.gov/ocio/securityprivacy/.  The safeguards include protecting the facilities where records are stored or accessed with security guards, badges and cameras, securing hard-copy records in locked file cabinets, file rooms or offices during off-duty hours, limiting access to electronic databases to authorized users based on roles and the principle of least privilege, and two-factor authentication (user ID and password), using a secured operating system protected by encryption, firewalls, and intrusion detection systems, using an SSL connection for secure encrypted transmissions, requiring encryption for records stored on removable media, and training personnel in Privacy Act and information security requirements.</p>

</xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>Records needed to enforce data use restrictions are retained for 20 years by AHRQ (see DAA-0510-2013-0003-0001) and 5 years by CMS (see N1-440-10-04) after the agreement is closed, and may be kept longer if necessary for enforcement, audit, legal, or other purposes.  The equivalent SAMHSA records will be retained indefinitely until a disposition schedule is approved by the National Archives and Records Administration (NARA).  SAMHSA anticipates proposing a 5 year retention period to NARA.</p>
<p>Records of payments made electronically are transmitted securely to a Payment Card Industry-compliant payment gateway for processing and are not stored.  Records of payments made by check, purchase order, or wire transfer are disposed of once the funds have been received.</p>
<p>Records are disposed of using destruction methods prescribed by NIST SP 800-88.</p>


</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>AHRQ:  HCUP Project Officer, Center for Delivery, Organization, and Markets, 540 Gaither Road, Rockville, MD 20850; Telephone: 301-427-1410; HCUP@AHRQ.GOV. </p>
<p>CMS:  DADSS and its successor, Division of Data and Information Dissemination, Data Development and Services Group, Office of Enterprise Data and Analytics, Centers for Medicare &amp; Medicaid Services, 7500 Security Boulevard, Mailstop: B2-29-04, Office Location: B2-03-37, Baltimore, MD 21244-1870. </p>
<p>SAMHSA:  SAMHDA Project Officer, CBHSQ, 1 Choke Cherry Road, Rockville, MD 20857.
</p>
</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>An individual who wishes to know if this system of records contains records about him or her should submit a written request to the relevant System Manager at the address indicated above.  The individual must verify his or her identity by providing either a notarized request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act, subject to a five thousand dollar fine.</p>

</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Same as notification procedure.  </p>

</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>An individual seeking to amend the content of information about him or her in this system should contact the relevant System Manager and reasonably identify the record, specify the information contested, state the corrective action sought, and provide the reasons for the amendment, with supporting justification. 
</p>
</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>Information in this system of records is obtained directly from the individual data requester to whom it applies, or is derived from information supplied by the individual or provided by HHS officials.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.</p></xhtmlContent></subsection></section> 

<section id="09-90-1402" toc="yes">
<systemNumber>09-25-1402</systemNumber>
<subsection type="systemName">HHS Payroll Records, HHS/OS.

</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified </p>

</xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>Civilian payroll records locations: </p>
<p>Defense Finance and Accounting Service (DFAS) and records storage facility at Rock Island, IL.  For more information contact HHS/Customer Care Services, 8455 Colesville Rd., Silver Spring, MD  20910</p>
<p>Retirement records: Federal Retirement Records Center, Boyers, PA</p>
<p>Records are also maintained by timekeepers and payroll liaisons.  Contact HHS/Customer Care Services for specific locations.</p>
<p>Commissioned Corps payroll records locations: </p>
<p>PHS/Office of the Assistant Secretary for Health (OASH)/Office of the Surgeon General (OSG)/Division of Commissioned Corps Personnel and Readiness (DCCPR)/ Assignments and Career Management Branch (ACMB)/Compensation Team, Silver Spring, MD</p>
<p>U.S. Coast Guard COMDT, Washington, DC</p>
<p>Commissioned corps payroll records are kept at the addresses shown above when the person to whom the record pertains has an active relationship with the PHS commissioned corps personnel system.  When an officer ceases the active relationship with the commissioned corps, the payroll records are combined with the Official Personnel Folder (OPF) covered in SORN 09-40-0001, "PHS Commissioned Corps General Personnel Records, HHS/PSC/ESS" and transferred to the appropriate facility as outlined in that SORN.</p>

</xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>The system collects and maintains records about HHS personnel (current and former civilian employees, and current and former PHS Commissioned Corps employees); current and former applicants for employment with HHS; and HHS employees’ dependents, survivors, beneficiaries, and current and former spouses.</p>

</xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>The system includes the following categories of records containing personally identifiable information (PII).   PII data elements include: name, email and telephone contact information, Social Security Number, date of birth, work and home addresses, pay plan and grade, dates and hours worked, dates, hours or amounts of leave accrued, used, awarded or donated, travel benefits and allowances and educational allowances (including educational allowances for dependents of commissioned corps personnel), certifications and licenses affecting pay, personnel orders, special positions (e.g., hazardous duty) affecting pay, bank account information, and amounts withheld and allotted for income tax, insurance, retirement, Thrift Saving Plan, flexible spending account, voluntary leave transfers, charitable contributions, garnishments, and other purposes.   </p>
<p>1. Documents related to pay, including forms used to process payroll deductions, leave, allotments, charitable contributions and garnishments; documentation of dependent status used to determine entitlement to or eligibility for benefits; debt collection documents; survivor benefit elections and pay records; worksheets, internal forms, internal memoranda and other documents which result in, or contribute, to a pay-related action.</p>
<p>2. Special pay files, containing special pay contracts, personnel orders and supporting documentation concerning special pay; worksheets, internal forms, internal memoranda and other documents which result in, or contribute, to a pay-related action.</p>
<p>3. Retirement pay files, containing personnel orders and supporting documentation concerning retirement pay; worksheets, internal forms, internal memoranda and other documents which result in, or contribute to, a pay-related action.</p>
<p>4. Correspondence relating to the above.</p>

</xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>5 USC Chapter 55—Pay Administration and Chapter 63—Leave; the Public Health Service Act (42 USC 202-217, 218a, and other pertinent sections); the Social Security Act (42 USC 410(m)); portions of Title 10, USC, related to the uniformed services; portions of Title 37, USC, related to pay and allowance for members of the uniformed services; portions of Title 38, USC, related to benefits administered by the Department of Veterans Affairs; sections of 50 USC App., related to the selective service obligations and the Soldiers’ and Sailors’ Civil Relief Act; Executive Order (EO) 9397, as amended, "Numbering System for Federal Accounts Relating to Individual Persons"; and EO 11140, as amended, which delegates the authority to administer the PHS Commissioned Corps from the President to the Secretary, HHS.</p>

</xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>HHS uses relevant information about individuals from this system on a need to know basis to: </p>
<p>Determine the individual’s eligibility for pay, allowances, entitlements, privileges, and benefits, and ensure that the individual receives proper pay and allowances, that proper deductions and authorized allowances are made from the individual’s pay, and that the individual is credited and charged with the proper amount of sick and annual leave.</p>
<p>Determine eligibility or entitlements of the individual’s dependents and beneficiaries for benefits based on the individual’s service records.</p>
<p>Give legal force to personnel transactions and establish the individual’s rights and obligations under the pertinent laws and regulations governing the applicable personnel system (civilian or commissioned corps).</p>
<p>With the individual’s consent, provide information to the HHS Voluntary Leave Transfer Program for Department-wide announcements.</p>
<p>Produce management reports, summary descriptive statistics, and analytical studies in support of the functions for which the records are collected and maintained and for related personnel management functions compatible with the intent for which the record system was created.</p>
<p>Provide information to HHS’ Debt Management and Collection System to collect a delinquent debt owed to the federal government, but only to the extent necessary to document and collect the delinquent debt.</p>
<p>Provide information to HHS components (the Office of Child Support Enforcement (OCSE) within the Administration for Children and Families) and HHS systems (the National Directory of New Hires (NDNH) and the Federal Parent Locator System (FPLS)), for use in locating individuals and identifying their income sources to establish paternity, to establish and modify orders of support and for enforcement actions in accordance with 42 USC 653.</p>
<p>Provide information to OCSE to share with the Social Security Administration for purposes of verifying Social Security Numbers used in operating FPLS.</p>
<p>Provide information to OCSE to release to the Department of the Treasury for purposes of administering 26 USC 32 (earned income tax credit), administering 26 USC 3507 (advance payment of earned income tax credit), and verifying a claim with respect to employment in a tax return. </p>
<p>Upon the request of the individual, provide information to organizations and companies administering charitable contribution payments, labor organization dues payments, and benefit plan payments (e.g., savings plans, insurance plans, flexible spending account plans) to effect the individual’s payments through payroll deductions, to administer the individual’s accounts, loans and loan repayments, and to adjudicate any related claims.</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>Relevant information about an individual may be disclosed from this system of records to the following parties outside HHS, without the individual’s prior, written consent, for the following routine uses:  </p>
<p>1. To federal agencies and Department contractors that have been engaged by HHS to assist in accomplishment of an HHS function relating to the purposes of the system (i.e., providing payroll services) and that need to have access to the records in order to assist HHS.  Any contractor will be required to comply with the requirements of the Privacy Act of 1974 and maintain safeguards with respect to such records.  These safeguards are explained in the "Safeguards" section.    </p>
<p>2. To authorized officials in federal agencies where commissioned officers are assigned, for purposes described in the "Purpose(s) of the System" section.   </p>
<p>3. To financial institutions, organizations and companies administering charitable contribution payments, labor organization dues payments (applicable to civilian personnel only), and benefit plan payments and reimbursements (e.g., under savings plans, insurance plans, flexible spending account plans) to effect an individual’s direct deposits, payroll deductions, and other transactions, to administer the individual’s plan accounts, loans and loan repayments, and to adjudicate any related claims.  </p>
<p>4. To the U.S. Department of the Treasury which performs federal payment and tax collection activities and needs information such as name, home address, Social Security Number, earned income amount, withholding status, and amount of taxes withheld, for purposes such as processing W-2 forms submitted to the Internal Revenue Service; issuing salary, retired pay and annuity checks or electronic payments; issuing U.S. savings bonds; recording income information; offsetting salary and other federal payments to collect delinquent federal debt owed by the individual; and collecting income taxes.     </p>
<p>5. To state and local government agencies having taxing authority, which need pertinent records relating to employees, retirees, and annuitants, such as name, home address, Social Security Number, earned income amount, and amount of taxes withheld, when these agencies have entered into tax withholding agreements with the Secretary of Treasury, but only to those state and local taxing authorities for which an employee, retiree, or annuitant is or was subject to tax, regardless of whether tax is or was withheld.  </p>
<p>6. To the Social Security Administration, which requires pertinent records relating to employees, retirees, and annuitants, including name, home address, Social Security Number, earned income amount, and amount of taxes withheld to administer the Social Security program.  </p>
<p>7. To respond to interrogatories in the prosecution of a divorce action or settlement for purposes stated in 10 USC 1408 (The Former Spouses Protection Act) pertaining to commissioned corps personnel.  </p>
<p>8. To disclose information about the entitlements and benefits of a beneficiary of a deceased employee, retiree or annuitant for the purpose of making disposition of the decedent’s estate.</p>
<p>9. To the U.S. Department of Justice (DOJ) or to a court or other tribunal when:</p>
<p>a. the agency or any component thereof; or</p>
<p>b. any employee of the agency in his or her official capacity, or</p>
<p>c. any employee of the agency in his or her individual capacity where DOJ has agreed to represent the employee, or</p>
<p>d. the United States Government,</p>
<p>is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that, therefore, the use of such records by the DOJ, court or other tribunal is deemed by HHS to be compatible with the purpose for which the agency collected the records.</p>
<p>1. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate public authority, whether federal, foreign, state, local, tribal, or otherwise, responsible for enforcing, investigating or prosecuting the violation or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to the enforcement, regulatory, investigative or prosecutorial responsibility of the receiving entity.   </p>
<p>2. To a Member of Congress or to a Congressional staff member in response to a written inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.  The Member of Congress does not have any greater authority to obtain records than the individual would have if requesting the records directly. </p>
<p>3. To the Office of Management and Budget (OMB) at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19, or for budgetary or management oversight purposes. </p>
<p>4. To a federal, foreign, state, local, tribal or other public authority of the fact that this system of records contains information relevant to the hiring or retention of an employee, the issuance or retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant or other benefit.  The other agency or licensing organization may then make a request supported by the written consent of the individual for further information if it so chooses.  HHS will not make an initial disclosure unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another federal agency for criminal, civil, administrative, personnel, or regulatory action.  </p>
<p>5. To thrift and savings institutions to conduct analytical studies of benefits being paid under such programs, provided such disclosure is consistent with the purpose for which the information was originally collected.   </p>
<p>6. To relevant agencies for the purpose of conducting computer matching programs designed to reduce fraud, waste and abuse in federal, state and local public assistance programs and operations.  </p>
<p>7. To the Equal Employment Opportunity Commission when requested in connection with investigations into alleged or possible discrimination practices in the federal sector, examination of federal affirmative employment programs, or other functions vested in the Commission. </p>
<p>8. To the Office of Personnel Management, to the extent it requires information to carry out its role as the oversight agency responsible for promoting the effectiveness of civilian personnel management and ensuring compliance with civilian personnel laws and regulations, if the information is relevant and necessary for that purpose. </p>
<p>9. To the Merit Systems Protection Board (including its Office of the Special Counsel) if relevant and necessary for its oversight responsibility, to protect the integrity of federal merit systems and the rights of federal civilian employees working in the systems.  </p>
<p>10. To the Federal Labor Relations Authority (including the General Counsel of the Authority and the Federal Service Impasses Panel) if relevant and necessary for its oversight of the federal service labor-management relations program, pertaining to civilian employees.</p>
<p>11. To a labor organization recognized under EO 11491 or 5 USC Chapter 71, when a contract between a component of the Department and the labor organization provides that the agency will disclose civilian personnel records when relevant and necessary to the labor organization’s duties of exclusive representation concerning civilian personnel policies, practices, and matters affecting working conditions.  </p>
<p>12. To the Department of Labor to make a compensation determination in connection with a claim filed by a civilian employee for worker’s compensation on account of a job-connected injury or disease.  </p>
<p>13. To state officers of unemployment compensation in connection with claims filed by former HHS civilian employees for unemployment compensation.  </p>
<p>14. To the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents. </p>
<p>15. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.</p>
<p>Information about an individual may also be disclosed to parties outside the agency without the individual’s prior, written consent for any of the uses authorized directly in the Privacy Act at 5 USC 552a(b)(2) and (b)(4)-(11).  Note:  The following requirements apply to a disclosure to another federal agency pursuant to 5 USC 552a(b)(7) (i.e., in response to a written request from the head of that agency for a civil or criminal law enforcement activity authorized by law, specifying the particular portion desired and the law enforcement activity for which the record is sought): the request must be connected with the agency’s auditing and investigative functions designed to reduce fraud, waste and abuse; it must be based on information that raises questions about an individual’s eligibility for benefits or payments; and it must be made reasonably soon after the information is received.</p>
</xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p>
<p>Automated files are stored on secured electronic storage applications, disks, electronic medium and magnetic tapes. Non-automated (hard-copy) files are kept in offices, and may be stored in shelves, safes, cabinets, bookcases or desks.</p></xhtmlContent></subsection>
    <subsection type="retrievability">
        <xhtmlContent>
            <p>Civilian payroll records: Records are retrieved by pay period and name and/or Social Security Number and timekeeper number within each pay period.</p>
            <p>Commissioned corps payroll records:  Records are retrieved by name, by PHS serial number, by Direct AccessEmplId and/or by Social Security Number.</p>
        </xhtmlContent>
    </subsection>
<subsection type="safeguards"><xhtmlContent>
<p>Safeguards conform to the HHS Information Security and Privacy Program, http://www.hhs.gov/ocio/securityprivacy/index.html.</p>
<p><i>1. Authorized Users</i></p>
<p>Automated Records. Access to and use of automated records is limited to: (1) authorized personnel within HHS  who perform payroll and personnel office functions, and authorized personnel of any contractors or federal agencies assisting HHS with those functions; (2) authorized officials in offices where commissioned officers are assigned—at HHS and at other federal agencies—whose official duties require such access; and (3) authorized personnel in other federal agencies, such as the U.S. Treasury with respect to federal payment and tax collection activities, acting on behalf of HHS for payroll-related activities.  </p>
<p>Non-automated records. Access to and use of non-automated records is limited to HHS employees whose official duties require such access or to parties outside HHS who need access to the information for purposes stated under routine uses. These individuals are permitted access to records only after they have satisfactorily identified themselves as having an official need to review the information and have provided satisfactory proof of their identities. Access is also granted to individuals who have permission to review the record when that permission has been obtained in writing and in advance from the individual to whom the record pertains. All individuals from outside the Department, to whom disclosure is made pursuant to a routine use, must complete Privacy Act nondisclosure oaths and must submit written requests for access to these records showing the name and employing office of the requester, the date on which the record is requested, and the purpose for reviewing the information in the records. This written request is then placed into the record.</p>

<p><i>2. Physical safeguards</i></p>
<p>Automated records. Terminals by which automated records are accessed are kept in offices secured with locks. Automated records on magnetic tape, disks and other computer equipment are kept in rooms designed to protect the physical integrity of the records media and equipment. These rooms are within inner offices to which access is permitted only with special clearance.  The data is encrypted using NIST-approved encryption methods.  Outer offices are secured with locks. During non-work hours, all cabinets, storage facilities, rooms and offices are locked and the premises are patrolled regularly by building security forces.</p>
<p>Non-automated records. Non-automated records are kept in such a way as to prevent observation by unauthorized individuals while the records are actively in use by an authorized employee. When records are not in use, they are closed and secured in desk drawers with locks, filing cabinets with locks, or other security equipment, all of which are kept inside authorized office space which is locked whenever it is not in use. Keys to furniture and equipment are kept only by the individual who is assigned to that furniture or equipment and by security officers.</p>

<p><i>3. Procedural safeguards</i></p>
<p>Automated records. Automated records are secured by assigning individual access codes to authorized personnel, and by the use of passwords for specific records created by authorized personnel. Access codes and passwords are changed on a random schedule. In addition, programming for automated record allows authorized personnel to access only those records that are essential to their duties. Remote access to automated data from remote terminals is restricted to a limited number of HHS personnel, HHS contractor personnel, and personnel at other federal agencies engaged by HHS who perform payroll and personnel office functions; similar personnel at other federal agencies where commissioned officers are assigned; and personnel at federal agencies (such as U.S. Treasury) that act on behalf of HHS for payroll-related activities.  No access is permitted to organizations that do not have automated personnel record-keeping systems that comply with Privacy Act requirements.</p>
<p>Non-automated records. All files are secured when employees are absent from the premises and are further protected by locks on entry ways and by the building security force. Official records may not be removed; when records are needed at a remote location, copies of the records are provided. When copying records for authorized purposes, care is taken to ensure that any imperfect or extra copies are not left in the copier room where they can be read, but are destroyed or obliterated.</p>

<p><i>4. Contractor Guidelines</i></p>
<p>A contractor given records under routine use 1 must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent any unauthorized persons from gaining access to the records, and return the records to the System Manager immediately upon completion of the work specified in the contract. Contractor compliance is assured though inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records are instructed to make no disclosure of the records except as authorized by the System Manager and stated in the contract.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent>
<p>Civilian payroll records:  Records are retained and disposed of in accordance with General Records Schedule 2 (GRS 2), "Payrolling and Pay Administration Records," which prescribes retention periods ranging from as short as a few months or years to as long as 56 years.  When an employee is separated, leave records are incorporated into the Official Personnel File (OPF) maintained by the servicing personnel office (SPO), and payroll retirement information is transferred to the Federal Retirement Records Center in Boyers, Pennsylvania.  The OPF is forwarded to the new employing agency by the SPO.  These procedures are in accordance with U.S. Office of Personnel Management policies and procedures.</p>
<p>Commissioned corps payroll records:  When an officer is separated, records are incorporated into the OPF and transferred to a Federal Records Center in accordance with 09-40-0001, "PHS Commissioned Corps General Personnel Records, HHS/ OS" procedures.  When an officer retires from the commissioned corps, a retirement payment file is generated and maintained in Compensation.  When the officer and/or annuitant dies, the file is retained in Compensation for 3 years, then is incorporated into the OPF and transferred to a Federal Records Center in accordance with 09-40-0001, "PHS Commissioned Corps General Personnel Records, HHS/PSC/HRS" procedures.</p>
<p>Destruction methods:  Records that are eligible for destruction are securely disposed of using destruction methods prescribed by NIST SP 800-88. </p>

</xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p><i>System Manager for civilian payroll records:</i>  DFAS.  For more information, contact HHS/Customer Care Services, 8455 Colesville Rd., Silver Spring, MD  </p>
<p><i>System Manager for commissioned corps payroll records:</i>  Director, OASH/OSG/Division of Systems Integration, Plaza Level, Suite 100, Tower Building, 1101 Wootton Parkway, Rockville, MD 20852.</p>

</xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>An individual who wishes to know if this system contains records about him or her should submit a written request to the applicable System Manager.  The request should include the full name of the individual, appropriate personal identification, and the individual’s current address.</p>

</xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Procedure for accessing civilian payroll records: </p>
<p>1. General procedures.  A subject individual, or parent, or legal guardian of an incompetent individual, who appears at a specific location seeking access to or disclosure of records relating to him/her may initially contact his/her agency personnel office or payroll liaison for information about obtaining access to the records.  Such individuals will be required to verify their identity to the satisfaction of the agency employee providing access.  Refusal to provide sufficient proof of identity will result in denial of the request for access until such time as proof of identity can be obtained.</p>
<p>2. Requests by mail.  Written requests must be addressed to the System Manager or the appropriate payroll liaison.  A comparison will be made of that signature and the signature maintained in a file prior to release of the material requested.  Copies of the records to which access has been requested will be mailed to the individual.</p>
<p>3. Requests by phone.  Because positive identification of the caller cannot be established with sufficient certainty, telephone requests for access to records will not be honored.</p>
<p>4. Accounting of disclosures.  An individual who is the subject of the records in this system may also request an accounting of all disclosures outside the Department, if any, that have been made from the individual’s records.  </p>
<p>Procedure for accessing commissioned corps payroll records:</p>
<p>1. General procedures. An individual (and/or the individual's legal representative) seeking access to his/her records may initially contact the DCCPR Privacy Act Coordinator for information about obtaining access to the records. Each individual seeking access will be required to verify his/her identity to the satisfaction of the DCCPR Privacy Act Coordinator. Refusal to provide sufficient proof of identity will result in denial of the request for access until such time as proof of identity can be obtained. The System Manager has authority to release records to authorized officials within DCCPR, HHS and other organizations where commissioned officers are assigned</p>
<p>2. Requests in person.  An individual who is the subject of a record and who appears in person seeking access shall provide his/her name and at least one piece of tangible identification (e.g., PHS Commissioned Corps Identification Card, driver's license or passport). Identification cards with current photograph are required. The records will be reviewed in the presence of an appropriate Compensation employee, who will answer questions and ensure that the individual neither removes nor inserts any material into the record without the knowledge of the Compensation employee. If the individual requests a copy of any records reviewed, the Compensation employee will provide them to the individual. The Compensation employee will record the name of the individual granted access, the date of access, and information about the verification of identity on a separate log sheet maintained in the office of the Privacy Act Coordinator, DCCPR.</p>
<p>3. Requests by mail.  Written requests must be addressed to the System Manager or the DCCPR Privacy Act Coordinator at the address shown as the System Location above. All written requests must be signed by the individual seeking access. A comparison will be made of that signature and the signature maintained on file prior to release of the material requested. Copies of the records to which access has been requested will be mailed to the individual. The original version of a record will not be released except in very unusual situations when only the original will satisfy the purpose of the request.</p>
<p>4. When an individual to whom a record pertains is mentally incompetent or under other legal disability, information in the individual's records may be disclosed to any person who is legally responsible for the care of the individual, to the extent necessary to assure payment of benefits to which the individual is entitled.</p>
<p>5. Requests by phone. Because positive identification of the caller cannot be established with sufficient certainty, telephone requests for access to records will not be honored.</p>
<p>6. Accounting of disclosures. An individual who is the subject of records maintained in this records system may also request an accounting of all disclosures outside the Department, if any, that have been made from that individual's records.</p>

</xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>An individual seeking to contest the content of information about him or her in this system should contact the applicable System Manager at the address specified under "System Manager" above and reasonably identify the record, specify the information contested, state the corrective action sought, and provide the reasons for the correction, with supporting justification.  </p>

</xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent>
<p>Information is obtained from individual personnel members (civilian employees and Public Health Service officers) and applicants, their dependents and former spouses, governmental and private training facilities, health professional licensing and credentialing organizations (e.g., organizations that verify license and credential information), government officials and employees, and from records contained in or transferred from predecessor payroll systems.</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>None.</p></xhtmlContent></subsection></section>

<section id="09-90-1501" toc="yes">
<systemNumber>09-90-1501</systemNumber>
<subsection type="systemName">Administrative Law Judge (ALJ) Working File, Office of Medicare Hearings and Appeals (OMHA).</subsection>
<subsection type="securityClassification"><xhtmlContent>
<p>Unclassified.</p></xhtmlContent></subsection>
<subsection type="systemLocation"><xhtmlContent>
<p>Records are maintained at OMHA headquarters and field offices.  Address information is available by accessing the OMHA website: http://www.hhs.gov/omha/.  Electronic records will be stored in a secured, FedRAMP-compliant, cloud service provider. Source documents will be destroyed once they are scanned and converted to electronic records.</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent>
<p>Records pertain to individuals involved in Medicare appeals adjudicated by OMHA, including Medicare beneficiaries or enrollees; physicians; providers; practitioners; suppliers; State Medicaid agencies; other individuals involved in furnishing items and services to health insurance beneficiaries or enrollees; and authorized or appointed representatives of such individuals.</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent>
<p>OMHA administers nationwide ALJ hearings for appeals of Medicare Part A and Part B claim determinations, Part C organization determinations, Part D coverage determinations that are made by CMS contractors, and appeals of Medicare entitlement and monthly premium determinations made by SSA. </p>
<p>OMHA establishes ALJ working files as a record of actions taken on each particular appeal. The file may contain copies of information from the administrative record, such as the request for hearing, hearing recording, notice of hearing, decision, and exhibit list, as well as copies of post-adjudicative material received and any responses made. Official copies of these materials are placed in the official agency record (case file). The ALJ working file also may contain deliberative working papers such as notes taken during the hearing by the ALJ; case analyses prepared by field office employees; attorney work product; working papers of field office staff; and other case developmental and decision-related notes and instructional sheets.  Information in these records that could pertain to individuals includes protected health information; Health Insurance Claim Number (HICN); Social Security Number (SSN); Provider Number, name, address, and other contact information; and billing, tax, and other financial information.   </p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent>
<p>Authority for maintenance of the system is given under § 205 of Title II, §§ 1155 and 1156 of Title XI, §§ 1812, 1814, 1816, 1842, 1869, and 1872 of Title XVIII of the Social Security Act (the Act), as amended (42 United States Code (U.S.C.) sections 405, 1320c–4, 1320c–5, 1395d, 1395f, 1395h, 1395u, 1395ff, and 1395ii). Additional authority for this system is given under Title IX, Subtitle D of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (Public Law (Pub. L.) 108–173). </p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>OMHA uses the records in this system of records to reference the actions OMHA takes in a particular case at the hearing level. For example, during the course of adjudication at the ALJ hearing level, ALJs and members of their staff often construct documents for internal purposes only regarding the evidence, testimony, legal theories, merits of the case, and opinions and advice regarding other factors involved in the case. </p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent>
<p>Relevant information about an individual may be disclosed from this system of records to parties outside HHS, without the individual’s prior, written consent, pursuant to these routine uses. </p>
<p><i>Note:</i> any information defined as "return or return information" under 26 U.S.C. § 6103 of the Internal Revenue Code (IRC) will not be disclosed unless authorized by the IRC, the Internal Revenue Service (IRS), or IRS regulations. </p>
<p>1. To a Member of Congress or to a Congressional staffer in response to a written inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.  The Member of Congress does not have any greater authority to obtain records than the individual would have if requesting the records directly. </p>
<p>2. To the Department of Justice (DOJ), a court or other tribunal, or another party before such tribunal, when:</p>
<p>(a)  HHS or any component thereof; or</p>
<p>(b) any HHS employee in his or her official capacity; or</p>
<p>(c) any HHS employee in his or her individual capacity where DOJ (or HHS where it is authorized to do so) has agreed to represent the employee; or </p>
<p>(d) the United States Government, is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that, therefore, the use of such records by DOJ, the court or other tribunal, or another party before such tribunal is deemed by HHS to be compatible with the purpose for which HHS collected the records.</p>
<p>1. To IRS, as necessary, for the purpose of auditing HHS’s compliance with safeguard provisions of the IRC, as amended.</p>
<p>2. To contractors and other federal agencies that have been engaged by HHS to assist in accomplishment of an HHS function relating to the purposes of the system of records and that have a need to have access to the records in order to assist HHS in performing the activity.  Any contractor will be required to comply with the requirements of the Privacy Act of 1974.</p>
<p>3. To the National Archives and Records Administration (NARA) in records inspections conducted under the authority of 44 U.S.C. § 2901 et seq.</p>
<p>4. To student volunteers and other workers performing functions for HHS but technically not having the status of agency employees, if they need access to the records in order to perform their assigned functions.</p>
<p>5. To federal, state, and local law enforcement agencies and private security contractors, as appropriate, if information is necessary   </p>
<p>(a) to enable them to protect the safety of HHS employees and customers, the security of the HHS workplace, and the operation of HHS facilities; or</p>
<p>(b) to assist investigations or prosecutions with respect to activities that affect such safety and security or activities that disrupt the operation of HHS facilities. </p>
<p>6. To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.</p>
    <p>Information about an individual may also be disclosed to parties outside HHS without the individual’s prior, written consent for any of the uses authorized directly in the Privacy Act at 5 U.S.C. § 552a(b)(2) and (b)(4)-(11).</p>
</xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent>
<p>Storage:</p><p>Records are maintained in electronic and paper form. Currently, OMHA headquarters and field offices keep ALJ working files in paper form. New technology will allow OMHA to store information electronically in the Electronic Case Adjudication and Processing Environment (ECAPE). As a result, records in this system may be paper and electronic.</p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent><p>Information is retrieved by name, Social Security Number (SSN), Health Insurance Claim Number (HICN), and assigned provider number or appeal number.</p></xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent><p>Only authorized OMHA personnel that have a need for the information in the performance of their official duties are permitted access to the information. </p>
<p>Security measures for electronic access include a minimum of a two-factor authentication solution (such as the use of a Personal Identity Verification (PIV) Card and Personal Identification Number (PIN)) to enter the computer system that will maintain the data, and storage of the computerized records in secured areas that are accessible only to employees who require the information in performing their official duties. Manually maintained records are kept in locked cabinets or in otherwise secure areas.</p>
<p>Personnel allowed access to the records have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system of records are instructed not to release data to an authorized recipient until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access. </p>
<p>This system will conform to all applicable federal laws and regulations and federal and HHS policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the Health Insurance Portability and Accountability Act of 1996; the E-Government Act of 2002, the Clinger-Cohen Act of 1996; the Medicare Modernization Act of 2003, and the corresponding implementing regulations. OMB Circular A–130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal and HHS policies and standards include but are not limited to: all pertinent National Institute of Standards and Technology publications; the HHS Information Systems Program Handbook and the CMS Information Security Handbook.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>OMHA will destroy electronic and paper records by deleting or shredding them 3 years after the final action is taken (see NARA-approved records schedule DAA-0468-2012-0003).</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent>
<p>Andrea Monson, Director, Division of Information Management and Systems, 1700 North Moore Street, Suite 1800, Arlington, VA 22209.</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent>
<p>An individual can determine if this system contains a record about him or her by making a written notification request to the System Manager, showing proof of identity, and providing the system name, the subject individual’s name, HICN, address, date of birth, and gender.  Furnishing the SSN is voluntary.    </p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>An individual can obtain access to a record about him or her by using the same procedures outlined in Notification Procedures above and specifying the record contents sought.</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent>
<p>The requesting individual should contact the System Manager named above, and reasonably identify the records and specify the information contested. In addition, the individual should state the corrective action sought and the reasons for the correction and provide supporting justification.</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent>
<p>Information in this system of records is obtained from individuals who complete a form requesting a Medicare hearing or appeal, from CMS and its contractors, and from SSA.</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent>
<p>This system of records is not a type of system eligible to be exempted from certain Privacy Act requirements under subsections (j) and (k) of the Privacy Act (5 U.S.C. § 552a(j)(k)); however, to the extent that records contained in the ALJ working files constitute material compiled in reasonable anticipation of a civil action or proceeding, they will be exempt from the Privacy Act’s access requirement under 5 U.S.C. § 552a(d)(5).</p></xhtmlContent></subsection></section>

        <section id="09-90-1601" toc="yes">
            <systemNumber>09-90-1601</systemNumber>
            <subsection type="systemName">
                Outside Experts Recruited for Non-FACA Activities
            </subsection>
            <subsection type="securityClassification">
                <xhtmlContent>
                    <p>
                        Unclassified.
                    </p>
                    </xhtmlContent> </subsection>
            <subsection type="systemLocation">
                <xhtmlContent>
                    <p>Physical locations include:</p>
                    <p>&#8226; CDC program offices that recruit consultants to assist in statistical projects and reporting programs conducted or sponsored by NCHS, in Atlanta, GA and Hyattsville, MD;</p>
                    <p>&#8226; FDA’s committee management office in Silver Spring, MD;</p>
                    <p>&#8226; Program offices at ACF in Washington, DC, at HRSA in Rockville, MD, and at SAMHSA in Rockville, MD, that recruit individuals to serve as peer reviewers; and</p>
                    <p>&#8226; Locations of SAMHSA contractors that arrange use of consultants on SAMHSA projects.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfIndividuals">
                <xhtmlContent>
                    <p>Records in this system pertain to individuals outside the HHS workforce who serve or are considered for service on HHS mission-related committees or other assignments that require specific outside expertise or experience (for example, medical, scientific, or manufacturing expertise, or patient advocacy experience), but that are not subject to the Federal Advisory Committee Act (FACA), 5 U.S.C. App., et seq.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="categoriesOfRecords">
                <xhtmlContent>
                    <p>The records consist of recruitment and other administrative records, including:</p>
                    <p>&#8226; An application and resume or curricula vitae, describing the individual’s qualifications;</p>
                    <p>&#8226; Nomination/recommendation records, or other records used in evaluating an individual’s qualifications and any potential conflicts of interest and selecting an individual for a specific assignment; and</p>
                    <p>&#8226; Records used to plan and arrange the individual’s participation in the assigned activities, including scheduling records and records used to coordinate parking, badging, and payment of any stipend or honorarium.</p>
                    <p>The records may contain these data elements:</p>
                    <p>&#8226; The individual’s name and other identifying information (e.g., sex, place and date of birth);</p>
                    <p>&#8226; Contact information (e.g., home and business addresses, telephone numbers, email addresses);</p>
                    <p>&#8226; Occupation, job titles, employers, employment status and history, and whether currently employed by the federal government;</p>
                    <p>&#8226; Work and organizational affiliations, memberships, credentials, and licenses;</p>
                    <p>&#8226; Degrees held, and general educational and/or experience background;</p>
                    <p>&#8226; Racial classification or ethnic background;</p>
                    <p>&#8226; Areas of specialization, expertise, or experience, and special qualifications (e.g., language or technical skills, ability to drive to an assignment);</p>
                    <p>&#8226; Dates and descriptions of past assignments or past experience;</p>
                    <p>&#8226; Sources and references, and any information provided by sources/references; and</p>
                    <p>&#8226; Information about availability and any special needs.</p>
                    <p>Any special needs, medical condition, or similar information contained in an individual’s records is maintained and used in accordance with relevant provisions of the Rehabilitation Act of 1973, as amended, 29 USC 791 et seq., and implementing regulations at 29 CFR parts 1614 and 1630, and the Genetic Information Nondiscrimination Act of 2008 at 42 USC 2000ff et seq.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="authorityForMaintenance">
                <xhtmlContent>
                    <p>For FDA Patient Representative Records: 21 U.S.C. 360bbb-8c, 371 et seq., 379d-1(b)(1)(A)</p>
                    <p>For ACF Peer Reviewer Records: 42 U.S.C. 799(f), 806(e)</p>
                    <p>For HRSA Peer Reviewer Records: 42 U.S.C. 799(f), 806(e)</p>
                    <p>For SAMHSA Peer Reviewer and Other Consultant Records: 42 U.S.C. 241, 249(c), 290aa et seq., 290aa-5, 290bb et seq., 290bb-21 et seq., 290bb-31 et seq., 5121 et seq., 10801 et seq.; 8 U.S.C. 1522 note; Executive Order 12341</p>
                    <p>See also: 5 USC 3109</p>
                </xhtmlContent>
            </subsection>
            <subsection type="purpose">
                <xhtmlContent>
                    <p>The records will be used within the agency on a need-to-know basis for the purpose of staffing committees and other assignments and managing administrative matters pertaining to individuals serving on committees and other assignments, including to:</p>
                    <p>&#8226; Prepare reports and lists of past, present, and recommended members, vacancies, acceptances, and separations;</p>
                    <p>&#8226; Send recruitment notices to individual prospective candidates, and send informational notices to selectees;</p>
                    <p>&#8226; Identify qualified candidates and document the selections; and</p>
                    <p>&#8226; Manage and coordinate the selected individuals’ participation in assignment activities (including sharing information within the agency to coordinate aspects such as badging, parking, travel, training, and payment of any stipend or honorarium).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="routineUsesOfRecords">
                <xhtmlContent>
                    <p>In addition to the statutory disclosures of information permitted in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(11), HHS may make the following disclosures of information about an individual from this system of records to parties outside the agency without the individual’s prior, written consent:</p>
                    <p>1. Disclosures may be made to federal agencies and Department contractors that have been engaged by HHS to assist in accomplishment of an HHS function relating to the purposes of this system of records and that have a need to have access to the records in order to assist HHS in performing the activity.  Any contractor will be required to comply with the requirements of the Privacy Act.</p>
                    <p>2. Records may be disclosed to parties such as educational institutions, current and former employers, and qualified experts, when necessary to check or obtain an opinion about a candidate’s qualifications.</p>
                    <p>3. Records about consultants and patient advocates may be disclosed to parties organizing or hosting assignment activities, such as grantee institutions and federal, foreign, state, tribal, local, and other government agencies and public authorities (e.g., U.S. Embassies and Ministries of Health), when necessary to apprise them of an individual’s qualifications for the assignment or coordinate the individual’s participation in the activities.</p>
                    <p>4. Records may be disclosed to supervisors and administrative assistants at the individual’s place of employment, for administrative purposes such as coordinating the individual’s participation in the activities.</p>
                    <p>5. Records may be disclosed to external parties that audit committee or assignment activities.</p>
                    <p>6. Relevant information will be included in any required reports to the President, the Office of Management and Budget (OMB), and the General Services Administration (GSA) about committees and other assignments that are mission-related.</p>
                    <p>7. Information may be disclosed to the U.S. Department of Justice (DOJ) or to a court or other tribunal, when:</p>
                    <p>a. The agency or any component thereof, or</p>
                    <p>b. Any employee of the agency in his or her official capacity, or</p>
                    <p>c. Any employee of the agency in his or her individual capacity where DOJ has agreed to represent the employee, or</p>
                    <p>d. The United States Government, is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that, therefore, the use of such records by the DOJ, court or other tribunal is deemed by HHS to be compatible with the purpose for which the agency collected the records.</p>
                    <p>8. Records may be disclosed to student volunteers and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.</p>
                    <p>9. Disclosures may be made to the National Archives and Records Administration (NARA) and/or the General Services Administration (GSA) for the purpose of records management inspections conducted under 44 U.S.C. 2904 and 2906.</p>
                    <p>10. Information may be disclosed to a Member of Congress or a Congressional staff member in response to a written inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.  The Congressional office does not have any greater authority to obtain records than the individual would have if requesting the records directly.</p>
                    <p>11. Records may be disclosed to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.</p>
                    <p>12. Disclosures may be made to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary to that assistance.</p>
                       </xhtmlContent>
        </subsection>
            <subsection type="policiesAndPractices">
                <xhtmlContent>
                    <p>Storage:</p>
                    <p>
                        Records are stored in hard-copy files and electronic media.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="retrievability">
                <xhtmlContent>
                    <p>Records are retrieved by the individual’s name.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="safeguards">
                <xhtmlContent>
                    <p>Safeguards conform to the HHS Information Security and Privacy Program, http://www.hhs.gov/ocio/securityprivacy/index.html.  Information is safeguarded in accordance with applicable laws, rules and policies, including the HHS Information Technology Security Program Handbook, all pertinent National Institutes of Standards and Technology (NIST) publications, and OMB Circular A-130, Management of Federal Resources.  Records are protected from unauthorized access through appropriate administrative, physical, and technical safeguards.  These safeguards include protecting the facilities where records are stored or accessed with security guards, badges and cameras, securing hard-copy records in locked file cabinets, file rooms or offices during off-duty hours, limiting access to electronic databases to authorized users based on roles and two-factor authentication (user ID and password), using a secured operating system protected by encryption, firewalls, and intrusion detection systems, requiring encryption for records stored on removable media, and training personnel in Privacy Act and information security requirements.  Records that are eligible for destruction are disposed of using destruction methods prescribed by NIST SP 800-88.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="retentionAndDisposal">
                <xhtmlContent>
                    <p>Records pertaining to recruitment and use of outside peer reviewers are destroyed three years after final action; they are retained longer if required for business use (see General Records Schedule (GRS) 1.2, Item 010, Grant and Cooperative Agreement Program Management Records).  Records pertaining to recruitment and use of other outside individuals (e.g., experts, patient advocates, and members of mission-related non-FACA committees) are currently unscheduled.  Unscheduled records must be retained indefinitely pending the agency’s submission, and NARA’s approval, of a disposition schedule.  HHS anticipates proposing to NARA, as an appropriate retention period for these records, "three years after final action, or longer if required for business use" (similar to the period provided in GRS 1.2, Item 010) or "when no longer needed for administrative purposes" (similar to the periods applicable to similar records not retrieved by personal identifier which are not covered under this SORN; i.e.: N1-442-93-1, Item 37 for the Agency for Toxic Substances and Disease Registry’s Curriculum Vitae Files, and NC1-235-82-1, Item 100-3 for the Office of the Secretary’s Advisory Committee Candidate Resume Files).</p>
                </xhtmlContent>
            </subsection>
            <subsection type="systemManager">
                <xhtmlContent>
                    <p>For CDC/NCHS Consultant Records:</p>
                    <p>&#8226; Centers for Disease Control and Prevention (CDC), Director, National Center for Health Statistics, OPHSS, Prince George’s Metro IV Bldg., Rm. 7209,  MS P08, Centers for Disease Control and Prevention, 3311 Toledo Road, Hyattsville, MD 20782</p>
                    <p>For FDA Patient Representative Records:</p>
                    <p>&#8226; Food and Drug Administration (FDA), Advisory Committee Oversight &amp; Management Staff, 10903 New Hampshire Avenue, Bldg. WO32, Rm. 5129, Silver Spring, MD 20993-002</p>
                    <p>For ACF Peer Reviewer Records:</p>
                    <p>&#8226; Administration for Children and Families (ACF), Privacy Act Contact, Office of Information Systems, 330 C Street, N.W., Washington, DC 20201                    </p>
                    <p>For HRSA Peer Reviewer Records:</p>
                    <p>&#8226; Health Resources and Services Administration (HRSA), Chief, Policy, Analysis &amp; Training Branch, Division of Independent Review, Office of Federal Assistance Management, 5600 Fishers Lane, Rockville, MD 20857                        </p>
                    <p>For SAMHSA Peer Reviewer Records:           </p>
                    <p>&#8226; Substance Abuse and Mental Health Services Administration (SAMHSA), Director, Division of Grant Review, 5600 Fishers lane, Rockville, MD 20852</p>
                    <p>For Other Consultant Records, Maintained by SAMHSA Contractors:</p>
                    <p>&#8226; Substance Abuse and Mental Health Services Administration (SAMHSA), Director, Division of Contracts Management, Office of Program Services, 5600 Fishers Lane, Rockville, MD 20852</p>
                </xhtmlContent>
            </subsection>
            <subsection type="notificationProcedure">
                <xhtmlContent>
                    <p>An individual who wishes to know if this system contains records about him or her should submit a written request to the relevant System Manager indicated above.  The individual must verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act, subject to a five thousand dollar fine.</p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordAccessProcedures">
                <xhtmlContent>
                    <p>An individual seeking access to records about him in this system should submit a request following the same procedure indicated under "Notification Procedure."</p>
                </xhtmlContent>
            </subsection>
            <subsection type="contestingRecordProcedures">
                <xhtmlContent>
                    <p>An individual seeking to amend the content of information about him or her in this system should contact the relevant System Manager indicated above and reasonably identify the record, specify the information contested, state the corrective action sought, and provide the reasons for the amendment, with supporting justification. </p>
                </xhtmlContent>
            </subsection>
            <subsection type="recordSourceCategories">
                <xhtmlContent>
                    <p>
                        Most information is obtained directly from the individual record subject.  Information pertaining to references and recommendations is obtained from other private individuals, educational institutions, current and former employers, HHS program personnel, biographical reference books, private organizations, Members of Congress, and other government sources.
                    </p>
                </xhtmlContent>
            </subsection>
            <subsection type="exemptionsClaimed">
                <xhtmlContent>
                    <p>None. </p>
                </xhtmlContent>
            </subsection>
        </section>


        <section id="09-90-9999" toc="yes">
<systemNumber>09-90-9999</systemNumber>
<subsection type="systemName"> Automated Litigation Tracking System, HHS/OS/OGC.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>The database and software for this computerized system will be located at the Parklawn Computer Center (part of the Public Health Service) located at 5600 Fishers Lane, Rockville, Maryland 20857.
</p> <p>Each OGC location identified in the Appendix on the Administrative Claims System (09-90-0062) Federal Register, Wednesday, October 13, 1982 (47 FR 45540-45542) will have access to the database and software via one or more CRT terminals.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The individuals on whom records are maintained in this system are: (1) Individuals who are involved in litigation with the Department or the United States (regarding matters within the jurisdiction of the Department) either as plaintiffs or as defendants in both civil and criminal matters, (2) individuals who either file administrative compliants with the Department or are the subjects of administrative complaints initiated by the Department, including claims which are the subjects of records maintained in the Administrative Claims System, 09 -90-0062, (3) individuals who are named parties in cases in which the Department believes it will or may become involved, and (4) OGC attorneys to whom cases are assigned.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The records contain information to identify: (1) The cases and legal actions that the Department either is involved in or in which it believes it will or may become involved, (2) the people involved in each case, (3) where within the government the case has been assigned, (4) what the status of the case is, including the key events that may have occurred, and (5) the legal and programmatic issues of the case.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The authority for maintaining this system are the various statutes, regulations, rules or orders pertaining to the subject matter of the litigation, administrative complaint or adverse personnel action, (e.g., Public Health Service Act; Social Security Act; Civil Rights Act; Federal Food, Drug and Cosmetic Act; Federal Tort Claims Act, 28 U.S.C. 2671-2680, 1346(b); Waiver of Overpayment of Pay Act, 5 U.S.C 5584; Military Personnel and Civilian Employees Claims Act, 31 U.S.C. 240-243; Federal Claims Collection Act, 31 U.S.C. 951-953; and Federal Medical Care Recovery Act, 42 U.S.C. 2651-2653).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To enable the Office of the General Counsel to: (1) More efficiently and effectively use its resources in court and administrative proceedings, (2) provide a research tool that will permit attorneys to identify when and where similar litigation has occurred, and (3) enable management to better balance the attorney workload.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Records are used in communicating with, among others, Federal, State, and local law enforcement agencies, private individuals, private and public hospitals, allegedly negligent parties, private attorneys, insurance companies, the United States Attorney and other Federal officials and agencies, individual law enforcement officers, and tribal officials. These communications are all for the purpose of investigating, settling, or denying claims and subsequent litigation action.
</p> <p>Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
</p> <p>In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>In the event that a system of records maintained by this agency to carry outs its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system or records may referred, as a routing use to the appropriate agency, whether Federal, state, local, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto.
</p> <p>In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p> <p>A record from this system of records may be disclosed as a "routine use" to a Federal, state or local agency maintaining civil, criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant to an agency decision concerning the hiring or retention of an employee, the issurance of a security clearance, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>A record from this system of records may be disclosed to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>A record from this system of records may be disclosed to the Department of Justice or other appropriate Federal agencies in defending claims against the United States when the claim is based upon an individual's mental or physical condition and is alleged to have arisen because of activities of the Public Health Service in connection with such individual.
</p> <p>A record from this system of records may be disclosed to any Federal, state or local agency where the Department deems that the information is needed for any aspect of administering a Federal, state, or local program.
</p> <p>Records from this system may be disclosed to a private firm under contract to the Department for the purpose of having that firm convert the records to machine readable form, or collate, analyze, aggregate or otherwise refine the information in the records. The contractor will be required to maintain Privacy Act safeguards with respect to such records.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Information will be stored on a variety of computer-readable, electronic media, including disc, mass storage, and magnetic tape.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The records in this system will be indexed by the court's docket number for the litigation and will be retrievable by any information contained in the record, including by: The name of either party, the Social Security Number (only for records on cases involving claims against one or more programs administered by the Social Security Administration or the Health Care Financing Administration), the name of the attorney assigned the case, and the legal or programmatic issues involved.
</p> <p>Only OGC staff will be permitted to retrieve information from this system.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>The buildings where these records are stored on electronic media are safeguarded by a variety of physical security systems which permit access only by authorized computer center personnel and authorized visitors escorted by computer center staff.
</p> <p>The computer terminals used to access the records are kept in rooms which are locked at the close of the business day and are generally accessible only to General Counsel personnel.
</p> <p>Electronically, the records are protected from unauthorized access by several password oriented systems which produce an audit trail of all attempts (successful and unsuccessful) to access the records. In general, this system complies with all security guidelines published by the Department (Part 6, ADP Systems Manual), which embodies the guidance presented by the National Bureau of Standards in the Federal Information Processing Standards.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are maintained until the litigation or other judicial proceedings have ended and for varying periods of time thereafter, subject to the Federal Records Act and applicable retention schedules.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>The agency official responsible for the system policies and practices outlined above is: The General Counsel, Department of Health and Human Services, Office of the General Counsel, Hubert H. Humphrey Building, Room 722A, 200 Independence Avenue, SW, Washington, DC 20201.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Any inquiries regarding these systems of records should be addressed to the System Manager. An individual who requests notification of or access to a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. Access will not be provided to materials compiled by the Department for litigation purposes, such as information about briefs and recommendations to appeal or not to appeal, except when such access is granted by the court as a result of discovery or due process.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official designated in the section, "System Manager(s) and address", above; reasonably identify the record and specify the information that is to be contested; and state the corrective action sought and your reasons for requesting the correction, with supporting evidence to show why the record is not accurate, timely, complete, relevant or necessary.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The information for this system is obtained through a number of sources including the exchange of legal pleadings, documents, formal and informal discovery, program offices and component agencies, private attorneys, State and local governments, their agencies and instrumentalities, and officers of other Federal agencies and the individuals involved.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-40-0001" toc="yes">
<systemNumber>09-40-0001</systemNumber>
<subsection type="systemName">Public Health Service (PHS) Commissioned Corps General Personnel Records, HHS/PSC/HRS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Division of Commissioned Personnel (DCP)/HRS/PSC, Room 4-36, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857 -0001.
</p> <p>PHS Health Data Center, GW Long Hansen's Disease Center, Carville, Louisiana 70721.
</p> <p>National Personnel Record Center, Civilian Personnel Records, 111 Winnebago Street, St. Louis, Missouri 63118.
</p> <p>Duplicates of records may also be maintained in operating offices (duty stations) of the Department and other agencies and organizations to which PHS Commissioned Corps officers are assigned. Contact the System Manager for the location of specific records.
</p> <p>Contact the Rockville, Maryland location before writing to other record sites.
</p> <p>Names and addresses of contractors given information under routine use 7 can be obtained from the System Manager at the location identified below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who are part of or who have some relationship with the PHS Commissioned Corps, including: Active duty commissioned officers, former commissioned officers, inactive reserve officers, retired commissioned officers, deceased commissioned officers, dependents and survivors of the above, former spouses of officers, and applicants to the PHS Commissioned Corps.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>These records contain:
</p><p>1. Applications for appointment, references and other documents relating to qualifications or suitability for appointment and assignment.
</p> <p>2. Official Personnel Folders (OPF), for all officers who are, or were at one time, on active duty, which include: All documents related to the application and appointment process; effectiveness reports; career development and training records; documents relating to assignment, promotion, retention, separation and all other personnel actions; records of personnel actions relating to pay, travel and allowances (including overseas educational allowances for dependents); documentation of dependent status used to determine entitlement or eligibility for benefits and identification and privilege cards; applications and records of service action relating to the Commissioned Officer Student Training and Extern Programs (COSTEP) officers; survivor benefit elections; information supporting officer awards, honors and commendations; documentation supporting non-board terminations and reprimands issued after final administrative action; pay records and medical data after death of subject individual; and leave records.
</p> <p>3. Worksheets, internal forms, internal memoranda and other documents which result in, or contribute to, an action resulting in a record identified in 2. above.
</p> <p>4. Service Record cards (summarizing personnel actions).
</p> <p>5. Correspondence relating to the above.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The Public Health Service Act (42 United States Code [U.S.C.] 202-217, 218a, 224, 228, 233, and other pertinent sections); The Social Security Act (42 U.S.C. 410(m) et seq.); portions of Title 10, U.S.C., related to the uniformed services; portions of the Title 37, U.S.C., related to pay and allowance for members of the uniformed services; portions of Title 38, U.S.C., related to benefits administered by the Department of Veterans Affairs; sections of 50 U.S.C. App., related to the selective service obligations and the Soldiers' and Sailors' Civil Relief Act; Executive Order (E.O.) 9397, "Numbering System for Federal Accounts Relating to Individual Persons"; E.O. 10450, "Security Requirements for Government Employment"; and E.O. 11140, which delegates the authority to administer the PHS Commissioned Corps from the President to the Secretary, HHS.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The information is used by the Program Support Center (PSC), DCP, HHS Operating Divisions (OPDIVs) and other organizations where commissioned officers are assigned, to:
</p><p>1. Determine qualifications and suitability for appointment, selection, career development, training, promotions, assignments, mobilization, temporary duty, and other types of officer utilization.
</p> <p>2. Determine eligibility for pay, allowances, entitlements, privileges, and benefits.
</p> <p>3. Prepare the Commissioned Officer Roster and Promotion Seniority of the Public Health Service.
</p> <p>4. Determine the eligibility or entitlements of dependents and beneficiaries for benefits based on the service of a PHS commissioned officer.
</p> <p>5. Give legal force to personnel transactions and establish officer rights and obligations under the pertinent laws and regulations governing the commissioned corps personnel system.
</p> <p>6. Provide material for research by the Office of the Secretary, HHS, concerning the activities of health professionals.
</p> <p>7. Provide information to HHS components seeking to collect an overdue debt to the Federal Government, but only to the extent necessary to collect that overdue debt.</p>
<p>8. Provide information about professional qualifications, past performance and career interests of PHS officers to Department and Agency officials involved in the selection or assignment of an officer to a particular program.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These records or information from these records may be used:
</p><p>1. To locate individuals for personnel research or survey response, and in the production of summary descriptive statistics and analytical studies in support of the function for which the records are collected and maintained, or for related work force studies. While published statistics and studies do not contain individual identifiers, in some instances the selection of elements of data included in the study may be structured in such a way as to make the data individually identifiable by inference.
</p> <p>2. To disclose information to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>3. To the Department of Justice, a court or other tribunal, when: (a) HHS, or any component, thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records are collected.
</p> <p>4. To disclose pertinent information to appropriate Federal, State, or local agencies; international agencies; or foreign governments responsible for investigating, prosecuting, enforcing or implementing statutes, rules, regulations or orders when PHS becomes aware of evidence of a potential violation of civil or criminal law.
</p> <p>5. To disclose information to an individual who has been asked to provide a reference, to the extent necessary to clearly identify the individual to whom the reference will pertain, inform the source of the purpose(s) of the reference, and to identify the type of information requested from the source, where necessary to obtain information relevant to an agency decision concerning the hiring or retention of any employee, the issuance of a security clearance, the conducting of a security or suitability investigation of an individual, the classifying of jobs, the letting of a contract, or the issuance of a license, grant or other benefit.
</p> <p>6. To disclose to any agency in the executive, legislative or judicial branch; the District of Columbia Government; a State or local government agency; a professional credentialing agency or a non-profit institution, in response to its request, or at the initiation of the PHS, information in connection with the hiring of an employee; the issuance of a license, grant or other benefit by the requesting agency; or the lawful statutory administrative, or investigative purpose of the agency to the extent that the information is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>7. When the Department contemplates contracting with a private firm for the purpose of collating, analyzing, aggregating, or otherwise refining records in this system, relevant records will be disclosed to such a contractor. The contractor will be required to maintain Privacy Act safeguards with respect to such records. These safeguards are explained in the section entitled "Safeguards."
</p><p>8. To disclose information to the Department of State and officials of foreign governments for the issuance of passports, visas and other clearances before an active, retired or inactive officer is assigned to that country.
</p> <p>9. To disclose information to the Department of Labor, the Department of Veterans Affairs, Social Security Administration or other Federal agencies having special employee benefit programs; to a Federal, State, county or municipal agency; or to a publicly recognized charitable organization when necessary to adjudicate a claim under a benefit program, or to conduct analytical studies of benefits being paid under such programs, provided such disclosure is consistent with the purposes for which the information was originally collected.
</p> <p>10. To disclose information to the Office of Management and Budget (OMB) at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19, or for budgetary or management oversight purposes.</p>
<p>11. To respond to interrogatories in the prosecution of a divorce action or settlement for purposes stated in 10 U.S.C. 1408 ("The Former Spouses' Protection Act").
</p> <p>12. To disclose information about the entitlements and benefits of a beneficiary of a deceased officer, retiree, or annuitant for the purpose of making disposition of the estate.
</p> <p>13. To disclose information to the Department of Defense, United States Coast Guard or Federal Emergency Management Agency, to the extent necessary to facilitate participation of PHS employees in planning, training, and emergency operations in support of civil defense activities and to provide support in the event of a national emergency.
</p> <p>14. To disclose information to Government training facilities (Federal State, and local) and to non-Government training facilities (e.g., private vendors of training courses or programs, private schools), for training purposes such as crediting of work experience in the COSTEP, or verification of status or income.
</p> <p>15. To disclose information to the Defense Enrollment/Eligibility Reporting System, uniformed services medical treatment facilities and to the Department of Defense, Office of the Civilian Health and Medical Program of the Uniformed Services when the information is needed to verify the eligibility of an officer, his/her dependents, or a former spouse for medical benefits.
</p> <p>16. To disclose information to agencies or organizations established in medically underserved areas which apply to the National Health Service Corps for the assignment of commissioned officers to such agencies or organizations.
</p> <p>17. To disclose information to an officer assigned to Federal health care facilities or private sector (i.e., other than Federal, State, or local government) agencies, boards or commissions (e.g., the Joint Commission on Accreditation of Healthcare Organizations), to obtain accreditation or other approval rating but only to the extent that the information disclosed is relevant and necessary for that purpose.
</p> <p>18. To disclose to a private employer who is considering hiring a former officer information such as the officer's dates of employment, salary, job title and description, duty station and character and nature of separation.
</p> <p>19. To disclose information to the Equal Employment Opportunity Commission when requested in connection with investigations into alleged or possible discrimination practices in the Federal sector, examination of Federal affirmative employment programs, or other functions vested in the Commission by the President's Reorganization Plan No. 1 of 1978.
</p> <p>20. To disclose to Federal and non-Federal agencies information allowing the consideration and selection of officers for honor awards made as a result of the individual's work as a commissioned officer, and to publicize those awards granted. This may include disclosure to other public and private organizations, including the news media, which grant or publicize officer awards and honors.
</p> <p>21. To disclose information to officials of the Selective Service System to allow crediting of active service performed by an individual with PHS so that the individual may be properly classified if draft laws once again become operative.
</p> <p>22. To disclose administrative and personnel information, including data elements reflected in the Officer Information Summary, to authorized officials in Federal agencies and other programs where commissioned officers are assigned such as the State Department; the Department of Defense; the Department of Justice, Bureau of Prisons and the Immigration and Naturalization Service; the Transportation Department, United States Coast Guard; the Environmental Protection Agency; the Department of the Interior, the United States Park Service; and the Commerce Department, National Oceanic and Atmospheric Administration.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Automated files are stored on disks, microfiche, electronic medium and magnetic tapes. Nonautomated (hard-copy) files are kept in offices, and may be stored in Lektrievers, safes, cabinets, bookcases or desks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Alphabetically by name, by PHS serial number and/or by Social Security Number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users
</p><p>(a) Automated Records. Access to and use of automated records is limited to: (1) Personnel employed in the PSC and the Office of the Surgeon General (OSG)/OS, (2) personnel employed in DCP, (3) authorized officials in HHS components and organizations where commissioned officers are assigned whose official duties require such access, and (4) authorized officials in other Federal agencies, such as those in routine use 22 above, where commissioned officers are assigned whose official duties require such access. Automated data is provided to Department personnel officials to update information contained in their personnel records and pay, leave and attendance systems. The Human Resources Service (HRS) provides computer design, programming and support to DCP, and has access to the data to the extent necessary to facilitate the provision of these services to DCP. However, HRS personnel are not authorized to grant access to or make disclosures from automated data in this system to anyone or any organization without the written approval of the Director of DCP or to an official to whom this authority has been delegated.</p>
<p>b. Nonautomated records. Access to and use of nonautomated records is limited to departmental employees whose official duties require such access or to individuals needing access to the information for purposes stated under routine uses. These individuals are permitted access to records only after they have satisfactorily identified themselves as having an official need to review the information and have provided satisfactory proof of their identities. Access is also granted to individuals who have written permission to review the record when that permission has been obtained from the individual to whom the record pertains. All individuals from outside the Department, to whom disclosure is made pursuant to a routine use, must complete Privacy Act nondisclosure oaths and must submit written requests for access to these records showing the name and employing office of the requester, the date on which the record is requested and the purpose for reviewing the information in the records. This written request is then placed into the record.
</p> <p>2. Physical safeguards
</p><p>a. Automated records. Terminals by which automated records are accessed are kept in offices secured with locks. Automated records on magnetic tape, disks and other computer equipment are kept in rooms designed to protect the physical integrity of the records media and equipment. These rooms are within inner offices to which access is permitted only with special clearance. Outer offices are secured with locks. During nonwork hours, all cabinets, storage facilities, rooms and offices are locked and the premises are patrolled regularly by building security forces.
</p> <p>b. Nonautomated records. Nonautomated records are kept in such a way as to prevent observation by unauthorized individuals while the records are actively in use by an authorized employee. When records are not in use, they are closed and secured in desk drawers with locks, filing cabinets with locks, or other security equipment, all of which are kept inside authorized office space which is locked whenever it is not in use. Keys to furniture and equipment are kept only by the individual who is assigned to that furniture or equipment and by the DCP security officer.
</p> <p>3. Procedural safeguards
</p><p>a. Automated records. Automated records are secured by assigning individual access codes to authorized personnel, and by the use of passwords for specific records created by authorized personnel. Access codes and passwords are changed on a random schedule. In addition, programming for automated records allows authorized personnel to access only those records that are essential to their duties. Remote access to automated data from remote terminals is restricted to the PSC, OSG and personnel officials where commissioned officers are employed. No access is permitted to organizations that do not have automated personnel record-keeping systems that comply with Privacy Act requirements.
</p> <p>b. Nonautomated records. All files are secured when employees are absent from the premises and are further protected by locks on entry ways and by the building security force. Official records may not be removed from the physical boundaries of DCP. When records are needed at a remote location, copies of the records will be provided. When copying records for authorized purposes, care is taken to ensure that any imperfect or extra copies are not left in the copier room where they can be read, but are destroyed or obliterated.
</p> <p>4. Contractor Guidelines. A contractor who is given records under routine use 7 must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent unauthorized persons from gaining access to the records, and return the records to the System Manager immediately upon completion of the work specified in the contract. Contractor compliance is assured though inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records are instructed to make no disclosure of the records except as authorized by the System Manager and as stated in the contract.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>These records are maintained for varying periods of time. Applicant files of individuals selected for appointment as commissioned officers become a part of the OPF. Applicant files of individuals not selected for appointment are maintained for one year after the application process has been completed and are then destroyed, unless an applicant requests that the file be held open for an additional year. The OPF is maintained for one year after an officer is separated from active duty, at which time such officer's OPF is transferred to a Federal Records Center for permanent storage. The OPF for inactive reserve officers is maintained at the PHS Health Data Center. When inactive officers change status, the OPF is returned to DCP.
</p> <p>The records of a deceased officer are maintained until one year after an individual's death and are then transferred to a Federal Record Center for permanent storage, unless a dependent of a deceased officer continues to receive benefits from PHS based upon the deceased's PHS service. When a dependent or beneficiary dies or becomes ineligible for further benefits based on a deceased officer's service, all records are maintained for one year in the event information is needed from the records to help settle an estate, and are then transferred to the Federal Records Center for permanent storage.
</p> <p>Service Records Cards, which list critical data with regard to the dates or all officers' appointments, reassignments, separations, retirements and deaths, are maintained permanently by the System Manager.</p>
</xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, DCP/HRS/PSC, Room 4A-15, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857-0001.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Same as Access Procedures. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>1. General procedures. An individual (and/or the individual's legal representative) seeking access to his/her records may contact the DCP Privacy Act Coordinator for information about obtaining access to the records. Each individual seeking access will be required to verify his/her identity to the satisfaction of the DCP Privacy Act Coordinator. Refusal to provide sufficient proof of identity will result in denial of the request for access until such time as proof of identity can be obtained. The System Manager has authority to release records to authorized officials within DCP, HHS and other organizations where commissioned officers are assigned.
</p> <p>2. Requests in person. An individual who is the subject of a record and who appears in person seeking access shall provide his/her name and at least one piece of tangible identification (e.g., PHS Commissioned Corps Identification Card, driver's license or passport). Identification cards with current photograph are required. The records will be reviewed in the presence of an appropriate DCP employee who will answer questions and ensure that the individual neither removes nor inserts any material into the record without the knowledge of the DCP employee. If the individual requests a copy of any records reviewed, the DCP employee will provide them to the individual. The DCP employee will record the name of the individual granted access, the date of access, and information about the verification of identity on a separate log sheet maintained in the office of the Privacy Act Coordinator, DCP.
</p> <p>3. Requests by mail. Written requests must be addressed to the System Manager or the DCP Privacy Act Coordinator at the address shown as the system location above. All written requests must be signed by the individual seeking access. A comparison will be made of that signature and the signature maintained on file prior to release of the material requested. Copies of the records to which access has been requested will be mailed to the individual. The original version of a record will not be released except in very unusual situations when only the original will satisfy the purpose of the request.
</p> <p>4. When an individual to whom a record pertains is mentally incompetent or under other legal disability, information in the individual's records may be disclosed to any person who is legally responsible for the care of the individual, to the extent necessary to assure payment of benefits to which the individual is entitled.
</p> <p>5. Requests by phone. Because positive identification of the caller cannot be established with sufficient certainty, telephone requests for access to records will not be honored.
</p> <p>6. Accounting of disclosures. An individual who is the subject of records maintained in this records system may also request an accounting of all disclosures made outside the Department, if any, that have been made from that individual's records.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address specified under System Location above and reasonably identify the record. Specify the information being contested. State the corrective action sought, with supporting justification, along with information to show how the record is inaccurate, incomplete, untimely or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>From individual officers, applicants, persons providing references, dependents, former spouses of officers, governmental and private training facilities, health professional licensing and credentialing organizations, government officials and employees and from the records contained in the following systems: 09-40-0002, Public Health Service (PHS) Commissioned Corps Medical Records, HHS/PSC/HRS; 09 -40-0003, Public Health Service (PHS) Commissioned Corps Board Proceedings, HHS/PSC/HRS; 09-40-0004, Public Health Service (PHS) Commissioned Corps Grievance, Investigatory and Disciplinary Files, HHS/PSC/HRS; 09-40-0005, Public Health Service (PHS) Commissioned Corps Beneficiary-Contract Medical/Health Care Records, HHS/PSC/HRS; and 09-40-0006, Public Health Service (PHS) Commissioned Corps Payroll Records, HHS/PSC/HRS.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-40-0002" toc="yes">
<systemNumber>09-40-0002</systemNumber>
<subsection type="systemName">Public Health Service (PHS) Commissioned Corps Medical Records, HHS/PSC/HRS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Medical Affairs Branch (MAB), DCP/HRS/PSC, Room 4C-14, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857- 0001.
</p> <p>Records in this system are kept at the address shown above when the person to whom the record pertains has an active relationship with the PHS Commissioned Corps personnel system. When an officer ceases the active relationship with the commissioned corps, the records are combined with the Official Personnel Folder (OPF) in records system 09-40-0001, Public Health Service (PHS) Commissioned Corps General Personnel Records, HHS/PSC/HRS, and transferred to the appropriate facility as outlined in 09-40-0001.
</p> <p>Duplicates of records may also be maintained in operating offices (duty stations) of the Department and other agencies and organizations to which PHS Commissioned Corps officers are assigned. Contact the System Manager for the location of specific records.
</p> <p>Names and addresses of contractors given information under routine use 4 can be obtained from the System Manager at the location identified below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>PHS commissioned officers (including active, inactive, terminated, retired and deceased officers), applicants to the commissioned corps, and dependents of officers seeking Defense Enrollment/Eligibility Reporting System eligibility on the basis of incapacity.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Medical files and records on individuals identified above; medical board records from Medical Review Boards and Appeals Boards, including board reports and supporting medical documentation; death case files and supporting documents; sick leave records; performance and behavior documentation of individuals as may relate to medical conditions; and correspondence relating to the above.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The Public Health Service Act (42 United States Code (U.S.C.) 202-217, 218a, 224, 228, 233, and other pertinent sections); The Social Security Act (42 U.S.C. 410(m) et seq.); portions of Title 10, U.S.C., related to the uniformed services; portions of the Title 37, U.S.C., related to pay and allowance for members of the uniformed services; portions of Title 38, U.S.C., related to benefits administered by the Department of Veterans Affairs; sections of 50 U.S.C. App., related to the selective service obligations and the Soldiers' and Sailors' Civil Relief Act; E.O. 9397, "Numbering System for Federal Accounts Relating to Individual Persons"; E.O. 10450, "Security Requirements for Government Employment"; and E.O. 11140, which delegates the authority to administer the PHS Commissioned Corps from the President to the Secretary, HHS.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The information is used by the Program Support Center (PSC), DCP, HHS Operating Divisions (OPDIVs) and other organizations where commissioned officers are assigned, to:
</p><p>1. Evaluate applicants for appointment and officers for reassignment, reactivation and fitness for duty and suitability for retention on active duty.
</p> <p>2. Make determinations about the level of an officer's disability and entitlement to disability severance or retired pay.
</p> <p>3. Make determinations regarding EEO complaints or grievances filed by the officer, if the nature of the complaint suggests that pertinent evidence may be located in the medical record.
</p> <p>4. Make determinations about the level of a dependent's disabilities or incapacities which may make the dependent eligible for benefits from PHS.
</p> <p>5. Make budgetary estimates about the cost of disability severance and retired pay.
</p> <p>6. Prepare reports or provide statistical information relating to the medical status of officers.
</p> <p>7. Initiate or support disciplinary or other adverse actions by the Director, DCP, against applicants or officers for misconduct.</p>
<p>8. Support monitoring of compliance of officers with the requirements of their professional licensing or certifying authorities.
</p> <p>9. Make decisions about funding, use, access, location and quality of medical care and promote continuity of medical evaluation and treatment.
</p> <p>10. Monitor officer compliance with recommended treatment and with commissioned corps policies regarding sick leave.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These records or information from these records may be used:
</p><p>1. To disclose information to the Department of Veterans Affairs; Bureau of Prisons (Department of Justice); Coast Guard (Department of Transportation); Department of State; Department of Defense; NOAA (Department of Commerce); Agency for International Development, Environmental Protection Agency and other Federal agencies or civilian health care providers where commissioned officers are assigned or are receiving medical treatment or voluntary or directed evaluations to ensure continuity of evaluation and/or treatment, to assure medically appropriate assignments and duty limitations, to support disciplinary or other adverse actions and to assure compliance with sick leave policies.
</p> <p>2. To disclose information to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>3. To promote continuity of care by supplying information to Government or civilian medical care facilities and/or practitioners who, under contract or as otherwise authorized or due to an emergency, provide treatment to officers and their dependents.
</p> <p>4. When the Department contemplates contracting with a private firm for the purpose of collating, analyzing, aggregating, or otherwise refining records in this system, relevant records will be disclosed to such a contractor. The contractor will be required to maintain Privacy Act safeguards with respect to such records. These safeguards are explained in the section entitled "Safeguards".
</p> <p>5. To the Department of Justice, a court or other tribunal, when: (a) HHS, or any component, thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records are collected.
</p> <p>6. To provide information relating to the disability or death of officers to the Social Security Administration to determine the Social Security benefits or other benefits which may be available to the officer or to the survivors of deceased officers.
</p> <p>7. To provide information to Federal agencies such as the Department of Veterans Affairs and State Workers' Compensation offices to help adjudicate post-service claims for benefits.
</p> <p>8. Information regarding the commission of crimes or the reporting of occurrences of communicable diseases, tumors, child abuse, births, deaths, alcohol or drug abuse, etc., may be disclosed as required by health providers and facilities by State law or regulation of the department of health or other agency of the State or its subdivision in which the facility is located. Disclosures will be made to organizations as specified by the State law or regulation, such as births and deaths to the vital statistics agency and crimes to law enforcement agencies. Disclosure of the contents of records which pertain to patient identity, diagnosis, prognosis, or treatment of alcohol or drug abuse is restricted under the provisions of the Confidentiality of Alcohol and Drug Abuse Patient Records Regulation 42 CFR part 2, as authorized by 21 U.S.C. 1175 and 42 U.S.C. 290dd.2, as amended by Pub. L. 98-24 and 102-321.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Automated files are stored on disks, microfiche and magnetic tapes. Nonautomated (hard-copy) files are kept in offices, and may be stored in Lektrievers, Conserve-a-files, safes, cabinets, bookcases or desks.</p>
</xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Alphabetically by name, by PHS serial number and/or by Social Security Number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users
</p><p>a. Automated Records. Access to and use of automated records is limited to personnel employed in the MAB and certain employees of the Office of the Director, DCP. Selected information may be released to employees in DCP whose official duties require such access. The Human Resources Service (HRS) provides computer design, programming and support to DCP, and has access to the data to the extent necessary to facilitate the provision of these services to DCP. However, HRS personnel are not authorized to grant access to or make disclosures from automated data in this system to anyone or any organization.
</p> <p>b. Nonautomated records. Access to and use of nonautomated records is limited to MAB, certain members of the Office of the Director, DCP, and departmental employees, such as EEO officials and members of Medical Review and Appeals Boards, whose official duties require such access to the information for purposes stated under routine uses or purposes. These individuals are permitted access to records only after they have satisfactorily identified themselves as having an official need to review the information and have provided satisfactory proof of their identities. Access is also granted to individuals who have written permission to review the record when that permission has been obtained from the individual to whom the record pertains. All individuals other than DCP employees must complete Privacy Act nondisclosure oaths and, except for Medical Board members, must submit written requests for access to these records showing the name and employing office of the requestor, the date on which the record is requested, and the purpose for reviewing the information in the record. This written request is then placed into the record.
</p> <p>2. Physical safeguards
</p><p>a. Automated records. Terminals by which automated records are accessed are kept in offices secured with locks. Automated records on magnetic tape, disks and other computer equipment are kept in rooms designed to protect the physical integrity of the records media and equipment. These rooms are within inner offices to which access is permitted only with special clearance. Outer offices are secured with locks. During nonwork hours, all cabinets, storage facilities, rooms and offices are locked and the premises are patrolled regularly by building security forces.
</p> <p>b. Nonautomated records. Nonautomated records are kept in such a way as to prevent observation by unauthorized individuals while the records are actively in use by an authorized employee. When records are not in use, they are closed and secured in desk drawers with locks, filing cabinets with locks, or other security equipment, all of which are kept inside authorized office space which is locked whenever it is not in use. Keys to furniture and equipment are kept only by the individual who is assigned to that furniture or equipment and by the DCP security officer.
</p> <p>3. Procedural safeguards
</p><p>a. Automated records. Automated records are secured by assigning individual access codes to authorized personnel, and by the use of passwords for specific records created by authorized personnel. Access codes and passwords are on a random schedule. In addition, programming for automated records allows authorized personnel to access only those records that are essential to their duties. Remote access to automated data from remote terminals is restricted to the PSC, Office of the Surgeon General and personnel officials where commissioned officers are employed. No access is permitted to automated records from remote terminal sites maintained by individuals or organizations outside of DCP.
</p> <p>b. Nonautomated records. All files are secured when employees are absent from the premises and are further protected by locks on entry ways and by the building security force. Official records may not be removed from the physical boundaries of MAB, DCP. When records are needed at a remote location, copies of the records will be provided. When copying records for authorized purposes, care is taken to ensure that any imperfect or extra copies are not left in the copier room where they can be read, but are destroyed or obliterated.
</p> <p>4. Contractor Guidelines. A contractor who is given records under routine use 4 must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent unauthorized persons from gaining access to the records, and return the records to the System Manager immediately upon completion of the work specified in the contract. Contractor compliance is assured though inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records are instructed to make no disclosure of the records except as authorized by the System Manager and as stated in the contract.</p>
</xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>When an officer terminates his/her commission, records are incorporated into the OPF and transferred to a Federal Records Center in accordance with 09-40-0001, Public Health Service (PHS) Commissioned Corps General Personnel Records, HHS/PSC/HRS, procedures. Medical records on nonselected applicants may be destroyed after two years. Records of retirees are incorporated into the OPF and disposed of in accordance with 09-40-0001, Public Health Service (PHS) Commissioned Corps General Personnel Records, HHS/PSC/HRS procedures, unless the individual is on the temporary disability retirement list, in which case the file is maintained under the same conditions as an active duty officer's file until the individual is permanently retired, returned to active duty or terminated. Medical records of a dependent incapable of self support are maintained until the dependent is no longer eligible for benefits from PHS at which time the records are transferred to a Federal Records Center for permanent storage.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, DCP/HRS/PSC, Room 4A-15, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857-0001.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Same as Access Procedures. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>1. General procedures. An individual (and/or the individual's legal representative) seeking access to his/her records may initially contact any DCP office or employee for information about obtaining access to the records. The DCP employees will inform each individual of the appropriate procedures to follow. Each individual seeking access will be required to verify his/her identity to the satisfaction of the DCP employee providing access. Refusal to provide sufficient proof of identity will result in denial of the request for access until such time as proof of identity can be obtained. The System Manager has authority to release automated records to the Medical Affairs Branch.
</p> <p>If a determination is made that the material sought contains medical information that is likely to have an adverse effect on the requester, the requester shall be asked to designate in writing a responsible representative who will be willing to review the record and inform the subject individual of the material's contents at the representative's discretion. Such a representative must provide proof that s/he is duly authorized to review the record by either the individual or the individual's legal guardian. A parent, guardian or legal representative who requests notification of, or access to, a dependent/incompetent person's record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify his/her relationship to the dependent/incompetent person as well as his/her own identity.
</p> <p>2. Requests in person. An individual who is the subject of a record and who appears in person seeking access shall provide his/her name and at least one piece of tangible identification (e.g., PHS Commissioned Corps Identification Card, driver's license or passport). Identification cards with current photograph are required. The records will be reviewed in the presence of an appropriate DCP employee, who will answer questions and ensure that the individual neither removes nor inserts any material into the record without the knowledge of the DCP employee. If the individual requests a copy of any records reviewed, the DCP employee will provide them to the individual. The DCP employee will record the name of the individual granted access, the date of access, and information about the verification of identity on a separate log sheet maintained in the office of the MAB, DCP.
</p> <p>3. Requests by mail. Written requests must be addressed to the System Manager or the Medical Affairs Branch at the address shown as the system location above. All written requests must be signed by the individual seeking access. A comparison will be made of that signature and the signature maintained on file prior to release of the material requested. Copies of the records to which access has been requested will be mailed to the individual. The original version of a record will not be released except in very unusual situations when only the original will satisfy the purpose of the request.
</p> <p>4. When an individual to whom a record pertains is mentally incompetent or under other legal disability, information in the individual's records may be disclosed to any person who is legally responsible for the care of the individual, to the extent necessary to assure payment of benefits to which the individual is entitled.
</p> <p>5. Requests by phone. Because positive identification of the caller cannot be established with sufficient certainty, telephone requests for access to records will not be honored.
</p> <p>6. Accounting of disclosures. An individual who is the subject of records maintained in this records system may also request an accounting of all disclosures made outside the Department, if any, that have been made from that individual's records.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address specified under System Location above and reasonably identify the record. Specify the information being contested. State the corrective action sought, with supporting justification, along with information to show how the record is inaccurate, incomplete, untimely or irrelevant.</p>
</xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>From individual officers and other commissioned corps officials; applicants; private and Government physicians; hospitals and clinics rendering treatment; investigative reports, records contained in system 09-40-0001, Public Health Service (PHS) Commissioned Officer General Personnel Records, HHS/PSC/HRS; records from system 09-40-0005, Public Health Service (PHS) Beneficiary Contract Medical/Health Care Records, HHS/PSC/HRS; death certificates and reports of death and from survivors and executors of estates.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-40-0003" toc="yes">
<systemNumber>09-40-0003</systemNumber>
<subsection type="systemName">Public Health Service (PHS) Commissioned Corps Board Proceedings, HHS/PSC/HRS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Division of Commissioned Personnel (DCP), HRS/PSC, Room 4-36, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857 -0001.
</p> <p>Duplicates of records may also be maintained in operating offices (duty stations) of the Department and other agencies and organizations to which PHS Commissioned Corps officers are assigned. Contact the System Manager for the location of specific records.
</p> <p>Names and addresses of contractors given information under routine use 4 can be obtained from the System Manager at the location identified below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Commissioned officers (including active, inactive, terminated, retired and deceased officers) and applicants to the PHS Commissioned Corps.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The categories of records in this system consist of the following:
</p><p>1. Appointment Board files consisting of applications, references, school transcripts, and other materials used in the appointment examination process.
</p> <p>2. Promotion Board files consisting of recommendations from PHS components and worksheets from previous promotion boards.
</p> <p>3. Officer Special Pay Review Board files consisting of Special Pay contracts, certification of eligibility by PHS components, information pertaining to disciplinary actions and related documents.
</p> <p>4. Assimilation Board files consisting of PHS component recommendations, information pertaining to disciplinary actions and related documents.
</p> <p>5. Three-Year File Review Board files consisting of recommendations from PHS components, information pertaining to disciplinary actions and related documents.
</p> <p>6. Chief Professional Officer Nominating Board files, consisting of recommendations from PHS programs and officials, curriculum vitae for officers under consideration, evaluation materials and other material used by the Board in its deliberations.
</p> <p>7. Flag Officer Billet Assignment Board and Flag Officer Nominations Board records consisting of recommendations from PHS programs and officials, curriculum vitae for officers under consideration, evaluation materials and other materials used by the Board in its deliberations.
</p> <p>8. Voluntary Retirement Board files consisting of recommendations from PHS components and worksheets.
</p> <p>9. Records from other Board processes instituted as part of the administration of the PHS Commissioned Corps personnel system.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The Public Health Service Act (42 U.S.C. 202-217, 218a, 224, 228, 233, and other pertinent sections); The Social Security Act (42 U.S.C. 410(m) et seq.); portions of Title 10, U.S.C., related to the uniformed services; portions of the Title 37, U.S.C., related to pay and allowance for members of the uniformed services; portions of Title 38, U.S.C., related to benefits administered by the Department of Veterans Affairs; sections of 50 U.S.C. App., related to the selective service obligations and the Soldiers' and Sailors' Civil Relief Act; E.O. 9397, "Numbering System for Federal Accounts Relating to Individual Persons"; E.O. 10450, "Security Requirements for Government Employment"; and E.O. 11140, which delegates the authority to administer the PHS Commissioned Corps from the President to the Secretary, HHS.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The information is used by the Program Support Center (PSC), DCP, HHS Operating Divisions (OPDIVs) and other organizations where commissioned officers are assigned, to:
</p><p>1. Recommend or decide on appropriate actions in the areas of commissioned corps personnel administration listed above.
</p> <p>2. Prepare the "PHS Commissioned Officer Roster and Promotion Seniority of the Public Health Service" which contains the names and status of officers on active duty.</p>
</xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These records or information from these records may be used:
</p><p>1. To disclose information to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>2. To the Department of Justice, a court or other tribunal, when: (a) HHS, or any component, thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components is a party to litigation or has interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records are collected.
</p> <p>3. To disclose pertinent information to appropriate Federal, State, or local agencies; international agencies; or foreign governments responsible for investigating, prosecuting, enforcing or implementing statutes, rules, regulations or orders when PHS becomes aware of evidence of a potential violation of civil or criminal law.
</p> <p>4. When the Department contemplates contracting with a private firm for the purpose of collating, analyzing, aggregating, or otherwise refining records in this system, relevant records will be disclosed to such a contractor. The contractor will be required to maintain Privacy Act safeguards with respect to such records. These safeguards are explained in the section entitled "Safeguards."
</p><p>5. To disclose information to the Department of Labor, the Department of Veterans Affairs, Social Security Administration or other Federal agencies having special employee benefit programs; to a Federal, State, county or municipal agency; or to a publicly recognized charitable organization when necessary to adjudicate a claim under a benefit program, or to conduct analytical studies of benefits being paid under such programs, provided such disclosure is consistent with the purposes for which the information was originally collected.
</p> <p>6. To disclose information to the Office of Management and Budget (OMB) at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19, or for budgetary or management oversight purposes.
</p> <p>7. To disclose information to Government training facilities (Federal, State, and local) and to non-Government training facilities (e.g. private vendors of training courses or program, private schools) for training purposes, such as crediting of work experience in Commissioned Officer Student Training and Extern Program or verification of status or income.
</p> <p>8. To disclose to Federal and non-Federal agencies information allowing the consideration and selection of officers for honor awards made as a result of the individual's work as a commissioned officer, and to publicize those awards granted. This may include disclosure to other public and private organizations, including the news media, which grant or publicize officer awards and honors.
</p> <p>9. Disclosure may be made to State Boards of Medical Examiners and to equivalent State licensing boards of professional review actions which adversely affect the clinical privileges of health care professionals who either: (a) Are or were employed by the Federal Government; (b) provide or have provided health care service under a fee-for-service contract with the Federal Government; (c) provide or have provided health care services on behalf of the Federal Government as a volunteer or visiting fellow. Boards of Medical Examiners and equivalent State licensing boards are required by the Health Care Quality Improvement Act of 1986 and by the Medicare and Medicaid Patient and Program Protection Act of 1987 to report this information to the National Practitioner Data Bank.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Automated files are stored on disks, microfiche and magnetic tapes. Nonautomated (hard-copy) files are kept in offices, and may be stored in Lektrievers, safes, cabinets, bookcases or desks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Alphabetically by name, by PHS serial number and/or by Social Security Number.</p>
</xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users
</p><p>a. Automated Records. Access to and use of automated records is limited to DCP personnel involved in the specific Board process for which the information was collected. The Business Systems Engineering Division (BSED) provides computer design, programming and support to DCP, and has access to the data to the extent necessary to facilitate the provision of these services to DCP. However, BSED personnel are not authorized to grant access to or make disclosures from automated data in this system to anyone or any organization.
</p> <p>b. Nonautomated records. Access to and use of nonautomated records is limited to DCP personnel involved in the specific Board process for which the information was collected, departmental employees whose official duties require such access or to individuals needing access to the information for purposes stated under routine uses. These individuals are permitted access to records only after they have satisfactorily identified themselves as having an official need to review the information and have provided satisfactory proof of their identities. Access is also granted to individuals who have written permission to review the record when that permission has been obtained from the individual to whom the record pertains. All individuals from outside the Department, to whom disclosure is made pursuant to a routine use, must complete Privacy Act nondisclosure oaths and must submit written requests for access to these records showing the name and employing office of the requester, the date on which the record is requested and the purpose for reviewing the information in the records. This written request is then placed into the record.
</p> <p>2. Physical safeguards
</p><p>a. Automated records. Terminals by which automated records are accessed are kept in offices secured with locks. Automated records on magnetic tape, disks and other computer equipment are kept in rooms designed to protect the physical integrity of the records media and equipment. These rooms are within inner offices to which access is permitted only with special clearance. Outer offices are secured with combination locks. During nonwork hours, all cabinets, storage facilities, rooms and offices are locked and the premises are patrolled regularly by building security forces.
</p> <p>b. Nonautomated records. Nonautomated records are kept in such a way as to prevent observation by unauthorized individuals while the records are actively in use by an authorized employee. When records are not in use, they are closed and secured in desk drawers with locks, filing cabinets with locks, or other security equipment, all of which are kept inside authorized office space which is locked whenever it is not in use. Keys to furniture and equipment are kept only by the individual who is assigned to that furniture or equipment and by the DCP security officer.
</p> <p>3. Procedural safeguards
</p><p>a. Automated records. Automated records are secured by assigning individual access codes to authorized personnel, and by the use of passwords for specific records created by authorized personnel. Access codes and passwords are changed on a random schedule. In addition, programming for automated records allows authorized personnel to access only those records that are essential to their duties. Remote access to automated data from remote terminals is restricted to the PSC, Office of the Surgeon General and personnel officials where commissioned officers are employed. No access is permitted to organizations that do not have automated personnel recordkeeping systems that comply with Privacy Act requirements.
</p> <p>b. Nonautomated records. All files are secured when employees are absent from the premises and are further protected by locks on entry ways and by the building security force. Official records may not be removed from the physical boundaries of DCP. When records are needed at a remote location, copies of the records will be provided. When copying records for authorized purposes, care is taken to ensure that any imperfect or extra copies are not left in the copier room where they can be read, but are destroyed or obliterated.
</p> <p>4. Contractor Guidelines. A contractor who is given records under routine use 4 must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent any unauthorized persons from gaining access to the records, and return the records to the System Manager immediately upon completion of the work specified in the contract. Contractor compliance is assured though inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records are instructed to make no disclosure of the records except as authorized by the System Manager and as stated in the contract.</p>
</xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Files pertaining to all board proceedings are only incorporated into 09-40-0001, Public Health Service (PHS) Commissioned Corps General Personnel Records, HHS/PSC/HRS to the extent required to provide sufficient documentation of an involuntary or adverse action. Special Pay Review Boards and board of inquiry records remain in this system as long as they are needed for administrative purposes, after which time they are destroyed by shredding. All promotion, assimilation and 3 year review board documentation is retained for a period of 5 years after which it is destroyed by shredding. Appointment board files are incorporated into 09-40-0001, Public Health Service (PHS) Commissioned Corps General Personnel Records, HHS/PSC/HRS when the applicant comes onto active duty with the commissioned corps with the exception of the reference forms which are shredded after 5 years. If the applicant does not come onto active duty, the file is destroyed by shredding when the file is closed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, DCP/HRS/PSC, Room 4A-15, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857-0001.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Same as Access Procedures. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>1. General procedures. An individual (and/or the individual's legal representative) seeking access to his/her records may contact the DCP Privacy Act Coordinator for information about obtaining access to the records. Each individual seeking access will be required to verify his/her identity to the satisfaction of the DCP employee providing access. Refusal to provide sufficient proof of identity will result in denial of the request for access until such time as proof of identity can be obtained. The System Manager has authority to release records to authorized officials within DCP, HHS and other organizations where commissioned officers are assigned.
</p> <p>If a determination is made that the material sought contains medical information that is likely to have an adverse effect on the requester, the requester shall be asked to designate in writing a responsible representative who will be willing to review the record and inform the subject individual of the material's contents at the representative's discretion. Such a representative must provide proof that s/he is duly authorized to review the record by either the individual or the individual's legal guardian. A parent, guardian or legal representative who requests notification of, or access to, a dependent/incompetent person's record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify his/her relationship to the dependent/incompetent person as well as his/her own identity.
</p> <p>2. Requests in person. An individual who is the subject of a record and who appears in person seeking access shall provide his/her name and at least one piece of tangible identification (e.g., PHS Commissioned Corps Identification Card, driver's license or passport). Identification cards with current photograph are required. The records will be reviewed in the presence of an appropriate DCP employee, who will answer questions and ensure that the individual neither removes nor inserts any material into the record without the knowledge of the DCP employee. If the individual requests a copy of any records reviewed, the DCP employee will provide them to the individual. The DCP employee will record the name of the individual granted access, the date of access, and information about the verification of identity on a separate log sheet maintained in the office of the DCP employee who reviewed the record.
</p> <p>3. Requests by mail. Written requests must be addressed to the System Manager or the DCP Privacy Act Coordinator at the address shown as the system location above. All written requests must be signed by the individual seeking access. A comparison will be made of that signature and the signature maintained on file prior to release of the material requested. Copies of the records to which access has been requested will be mailed to the individual. The original version of a record will not be released except in very unusual situations when only the original will satisfy the purpose of the request.
</p> <p>4. When an individual to whom a record pertains is mentally incompetent or under other legal disability, information in the individual's records may be disclosed to any person who is legally responsible for the care of the individual, to the extent necessary to assure payment of benefits to which the individual is entitled.
</p> <p>5. Requests by phone. Because positive identification of the caller cannot be established with sufficient certainty, telephone requests for access to records will not be honored.
</p> <p>6. Accounting of disclosures. An individual who is the subject of records maintained in this records system may also request an accounting of all disclosures made outside the Department, if any, that have been made from that individual's records.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address specified under System Location above and reasonably identify the record. Specify the information being contested. State the corrective action sought, with supporting justification, along with information to show how the record is inaccurate, incomplete, untimely or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>From individual officers or their service records; efficiency reports; persons providing references; reports of findings and recommendations made by Board members; supervisors; private and Government physicians; hospitals and clinics rendering treatment; licensure and professional credentialing organizations; investigative reports, law enforcement organizations; court records; death certificates and reports of death; survivors and executors of estates; and the records contained in the following systems: 09-40-0001, Public Health Service (PHS) Commissioned Corps General Personnel Records, HHS/PSC/HRS; 09-40-0002, Public Health Service (PHS) Commissioned Corps Medical Records, HHS/PSC/HRS; and 09-40-0004, Public Health Service (PHS) Commissioned Corps Grievance, Investigatory and Disciplinary Files, HHS/PSC/HRS.</p>
</xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-40-0004" toc="yes">
<systemNumber>09-40-0004</systemNumber>
<subsection type="systemName">Public Health Service (PHS) Commissioned Corps Grievance, Investigatory and Disciplinary Files, HHS/PSC/HRS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Division of Commissioned Personnel (DCP), HRS/PSC, Room 4-36, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857-0001 and offices and organizations to which an individual commissioned officer is assigned. The exact location of any record may be obtained by contacting the Director, DCP, at the location identified below.
</p> <p>Duplicates of records may also be maintained in operating offices (duty stations) of the Department and other agencies and organizations to which PHS Commissioned Corps officers are assigned. Contact the System Manager for the location of specific records.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>PHS Commissioned Corps officers, including active duty, inactive, terminated, separated and deceased officers.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Files concerning grievances filed by or against commissioned officers; investigative files, records related to disciplinary actions, records related to involuntary retirements and involuntary separations (non-board or pre-board actions) taken against commissioned officers; and correspondence relating to the above.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>The Public Health Service Act (42 United States Code (U.S.C.) 202-217, 218a, 224, 228, 233, and other pertinent sections); The Social Security Act (42 U.S.C. 410(m) et seq.); portions of Title 10, U.S.C., related to the uniformed services; portions of the Title 37, U.S.C., related to pay and allowance for members of the uniformed services; portions of Title 38, U.S.C., related to benefits administered by the Department of Veterans Affairs; sections of 50 U.S.C. App., related to the selective service obligations and the Soldiers' and Sailors' Civil Relief Act; E.O. 9397, "Numbering System for Federal Accounts Relating to Individual Persons"; E.O. 10450, "Security Requirements for Government Employment"; and E.O. 11140, which delegates the authority to administer the PHS Commissioned Corps from the President to the Secretary, HHS.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The information is used by the Program Support Center (PSC), DCP, HHS Operating Divisions (OPDIVs) and other organizations where commissioned officers are assigned, to:
</p><p>1. Investigate allegations of misconduct or marginal and substandard performance.
</p> <p>2. Process and decide grievances, involuntary retirements, involuntary separations, temporary grade reversions or disciplinary actions.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These records or information from these records may be used:
</p><p>1. To disclose information to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>2. To the Department of Justice, a court or other tribunal, when: (a) HHS, or any component, thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components is a party to litigation or has interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records are collected.
</p> <p>3. To disclose pertinent information to appropriate Federal, State, or local agencies; international agencies; or foreign governments responsible for investigating, prosecuting, enforcing or implementing statutes, rules, regulations or orders when PHS becomes aware of evidence of a potential violation of civil or criminal law.
</p> <p>4. To disclose information to the Equal Employment Opportunity Commission when requested in connection with investigations into alleged or possible discrimination practices in the Federal sector, examination of Federal affirmative employment programs, or other functions vested in the Commission by the President's Reorganization Plan No. 1 of 1978.</p>
<p>5. Disclosure may be made to State Boards of Medical Examiners and to equivalent State licensing boards of professional review actions which adversely affect the clinical privileges of health care professionals who either: (a) Are or were employed by the Federal Government; (b) provide or have provided health care services under a fee-for-service contract with the Federal Government; or (c) provide or have provided health care services on behalf of the Federal Government as a volunteer or visiting fellow. Boards of Medical Examiners and equivalent State licensing boards are required by the Health Care Quality Improvement Act of 1986 and by the Medicare and Medicaid Patient and Program Protection Act of 1987 to report this information to the National Practitioner Data Bank.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Automated files are stored on disks, microfiche and magnetic tapes. Nonautomated (hard-copy) files are kept in offices, and may be stored in Lektrievers, safes, cabinets, bookcases or desks.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Alphabetically by name, by PHS serial number and/or by Social Security Number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users
</p><p>a. Automated Records. Access to and use of automated records is limited to DCP personnel involved in the grievance or investigation for which the information was collected. The Human Resources Service (HRS) provides computer design, programming and support to DCP, and has access to the data to the extent necessary to facilitate the provision of these services to DCP. However, HRS personnel are not authorized to grant access to or make disclosures from automated data in this system to anyone or any organization.
</p> <p>b. Nonautomated records. Access to and use of nonautomated records is limited to DCP personnel involved in the specific grievance or investigatory process for which the information was collected. These records may be copied and related to departmental officials involved in a decisionmaking capacity in a given case. These individuals are permitted access to records only after they have satisfactorily identified themselves as having an official need to review the information and have provided satisfactory proof of their identities. Access is also granted to individuals who have written permission to review the record when that permission has been obtained from the individual to whom the record pertains. All individuals from outside the Department, to whom disclosure is made pursuant to a routine use, must complete Privacy Act nondisclosure oaths and must submit written requests for access to these records showing the name and employing office of the requester, the date on which the record is requested and the purpose for reviewing the information in the records. This written request is then placed into the record.
</p> <p>2. Physical safeguards
</p><p>a. Automated records. Terminals by which automated records are accessed are kept in offices secured with locks. Automated records on magnetic tape, disks and other computer equipment are kept in rooms designed to protect the physical integrity of the records media and equipment. These rooms are within inner offices to which access is permitted only with special clearance. Outer offices are secured with combination locks. During nonwork hours, all cabinets, storage facilities, rooms and offices are locked and the premises are patrolled regularly by building security forces.
</p> <p>b. Nonautomated records. Nonautomated records are kept in such a way as to prevent observation by unauthorized individuals while the records are actively in use by an authorized employee. When records are not in use, they are closed and secured in desk drawers with locks, filing cabinets with locks, or other security equipment, all or which are kept inside authorized office space which is locked whenever it is not in use. Keys to furniture and equipment are kept only by the individual who is assigned to that furniture or equipment and by the DCP security officer.
</p> <p>3. Procedural safeguards
</p><p>a. Automated records. Automated records are secured by assigning individual access codes to authorized personnel, and by the use of passwords for specific records created by authorized personnel. Access codes and passwords are changed on a random schedule. In addition, programming for automated records allows authorized personnel to access only those records that are essential to their duties. Remote access to automated data from remote terminals is restricted to the PSC, OSG and personnel officials where commissioned officers are employed. No access is permitted to organizations that do not have automated personnel record-keeping systems that comply with Privacy Act requirements.</p>
<p>b. Nonautomated records. All files are secured when employees are absent from the premises and are further protected by locks on entry ways and by the building security force. Official records may not be removed from the physical boundaries of DCP. When records are needed at a remote location, copies of the records will be provided. When copying records for authorized purposes, care is taken to ensure that any imperfect or extra copies are not left in the copier room where they can be read, but are destroyed or obliterated.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Grievance files are destroyed after two years or earlier if no longer needed for administrative purposes. Documentation which directly supports personnel actions affecting an individual is placed into the individual's Official Personnel Folder after a final, official decision has been made and/or the action has been effected, and is then treated in the same manner as other material in system 09-40-0001, "PHS Commissioned Corps General Personnel Records, HHS/PSC/HRS." Investigatory records concerning cases in which no final decisions have been made, or which are ongoing over a period of time are kept indefinitely until a final decision is made. Records concerning cases which are closed or on which final action has been taken, but which are not essential to document or support the final action, are retained as long as they are needed for administrative purposes and are then destroyed by shredding.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, DCP/HRS/PSC, Room 4A-15, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857-0001.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Same as Access Procedures. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>1. General procedures. An individual (and/or the individual's legal representative) seeking access to his/her records may initially contact the DCP Privacy Act Coordinator for information about obtaining access to the record. Each individual seeking access will be required to verify his/her identity to the satisfaction of the Privacy Act Coordinator. Refusal to provide sufficient proof of identity will result in denial of the request for access until such time as proof of identity can be obtained. The System Manager has authority to release records to authorized officials within DCP.
</p> <p>If a determination is made that the material sought contains medical information that is likely to have an adverse effect on the requester, the requester shall be asked to designate in writing a responsible representative who will be willing to review the record and inform the subject individual of the material's contents at the representative's discretion. Such a representative must provide proof that s/he is duly authorized to review the record by either the individual or the individual's legal guardian. A parent, guardian or legal representative who requests notification of, or access to, a dependent/incompetent person's record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify his/her relationship to the dependent/incompetent person as well as his/her own identity.
</p> <p>2. Requests in person. An individual who is the subject of a record and who appears in person seeking access shall provide his/her name and at least one piece of tangible identification (e.g., PHS Commissioned Corps Identification Card, driver's license or passport). Identification cards with current photograph are required. The records will be reviewed in the presence of an appropriate DCP employee who will answer questions and ensure that the individual neither removes nor inserts any material into the record without the knowledge of the DCP employee. If the individual requests a copy of any records reviewed, the DCP employee will provide them to the individual. The DCP employee will record the name of the individual granted access, the date of access, and information about the verification of identity on a separate log sheet maintained in the record.
</p> <p>3. Requests by mail. Written requests must be addressed to the System Manger or the DCP Privacy Act Coordinator at the address shown as the system location above. All written requests must be signed by the individual seeking access. A comparison will be made of that signature and the signature maintained on file prior to release of the material requested. Copies of the records to which access has been requested will be mailed to the individual. The original version of a record will not be released except in very unusual situations when only the original will satisfy the purpose of the request.
</p> <p>4. When an individual to whom a record pertains is mentally incompetent or under other legal disability, information in the individual's records may be disclosed to any person who is legally responsible for the care of the individual, to the extent necessary to assure payment of benefits to which the individual is entitled.</p>
<p>5. Requests by phone. Because positive identification of the caller cannot be established with sufficient certainty, telephone requests for access to records will not be honored.
</p> <p>6. Accounting of disclosures. An individual who is the subject of records maintained in this records system may also request an accounting of all disclosures made outside the Department, if any, that have been made from that individual's records.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address specified under System Location above and reasonably identify the record. Specify the information being contested. State the corrective action sought, with supporting justification, along with information to show how the record is inaccurate, incomplete, untimely or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>From individual officers or their service records; efficiency reports; persons providing references; reports of findings and recommendations made by the commissioned corps Board members; supervisors, private and Government physicians; hospitals and clinics rendering treatment; licensure and professional credentialing organizations; investigative reports; law enforcement organizations; court records; death certificates and reports of death; survivors and executors of estates; and records contained in the following systems: 90-40-0001, Public Health Service (PHS) Commissioned Corps General Personnel Records, HHS/PSC/HRS; 09-40-0002, Public Health Service (PHS) Commissioned Corps Medical Records, HHS/PSC/HRS; 09-40-0003, Public Health Service (PHS) Commissioned Corps Board Proceedings, HHS/PSC/HRS; and 09-40-0006, Public Health Service (PHS) Commissioned Corps Payroll Records, HHS/PSC/HRS.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-40-0005" toc="yes">
<systemNumber>09-40-0005</systemNumber>
<subsection type="systemName">Public Health Service (PHS) Beneficiary-Contract Medical/Health Care Records, HHS/PSC/HRS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Medical Affairs Branch (MAB), Beneficiary Medical Programs Section, DCP/HRS/PSC, Room 4C-06, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857-0001.
</p> <p>Duplicates of records may also be maintained in operating offices (duty stations) of the Department and other agencies and organizations to which PHS Commissioned Corps officers are assigned. Contact the System Manager for the location of specific records.
</p> <p>Names and addresses of contractors given information under routine use 8 can be obtained from the System Manager at the location identified below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who are or were legally entitled to health care through the Public Health Service and who have received health care from health professionals or facilities under contract or agreement with the Department of Health and Human Services.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>May include any or all of the following: Diagnostic (laboratory/X-ray, etc.) and treatment data; sociological information; invoices for services; eligibility data including employment history; and uniformed services information (employing services, service numbers, duty station, home address, etc.).
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Section 215 of the Public Health Service Act (42 U.S.C. 216) "Regulations" and section 326 of the Public Health Service Act (42 U.S.C 253) "Medical Services to Coast Guard, National Oceanic and Atmospheric Administration and the Public Health Service."
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The information is used by the Program Support Center (PSC), DCP, HHS Operating Divisions and other organizations where commissioned officers are assigned, to:
</p><p>1. Serve as the basis for payment for patient care and for continuity in the evaluation of the patient's condition and treatment.
</p> <p>2. Furnish documentary evidence of the course of the patient's medical evaluation and treatment to document communications between the responsible practitioner and any other health professionals contributing to the patient's care and treatment.
</p> <p>3. Verify patient eligibility.
</p> <p>4. Ensure quality assurance.
</p> <p>5. Monitor contract compliance.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Disclosure of these records and information from these records may be made to:
</p><p>1. Medical laboratories and facilities and non-agency physicians in order to facilitate treatment and payment of bills. Recipients are required to maintain adequate safeguards with respect to such records.</p>
<p>2. The Department of Commerce to report results of examination and/or treatment of that agency's personnel.
</p> <p>3. The Department of Defense and the Department of Veterans Affairs to assist uniformed services, personnel, retirees and veterans to obtain medical care or benefits.
</p> <p>4. A Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, other issuance of a license, grant or other benefit by the requesting agency, to the extent that the information is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>5. A congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>6. In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her official capacity where the Justice Department has agreed to represent such employee, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected.
</p> <p>7. Information regarding the commission of crimes or the reporting of occurrences of communicable diseases, tumors, child abuse, births, deaths, alcohol or drug abuse, etc., may be disclosed as required by health providers and facilities by State law or regulation of the department of health or other agency of the State or its subdivision in which the facility is located. Disclosures will be made to organizations as specified by the State law or regulation, such as births and deaths to the vital statistics agency and crimes to law enforcement agencies. Disclosure of the contents of records which pertain to patient identity, diagnosis, prognosis or treatment of alcohol or drug abuse is restricted under the provisions of the Confidentiality of Alcohol and Drug Abuse Patient Records Regulation 42 CFR part 2, as authorized by 42 U.S.C. 290dd-2.
</p> <p>8. When the Department contemplates contracting with a private firm for the purpose of collating, analyzing, aggregating, or otherwise refining records in this system, relevant records will be disclosed to such a contractor. The contractor will be required to maintain Privacy Act safeguards with respect to such records. These safeguards are explained in the section entitled "Safeguards."
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>File folders and electronic data base.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Alphabetically by name, by PHS serial number and/or by Social Security Number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users
</p><p>a. Automated Records. Access to and use of automated records is limited to departmental employees whose official duties require such access; supervisory, contracting officials who review the contractor's records annually; and doctors, dentists, nurses, allied health professionals and administrative staff in the contractor's office who are involved in patient care management.
</p> <p>b. Nonautomated records. Access to and use of nonautomated records is limited to departmental employees whose official duties require such access; contracting officials who review the contractor's records annually; and doctors, dentists, nurses, allied health professionals and administrative staff in the contractor's office. Access is also granted to individuals who have written permission to review the records when that permission has been obtained from the individual to whom the record pertains.
</p> <p>2. Physical safeguards
</p><p>a. Automated records. Terminals by which automated records are accessed are kept in offices secured with locks. Automated records on magnetic tape, disks and other computer equipment are kept in rooms designed to protect the physical integrity of the records media and equipment. These rooms are within inner offices to which access is permitted only with special clearance. Outer offices are secured with locks. During nonwork hours, all cabinets, storage facilities, rooms and offices are locked and the premises are patrolled regularly by building security forces.</p>
<p>b. Nonautomated records. Nonautomated records are kept in such a way as to prevent observation by unauthorized individuals while the records are actively in use by an authorized employee. When records are not in use, they are closed and secured behind locked inner office doors, in desk drawers with locks, filing cabinets with locks, or other security equipment, all of which are kept inside authorized office space which is locked whenever it is not in use. Keys to furniture and equipment are kept only by the individual who is assigned to that furniture or equipment and by the DCP security officer.
</p> <p>3. Procedural safeguards
</p><p>a. Automated records. Automated records are secured by assigning individual access codes to authorized personnel, and by the use of passwords for specific records created by authorized personnel. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office.
</p> <p>b. Nonautomated records. All files are secured when employees are absent from the premises and are further protected by locks on entry ways and by the building security force. Official records may not be removed from the physical boundaries of DCP. When records are needed at a remote location, copies of the records will be provided. When copying records for authorized purposes, care is taken to ensure that any imperfect or extra copies are not left in the copier room where they can be read, but are destroyed or obliterated.
</p> <p>4. Contractor Guidelines. A contractor who is given records under routine use 8 must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent any unauthorized persons from gaining access to the records, and return the records to the System Manager immediately upon completion of the work specified in the contract. Contractor compliance is assured though inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records are instructed to make no disclosure of the records except as authorized by the System Manager and as stated in the contract.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>a. Automated records. Automated billing data are retained for a period of six years and three months after the closing of a file. The record is then destroyed.
</p> <p>b. Nonautomated records. Nonautomated records are retained in the MAB files until the contract is terminated or the payment action completed. The medical records are then forwarded to the MAB, DCP, and retained as indicated in 09-40-0002, "PHS Commissioned Corps Medical Records, HHS/PSC/HRS." Billing information is retained for three fiscal years, then purged and shredded. Patient care notes are retained in the chart until retirement, termination or inactivation. Once a chart is inactivated for over three years it is sent to storage at the Northeast Region Federal Records Center, Bayonne, New Jersey for 16 years. Destruction at that time is in accordance with standard practices of the Federal Records Center.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, DCP/HRS/PSC, Room 4A-15, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857-0001.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Same as Access Procedures. Requesters should also reasonably specify the record contents being sought.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>1. General procedures. An individual (and/or the individual's legal representative) seeking access to his/her records may initially contact any DCP office or employee for information about obtaining access to the records. The DCP employees will inform each individual of the appropriate procedures to follow. Individuals may also seek access to these records by initially contacting the duty station at which they believe the records are located. Individuals at the duty station will ascertain whether the records being sought are maintained at that location. If the records are not located at that duty station, the employee will instruct the individual as to where these records may be located. Each individual seeking access will be required to verify his/her identity to the satisfaction of the employee providing access. Refusal to provide sufficient proof of identity will result in denial of the request for access until such time as proof of identity can be obtained.
</p> <p>If a determination is made that the material sought contains medical information that is likely to have an adverse effect on the requester, the requester shall be asked to designate in writing a responsible representative who will be willing to review the record and inform the subject individual of the material's contents at the representative's discretion. Such a representative must provide proof that s/he is duly authorized to review the record by either the individual or the individual's legal guardian. A parent, guardian or legal representative who requests notification of, or access to, a dependent/incompetent person's record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify his/her relationship to the dependent/incompetent person as well as his/her own identity.
</p> <p>2. Requests in person. An individual who is the subject of a record and who appears in person seeking access shall provide his/her name and at least one piece of tangible identification (e.g., PHS Commissioned Corps Identification Card, driver's license or passport). Identification cards with current photograph are required. The records will be reviewed in the presence of an appropriate employee who will answer questions and ensure that the individual neither removes nor inserts any material into the record without the knowledge of the DCP employee. If the individual requests a copy of any records reviewed, the employee will provide them to the individual. The employee will record the name of the individual granted access, the date of access, and information about the verification of identity on a separate log sheet maintained in the Beneficiary Medical Program office.</p>
<p>3. Requests by mail. Written requests must be addressed to the System Manager at the address shown as the system location above. All written requests must be signed by the individual seeking access. A comparison will be made of that signature and the signature maintained on file prior to release of the material requested. Copies of the records to which access has been requested will be mailed to the individual. The original version of a record will not be released except in very unusual situations when only the original will satisfy the purpose of the request.
</p> <p>4. When an individual to whom a record pertains is mentally incompetent or under other legal disability, information in the individual's records may be disclosed to any person who is legally responsible for the care of the individual, to the extent necessary to assure payment of benefits to which the individual is entitled.
</p> <p>5. Requests by phone. Because positive identification of the caller cannot be established with sufficient certainty, telephone requests for access to records will not be honored.
</p> <p>6. Accounting of disclosures. An individual who is the subject of records maintained in this records system may also request an accounting of all disclosures made outside the Department, if any, that have been made from that individual's records.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager at the address specified under System Location above and reasonably identify the record. Specify the information being contested. State the corrective action sought, with supporting justification, along with information to show how the record is inaccurate, incomplete, untimely or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information is provided from Individuals, employers, other health care providers, families and social agencies, and 09-40- 0002, Public Health Service (PHS) Commissioned Corps Medical Records, HHS/PSC/HRS.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>

<section id="09-40-0011" toc="yes">
<systemNumber>09-40-0011</systemNumber>
<subsection type="systemName">Proceedings of the Board for Correction of PHS Commissioned Corps Records, HHS/PSC/HRS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Board for Correction of PHS Commissioned Corps Records, HHS/PSC/HRS, Room 17A-12, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857; and Washington National Records Center, 4205 Suitland Road, Suitland, Maryland 20409. Records also may be located at the contractor site. The names and addresses of contractors used by the Board for Correction can be obtained from the System Manager.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Commissioned Officers of the PHS Commissioned Corps who appeal to the Board for Correction, former officers, their spouses and heirs.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Commissioned Officer case files consisting of requests for correction of alleged errors or injustices; administrative reports; case summaries; findings; conclusions; recommendations; Board for Correction decisions and related documents, including copies of records from other systems of records as specified under Record Source Categories below.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>10 U.S.C. 1552 "Correction of Military Records"; Public Health Service Act, 42 U.S.C. 213a(a)(12); Executive Order 9397, "Numbering System for Federal Accounts Relating to Individual Persons."
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>This system of records is used:
</p><p>1. To process appeals from current or former Commissioned Officers, their spouses and heirs to determine the existence of alleged errors or injustices resulting from the administration of laws and regulations.
</p> <p>2. To review and adjudicate these appeals.
</p> <p>3. To disclose the decisions of the Board for Correction to the Division of Commissioned Personnel (DCP) for appropriate action. The DCP is not authorized to release copies of original Board for Correction records without approval by the System Manager.
</p> <p>4. To document all actions and activities of the Board for Correction.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>These records may be used to disclose information:
</p><p>1. To a congressional office from the record of any individual in response to an inquiry from the congressional office made at the written request of that individual.</p>
<p>2. To the Department of Justice, a court or other tribunal, when: (a) HHS, or any component thereof; or (b) Any HHS employee in his or her official capacity; or (c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components; is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records are collected.
</p> <p>3. To appropriate Federal, State, or local agencies; international agencies; or foreign governments responsible for investigating, prosecuting, enforcing, or implementing statutes, rules, regulations, or orders, when HHS becomes aware of evidence of a potential violation of civil or criminal law.
</p> <p>4. To private contractors who record and transcribe tapes of Board for Correction meetings. Contractors are required to comply with Privacy Act safeguards and the HHS Privacy Act Regulations with respect to such records. These safeguards are explained in the section entitled "Safeguards."
</p><p>5. To properly identified attorneys of subject individuals or their personally designated representatives, to court-appointed representatives of mentally incompetent or otherwise legally handicapped subject individuals and to guardians to the extent necessary to assure attainment of rights or payment of benefits to which such individuals would be entitled.
</p> <p>6. To Federal, State or local government agencies (such as those concerned with disability compensation, health and human services, hospitals, and legal affairs) or to public interest organizations (such as the American Red Cross, the American Civil Liberties Union, Disabled American Veterans, and the Legal Aid Society) when the subject individual's request for correction will affect the individual's entitlement to rights or benefits, and when such agencies may have information which will assist the Board for Correction in clarifying that entitlement.
</p> <p>7. To authorized experts or consultants in a Federal agency or in the private sector if the Board for Correction has determined that it needs such opinions to arrive at an equitable decision concerning the subject individual's request; or to authorized officials in a Federal agency if required to facilitate equitable handling of a case, e.g., to an EEO official when a complaint is initiated by a PHS commissioned officer, to ensure that the same complaint has not already been decided through the Board for Correction process. All consultants, experts and Federal officials are required to comply with Privacy Act safeguards and the HHS Privacy Act Regulations with respect to such records.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>File folders, computerized records, disks and microfiche.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Last name and case number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: The System Manager and/or the Executive Secretary of the Board for Correction will control access to the data. Additional authorized personnel having access to the data are: (1) The Executive Director of the Board for Correction; (2) Designated clerical support staff in the offices of the System Manager and the Executive Secretary; (3) Board for Correction members on a need-to-know basis; and (4) Experts, consultants or private contractors when approved by the System Manager.
</p> <p>2. Physical Safeguards: Automated records. Automated records are stored on personal computers which require passwords for access, or on disks, and are located in offices with locks. During nonwork hours, all cabinets, storage facilities and offices are locked and the premises are patrolled regularly by building security forces. Nonautomated records. When records are not in use they are stored in filing cabinets with locks located in an inner office occupied during working hours and locked at all other times.
</p> <p>3. Procedural Safeguards: Authorized personnel are trained to comply with provisions of the Privacy Act and the HHS Privacy Act Regulations. Records are transmitted in sealed envelopes and are identified as confidential material. When copying records for authorized purposes, care is taken to ensure that no imperfect or extra pages are left in the copier room. These pages are disposed of by shredding.
</p> <p>4. Contractor Guidelines: Contractor compliance is assured through inclusion of privacy requirements in contract clauses, and through monitoring by contract and project officers. A contractor who is given records must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent unauthorized persons from gaining access to the records, caution employees about the confidentiality of the records, and return the records to the System Manager immediately upon completion of the work specified in the contract. Contractors are instructed to make no disclosure of the records except as authorized by the System Manager.</p>
</xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Original records are retained at the System Location either for one year after the Board for Correction's recommendation for favorable decision is upheld by the approving official, or for three years after the approval of the Board for Correction's recommendation for denial of an appeal, whichever applies to the final disposition of a case. The records are then transferred to the Washington National Records Center (WNRC) and are destroyed by the WNRC after 20 years.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Executive Director of the Board for Correction of PHS Commissioned Corps Records, Room 17-21, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Same as Access Procedures. The requester is required to specify reasonably the contents of the records being sought.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>To determine whether information about themselves is contained in this system, the subject individual should contact the System Manager at the above address.
</p> <p>A subject individual who appears in person is required to provide his/her name and at least one piece of tangible identification (e.g., PHS Commissioned Corps Identification Card, driver's license, Social Security card, or discharge or separation papers).
</p> <p>An individual making a written inquiry is required to sign the request mailed to the System Manager. The signature given is compared with the signature on file prior to release of the material requested.
</p> <p>If the subject individual is represented by an attorney, other than the one shown on the application to the Board for Correction, it is necessary to have in the case file a dated letter signed by the subject individual giving the name of the attorney and stating that he/she has been authorized access to the case file. If the subject individual is represented by another person, it is necessary to have in the case file a dated letter signed by the individual giving the name of the representative and stating that he/she has been authorized access to the case file. In both instances, the person representing the subject individual would be required to present documentation identifying him/herself as being the person mentioned in the application or in a letter on file with the Board for Correction.
</p> <p>If the subject individual is judged to be mentally incompetent to handle his/her personal affairs, a court order should be issued to that effect. The person identifying him/herself as representing the subject individual in this circumstance is required to present a copy of the court order and to personally identify him/herself as being the person identified in the order.
</p> <p>If the subject individual is physically incapacitated, a medical statement certifying to the physical disability is required, signed and dated by a licensed physician. The person presenting this statement is required to personally identify him/herself and provide documentation of his/her relationship to the subject individual (e.g., marriage license, birth certificate, etc.).
</p> <p>If the subject individual is deceased, proof of death is required, signed and dated by the appropriate certifying agency of the Federal Government. The person presenting this document is required to personally identify him/herself and provide documentation of his/her relationship to the deceased (e.g., marriage license, birth certificate, etc.).
</p> <p>If a determination is made that the material sought contains medical information that is likely to have an adverse effect on either the subject individual or the determination of his/her request, the requester (whether the subject individual, his/her personal representative, an attorney other than the one shown on the application to the Board for Correction, a court appointed representative, or a guardian) shall be asked to designate in writing a physician or other health professional who is willing to review the material and inform the requester of its contents, at the discretion of the health professional. The person designated to evaluate the medical information must provide proof that he/she is duly authorized by the requester to review the material.
</p> <p>An individual who is the subject of the records maintained in this records system may request an accounting of disclosures that have been made of his/her records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>If access has been granted, the requester shall contact the System Manager above, reasonably identify the records, specify the information being contested, and state the corrective action sought, with supporting documentation, to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Records are obtained from applicants; reports of findings and recommendations made by Board for Correction members; Board for Correction decisions; supervisors; private and Government physicians; hospitals and clinics rendering treatment; investigative reports; death certificates and reports of death; survivors and executors of estates; private and Government agency reports of service delivery, compensation, disability and legal opinions; and records contained in systems 09-40-0001, Public Health Service (PHS) Commissioned Corps General Personnel Records, HHS/PSC/HRS; 09-40-0002, Public Health Service (PHS) Commissioned Officer Medical Records, HHS/PSC/HRS; 09-40-0003, Public Health Service (PHS) Commissioned Corps Board Proceedings, HHS/PSC/HRS; 09-40-0004, Public Health Service (PHS) Commissioned Corps Grievance, Investigatory and Disciplinary Files, HHS/PSC/HRS; 09-40-0005, Public Health Service (PHS) Beneficiary-Contract Medical/Health Care Records, HHS/PSC/HRS; and 09-40-0006, Public Health Service (PHS) Commissioned Corps Payroll Records, HHS/PSC/HRS.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-40-0012" toc="yes">
<systemNumber>09-40-0012</systemNumber>
<subsection type="systemName">Debt Management and Collection System, HHS/PSC/FMS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Division of Financial Operations, Financial Management Service, Program Support Center, Room 2B-40, Parklawn Building, 5600 Fishers Lane, Rockville, 20857.
</p> <p>Division of Accounting, Food and Drug Administration, Room 11-41, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>Division of State Legislation and Repatriation, Administration for Children and Families, Aerospace Building, 370 L'Enfant Promenade, SW, Washington, DC 20447.
</p> <p>Division of Health Professions Support, Indian Health Service, Twinbrook Metro Plaza Building, Suite 100, 12300 Twinbrook Parkway, Rockville, MD 20850.
</p> <p>Division of Financial Management, Substance Abuse and Mental Health Services Administration, Room 16C-05, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>Division of Commissioned Personnel, Human Resources Service, Program Support Center, Room 4A-15, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>Personnel and Pay Systems Division, Human Resources Service, Program Support Center, 8455 Colesville Road, Suite 700, Silver Spring, MD 20910.
</p> <p>Division of Student Assistance, Bureau of Health Professions, Health Resources and Services Administration, Room 8-22, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.
</p> <p>Division of Scholarships and Loan Repayments, Bureau of Primary Health Care, Health Resources and Services Administration, 10th Floor, East/West Towers, 4350 East-West Highway, Bethesda, MD 20814.
</p> <p>Division of Accounting, Health Care Financing Administration, Room C3-09-17, 7500 Security Blvd., Baltimore, MD 21244.
</p> <p>Division of Financial Management, National Institutes of Health, Building 31, Room B1B63, 9000 Rockville Pike, Bethesda, MD 20892.
</p> <p>Financial Management Office, Centers for Disease Control and Prevention, Room 3149, 1600 Clifton Road, Atlanta, GA 30333.
</p> <p>Washington National Records Center, 4205 Suitland Road, Washington, DC 20409.
</p> <p>Names and addresses of contractors given information under routine use 17 can be obtained from the System Manager at the location identified below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>1. Individuals owing monies to HHS Operating Divisions or other Federal entities for which PSC provides debt collection services.
</p> <p>2. Individuals owing monies include, but are not limited to, students and health care professionals who have received student loans, scholarships, traineeships, or grant funds under Titles III, VII, and VIII of the Public Health Service Act, as amended, and who are delinquent in repaying either loans or funds owed in lieu of a service obligation under such programs.
</p> <p>3. Repatriates owing repayment of funds loaned to them by the United States.
</p> <p>4. Individuals owing repayment for services rendered such as Freedom of Information Act requests and queries associated with the National Practitioner Data Bank, and Health Care Integrity and Protection Data Bank queries.
</p> <p>5. Current and separated HHS employees who have incurred payroll debts.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Categories of records in this system include records such as: Name; taxpayer identification number and/or Social Security Number; address; amount of debt; rate of interest; account and repayment history and status; discipline/specialty; lending institutions; and invoice number.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Debt Collection Act of 1982 (Pub. L. 97-365), as amended; and Debt Collection Improvement Act of 1996 (Pub. L. 104-134), as amended.</p>
</xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>The purpose of the system is:
</p><p>1. To reduce the amount of outstanding debts owed to the Federal Government.
</p> <p>2. To protect the programmatic and financial integrity of Federal funds paid or awarded to individuals.
</p> <p>3. To be used by other components within HHS to facilitate debt management activities.
</p> <p>4. To be used for developing both regulatory and ad hoc management reports relating to debt collection activities.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>Records may be disclosed:
</p><p>1. To a congressional office in response to an inquiry from the congressional office made at the written request of that individual.
</p> <p>2. To authorized persons employed at educational institutions where the recipient received a loan, scholarship, or grant. The purpose of this disclosure is to assist institutions in identifying delinquent borrowers and to enforce the conditions and terms of such loans, scholarships and grants.
</p> <p>3. To the Department of Justice, or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party of litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records are collected.
</p> <p>4. To the General Accounting Office, the HHS Inspector General's Office, private auditing firms, and to the Office of Management and Budget for auditing financial obligations to determine compliance with programmatic, statutory, and regulatory provisions.
</p> <p>5. To a consumer reporting agency (credit bureau) to obtain a commercial credit report for the following purposes:
</p><p>a. To establish creditworthiness of a loan/grant/scholarship/ traineeship applicant; and
</p><p>b. To assess and verify the ability of a debtor to repay debts owed to the Federal Government.
</p> <p>Disclosures are limited to the individual's name, address, Social Security Number and other information necessary to identify him/her; the funding being sought or amount and status of the debt; and the program under which the application or claim is being processed.
</p> <p>6. To debt collection agents, other Federal agencies, and other third parties who are authorized to collect a Federal debt, information necessary to identify a delinquent debtor. Disclosure will be limited to the debtor's name, address, Social Security Number, and other information necessary to identify him/her; the amount, status, and history of the claim; and the agency or program under which the claim arose.
</p> <p>7. To any third party that may have information about a delinquent debtor's current address, such as a U.S. post office, a State motor vehicle administration, a professional organization, an alumni association, etc., for the purpose of obtaining the debtor's current address. This disclosure will be limited to information necessary to identify the individual.
</p> <p>8. To the Defense Manpower Data Center, Department of Defense, to conduct matching programs for the purpose of identifying and locating individuals who are receiving Federal salaries or certain benefit payments resulting from Federal employment and are delinquent in their repayment of debts owed to the U.S. Government. The PSC will disclose this information in an effort to collect the debts by administrative or salary offset under the provisions of the Debt Collection Act of 1982 and the Debt Collection Improvement Act of 1996.
</p> <p>9. To the United States Postal Service to conduct matching programs for the purpose of identifying and locating individuals who are receiving Federal salaries or certain benefit payments resulting from Federal employment and are delinquent in their repayment of debts owed to the U.S. Government. The PSC will disclose this information in an effort to collect the debts by administrative or salary offset, under the provisions of the Debt Collection Act of 1982 and the Debt Collection Improvement Act of 1996.
</p> <p>10. To the following entities to help collect a debt owed:
</p><p>a. To the Treasury Department or another Federal agency in order to effect an administrative offset under common law or under 31 U.S.C 3716 (withholding from money payable to or held on behalf of the individual); and
</p><p>b. To debt collection agents or contractors under 31 U.S.C. 3718 or under common law to help collect a past due amount or locate or recover debtors' assets.
</p> <p>11. The PSC will disclose from this system of records a delinquent debtor's name, address, Social Security Number, and other information necessary to identify him/her; the amount, status, and history of the claim; and the agency or program under which the claim arose, as follows:
</p><p>a. To another Federal agency so that agency can effect a salary offset for debts owed by Federal employees; if the claim arose under the Social Security Act, the employee must have agreed in writing to the salary offset;
</p><p>b. To another Federal agency so that agency can effect an authorized administrative offset; i.e., withhold money payable to or held on behalf of debtors other than Federal employees; and
</p><p>c. To the Department of Treasury, Internal Revenue Service to request a debtor's current mailing address to locate him/her for purposes of either collecting or compromising a debt, or to have a commercial credit report prepared.
</p> <p>12. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with enforcing or implementing the statute, rule, regulation, or order.
</p> <p>13. To the Department of the Treasury, Internal Revenue Service, as taxable income, the written-off amount of a debt owed by an individual to the Federal Government when a debt becomes partly or wholly uncollectible--either because the time period for collection under the statute of limitations has expired, or because the Government agrees to forgive or compromise the debt.
</p> <p>14. To the Treasury Department or to an agency operating a Debt Collection Center designated by the Treasury Department in order to collect past due amounts.
</p> <p>15. If PSC or an agency to which PSC provides debt collection services decides to sell a debt pursuant to 31 U.S.C. section 3711(I), a record from the system may be disclosed to purchasers, potential purchasers, and contractors engaged to assist in the sale or to obtain information necessary for potential purchasers to formulate bids and information necessary for purchasers to pursue collection remedies.
</p> <p>16. Pursuant to 31 U.S.C. Section 3720E, or specific program regulations, PSC may publish or otherwise publicly disseminate information regarding the identity of a delinquent debtor and the existence of the debt.
</p> <p>17. When the Department contemplates contracting with a private firm for the purpose of collating, analyzing, aggregating, or otherwise refining records in this system, relevant records will be disclosed to such a contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records. These safeguards are explained in the section entitled "Safeguards."
</p><p>Disclosure to consumer reporting agencies:
</p><p>Disclosure pursuant to 5 U.S.C. 552a(b)(12): Disclosures may be made from this system to "consumer reporting agencies" as defined in the Fair Credit Reporting Act (15 U.S.C. 158a(f) or the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a)(3)) and the Debt Collection Improvement Act of 1996 (Pub. L. 104-134). The purposes of these disclosures are: (1) To provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records, and (2) to enable HHS to improve the quality of loan and scholarship decisions by taking into account the financial reliability of applicants. Disclosure of records will be limited to the individual's name, Social Security Number, and other information necessary to establish the identity of the individual, the amount, status, and history of the claim, and the agency or program under which the claim arose.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records are maintained in file folders, ledgers, magnetic tapes, electronic media and diskettes.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by name, Social Security Number, taxpayer identification number and account number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Employees and officials directly responsible for programmatic or fiscal activity, including administrative and staff personnel, financial management personnel, computer personnel, and managers who have responsibilities for implementing programs funded by Operating Divisions or agencies served by PSC.</p>
<p>2. Physical Safeguards: File folders, reports and other forms of data, and electronic diskettes are stored in areas where fire and life safety codes are strictly enforced. All documents and diskettes are protected during lunch hours and nonduty hours in locked file cabinets or locked storage areas. Magnetic tapes and computer matching tapes are locked in a computer room and tape vault.
</p> <p>3. Procedural Safeguards: All authorized users protect information from public view and from unauthorized personnel entering an office.
</p> <p>4. Technical Safeguards: PSC conducts regular reviews of computer access to the automated system by reviewing listings of employees who have access to the system via terminal entry. All personal computers having forte boards with modems are protected. Access is limited by use of IDs and passwords. PSC utilizes a Resource Access Control Facility program product which provides systems security, resource access control, auditability and accountability and administrative control.
</p> <p>Contractor Guidelines: A contractor who is given records under routine use 17 must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent any unauthorized persons from gaining access to the records, and return the records to the System Manager immediately upon completion of the work specified in the contract. Contractor compliance is assured through inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records are instructed to make no disclosure of the records except as authorized by the System Manager and stated in the contract.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained by the responsible organizations listed under "System Location" until completion of the repayment of the debt. The records are then sent to the Federal Records Center for a retention period of six years and three months, and are subsequently disposed of in accordance with National Archives and Records Administration standard disposal practices.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Chief, Debt Management Branch, Division of Financial Operations, Financial Management Service, Program Support Center, Parklawn Building, Room 2B40, 5600 Fishers Lane, Rockville, MD 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To find out if the system contains records about you, contact the System Manager at the above address.
</p> <p>Requests in person: A subject individual, or parent, or legal guardian of an incompetent individual, who appears in person at a specific location seeking access to or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of tangible identification such as driver's license, passport, voter registration card, or union card. Identification papers with current photographs are preferred but not required. If a subject individual has no identification but is personally known to an agency employee, such employee shall make a written record verifying the subject individual's identity. Where the subject individual has no identification papers, the responsible agency official shall require that the subject individual certify in writing that he/she is the individual who he/she claims to be and that he/she understands that the knowing and willful request or acquisition of a record concerning an individual under false pretenses is a criminal offense subject to a fine. In addition, the following information is needed: (1) The name of the assistance program that he/she participated in, (2) dates of enrollment in the program, and (3) school(s) of attendance.
</p> <p>Requests by mail: Written requests must be addressed to the System Manager and must contain the name and address of the requester, his/her date of birth, and either his/her notarized signature to verify his/her identity, or a written certification that the requester is who he/she claims to be and understands that the known and willful request or acquisition of records concerning an individual under false pretenses is a criminal offense subject to a fine. In addition, the following information is needed: The name of the assistance program that he/she participated in and, for student assistance programs, dates of enrollment in the program, and school(s) of attendance.
</p> <p>In addition, be informed that provision of the Social Security Number may assist in the verification of your identity as well as the identification of your record. Providing your Social Security Number is voluntary and you will not be refused access to your record for failure to disclose your Social Security Number.
</p> <p>Requests by telephone: Since positive identification of the caller cannot be established, telephone requests are not honored.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should provide a reasonable description of the record being sought. Requesters may also request an accounting of disclosures that have been made of their records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the System Manager, provide a reasonable description of the record, specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individuals whose records are contained in the system; Federal agencies, including but not limited to all Operating Divisions of the Department of Health and Human Services and the Department of the Treasury; credit reporting agencies; lending institutions; professional associations; schools of higher education; and Federal and State courts.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>

<section id="09-30-0023" toc="yes">
<systemNumber>09-30-0023</systemNumber>
<subsection type="systemName">Records of Contracts Awarded to Individuals. HHS/SAMHSA/OPS.</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Director, Division of Contracts Management,  Office of Program Services,  Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road, Rm., 7-1053, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>An individual who receives a contract as well as individuals who apply or compete for an award but do not receive the award and their consultants.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Curriculum vitae, salary information, evaluations of proposals by contract review committees.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>SAMHSA: Public Health Service Act, sections 301 (42 U.S.C. 241), 322 (42 U.S.C. 249(c)), and 501-05 (42 U.S.C. 290aa <i>et seq</i>). CSAT: Center for Substance Abuse Treatment, Section 507-12 (42 U.S.C. 290bb <i>et seq.</i>). CSAP: Center for Substance Abuse Prevention, Section 515-8 (42 U.S.C. 290bb-21 <i>et seq.</i>). CMHS: Center for Mental Health Services, Section 520-35 (42 U.S.C. 290bb-31 <i>et seq.</i>). Protection and Advocacy for Individuals with Mental Health Illness Act of 1986 as amended (42 U.S.C 10801 <i>et seq.</i>); Refugee Education Assistance Act 1980, section 501(c) (8 U.S.C. 1522 note). Public Law 96-422; Executive Order 12341; and Disaster Relief Act of 1974, section 413. Public Law 93-288, as amended by section 416 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act. Public Law 100-107.</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>To document the history of each contract procurement action and award made within SAMHSA to an individual. The records are also used by contract review committee members when evaluating a proposal submitted by an individual.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. A record from this system may be disclosed to the following entities in order to help collect a debt owed the United States:
</p><p>(a) To another Federal agency so that agency can effect a salary offset;
</p><p>(b) to another Federal agency so that agency can effect an administrative offset under common law or under 31 U.S.C. 3716 (withholding from money payable to, or held on behalf of, the individual);
</p><p>(c) to the Treasury Department, Internal Revenue Service (IRS), to request his/her mailing address to locate him/her or in order to have a credit report prepared;
</p><p>(d) to agents of the Department and to other third parties to help locate him/her in order to help collect or compromise a debt;
</p><p>(e) to debt collection agents under 31 U.S.C. 3718 or under common law to help collect a debt; and
</p><p>(f) to the Justice Department for litigation or further administrative action.
</p> <p>Disclosure under part (d) of this routine use is limited to the individual's name, address, Social Security number, and other information necessary to identify him/her. Disclosure under parts (a)-(c) and (e) is limited to those items; the amount, status, and history of the claim; and the agency or program under which the claim arose. An address obtained from IRS may be disclosed to a credit reporting agency under part (d) only for purposes of preparing a commercial credit report on the individual. Part (a) applies to claims or debts arising or payable under the Social Security Act if and only if the employee consents in writing to the offset.
</p> <p>4. SAMHSA may disclose information from its records in this system to consumer reporting agencies in order to obtain credit reports to verify credit worthiness of contract applicants. Permissible disclosures include name, address, Social Security number or other information necessary to identify the individual; the funding being sought; and the program for which the information is being obtained.
</p> <p>5. When a debt becomes partly or wholly uncollectible, either because the time period for collection under the statute of limitations has expired or because the Government agrees with the individual to forgive or compromise the debt, a record from this system of records may be disclosed to the Internal Revenue Service to report the written-off amount as taxable income to the individual.
</p> <p>6. A record from this system may be disclosed to another Federal agency that has asked the Department to effect an administrative offset under common law or under 31 U.S.C. 3716 to help collect a debt owed the United States.
</p> <p>Disclosure under this routine use is limited to: name, address, Social Security number, and other information necessary to identify the individual, information about the money payable to or held for the individual, and other information concerning the administrative offset.
</p> <p>7. SAMHSA may disclose from this system of records to the Department of Treasury, Internal Revenue Service (IRS): (1) A delinquent debtor's name, address, Social Security number, and other information necessary to identify the debtor; (2) the amount of the debt; and (3) the program under which the debt arose, so that IRS can offset against the debt any income tax refunds which may be due to the debtor.
</p> <p>8. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p><p> DISCLOSURES TO CONSUMER REPORTING AGENCIES: </p><p>Disclosures may be made from this system to "consumer reporting agencies" as defined in the Fair Credit Reporting Act (15 U.S.C. 1681 (F)) or the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a)(3)). The purpose of such disclosures is to provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records. Information disclosed will be limited to name, Social Security number, address, other information necessary to establish the identity of the individual, and amount, status, and history of the claim, and the agency or program under which the claim arose. Such disclosures will be made only after the procedural requirements of 31 U.S.C. 3711(f) have been met.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Documents are filed in manual files in enclosed and/or locked file cabinets.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by contract number and cross indexed by individual's name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. Authorized Users: Federal contract and support personnel, Federal contract review staff and outside consultants acting as peer reviewers of the project.
</p> <p>2. Physical Safeguards: All folders are in file cabinets in a room that is locked after business hours in a building with controlled entry (picture identification). Files are withdrawn from cabinet for Federal staff who have a need to know by a sign in and out procedure.
</p> <p>3. Procedural Safeguards: Access to records is strictly limited to those staff members trained in accordance with the Privacy Act.
</p> <p>4. Implementation Guidelines: DHHS Chapter 45-13 of the General Administration Manual.
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>a. Procurement or purchase copy, and related papers:
</p><p>(1) Transactions of more than $25,000 are destroyed 6 years and 3 months after final payment.
</p> <p>(2) Transactions of $25,000 or less are destroyed 3 years after final payment.
</p> <p>b. Other copies of records used by the Division of Contracts Management for administrative purposes are destroyed upon termination or completion.</p>
</xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director,  Division of Contracts Management,  Office of Program Services,  Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road, Rm. 7-1053, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the appropriate System Manager at the address above or appear in person to the Division of Contracts Management. An individual may learn if a record exists about himself/herself upon written request with notarized signature. The request should include, if known, contractor's name, contract number, and approximate date contract was awarded. An individual who is the subject of records maintained in this records system may also request an accounting of all disclosures that have been made from that individual's records, if any.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above and reasonably identify the record, specify the information being contested, the corrective action sought, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Contract proposals and supporting contract documents, contract review committees, site visitors.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-30-0027" toc="yes">
<systemNumber>09-30-0027</systemNumber>
<subsection type="systemName">Grants and Cooperative Agreements: Alcohol, Drug Abuse, and Mental Health Services Evaluation, Service, Demonstration, Education, Fellowship, Training, Clinical Training, and Community Services Programs (HHS/SAMHSA/OA).
 </subsection> <subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Director, Center for Substance Abuse Prevention,  Substance Abuse and Mental Health Services Administration,  1 Choke Cherry Road, Room 4-1057, Rockville, Maryland 20857.
</p> <p>Director, Center for Substance Abuse Treatment,  Substance Abuse and Mental Health Services Administration,  1 Choke Cherry Road, Room 5 -1015, Rockville, Maryland 20857.
</p> <p>Director, Center for Mental Health Services,  Substance Abuse and Mental Health Services Administration,  1 Choke Cherry Road, Room 6 -1057, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Principal investigators, program directors, trainees, fellows, and other employees of applicant or grantee institutions.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Grant and cooperative agreement applications and review history, including curriculum vitae, salary information, summary of review committee deliberations and supporting documents, progress reports, financial records, and payback records of clinical training awardees.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>SAMHSA: Public Health Service Act, Sections 301 (42 U.S.C. 241), 303 (42 U.S.C. 242(a), 322 (42 U.S.C. 249(c), 501 (42 U.S.C. 290aa), 503 (42 U.S.C. 290aa-2), and 505 (42 U.S.C. 290aa-4). CSAP: Center for Substance Abuse Prevention, Section 515-18 (42 U.S.C 290bb-21 <i>et seq.</i>). CSAT: Center for Substance Abuse Treatment, Section 507-12 (42 U.S.C. 290bb <i>et seq.</i>). CMHS: Center for Mental Health Services, Sections 506 (42 U.S.C. 290aa-5) and 520-35 (42 U.S.C. 290bb-31 <i>et seq.</i>). Protection and Advocacy for Individuals with Mental Illness Act of 1986 as amended (42 U.S.C. 10801 <i>et seq.</i>); Refugee Education Assistance Act of 1980, Section 501 (c) (8 U.S.C. 1522 note), Public Law 96-422; Executive Order 12341; and Disaster Relief Act of 1974, Section 413, Public Law 93-288, as amended by Section of 416 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, Public Law 100-107.</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent>
<p>Records are maintained as official documentation relevant to the review, award, and administration of grant programs. Specifically, records are: (1) Used by staff program and management specialists for purpose of awarding and monitoring grant funds; and (2) used to maintain communication with former trainees/fellows who have incurred an obligation for clinical training under Public Health Service Act, Section 303 (42 U.S.C. 242a).
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to qualified experts not within the definition of Department employees for opinion during the application review process.
</p> <p>2. Disclosure may be made to SAMHSA contractors for the purpose of providing services related to the grant review or for carrying out quality assessment, program evaluation, and management reviews. Contractors are required to maintain Privacy Act safeguards with respect to the records.
</p> <p>3. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal (<i>e.g., </i> the Department of Justice) or State (<i>e.g.,</i> the State's Attorney's Office), charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto for litigation.
</p> <p>4. Disclosure may be made to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.
</p> <p>5. Where Federal agencies having the power to subpoena other Federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p> <p>6. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
</p> <p>7. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.</p>
<p>8. A record from this system may be disclosed to the following entities in order to help collect a debt owed the United States:
</p><p>(a) To another Federal agency so that agency can effect a salary offset;
</p><p>(b) to another Federal agency so that agency can effect an administrative offset under common law or under 31 U.S.C. 3716 (withholding from money payable to, or held on behalf of, the individual);
</p><p>(c) to the Treasury Department, Internal Revenue Service (IRS), to request his/her mailing address to locate him/her or in order to have a credit report prepared;
</p><p>(d) to agents of the Department and to other third parties to help locate him/her in order to help collect or compromise a debt;
</p><p>(e) to debt collection agents under 31 U.S.C. 3718 or under common law to help collect a debt; and
</p><p>(f) to the Justice Department for litigation or further administrative action.
</p> <p>Disclosure under part (d) of this routine use is limited to the individual's name, address, social security number and other information necessary to identify him/her. Disclosure under parts (a)-(c) and (e) is limited to those items; the amount, status, and history of the claim; and the agency or program under which the claim arose. An address obtained from IRS may be disclosed to a credit reporting agency under part (d) only for the purpose of preparing a commercial credit report on the individual. Part (a) applies to any claims or debts arising or payable under the Social Security Act if and only if the employee consents in writing to the offset.
</p> <p>9. SAMHSA may disclose information from its records in this system to consumer reporting agencies in order to obtain credit reports to verify credit worthiness of grant/cooperative agreement applicants. Permissible disclosures include name, address, Social Security number or other information necessary to identify the individual; the funding being sought; and the program for which the information is being obtained.
</p> <p>10. When a debt becomes partly or wholly uncollectible, either because the time period for collection under the statute of limitations has expired or because the Government agrees with the individual to forgive or compromise the debt, a record from this system of records may be disclosed to the Internal Revenue Service to report the written-off amount as taxable income to the individual.
</p> <p>11. A record from this system may be disclosed to another Federal agency that has asked the Department to effect an administrative offset under common law or under 31 U.S.C. 3716 to help collect a debt owed the United States.
</p> <p>Disclosure under this routine use is limited to: name, address, Social Security number, and other information necessary to identify the individual, information about the money payable to or held for the individual, and other information concerning the administrative offset.
</p> <p>12. SAMHSA may disclose from this system of records to the Department of Treasury, Internal Revenue Service (IRS): (1) A delinquent debtor's name, address, Social Security number, and other information necessary to identify the debtor; (2) the amount of the debt; and (3) the program under which the debt arose, so that IRS can offset against the debt any income tax refunds which may be due to the debtor.
</p> <p>13. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p><p>DISCLOSURES TO CONSUMER REPORTING AGENCIES: </p><p>Disclosures may be made from this system to "consumer reporting agencies" as defined in the Fair Credit Reporting Act (15 U.S.C. 1681 (f)) or the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a)(3)). The purpose of such disclosures is to provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records. Information disclosed will be limited to name, Social Security number, address, other information necessary to establish the identity of the individual, the amount, status, and history of the claim, and the agency or program under which the claim arose. Such disclosures will be made only after the procedural requirements of 31 U.S.C. 3711(f) have been met.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Non-computerized documents are filed in folders in enclosed file cabinets and open shelves. Computerized records exist in tape and disk form.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>By grant numbers and cross-indexed by name.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. <i>Authorized Users:</i> Access is limited to the Director, Division of Grants Management, SAMHSA, and staff authorized by him/her: grants specialists, grants technicians, program officials, assigned computer personnel, and possibly contractor staff including the project director and research associates.
</p> <p>2. <i>Physical Safeguards:</i> Records are maintained in a secured area. During normal work hours, area is staffed by authorized personnel who must show identification for entry. At other times, the computer area is locked. Hard copy files are stored in rooms which are locked at night. A 24-hour security guard patrols building.
</p> <p>3. <i>Procedural Safeguards:</i> Computer records are password protected; passwords are changed periodically. Contractors working on computerized records are given passwords to access data only on a need-to-know basis.
</p> <p>4. <i>Implementation Guidelines:</i> DHHS Chapter 45-13 of the General Administration Manual and Part 6, "Automated Information Systems Security" of the Information Resources Management Manual.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>a. <i>Alcohol, Drug Abuse, and Mental Health Services Evaluation, Services and Demonstration Grants:</i> A copy of the final report is offered to the National Archives and Records Administration when 10 years old. Other records are held two years after termination of support Suitland Road, Suitland, MD, 20409. Records are destroyed when 6 years and 3 months old.
</p> <p>b. <i>Education Grants:</i> Records are held 2 years after completion of grants activities and final audit and then transferred to the Washington National Records Center located at 4205 Suitland Road, Suitland, MD 20409. Records are destroyed when 13 years old.
</p> <p>c. <i>Training Program Grants:</i> Records are held 1 year after termination of support and final audit and then retired transferred to the Washington National Records Center located at 4205 Suitland Road, Suitland, MD 20409. Records are destroyed when 3 years old.
</p> <p>d. <i>Fellowships, Community Services Program Grants and Other Related Grants:</i> Records are held 2 years after termination of support and final audit and then retired to the Washington National Records Center located at 4205 Suitland Road, Suitland, MD 20409. Records are destroyed when 5 years old.</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Same as System Location.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the appropriate System Manager at the above address. Verifiable proof of identity is required.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedure. Requesters should also reasonably specify the record contents being sought, and should provide the official grant number when possible. An individual may also request an accounting of disclosures of his/her record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the appropriate System Manager at the address specified above and reasonably identify the record, specify the information being contested, the corrective action sought, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Applicants, grantees, fellows, trainees, personnel at grantee institution on whom the record is maintained, Federal advisory committees, site visitors, consultants, references.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-30-0033" toc="yes">
<systemNumber>09-30-0033</systemNumber>
<subsection type="systemName">Correspondence Files (HHS/SAMHSA/OA).</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of the Administrator, Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road,  Room, 8-1065, Rockville, Maryland 20857.
</p> <p>Office of the Director, Center for Substance Abuse Prevention, Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road,  Room, 4-1057, Rockville, Maryland 20857.
</p> <p>Office of the Director, Center for Substance Abuse Treatment, Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road,  Room, 5-1015, Rockville, Maryland 20857.
</p> <p>Office of the Director, Center for Mental Health Services, Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road, Room, 4-1057, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who request information on SAMHSA programs.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Correspondence.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>SAMHSA: Public Health Service Act, Sections 301 (42 U.S.C. 241), 322 (42 U.S.C. 249(c)), and 501-05 (42 U.S.C. 290aa <i>et seq</i>). CSAP: Center for Substance Abuse Prevention, Section 515-8 (42 U.S.C. 290bb-21 <i>et seq.</i>). CSAT: Center for Substance Abuse Treatment, Section 507-12 (42 U.S.C. 290bb <i>et seq.</i>). CMHS: Center for Mental Health Services, Sections 506 (42 U.S.C. 290aa -5) and 520-35 (42 U.S.C. 290bb-31 <i>et seq.</i>). Protection and Advocacy for Individuals with Mental Illness Act of 1986 as amended (42 U.S.C. 1801 <i>et seq.</i>); Refugee Education Assistance Act of 1980, Section 501(c) (8 U.S.C. 1522 note), Public Law 96 -422; Executive Order 12341; and Disaster Relief Act of 1974, Section 413, Public Law 93-288, as amended by Section 416 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act Public Law 100-107.</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>To provide reference retrieval and control to assure timely and appropriate attention.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the request of that individual.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Correspondence records maintained in hard copy; control records maintained on computer printout, tape, and disk.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Hard copy records indexed alphabetically by name and date of outgoing correspondence, by subject, and/or by computerized numerical code. Records are cross-referenced in detail on computer.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. <i>Authorized Users:</i> Authorized correspondence control staff in each location and managers and supervisors on a need-to-know basis.
</p> <p>2. <i>Physical Safeguards:</i> Records are maintained in file cabinets in a locked, secure location; computer system records are secured through the use of passwords which are changed frequently.
</p> <p>3. <i>Procedural Safeguards:</i> Only authorized personnel have access to files and passwords.
</p> <p>4. <i>Implementation Guidelines:</i> DHHS Chapter 45-13 of the General Administration Manual and Part 6, "Automated Information Systems Security" in the HHS Information Resources Management Manual.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Records which are pertinent are held 5 years and then transferred to the Washington National Records Center (WNRC) located at 4205 Suitland Road, Suitland, MD 20409. Records are destroyed when 10 years old. Other material is destroyed when 2 years old. Control forms are destroyed when 1 year old.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Same as system location; each system manager maintains full responsibility for their specific correspondence system.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>An individual may learn if a record exists about himself or herself by contacting the appropriate System Manager as listed under system location above. Give name and approximate date of records requested. Individuals who request notification in person must supply one proof of identity containing individual's complete name and one other identifier with picture (<i>e.g.,</i> driver's license, building pass). Individuals who request notification by mail must supply notarized signature as proof of identity.</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the appropriate official at the address specified under Notification Procedures above and reasonably identify the record. Specify the information to be contested, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Records are derived from incoming and outgoing correspondence.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-30-0036" toc="yes">
<systemNumber>09-30-0036</systemNumber>
<subsection type="systemName">Alcohol, Drug Abuse, and Mental Health Epidemiologic Data (HHS/SAMHSA/OA).</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Records are located at facilities which collect or provide service evaluations for this system under contract to the agency. Contractors may include, but are not limited to, research centers, clinics, hospitals, universities, research foundations, national associations, and coordinating centers. Records may also be located at the Office of Applied Studies, the Center for Substance Abuse Prevention, the Center for Substance Abuse Treatment, and the Center for Mental Health Services. A current list of sites is available by writing to the appropriate System Manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>Individuals who are the subjects of epidemiologic, methodologic, services evaluations, and longitudinal studies and surveys of mental health and alcohol and drug use/abuse and mental, alcohol, and/or drug abuse disorders. These individuals are selected as representative of the general adult and/or child population or of special groups. Special groups include, but are not limited to, normal individuals serving as controls; clients referred for or receiving medical, mental health, and alcohol and/or drug abuse related treatment and prevention services; providers of services; demographic sub-groups as applicable, such as age, sex, ethnicity, race, occupation, geographic location; and groups exposed to hypothesized risks, such as relatives of individuals who have experienced mental health and/or alcohol, and/or drug abuse disorders, life stresses, or have previous history of mental, alcohol, and/or drug abuse related illness.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>The system contains data about the individual as relevant to a particular study. Examples include, but are not limited to, items about the health/mental health and/or alcohol or drug consumption patterns of the individual; demographic data; Social Security numbers (voluntary); past and present life experiences; personality characteristics; social functioning; utilization of health/mental health, alcohol, and/or drug abuse services; family history; physiological measures; and characteristics and activities of health/mental health, alcohol abuse, and/or drug abuse care providers.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>SAMHSA: Public Health Service Act, Section 301 (42 U.S.C. 241), 322 (42 U.S.C. 249(c)), 501 (42 U.S.C. 290aa), 502 (42 U.S.C. 290aa -2), and 505 (42 U.S.C. 290aa-4). CSAP: Center for Substance Abuse Prevention, Section 515-18 (42 U.S.C. 290bb-21 <i> et seq.</i>). CSAT: Center for Substance Abuse Treatment, Section 507-12 (42 U.S.C. 290bb <i>et seq.</i>). CMHS: Center for Mental Health Services, Sections 506 (42 U.S.C. 290aa-5) and 520-35 (42 U.S.C. 290bb-31 <i>et seq.</i>). Protection and Advocacy for Individuals with Mental Illness Act of 1980, Section 501(c) (8 U.S.C. 1522 note), Public Law 96-422; Executive Order 12341; and Disaster Relief Act of 1974, Section 416 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, Public Law 100-107.</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>The purpose of the system of records is to collect and maintain a data base for health services evaluation activities of the Center for Substance Abuse Prevention, the Center for Substance Abuse Treatment, and the Center for Mental Health Services. Analyses of these data involve groups of individuals with given characteristics and do not refer to special individuals. The generation of information and statistical analyses will ultimately lead to a better description and understanding of mental, alcohol, and/or drug abuse disorders, their diagnosis, treatment and prevention, and the promotion of good physical and mental health.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. A record may be disclosed for an evaluation purpose, when the Department:
</p><p>(a) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; <i>e.g.,</i> disclosure of alcohol or drug abuse patient records will be made only in accordance with 42 U.S.C. 290(dd-2).
</p> <p>(b) has determined that the study purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring;
</p><p>(c) has required the recipient to--(1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, and (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the health services evaluation project, unless the recipient has presented adequate justification of an analytical or health nature for retaining such information, and (3) make no further use or disclosure of the record except--(A) in emergency circumstances affecting the health or safety of any individual, (B) for use in another health services research or evaluation project, under these same conditions, and with written authorization of the Department, (C) for disclosure to a properly identified person for the purpose of an audit related to the evaluation project, if information that would enable study subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (D) when required by law; and
</p><p>(d) has secured a written statement attesting to the recipient's understanding of, and willingness to abide by, these provisions.
</p> <p>2. Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from a congressional office made at the written request of that individual.
</p> <p>3. In the event of litigation, where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee; the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided such disclosure is compatible with the purpose for which the records were collected (e.g., disclosure may be made to the Department of Justice or other appropriate Federal agencies in defending claims against the United States when the claim is based upon an individual's mental or physical condition and is alleged to have arisen because of the individual's participation in activities of a Federal Government supported research project).
</p> <p>4. The Department contemplates that it will contract with a private firm for the purpose of collecting, analyzing, aggregating, or otherwise refining records in this system. Relevant records will be disclosed to such contractor. The contractor shall be required to maintain Privacy Act safeguards with respect to such records.
</p> <p>5. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Records may be stored on index cards, file folders, computer tapes and disks, microfiche, microfilm, and audio and video tapes. Normally, the factual data, with study code numbers, are stored on computer tape or disk, while the key to personal identifiers is stored separately, without factual data, in paper files.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>During data collection stages and follow up, if any, retrieval by personal identifier (e.g., name, social security number (in some studies), or medical record number), is necessary. During the data analysis stage, data are normally retrieved by the variables of interest (e.g., diagnosis, age, occupation).
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. <i>Authorized Users:</i> Access to identifiers and to link files is strictly limited to those authorized personnel whose duties require such access. Procedures for determining authorized access to identified data are established as appropriate for each location. Personnel, including contractor personnel, who may be so authorized include those directly involved in data collection and in the design of research studies, <i>e.g.,</i> interviewers and interviewer supervisors; project managers; and statisticians involved in designing sampling plans.
</p> <p>2. <i>Physical Safeguards:</i> Records are stored in locked rooms, locked file cabinets, and/or secured computer facilities. Personal identifiers and link files are separated as much as possible and stored in locked files. Computer data access is limited through the use of key words known only to authorized personnel.
</p> <p>3. <i>Procedural Safeguards:</i> Collection and maintenance of data is consistent with legislation and regulations in the protection of human subjects, informed consent, confidentiality, and confidentiality specific to drug and alcohol abuse patients where these apply. When a SAMHSA component or a contractor provides anonymous data to research scientists for analysis, study numbers which can be matched to personal identifiers will be eliminated, scrambled, or replaced by the agency or contractor with random numbers which cannot be matched. Contractors who maintain records in this system are instructed to make no further disclosure of the records. Privacy Act requirements are specifically included in contracts for survey and research activities related to this system. The HHS project directors, contract officers, and project officers oversee compliance with these requirements.
</p> <p>4. <i>Implementation Guidelines:</i> DHHS Chapter 45-13 of the General Administration Manual and Part 6, "Automated Information Systems Security" of the HHS Information Resources Management Manual.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Records may be retired to the Washington National Records Center located at 4205 Suitland Road, Suitland, MD 20409, and subsequently disposed of in accordance with the SAMHSA Records Control Schedule. The records control schedule and disposal standard for these records may be obtained by writing to the appropriate System Manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Office of the Director, Office of Applied Studies, Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road, Room 7-1047, Rockville, Maryland 20857.
</p> <p>Office of the Director, Center for Substance Abuse Prevention, Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road,  Room 4-1057, Rockville, Maryland 20857.
</p> <p>Office of the Director, Center for Substance Abuse Treatment, Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road,  Room 5-1015, Rockville, Maryland 20857.
</p> <p>Office of the Director, Center for Mental Health Services, Substance Abuse and Mental Health Services Administration, 1 Choke Cherry Road, Room 6-1057, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the appropriate System Manager at the address above. Provide individual's name; current address; date of birth; date, place and nature of participation in specific evaluation study; name of individual or organization administering the study (if known); name or description of the study (if known); address at the time of participation; and a notarized statement by two witnesses attesting to the individual's identity.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p> <p>An individual who requests notification of, or access to, a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. A parent or guardian who requests notification of, or access to, a child's or incompetent person's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child or incompetent person as well as his or her own identity.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the appropriate official at the address specified under System Manager(s) above and reasonably identify the record, specify the information being contested, and state corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>The system contains information obtained directly from the subject individual by interview (face-to-face or telephone), by written questionnaire, or by other tests, recording devices or observations, consistent with legislation and regulation regarding informed consent and protection of human subjects. Information is also obtained from other sources, such as health, mental health, alcohol, and/or drug abuse care providers; relatives; guardians; and clinical medical research records.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>

<section id="09-30-0050" toc="yes">
<systemNumber>09-30-0050</systemNumber>
<subsection type="systemName">Child Care Subsidy Program Records (HHS/SAMHSA/OPS).</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This system of records is maintained by the Office of Program Services, 5600 Fishers Lane, Rockville, Maryland 20857. The system of records will also be maintained at various contractor sites. A current list of contractor sites is available by writing to the System Manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The individuals in the system are employees of the Substance Abuse and Mental Health Services Administration who voluntarily apply for child care subsidies.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Application forms for a child care subsidy contain personal information, including employee's (parent) name, Social Security Number, grade, home phone number, home address, total income, number of dependent children, and number of children on whose behalf the parent is applying for a subsidy, information on any tuition assistance received from State/County/local child care subsidy, and information on child care providers used, including their name, address, provider license number, and State where license issued, tuition cost, provider tax identification number, and copies of Internal Revenue Form 1040 for verification purposes.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Pub. L. 106-58 and Executive Order 9397.
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To establish and verify SAMHSA employees' eligibility for child care subsidies in order for SAMHSA to provide monetary assistance for its employees.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a Member of Congress or to a congressional staff member in response to a request for assistance from the Member by the individual of record.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation, and HHS determines that the use of such records by the Department of Justice, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. SAMHSA intends to disclose information from this system to an expert, consultant, or contractor (including employees of the contractor) of SAMHSA if necessary to further the implementation and operation of this program.
</p> <p>4. Disclosure may be made to a Federal, State, or local agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, where the Substance Abuse and Mental Health Services Administration is made aware of a violation or potential violation of civil or criminal law or regulation.
</p> <p>5. Disclosure may be made to the Office of Personnel Management or the General Accounting Office when the information is required for evaluation of the subsidy program.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p> Information may be collected on paper or electronically and may be stored as paper forms or on computers.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The records are retrieved by name and may also be cross-referenced to Social Security Number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>--Authorized Users: Only SAMHSA personnel working on this project and personnel employed by SAMHSA contractors to work on this project are authorized users as designated by the system manager.
</p> <p>--Physical Safeguards: Records are stored in lockable metal file cabinets or security rooms.
</p> <p>--Procedural Safeguards: Contractors who maintain records in this system are instructed to make no further disclosure of the records, except as authorized by the system manager and permitted by the Privacy Act. Privacy Act requirements are specifically included in contracts.
</p> <p>--Technical Safeguards: Electronic records are protected by use of passwords.
</p> <p>--Implementation Guidelines: HHS Chapter 45-13 of the General Administration Manual, "Safeguard Records Contained in Systems of Records and the HHS Automated Information Systems Security Program Handbook, Information Resources Management Manual."
</p></xhtmlContent></subsection>
 <subsection type="retentionAndDisposal"><xhtmlContent><p>Disposition of records is according to the National Archives and Records Administration (NARA) guidelines, as set forth in the SAMHSA Records Control Schedule, Appendix B-311 (NCI-90-76-5) Item 45.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Division of Human Resources Management, Office of Program Services, Substance Abuse and Mental Health Services Administration, 5600 Fishers Lane, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Individuals may submit a request with a notarized signature on whether the system contains records about them to the above system manager.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Requests from individuals for access to their records should be addressed to the system manager. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosures of their records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedures above and reasonably identify the record, specify the information being contested, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information is provided by SAMHSA employees who apply for child care subsidies. Furnishing of the information is voluntary.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection> </section>
<section id="09-30-0051" toc="yes">
<systemNumber>09-30-0051</systemNumber>
<subsection type="systemName">SAMHSA Information Mailing System (SIMS).</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>This system of records is maintained by the Office of Communications, 1 Choke Cherry Road, Rockville, Maryland 20857. The system of records will also be maintained at the site of the contractor managing SAMHSA's National Clearinghouse on Alcohol and Drug Abuse. Additional information about that contractor site is available by writing  to the System Manager at the address below.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>The individuals listed in the system are individuals who voluntarily request publications and other information from the SAMHSA Web site.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Request forms for SAMHSA publications include categories for personal information, such as name, phone number (home phone number may be provided), address (home address may be provided), title, level  of education, topics/areas of interest related to SAMHSA programs, occupation, type of organization in  which employed, and ethnic group.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Public Law 102-321 ("ADAMHA Reorganization Act"), Section 501 on July 10, 1992, as amended by Public Law 106- 310.
</p></xhtmlContent></subsection>
<subsection type="purpose"><xhtmlContent><p>To establish a mailing list of States, political subdivisions, educational agencies and institutions, treatment providers, organizations, and individuals to provide SAMHSA publications and other print materials identified as of interest to them. In addition, it is used to provide them information about new and upcoming publications.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>1. Disclosure may be made to a Member of Congress or to a congressional staff member in response to a request for assistance from the Member by the individual of record.
</p> <p>2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court  or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or  her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation, and HHS determines that the use of such records by the Department of Justice, court or other  tribunal is relevant and necessary to the litigation  and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>3. SAMHSA intends to disclose information from this system to an expert, consultant, or contractor (including employees of the contractor) of SAMHSA only if necessary to further the implementation and operation of this program.
</p> <p>4. To appropriate Federal agencies and Department  contractors that have a need to know the information  for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Storage:
</p> <p>Information may be collected on paper or electronically and may be stored as paper forms or on computers.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>The records are retrieved by name; they may be sorted by topic of interest, State, organizational affiliation in order to direct information of relevance to them.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p><i>Authorized Users:</i> Only SAMHSA personnel working on this project and personnel employed by SAMHSA contractors to work on this project are authorized users as designated by the system manager.
</p> <p><i>Physical Safeguards:</i> Physical paper records are stored in lockable metal file cabinets or security rooms.
</p> <p><i>Procedural Safeguards:</i> Contractors who maintain records in this system are instructed to make no further disclosure of the records, except  as authorized by the system manager and permitted by the Privacy Act. Privacy Act requirements are specifically included in contracts.
</p> <p><i>Technical Safeguards:</i> Electronic records are protected by use of passwords.
</p> <p><i>Implementation Guidelines:</i> HHS Chapter 45-13 of the General Administration Manual, "Safeguarding Records Contained in Systems of Records and the HHS Automated Information Systems Security Program Handbook, Information Resources Management Manual."</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Disposition of records is according to the National Archives and Records Administration (NARA) guidelines, as set forth in the SAMHSA Records Control Schedule, Appendix B-311 (NCI-90-76-5) Item 3.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Director, Office of Communications, Office of the  Administrator,  Substance Abuse and Mental Health Services Administration,  1 Choke Cherry Road, Room,  8-1033, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>Individuals may submit a request with a notarized  signature on whether the system contains records about them to the above system manager.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Individuals have direct access to their personal record on the SIMS system, via the Internet, utilizing a discrete password of their own selection. Should this not be feasible or desired, and, in all other cases, requests from individuals for access to their records should be addressed to the system manager. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosures of their records, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under Notification Procedures above and reasonably identify the record, specify the information being  contested, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Information is provided by individuals, among others, who request SAMHSA publications. Furnishing of the information is voluntary.
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="09-30-0052" toc="yes">
<systemNumber>09-30-0052</systemNumber>
<subsection type="systemName">Opioid Treatment Waiver Notification System (OTWNS).</subsection>
<subsection type="securityClassification"><xhtmlContent><p>None.
</p></xhtmlContent></subsection>
 <subsection type="systemLocation"><xhtmlContent><p>Office of Pharmacologic and Alternative Therapies, Center for Substance Abuse Treatment, Substance Abuse and Mental Health Services Administration, Room 5-1015, 1 Choke Cherry Road, Rockville, Maryland 20857.
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfIndividuals"><xhtmlContent><p>An individual practitioner (physician) or a practitioner in a group practice who submits a  written notification of intent to use schedule III, IV, or V opioid drugs for the maintenance or detoxification treatment of opiate addiction under 21 U.S.C. 823(g)(2).
</p></xhtmlContent></subsection>
 <subsection type="categoriesOfRecords"><xhtmlContent><p>Physician name, address, phone, facsimile, state medical license number, DEA registration number, credentialing and specialized training information. In addition, for those practitioners in group practices, the group practice EIN.
</p></xhtmlContent></subsection>
 <subsection type="authorityForMaintenance"><xhtmlContent><p>Controlled Substance Act (21 U.S.C. 823(g)(2)).
</p></xhtmlContent></subsection>
 <subsection type="purpose"><xhtmlContent><p>To determine (as required by 21 U.S.C. 823 (g)(2)) whether practitioners who submit notifications meet all of the requirements for a waiver under 21 U.S.C. 823(g)(2)(B). The established criteria for a  waiver include: a written notification that states the practitioner's name, the practitioner's registration under 21 U.S.C. 823(f), the practitioner's physician license under State law, and the qualifying physician criteria. The record system will also allow disclosure with consent of limited information to the Treatment Facility Locator.
</p></xhtmlContent></subsection>
 <subsection type="routineUsesOfRecords"><xhtmlContent><p>A. Medical specialty societies to verify practitioner qualifications.
</p> <p>B. Other Federal law enforcement and regulatory agencies for law enforcement and regulatory purposes.
</p> <p>C. State and local law enforcement and regulatory  agencies for law enforcement and regulatory purposes.
</p> <p>D. Persons registered under the Controlled Substance Act (Pub. L. 91-513) for the purpose  of verifying the registration of customers and practitioners.
</p> <p>E. Disclosure may be made to a congressional  office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.</p>
<p>F. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court  or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of  Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective  representation of the governmental party, provided however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
</p> <p>G. SAMHSA intends to disclose information from this system to an expert, consultant, or contractor (including employees of the contractor) of SAMHSA if necessary to further the implementation and operation of this program.
</p> <p>H. Disclosure limited to the individual's name, address, and phone number will also be made to the SAMHSA Treatment Facility Locator pursuant to express consent.
</p> <p>I. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
</p><p>Disclosures to consumer reporting agencies:</p><p>None.
</p></xhtmlContent></subsection>
 <subsection type="policiesAndPractices"><xhtmlContent><p>Documents are filed in manual files in enclosed and/or locked file cabinets and in secured computers. The same basic data is maintained in an automated system for quick retrieval.
</p></xhtmlContent></subsection>
 <subsection type="retrievability"><xhtmlContent><p>Records are retrieved by the individual practitioner's name and cross indexed by the practitioner's DEA registration number.
</p></xhtmlContent></subsection>
 <subsection type="safeguards"><xhtmlContent><p>1. <i>Authorized Users:</i> Federal contract and support personnel.
</p> <p>2. <i>Physical Safeguards:</i> All folders are in file cabinets in a room that is locked after business hours in a building with controlled entry (picture identification). Files are withdrawn from cabinet for Federal staff who have a need to know by a sign in and out procedure.
</p> <p>3. <i>Procedural Safeguards:</i> Access to records is strictly limited to those staff members trained in accordance with the Privacy Act.
</p> <p>4. <i>Implementation Guidelines:</i> DHHS Chapter 45-13 of the General Administration Manual.</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>Records are retained for a period of five years and then destroyed.
</p></xhtmlContent></subsection>
 <subsection type="systemManager"><xhtmlContent><p>Nicholas Reuter, Office of Pharmacologic and Alternative Therapies, Center for Substance Abuse Treatment, Substance Abuse and Mental Health Services Administration, Room 6-70, Rockwall II Building, 5600 Fishers Lane, Rockville, Maryland  20857.
</p></xhtmlContent></subsection>
 <subsection type="notificationProcedure"><xhtmlContent><p>To determine if a record exists, write to the appropriate System Manager at the address above or appear in person to the Division of Contracts Management. An individual may learn if a record exists about himself/herself upon written request with notarized signature. An individual who is the subject of records maintained in this record system  may also request an accounting of all disclosures that have been made from that individual's records, if any.
</p></xhtmlContent></subsection>
 <subsection type="recordAccessProcedures"><xhtmlContent><p>Same as notification procedures. Requesters should specify the record contents being sought. An individual may also request an accounting of disclosures of his/her record, if any.
</p></xhtmlContent></subsection>
 <subsection type="contestingRecordProcedures"><xhtmlContent><p>Contact the official at the address specified under notification procedures above and identify the record, specify the information being contested, the corrective action sought, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
</p></xhtmlContent></subsection>
 <subsection type="recordSourceCategories"><xhtmlContent><p>Individual practitioner notifications of intent to use Schedule III, IV, or V opioid drugs for the Maintenance and Detoxification Treatment of Opiate Addiction under 21 U.S.C. 823(g)(2).
</p></xhtmlContent></subsection>
 <subsection type="systemsExempted"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<appendix id="app" toc="yes" letter="1">
<title>HHS Finance Office Locations</title>
<xhtmlContent>

<p><b>Centers for Disease Control and Prevention (CDC), and Agency for Toxic Substances and Disease Registry (ATSDR)</b></p>

<p>University Park, Columbia Building, 2900 Woodcock Boulevard, Atlanta, GA 30341</p>


<p><b>Centers for Medicare &amp; Medicaid Services (CMS)</b></p>

<p>Centers for Medicare &amp; Medicaid Services, 7500 Security Boulevard, Baltimore, MD 21244</p>


<p><b>Food and Drug Administration District Offices (FDA)</b></p>

<p>Food and Drug Administration, FDA, Atlanta District Office, 60 Eighth Street, NE., Atlanta, GA 30309</p>

<p>Food and Drug Administration, FDA, New England District Office, One Montvale Avenue, Stoneham, MA 02180</p>

<p>Food and Drug Administration, FDA, New Jersey District Office, 10 Waterview Boulevard, 3rd Floor, Parsippany, NJ 07054</p>

<p>Food and Drug Administration, FDA, Philadelphia District Office, Room 900, U.S. Customhouse, 2nd and Chestnut Streets, Philadelphia, PA 19106</p>

<p>Food and Drug Administration, FDA, Baltimore District Office, 6000 Metro Drive, Suite 101, Baltimore, MD 21215</p>

<p>Food and Drug Administration, FDA, San Juan District Office, 466 Fernandez Juncos Avenue, San Juan, PR 00901-3223</p>

<p>Food and Drug Administration, FDA, Chicago District Office, 550 W. Jackson Boulevard, Suite 1500 South, Chicago, IL 606601</p>

<p>Food and Drug Administration, FDA, Cincinnati District Office, Food and Drug Administration, FDA, 6751 Steger Drive, Cincinnati, OH 45237-3097</p>

<p>Food and Drug Administration, FDA, Minneapolis District Office, 250 Marquette Avenue, Suite 600, Minneapolis, MN 55401</p>

<p>Food and Drug Administration, FDA, Dallas District Office, 4040 N. Central Expressway, Suite 300, Dallas, TX 75204</p>

<p>Food and Drug Administration, FDA, Southwest Import District, 4040 N. Central Expressway, Suite 300, Dallas, TX 75204</p>

<p>Food and Drug Administration, FDA, New Orleans District Office, 6600 Plaza Drive, Suite 400, New Orleans, LA 70127</p>

<p>Food and Drug Administration, FDA, Kansas City District Office, 8050 Marshall Drive, Suite 205, Lenexa, KS 66214</p>

<p>Food and Drug Administration, FDA, Denver District Office, 6th Avenue &amp; Kipling St., Building 20, Denver Federal Center, Denver, CO 80225-0087</p>

<p>Food and Drug Administration, FDA, Florida District Office, 555 Winderly Place, Suite 200, Maitland, FL 32751</p>

<p>Food and Drug Administration, FDA, San Francisco District Office, 1431 Harbor Bay Parkway, Alameda, CA 94502-7096</p>

<p>Food and Drug Administration, FDA, Los Angeles District Office, 19701 Fairchild, Irvine, CA 92612-2506</p>

<p>Food and Drug Administration, FDA, New York District Office, 158-15 Liberty Avenue, Jamaica, NY 11433-1034</p>

<p>Food and Drug Administration, FDA, Seattle District Office, 22215 26th Ave SE, Suite 210, Bothell, WA 98021</p>

<p>Food and Drug Administration, FDA, Headquarters Office, 10903 New Hampshire Avenue, Silver Spring, MD 20993</p>


<p><b>Indian Health Service (IHS)</b></p>

<p>Alaska Area Indian Health Service, 4141 Ambassador Drive, Anchorage, AK 99508-5928</p>

<p>Albuquerque Area Indian Health Service, 5300 Homestead Road, NE, Albuquerque, NM 87109-1311</p>

<p>Bemidji Area Indian Health Service, 522 Minnesota Avenue, NW, Room 119, Bemidji, MN 56601</p>

<p>Billings Area Indian Health Service, 2900 4th Avenue North, Billings, MT 59101</p>

<p>California Area Indian Health Service, 650 Capitol Mall, Suite 7-100, Sacramento, CA 95814</p>

<p>Great Plains Area IHS, Federal Building, 115 Fourth Avenue, Southeast, Aberdeen, SD 57401 </p>

<p>Nashville Area Indian Health Service, 711 Stewarts Ferry Pike, Nashville, TN 37214-2634</p>

<p>Navajo Area Indian Health Service, P.O. Box 9020, Window Rock, AZ 86515-9020</p>

<p>Oklahoma City Area Indian Health Service, 701 Market Dr., Oklahoma City, OK 73114</p>

<p>Phoenix Area Indian Health Service, Two Renaissance Square, 40 North Central Avenue, Phoenix, AZ 85004-4424</p>

<p>Portland Area Indian Health Service, 1414 NW Northrup Street, Suite 800, Portland, OR 97209</p>

<p>Tucson Area Indian Health Service, 7900 S.J. Stock Road, Tucson, AZ 85746-7012</p>


<p><b>National Institutes of Health (NIH) </b></p>

<p>National Institutes of Health (NIH), Office of the Director (OD), Office of Management (OM), Office of Financial Management (OFM), 2115 East Jefferson Street, Rockville, MD 20892-8500</p>


<p><b>Program Support Center (PSC) </b></p>

<p>Program Support Center (PSC) Division of Fiscal Operations, 5600 Fishers Lane, Room 16-05, Rockville, MD 20857</p>

<p>PSC serves as the finance center for these HHS components:</p>

<p>1. Office of the Secretary (OS)</p>
<p>2. Administration for Children and Families (ACF)</p>
<p>3. Administration for Community Living (ACL)</p>
<p>4. Agency for Healthcare Research and Quality (AHRQ)</p>
<p>5. Health Resources and Services Administration (HRSA)</p>
<p>6. Office of Inspector General (OIG)</p>
<p>7. Substance Abuse and Mental Health Services Administration (SAMHSA)
</p></xhtmlContent></appendix>

<previousPubs id="systems" toc="yes">
<title>Systems of Records Published Between January 2, 2016 and December 31, 2017</title>
</previousPubs>
        <regulations id="reg" toc="yes">
<regulationsTitle number="45">
<heading> Public Welfare </heading>
<regulationsPart number="5b">
<heading> PRIVACY ACT REGULATIONS </heading>
<xhtmlContent><p>
Sec.
</p>
<p>5b.1 Definitions.
</p>
<p>5b.2 Purpose and scope.
</p>
<p>5b.3 Policy.
</p>
<p>5b.4 Maintenance of records.
</p>
<p>5b.5 Notification of or access to records.
</p>
<p>5b.6 Special procedures for notification of or access to medical records.
</p>
<p>5b.7 Procedures for correction or amendment of records.
</p>
<p>5b.8 Appeals of refusals to correct or amend records.
</p>
<p>5b.9 Disclosure of records.
</p>
<p>5b.10 Parents and guardians.
</p>
<p>5b.11 Exempt systems.
</p>
<p>5b.12 Contractors.
</p>
<p>5b.13 Fees.
</p>
<p>Appendix A to Part 5b--Employee Standards of Conduct
</p>
<p>Appendix B to Part 5b--Routine Uses Applicable to More Than One System of Records Maintained by HHS
</p>
<p>Appendix C to Part 5b--Delegations of Authority [Reserved]
</p>
<p><b>Authority:</b> 5 U.S.C. 301, 5 U.S.C. 552a.
</p>
<p><b>Source:</b> 40 FR 47409, Oct. 8, 1975, unless otherwise noted.
</p><p><b>&#167; 5b.1
 Definitions.
</b></p>
<p>As used in this part:
</p>
<p>(a) <i>Access</i> means availability of a record to a subject individual.
</p>
<p>(b) <i>Agency</i> means the Department of Health and Human Services.
</p>
<p>(c) <i>Department</i> means the Department of Health and Human Services.
</p>
<p>(d) <i>Disclosure</i> means the availability or release of a record to anyone other than the subject individual.
</p>
<p>(e) <i>Individual</i> means a living person who is a citizen of the United States or an alien lawfully admitted for permanent residence. It
does not include persons such as sole proprietorships, partnerships, or corporations. A business firm which is identified by the name of one
or more persons is not an individual within the meaning of this part.
</p>
<p>(f) <i>Maintain</i> means to maintain, collect, use, or disseminate when used in connection with the term "record"; and, to have control
over or responsibility for a system of records when used in connection with the term "system of records."
</p>
<p>(g) <i>Notification</i> means communication to an individual whether he is a subject individual.
</p>
<p>(h) <i>Record</i> means any item, collection, or grouping of information about an individual that is maintained by the Department,
including but not limited to the individual's education, financial transactions, medical history, and criminal or employment history and that
contains his name, or an identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice
print or a photograph. When used in this part, record means only a record which is in a system of records.
</p>
<p>(i) <i>Responsible Department official</i> means that officer who is listed in a notice of a system of records as the system manager for a
given system of records or another individual listed in the notice of a system of records to whom requests may be made, or the designee of
either such officer or individual.
</p>
<p>(j) <i>Routine use</i> means the disclosure of a record outside the Department, without the consent of the subject individual, for a
purpose which is compatible with the purpose for which the record was collected. It includes disclosures required to be made by statute other
than the Freedom of Information Act, 5 U.S.C. 552. It does not include disclosures which are permitted to be made without the consent of the
subject individual which are not compatible with the purpose for which it was collected such as disclosures to the Bureau of the Census, the
General Accounting Office, or to Congress.
</p>
<p>(k) <i>Secretary</i> means the Secretary of Health and Human Services, or his designee.
</p>
<p>(l) <i>Statistical record</i> means a record maintained for statistical research or reporting purposes only and not maintained to make
determinations about a particular subject individual.
</p>
<p>(m) <i>Subject individual</i> means that individual to whom a record pertains.
</p>
<p>(n) <i>System of records</i> means any group of records under the control of the Department from which a record is retrieved by personal
identifier such as the name of the individual, number, symbol or other unique retriever assigned to the individual. Single records or groups
of records which are not retrieved by a personal identifier are not part of a system of records. Papers maintained by individual employees of
the Department which are prepared, maintained, or discarded at the discretion of the employee and which are not subject to the Federal Records
Act, 44 U.S.C. 2901, are not part of a system of records; <i>Provided,</i> That such personal papers are not used by the employee or the
Department to determine any rights, benefits, or privileges of individuals.
</p><p><b>&#167; 5b.2
 Purpose and scope.
</b></p>
<p>(a) This part implements section 3 of the Privacy Act of 1974, 5 U.S.C. 552a (hereinafter referred to as the Act), by establishing
agency policies and procedures for the maintenance of records. This part also establishes agency policies and procedures under which a subject
individual may be given notification of or access to a record pertaining to him and policies and procedures under which a subject individual
may have his record corrected or amended if he believes that his record is not accurate, timely, complete, or relevant or necessary to
accomplish a Department function.
</p>
<p>(b) All components of the Department are governed by the provisions of this part. Also governed by the provisions of this part are:
</p>
<p>(1) Certain non-Federal entities which operate as agents of the Department for purposes of carrying out Federal functions, such as
intermediaries and carriers performing functions under contracts and agreements entered into pursuant to sections 1816 and 1842 of the Social
Security Act, 42 U.S.C. 1395h and 1395u.
</p>
<p>(2) Advisory committees and councils within the meaning of the Federal Advisory Committee Act which provide advice to (i) any official or
component of the Department or (ii) the President and for which the Department has been delegated responsibility for providing services.
</p>
<p>(c) Employees of the Department governed by this part include all regular and special government employees of the Department; members of
the Public Health Service Commissioned Corps; experts and consultants whose temporary (not in excess of 1 year) or intermittent services have
been procured by the Department by contract pursuant to 3109 of Title 5, United States Code; volunteers where acceptance of their services are
authorized by law; those individuals performing gratuitous services as permitted under conditions prescribed by the Civil Service Commission;
and, participants in work-study or training programs.
</p>
<p>(d) Where other statutes mandate procedures which are inconsistent with the procedures set forth in this part, components of the Department
may issue supplementary regulations containing procedures necessary to comply with such statutes. In addition, components of the Department
may supplement by regulation the policies and procedures set forth in this part to meet particular needs of the programs administered by such
components.
</p>
<p>(e) This part does not:
</p>
<p>(1) Make available to a subject individual records which are not retrieved by that individual's name or other personal identifier.
</p>
<p>(2) Make available to the general public records which are retrieved by a subject individual's name or other personal identifier or make
available to the general public records which would otherwise not be available to the general public under the Freedom of Information Act, 5
U.S.C. 552, and Part 5 of this title.
</p>
<p>(3) Govern the maintenance or disclosure of, notification of or access to, records in the possession of the Department which are subject to
regulations of another agency, such as personnel records subject to the regulations of the Civil Service Commission.
</p>
<p>(4) Apply to grantees, including State and local governments or subdivisions thereof, administering federally funded programs.
</p>
<p>(5) Make available records compiled by the Department in reasonable anticipation of court litigation or formal administrative proceedings.
The availability of such records to the general public or to any subject individual or party to such litigation or proceedings shall be
governed by applicable constitutional principles, rules of discovery, and applicable regulations of the Department and any of its components.
</p><p><b>&#167; 5b.3
 Policy.
</b></p>
<p>It is the policy of the Department to protect the privacy of individuals to the fullest extent possible while nonetheless permitting
the exchange of records required to fulfill the administrative and program responsibilities of the Department, and responsibilities of the
Department for disclosing records which the general public is entitled to have under the Freedom of Information Act, 5 U.S.C. 552, and Part 5
of this title.
</p><p><b>&#167; 5b.4
 Maintenance of records.
</b></p>
<p>(a) No record will be maintained by the Department unless:
</p>
<p>(1) It is relevant and necessary to accomplish a Department function required to be accomplished by statute or Executive Order;
</p>
<p>(2) It is acquired to the greatest extent practicable from the subject individual when maintenance of the record may result in a
determination about the subject individual's rights, benefits or privileges under Federal programs;
</p>
<p>(3) The individual providing the record is informed of the authority for providing the record (including whether the providing of the
record is mandatory or voluntary, the principal purpose for maintaining the record, the routine uses for the record, what effect his refusal
to provide the record may have on him), and if the record is not required by statute or Executive Order to be provided by the individual, he
agrees to provide the record.
</p>
<p>(b) No record will be maintained by the Department which describes how an individual exercises rights guaranteed by the First Amendment
unless expressly authorized (1) by statute, or (2) by the subject individual, or (3) unless pertinent to and within the scope of an authorized
law enforcement activity.
</p><p><b>&#167; 5b.5
 Notification of or access to records.
</b></p>
<p>(a) <i>Times, places, and manner of requesting notification of or access to a record.</i> (1) Subject to the provisions governing
medical records in &#167; 5b.6 of this part, any individual may request notification of a record. He may at the same time request access
to any record pertaining to him. An individual may be accompanied by another individual of his choice when he requests access to a record in
person; <i>Provided,</i> That he affirmatively authorizes the presence of such other individual during any discussion of a record to which
access is requested.
</p>
<p>(2) An individual making a request for notification of or access to a record shall address his request to the responsible Department
official and shall verify his identity when required in accordance with paragraph (b)(2) of this section. At the time the request is made, the
individual shall specify which systems of records he wishes to have searched and the records to which he wishes to have access. He may also
request that copies be made of all or any such records. An individual shall also provide the responsible Department official with sufficient
particulars to enable such official to distinguish between records on subject individuals with the same name. The necessary particulars are
set forth in the notices of systems of records.
</p>
<p>(3) An individual who makes a request in person may leave with any responsible Department official a request for notification of or access
to a record under the control of another responsible Department official; <i>Provided,</i> That the request is addressed in writing to the
appropriate responsible Department official.
</p>
<p>(b) <i>Verification of identity</i>--(1) <i>When required.</i> Unless an individual, who is making a request for notification of or
access to a record in person, is personally known to the responsible Department official, he shall be required to verify his identity in
accordance with paragraph (b)(2) of this section if:
</p>
<p>(i) He makes a request for notification of a record and the responsible Department official determines that the mere disclosure of the
existence of the record would be a clearly unwarranted invasion of privacy if disclosed to someone other than the subject individual; or,
</p>
<p>(ii) He makes a request for access to a record which is not required to be disclosed to the general public under the Freedom of Information
Act, 5 U.S.C. 552, and Part 5 of this title.
</p>
<p>(2) <i>Manner of verifying identity.</i> (i) An individual who makes a request in person shall provide to the responsible Department
official at least one piece of tangible identification such as a driver's license, passport, alien or voter registration card, or union card
to verify his identity. If an individual does not have identification papers to verify his identity, he shall certify in writing that he is
the individual who he claims to be and that he understands that the knowing and willful request for or acquisition of a record pertaining to
an individual under false pretenses is a criminal offense under the Act subject to a $5,000 fine.
</p>
<p>(ii) Except as provided in paragraph (b)(2)(v) of this section, an individual who does not make a request in person shall submit a
notarized request to the responsible Department official to verify his identity or shall certify in his request that he is the individual who
he claims to be and that he understands that the knowing and willful request for or acquisition of a record pertaining to an individual under
false pretenses is a criminal offense under the Act subject to a $5,000 fine.
</p>
<p>(iii) An individual who makes a request on behalf of a minor or legal incompetent as authorized under &#167; 5b.10 of this part shall
verify his relationship to the minor or legal incompetent, in addition to verifying his own identity, by providing a copy of the minor's birth
certificate, a court order, or other competent evidence of guardianship to the responsible Department official; <i>except that,</i> an
individual is not required to verify his relationship to the minor or legal incompetent when he is not required to verify his own identity or
when evidence of his relationship to the minor or legal incompetent has been previously given to the responsible Department official.
</p>
<p>(iv) An individual shall further verify his identity if he is requesting notification of or access to sensitive records such as medical
records. Any further verification shall parallel the record to which notification or access is being sought. Such further verification may
include such particulars as the individual's years of attendance at a particular educational institution, rank attained in the uniformed
services, date or place of birth, names of parents, an occupation or the specific times the individual received medical treatment.
</p>
<p>(v) An individual who makes a request by telephone shall verify his identity by providing to the responsible Department official
identifying particulars which parallel the record to which notification or access is being sought. If the responsible Department official
determines that the particulars provided by telephone are insufficient, the requester will be required to submit the request in writing or in
person. Telephone requests will not be accepted where an individual is requesting notification of or access to sensitive records such as
medical records.
</p>
<p>(c) <i>Granting notification of or access to a record.</i> (1) Subject to the provisions governing medical records in &#167; 5b.6 of
this part and the provisions governing exempt systems in &#167; 5b.11 of this part, a responsible Department official, who receives a
request for notification of or access to a record and, if required, verification of an individual's identity, will review the request and
grant notification or access to a record, if the individual requesting access to the record is the subject individual.
</p>
<p>(2) If the responsible Department official determines that there will be a delay in responding to a request because of the number of
requests being processed, a breakdown of equipment, shortage of personnel, storage of records in other locations, etc., he will so inform the
individual and indicate when notification or access will be granted.
</p>
<p>(3) Prior to granting notification of or access to a record, the responsible Department official may at his discretion require an
individual making a request in person to reduce his request to writing if the individual has not already done so at the time the request is
made.
</p><p><b>&#167; 5b.6
 Special procedures for notification of or access to medical records.
</b></p>
<p>(a) <i>General.</i> An individual in general has a right to notification of or access to his medical records, including psychological
records, as well as to other records pertaining to him maintained by the Department. This section sets forth special procedures as permitted
by the Act for notification of or access to medical records, including a special procedure for notification of or access to medical records of
minors. The special procedures set forth in paragraph (b) of this section may not be suitable for use by every component of the Department.
Therefore, components may follow the paragraph (b) procedure for notification of or access to medical records, or may issue regulations
establishing special procedures for such purposes. The special procedure set forth in paragraph (c) of this section relating to medical
records of minors is mandatory.
</p>
<p>(b) <i>Medical records procedures</i>--(1) <i>Notification of or access to medical records.</i> (i) Any individual may request
notification of or access to a medical record pertaining to him. Unless the individual is a parent or guardian requesting notification of or
access to a minor's medical record, an individual shall make a request for a medical record in accordance with this section and the procedures
in &#167; 5b.5 of this part.
</p>
<p>(ii) An individual who requests notification of or access to a medical record shall, at the time the request is made, designate a
representative in writing. The representative may be a physician, other health professional, or other responsible individual, who would be
willing to review the record and inform the subject individual of its contents at the representative's discretion.
</p>
<p>(2) <i>Utilization of the designated representative.</i> A subject individual will be granted direct access to a medical record if the
responsible official determines that direct access is not likely to have an adverse effect on the subject individual. If the responsible
Department official believes that he is not qualified to determine, or if he does determine, that direct access to the subject individual is
likely to have an adverse effect on the subject individual, the record will be sent to the designated representative. The subject individual
will be informed in writing that the record has been sent.
</p>
<p>(c) <i>Medical records of minors</i>--(1) <i>Requests by minors; notification of or access to medical records to minors.</i> A minor
may request notification of or access to a medical record pertaining to him in accordance with paragraph (b) of this section.
</p>
<p>(2) <i>Requests on a minor's behalf; notification of or access to medical records to an individual on a minor's behalf.</i> (i) In order to
protect the privacy of a minor, a parent or guardian, authorized to act on a minor's behalf as provided in &#167; 5b.10 of this part, who
makes a request for notification of or access to a minor's medical record will not be given direct notification of or access to such record.
</p>
<p>(ii) A parent or guardian shall make all requests for notification of or access to a minor's medical record in accordance with this
paragraph and the procedures in &#167; 5b.5 of this part. A parent or guardian shall at the time he makes a request designate a family
physician or other health professional (other than a family member) to whom the record, if any, will be sent.
</p>
<p>(iii) Where a medical record on the minor exists, it will be sent to the physician or health professional designated by the parent or
guardian in all cases. If disclosure of the record would constitute an invasion of the minor's privacy, that fact will be brought to the
attention of the physician or health professional to whom the record is sent. The physician or health professional will be asked to consider
the effect that disclosure of the record to the parent or guardian would have on the minor in determining whether the minor's medical record
should be made available to the parent or guardian. Response to the parent or guardian making the request will be made in substantially the
following form:
</p><p>
We have completed processing your request for notification of or access to
</p>
<p>________________________________________'s
</p>

<p>   (Name of minor)
</p>
<p>medical records. Please be informed that if any medical record were found pertaining to that individual, they have not been sent to your
designated physician or health professional.
</p>

<p>In each case where a minor's medical record is sent to a physician or health professional, reasonable efforts will be made to so inform the
minor.
</p><p><b>&#167; 5b.7
 Procedures for correction or amendment of records.
</b></p>
<p>(a) Any subject individual may request that his record be corrected or amended if he believes that the record is not accurate, timely,
complete, or relevant or necessary to accomplish a Department function. A subject individual making a request to amend or correct his record
shall address his request to the responsible Department official in writing; <i>except that,</i> the request need not be in writing if the
subject individual makes his request in person and the responsible Department official corrects or amends the record at that time. The subject
individual shall specify in each request:
</p>
<p>(1) The system of records from which the record is retrieved;
</p>
<p>(2) The particular record which he is seeking to correct or amend;
</p>
<p>(3) Whether he is seeking an addition to or a deletion or substitution of the record; and,
</p>
<p>(4) His reasons for requesting correction or amendment of the record.
</p>
<p>(b) A request for correction or amendment of a record will be acknowledged within 10 working days of its receipt unless the request can be
processed and the subject individual informed of the responsible Department official's decision on the request within that 10 day period.
</p>
<p>(c) If the responsible Department official agrees that the record is not accurate, timely, or complete based on a preponderance of the
evidence, the record will be corrected or amended. The record will be deleted without regard to its accuracy, if the record is not relevant or
necessary to accomplish the Department function for which the record was provided or is maintained. In either case, the subject individual
will be informed in writing of the correction, amendment, or deletion and, if accounting was made of prior disclosures of the record, all
previous recipients of the record will be informed of the corrective action taken.
</p>
<p>(d) If the responsible Department official does not agree that the record should be corrected or amended, the subject individual will be
informed in writing of the refusal to correct or amend the record. He will also be informed that he may appeal the refusal to correct or amend
his record to the appropriate appeal authority listed in &#167; 5b.8 of this part. The appropriate appeal authority will be identified to
the subject individual by name, title, and business address.
</p>
<p>(e) Requests to correct or amend a record governed by the regulation of another government agency, <i>e.g.,</i> Civil Service Commission,
Federal Bureau of Investigation, will be forwarded to such government agency for processing and the subject individual will be informed in
writing of the referral.
</p><p><b>&#167; 5b.8
 Appeals of refusals to correct or amend records.
</b></p>
<p>(a) <i>Processing the appeal.</i> (1) A subject individual who disagrees with a refusal to correct or amend his record may appeal the
refusal in writing. All appeals shall be made to the following appeal authorities, or their designees, or successors in function:
</p>
<p>(i) Assistant Secretary for Administration and Management for records of the Office of the Secretary, or where the initial refusal to
correct or amend was made by another appeal authority. The appeal authority for an initial refusal by the Assistant Secretary for
Administration and Management is the Under Secretary.
</p>
<p>(ii) Assistant Secretary for Health for records of the Public Health Service including Office of Assistant Secretary for Health; Health
Resources Administration; Health Services Administration; Alcohol, Drug Abuse, and Mental Health Administration; Center for Disease Control;
National Institutes of Health; and Food and Drug Administration.
</p>
<p>(iii) Assistant Secretary for Education for records of the Office of the Assistant Secretary for Education, National Center for Education
Statistics, National Institute of Education, and Office of Education.
</p>
<p>(iv) Assistant Secretary for Human Development for records of the Office of Human Development.
</p>
<p>(v) Commissioner of Social Security for records of the Social Security Administration.
</p>
<p>(vi) Administrator, Social and Rehabilitation Service for the records of the Social and Rehabilitation Service.
</p>
<p>(2) An appeal will be completed within 30 working days from its receipt by the appeal authority; <i>except that,</i> the appeal authority
may for good cause extend this period for an additional 30 days. Should the appeal period be extended, the subject individual appealing the
refusal to correct or amend the record will be informed in writing of the extension and the circumstances of the delay. The subject
individual's request to amend or correct the record, the responsible Department official's refusal to correct or amend, and any other
pertinent material relating to the appeal will be reviewed. No hearing will be held.
</p>
<p>(3) If the appeal authority agrees that the record subject to the appeal should be corrected or amended, the record will be amended and the
subject individual will be informed in writing of the correction or amendment. Where an accounting was made of prior disclosures of the
record, all previous recipients of the record will be informed of the corrective action taken.
</p>
<p>(4) If the appeal is denied, the subject individual will be informed in writing:
</p>
<p>(i) Of the denial and the reasons for the denial;
</p>
<p>(ii) That he has a right to seek judicial review of the denial; and,
</p>
<p>(iii) That he may submit to the responsible Department official a concise statement of disagreement to be associated with the disputed
record and disclosed whenever the record is disclosed.
</p>
<p>(b) <i>Notation and disclosure of disputed records.</i> Whenever a subject individual submits a statement of disagreement to the
responsible Department official in accordance with paragraph (a)(4)(iii) of this section, the record will be noted to indicate that it is
disputed. In any subsequent disclosure, a copy of the subject individual's statement of disagreement will be disclosed with the record. If the
responsible Department official deems it appropriate, a concise statement of the appeal authority's reasons for denying the subject
individual's appeal may also be disclosed with the record. While the subject individual will have access to this statement of reasons, such
statement will not be subject to correction or amendment. Where an accounting was made of prior disclosures of the record, all previous
recipients of the record will be provided a copy of the subject individual's statement of disagreement, as well as the statement, if any, of
the appeal authority's reasons for denying the subject individual's appeal.
</p><p><b>&#167; 5b.9
 Disclosure of records.
</b></p>
<p>(a) <i>Consent to disclosure by a subject individual.</i> (1) Except as provided in paragraph (b) of this section authorizing
disclosures of records without consent, no disclosure of a record will be made without the consent of the subject individual. In each case the
consent, whether obtained from the subject individual at the request of the Department or whether provided to the Department by the subject
individual on his own initiative, shall be in writing. The consent shall specify the individual, organizational unit or class of individuals
or organizational units to whom the record may be disclosed, which record may be disclosed and, where applicable, during which time frame the
record may be disclosed (<i>e.g.,</i> during the school year, while the subject individual is out of the country, whenever the subject
individual is receiving specific services). A blanket consent to disclose all of a subject individual's records to unspecified individuals or
organizational units will not be honored. The subject individual's identity and, where applicable (<i>e.g.,</i> where a subject individual
gives consent to disclosure of a record to a specific individual), the identity of the individual to whom the record is to be disclosed shall
be verified.
</p>
<p>(2) A parent or guardian of any minor is not authorized to give consent to a disclosure of the minor's medical record.
</p>
<p>(b) <i>Disclosures without the consent of the subject individual.</i> The disclosures listed in this paragraph may be made without the
consent of the subject individual. Such disclosures are:
</p>
<p>(1) To those officers and employees of the Department who have a need for the record in the performance of their duties. The responsible
Department official may upon request of any officer or employee, or on his own initiative, determine what constitutes legitimate need.
</p>
<p>(2) Required to be disclosed under the Freedom of Information Act, 5 U.S.C. 552, and Part 5 of this title.
</p>
<p>(3) For a routine use as defined in paragraph (j) of &#167; 5b.1 of this part. Routine uses will be listed in any notice of a system
of records. Routine uses published in Appendix B are applicable to more than one system of records. Where applicable, notices of systems of
records may contain references to the routine uses listed in Appendix B. Appendix B will be published with any compendium of notices of
systems of records.
</p>
<p>(4) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions
of Title 13 U.S.C.
</p>
<p>(5) To a recipient who has provided the agency with advance written assurance that the record will be used solely as a statistical research
or reporting record; <i>Provided,</i> That, the record is transferred in a form that does not identify the subject individual.
</p>
<p>(6) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued
preservation by the United States Government, or for evaluation by the Administrator of General Services or his designee to determine whether
the record has such value.
</p>
<p>(7) To another government agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States
for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of such government agency or
instrumentality has submitted a written request to the Department specifying the record desired and the law enforcement activity for which the
record is sought.
</p>
<p>(8) To an individual pursuant to a showing of compelling circumstances affecting the health or safety of any individual if a notice of the
disclosure is transmitted to the last known address of the subject individual.
</p>
<p>(9) To either House of Congress, or to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint
committee of Congress or subcommittee of any such joint committee.
</p>
<p>(10) To the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General
Accounting Office.
</p>
<p>(11) Pursuant to the order of a court of competent jurisdiction.
</p>
<p>(c) <i>Accounting of disclosures.</i> (1) An accounting of all disclosures of a record will be made and maintained by the Department for 5
years or for the life of the record, whichever is longer; <i>except that,</i> such an accounting will not be made:
</p>
<p>(i) For disclosures under paragraphs (b) (1) and (2) of this section; and,
</p>
<p>(ii) For disclosures made with the written consent of the subject individual.
</p>
<p>(2) The accounting will include:
</p>
<p>(i) The date, nature, and purpose of each disclosure; and
</p>
<p>(ii) The name and address of the person or entity to whom the disclosure is made.
</p>
<p>(3) Any subject individual may request access to an accounting of disclosures of a record. The subject individual shall make a request for
access to an accounting in accordance with the procedures in &#167; 5b.5 of this part. A subject individual will be granted access to an
accounting of the disclosures of a record in accordance with the procedures of this part which govern access to the related record. Access to
an accounting of a disclosure of a record made under paragraph (b)(7) of this section may be granted at the discretion of the responsible
Department official.
</p><p><b>&#167; 5b.10
 Parents and guardians.
</b></p>
<p>For the purpose of this part, a parent or guardian of any minor or the legal guardian or any individual who has been declared
incompetent due to physical or mental incapacity or age by a court of competent jurisdiction is authorized to act on behalf of an individual
or a subject individual. Except as provided in paragraph (b)(2) of &#167; 5b.5, of this part governing procedures for verifying an
individual's identity, and paragraph (c) (2) of &#167; 5b.6 of this part governing special procedures for notification of or access to a
minor's medical records, an individual authorized to act on behalf of a minor or legal incompetent will be viewed as if he were the individual
or subject individual.
</p><p><b>&#167; 5b.11
 Exempt systems.
</b></p>
<p>(a) <i>General policy.</i> The Act permits certain types of specific systems of records to be exempt from some of its requirements. It
is the policy of the Department to exercise authority to exempt systems of records only in compelling cases.
</p>
<p>(b) <i>Specific systems of records exempted.</i> (1) Those systems of records listed in paragraph (b)(2) of this section are exempt from
the following provisions of the Act and this part:
</p>
<p>(i) 5 U.S.C. 552a(c)(3) and paragraph (c)(2) of &#167; 5b.9 of this part which require a subject individual to be granted access to an
accounting of disclosures of a record.
</p>
<p>(ii) 5 U.S.C. 552a(d) (1) through (4) and (f) and &#167;&#167; 5b.6, 5b.7, and 5b.8 of this part relating to notification of or access
to records and correction or amendment of records.
</p>
<p>(iii) 5 U.S.C. 552a(e)(4) (G) and (H) which require inclusion of information about Department procedures for notification, access, and
correction or amendment of records in the notice for the systems of records.
</p>
<p>(iv) 5 U.S.C. 552(e)(3) and paragraph (a)(3) of &#167; 5b.4 of this part which require that an individual asked to provide a record to
the Department be informed of the authority for providing the record (including whether the providing of the record is mandatory or voluntary,
the principal purposes for maintaining the record, the routine uses for the record, and what effect his refusal to provide the record may have
on him), and if the record is not required by statute or Executive Order to be provided by the individual, he agrees to provide the record.
This exemption applies only to an investigatory record compiled by the Department for criminal law enforcement purposes in a system of records
exempt under subsection (j)(2) of the Act to the extent that these requirements would prejudice the conduct of the investigation.
</p>
<p>(2) The following systems of records are exempt from those provisions of the Act and this part listed in paragraph (b) (1) of this section.
</p>
<p>(i) Pursuant to subsection (j)(2) of the Act:
</p>
<p>(A) The Saint Elizabeths Hospital's Court-Ordered Forensic Investigatory Materials Files; and
</p>
<p>(B) The Investigatory Material Compiled for Law Enforcement Purposes System, HHS.
</p>
<p>(ii) Pursuant to subsection (k)(2) of the Act:
</p>
<p>(A) The General Criminal Investigation Files, HHS/SSA;
</p>
<p>(B) The Criminal Investigations File, HHS/SSA; and,
</p>
<p>(C) The Program Integrity Case Files, HHS/SSA.
</p>
<p>(D) Civil and Administrative Investigative Files of the Inspector General, HHS/OS/OIG.
</p>
<p>(E) Complaint Files and Log. HHS/OS/OCR.
</p>
<p>(F) Investigative materials compiled for law enforcement purposes for the Healthcare Integrity and Protection Data Bank (HIPDB), of the
Office of Inspector General. (See &#167; 61.15 of this title for access and correction rights under the HIPDB by subjects of the Data
Bank.)
</p>
<p>(G) Investigative materials compiled for law enforcement purposes for the Program Information Management System, HHS/OS/OCR.
</p>
<p>(H) Investigative materials compiled for law enforcement purposes from the CMS Fraud Investigation Database (FID), HHS/CMS.
</p>
<p>(I) Investigative materials compiled for law enforcement purposes from the Automated Survey Processing Environment (ASPEN) Complaints/
Incidents Tracking System (ACTS), HHS/CMS.
</p>
<p>(J) Investigative materials compiled for law enforcement purposes from the Health Insurance Portability and Accountability Act (HIPAA)
Information Tracking System (HITS), HHS/CMS.
</p>
<p>(K) Investigative materials compiled for law enforcement purposes from the Organ Procurement Organizations System (OPOS), HHS/CMS.
</p>
<p>(L) Investigative materials compiled for law enforcement purposes in the National Practitioner Data Bank (NPDB). (See &#167; 60.16 of
this subtitle for access and correction rights under the NPDB by subjects of the Data Bank.)
</p>
<p>(iii) Pursuant to subsection (k)(4) of the Act:
</p>
<p>(A) The Health and Demographic Surveys Conduct in Random Samples of the U.S. Population;
</p>
<p>(B) The Health Manpower Inventories and Surveys;
</p>
<p>(C) The Vital Statistics for Births, Deaths, Fetal Deaths, Marriages and Divorces Occurring in the U.S. during Each Year; and,
</p>
<p>(D) The Maryland Psychiatric Case Register.
</p>
<p>(E) The Health Resources Utilization Statistics, DHHS/OASH/NCHS.
</p>
<p>(F) National Medical Expenditure Survey Records. HHS/OASH/NCHSR.
</p>
<p>(iv) Pursuant to subsection (k)(5) of the Act:
</p>
<p>(A) The Investigatory Material Compiled for Security and Suitability Purposes System, HHS; and,
</p>
<p>(B) The Suitability for Employment Records, HHS.
</p>
<p>(v) Pursuant to subsections (j)(2), (k)(2), and (k)(5) of the Act:
</p>
<p>(A) The Clinical Investigatory Records, HHS/FDA;
</p>
<p>(B) The Regulated Industry Employee Enforcement Records, HHS/FDA;
</p>
<p>(C) The Employee Conduct Investigative Records, HHS/FDA; and,
</p>
<p>(D) The Service Contractor Employee Investigative Records, HHS/FDA.
</p>
<p>(vi) Pursuant to subsection (k)(6) of the Act:
</p>
<p>(A) The Personnel Research and Merit Promotion Test Records, HHS/SSA/OMA.
</p>
<p>(vii) Pursuant to subsections (k)(2) and (k)(5) of the Act:
</p>
<p>(A) Public Health Service Records Related to Investigations of Scientific Misconduct, HHS/OASH/ORI.
</p>
<p>(B) Administration: Investigative Records, HHS/NIH/OM/OA/OMA.
</p>
<p>(c) <i>Notification of or access to records in exempt systems of records.</i> (1) Where a system of records is exempt as provided in
paragraph (b) of this section, any individual may nonetheless request notification of or access to a record in that system. An individual
shall make requests for notification of or access to a record in an exempt system of records in accordance with the procedures of
&#167;&#167; 5b.5 and 5b.6 of this part.
</p>
<p>(2) An individual will be granted notification of or access to a record in an exempt system but only to the extent such notification or
access would not reveal the identity of a source who furnished the record to the Department under an express promise, and prior to September
27, 1975 an implied promise, that his identity would be held in confidence, if:
</p>
<p>(i) The record is in a system of records which is exempt under subsection (k)(2) of the Act and the individual has been, as a result of the
maintenance of the record, denied a right, privilege, or benefit to which he would otherwise be eligible; or,
</p>
<p>(ii) The record is in a system of records which is exempt under subsection (k)(5) of the Act.
</p>
<p>(3) If an individual is not granted notification of or access to a record in a system of records exempt under subsections (k) (2) and (5)
of the Act in accordance with this paragraph, he will be informed that the identity of a confidential source would be revealed if notification
of or access to the record were granted to him.
</p>
<p>(d) <i>Discretionary actions by the responsible Department official.</i> Unless disclosure of a record to the general public is otherwise
prohibited by law, the responsible Department official may in his discretion grant notification of or access to a record in a system of
records which is exempt under paragraph (b) of this section. Discretionary notification of or access to a record in accordance with this
paragraph will not be a precedent for discretionary notification of or access to a similar or related record and will not obligate the
responsible Department official to exercise his discretion to grant notification of or access to any other record in a system of records which
is exempt under paragraph (b) of this section.
</p>
<p>[40 FR 47409, Oct. 8, 1975, as amended at 43 FR 40229, Sept. 11, 1978; 47 FR 57040, Dec. 22, 1982; 49 FR 14108, Apr. 10, 1984; 51 FR 41352,
Nov. 14, 1986; 59 FR 36717, July 19, 1994; 65 FR 34988, June 1, 2000; 65 FR 37289, June 14, 2000; 68 FR 62751, Nov. 6, 2003; 73 FR 55775,
Sept. 26, 2008; 76 FR 72327, Nov. 23, 2011]
</p><p><b>&#167; 5b.12
 Contractors.
</b></p>
<p>(a) All contracts entered into on or after September 27, 1975 which require a contractor to maintain or on behalf of the Department to
maintain, a system of records to accomplish a Department function must contain a provision requiring the contractor to comply with the Act and
this part.
</p>
<p>(b) All unexpired contracts entered into prior to September 27, 1975 which require the contractor to maintain or on behalf of the
Department to maintain, a system of records to accomplish a Department function will be amended as soon as practicable to include a provision
requiring the contractor to comply with the Act and this part. All such contracts must be so amended by July 1, 1976 unless for good cause the
appeal authority identified in &#167; 5b.8 of this part authorizes the continuation of the contract without amendment beyond that date.
</p>
<p>(c) A contractor and any employee of such contractor shall be considered employees of the Department only for the purposes of the criminal
penalties of the Act, 5 U.S.C. 552a(i), and the employee standards of conduct listed in Appendix A of this part where the contract contains a
provision requiring the contractor to comply with the Act and this part.
</p>
<p>(d) This section does not apply to systems of records maintained by a contractor as a result of his management discretion, <i>e.g.,</i> the
contractor's personnel records.
</p><p><b>&#167; 5b.13
 Fees.
</b></p>
<p>(a) <i>Policy.</i> Where applicable, fees for copying records will be charged in accordance with the schedule set forth in this
section. Fees may only be charged where an individual requests that a copy be made of the record to which he is granted access. No fee may be
charged for making a search of the system of records whether the search is manual, mechanical, or electronic. Where a copy of the record must
be made in order to provide access to the record (<i>e.g.,</i> computer printout where no screen reading is available), the copy will be made
available to the individual without cost. Where a medical record is made available to a representative designated by the individual or to a
physician or health professional designated by a parent or guardian under &#167; 5b.6 of this part, no fee will be charged.
</p>
<p>(b) <i>Fee schedule.</i> The fee schedule for the Department is as follows:
</p>
<p>(1) Copying of records susceptible to photocopying--$.10 per page.
</p>
<p>(2) Copying records not susceptible to photocopying (<i>e.g.,</i> punch cards or magnetic tapes)--at actual cost to be determined on a
case-by-case basis.
</p>
<p>(3) No charge will be made if the total amount of copying does not exceed $25.
</p><p><b>Appendix A to Part 5b--Employee Standards of Conduct</b>
</p>
<p>(a) <i>General.</i> All employees are required to be aware of their responsibilities under the Privacy Act of 1974, 5 U.S.C. 552a.
Regulations implementing the Act are set forth in 45 CFR 5b. Instruction on the requirements of the Act and regulation shall be provided to
all new employees of the Department. In addition, supervisors shall be responsible for assuring that employees who are working with systems of
records or who undertake new duties which require the use of systems of records are informed of their responsibilities. Supervisors shall also
be responsible for assuring that all employees who work with such systems of records are periodically reminded of the requirements of the Act
and are advised of any new provisions or interpretations of the Act.
</p>
<p>(b) <i>Penalties.</i> (1) All employees must guard against improper disclosure f records which are governed by the Act. Because of the
serious consequences of improper invasions of personal privacy, employees may be subject to disciplinary action and criminal prosecution for
knowing and willful violations of the Act and regulation. In addition, employees may also be subject to disciplinary action for unknowing or
unwillful violations, where the employee had notice of the provisions of the Act and regulations and failed to inform himself sufficiently or
to conduct himself in accordance with the requirements to avoid violations.
</p>
<p>(2) The Department may be subjected to civil liability for the following actions undertaken by its employees:
</p>
<p>(a) Making a determination under the Act and &#167;&#167; 5b.7 and 5b.8 of the regulation not to amend an individual's record in
accordance with his request, or failing to make such review in conformity with those provisions;
</p>
<p>(b) Refusing to comply with an individual's request for notification of or access to a record pertaining to hiem;
</p>
<p>(c) Failing to maintain any record pertaining to any individual with such accuracy, relevance, timeliness, and completeness as is necessary
to assure fairness in any determination relating to the qualifications, character, rights, or opportunities of, or benefits to the individual
that may be made on the basis of such a record, and consequently a determination is made which is adverse to the individual; or
</p>
<p>(d) Failing to comply with any other provision of the Act or any rule promulgated thereunder, in such a way as to have an adverse effect on
an individual.
</p>
<p>(3) An employee may be personally subject to criminal liability as set forth below and in 5 U.S.C. 552a (i):
</p>
<p>(a) Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency
records which contain individually identifiable information the disclosure of which is prohibited by the Act or by rules or regulations
established thereunder, and who, knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any
manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.
</p>
<p>(b) Any officer or employee of any agency who willfully maintains a system of records without meeting the notice requirements [of the Act]
shall be guilty of a misdemeanor and fined not more than $5,000.
</p>
<p>(c) <i>Rules Governing Employees Not Working With Systems of Records.</i> Employees whose duties do not involve working with systems of
records will not generally disclose to any one, without specific authorization from their supervisors, records pertaining to employees or
other individuals which by reason of their official duties are available to them. Notwithstanding the above, the following records concerning
Federal employees are a matter of public record and no further authorization is necessary for disclosure:
</p>
<p>(1) Name and title of individual.
</p>
<p>(2) Grade classification or equivalent and annual rate of salary.
</p>
<p>(3) Position description.
</p>
<p>(4) Location of duty station, including room number and telephone number.
</p>
<p>In addition, employees shall disclose records which are listed in the Department's Freedom of Information Regulation as being available to
the public. Requests for other records will be referred to the responsible Department official. This does not preclude employees from
discussing matters which are known to them personally, and without resort to a record, to official investigators of Federal agencies for
official purposes such as suitability checks, Equal Employment Opportunity investigations, adverse action proceedings, grievance proceedings,
etc.
</p>
<p>(d) <i>Rules governing employees whose duties require use or reference to systems of records.</i> Employees whose official duties require
that they refer to, maintain, service, or otherwise deal with systems of records (hereinafter referred to as "Systems Employees") are governed
by the general provisions. In addition, extra precautions are required and systems employees are held to higher standards of conduct.
</p>
<p>(1) Systems Employees shall:
</p>
<p>(a) Be informed with respect to their responsibilities under the Act;
</p>
<p>(b) Be alert to possible misuses of the system and report to their supervisors any potential or actual use of the system which they believe
is not in compliance with the Act and regulation;
</p>
<p>(c) Make a disclosure of records within the Department only to an employee who has a legitimate need to know the record in the course of
his official duties;
</p>
<p>(d) Maintain records as accurately as practicable.
</p>
<p>(e) Consult with a supervisor prior to taking any action where they are in doubt whether such action is in conformance with the Act and
regulation.
</p>
<p>(2) Systems Employees shall not:
</p>
<p>(a) Disclose in any form records from a system of records except (1) with the consent or at the request of the subject individual; or (2)
where its disclosure is permitted under &#167; 5b.9 of the regulation.
</p>
<p>(b) Permit unauthorized individuals to be present in controlled areas. Any unauthorized individuals observed in controlled areas shall be
reported to a supervisor or to the guard force.
</p>
<p>(c) Knowingly or willfully take action which might subject the Department to civil liability.
</p>
<p>(d) Make any arrangements for the design development, or operation of any system of records without making reasonable effort to provide
that the system can be maintained in accordance with the Act and regulation.
</p>
<p>(e) <i>Contracting officers.</i> In addition to any applicable provisions set forth above, those employees whose official duties involve
entering into contracts on behalf of the Department shall also be governed by the following provisions:
</p>
<p>(1) <i>Contracts for design, or development of systems and equipment.</i> No contract for the design or development of a system of records,
or for equipment to store, service or maintain a system of records shall be entered into unless the contracting officer has made reasonable
effort to ensure that the product to be purchased is capable of being used without violation of the Act or regulation. Special attention shall
be given to provision of physical safeguards.
</p>
<p>(2) <i>Contracts for the operation of systems of records.</i> A review by the Contracting Officer, in conjunction with other officials whom
he feels appropriate, of all proposed contracts providing for the operation of systems of records shall be made prior to execution of the
contracts to determine whether operation of the system of records is for the purpose of accomplishing a Department function. If a
determination is made that the operation of the system is to accomplish a Department function, the contracting officer shall be responsible
for including in the contract appropriate provisions to apply the provisions of the Act and regulation to the system, including prohibitions
against improper release by the contractor, his employees, agents, or subcontractors.
</p>
<p>(3) <i>Other service contracts.</i> Contracting officers entering into general service contracts shall be responsible for determining the
appropriateness of including provisions in the contract to prevent potential misuse (inadvertent or otherwise) by employees, agents, or
subcontractors of the contractor.
</p>
<p>(f) <i>Rules Governing Responsible Department Officials.</i> In addition to the requirements for Systems Employees, responsible Department
officials shall:
</p>
<p>(1) Respond to all requests for notification of or access, disclosure, or amendment of records in a timely fashion in accordance with the
Act and regulation;
</p>
<p>(2) Make any amendment of records accurately and in a timely fashion;
</p>
<p>(3) Inform all persons whom the accounting records show have received copies of the record prior to the amendments of the correction; and
</p>
<p>(4) Associate any statement of disagreement with the disputed record, and
</p>
<p>(a) Transmit a copy of the statement to all persons whom the accounting records show have received a copy of the disputed record, and
</p>
<p>(b) Transmit that statement with any future disclosure.
</p><p><b>Appendix B to Part 5b--Routine Uses Applicable to More Than One System of Records Maintained by HHS</b>
</p>
<p>(1) In the event that a system of records maintained by this agency or carry out its functions indicates a violation or potential violation
of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by
regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the
appropriate agency, whether federal, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged
with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p>
<p>(2) Referrals may be made of assignments of research investigators and project monitors to specific research projects to the Smithsonian
Institution to contribute to the Smithsonian Science Information Exchange, Inc.
</p>
<p>(3) In the event the Department deems it desirable or necessary, in determining whether particular records are required to be disclosed
under the Freedom of Information Act, disclosure may be made to the Department of Justice for the purpose of obtaining its advice.
</p>
<p>(4) A record from this system of records may be disclosed as a "routine use" to a federal, state or local agency maintaining civil,
criminal or other relevant enforcement records or other pertinent records, such as current licenses, if necessary to obtain a record relevant
to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or
the issuance of a license, grant or other benefit.
</p>
<p>A record from this system of records may be disclosed to a Federal agency, in response to its request, in connection with the hiring or
retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract,
or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the record is relevant and necessary to the
requesting agency's decision on the matter.
</p>
<p>(5) In the event that a system of records maintained by this agency to carry out its function indicates a violation or potential violation
of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by
regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the
appropriate agency, whether state or local charged with the responsibility of investigating or prosecuting such violation or charged with
enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.
</p>
<p>(6) Where Federal agencies having the power to subpoena other Federal agencies' records, such as the Internal Revenue Service or the Civil
Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.
</p>
<p>(7) Where a contract between a component of the Department and a labor organization recognized under E.O. 11491 provides that the agency
will disclose personal records relevant to the organization's mission, records in this system of records may be disclosed to such
organization.
</p>
<p>(8) Where the appropriate official of the Department, pursuant to the Department's Freedom of Information Regulation determines that it is
in the public interest to disclose a record which is otherwise exempt from mandatory disclosure, disclosure may be made from this system of
records.
</p>
<p>(9) The Department contemplates that it will contract with a private firm for the purpose of collating, analyzing, aggregating or otherwise
refining records in this system. Relevant records will be disclosed to such a contractor. The contractor shall be required to maintain Privacy
Act safeguards with respect to such records.
</p>
<p>(10)-(99) [Reserved]
</p>
<p>(100) To the Department of Justice or other appropriate Federal agencies in defending claims against the United States when the claim is
based upon an individual's mental or physical condition and is alleged to have arisen because of activities of the Public Health Service in
connection with such individual.
</p>
<p>(101) To individuals and organizations, deemed qualified by the Secretary to carry out specific research solely for the purpose of carrying
out such research.
</p>
<p>(102) To organizations deemed qualified by the Secretary to carry out quality assessment, medical audits or utilization review.
</p>
<p>(103) Disclosures in the course of employee discipline or competence determination proceedings.
</p><p><b>Appendix C to Part 5b--Delegations of Authority [Reserved]</b>
</p>
</xhtmlContent>
</regulationsPart>
</regulationsTitle>
</regulations>

    
    
    <regulations id="reg" toc="yes">
<regulationsTitle number="21">
<heading>Food and Drugs</heading>
    <regulationsChapter number="I">
        <heading>Food and Drug Administration</heading>

<regulationsPart number="21">
<heading>PROTECTION OF PRIVACY</heading>
<xhtmlContent><p>
Sec.
</p>
 <p><b>Subpart A--General Provisions
</b></p>
<p>Sec.
</p>
<p>21.1 Scope.
</p>
<p>21.3 Definitions.
</p>
<p>21.10 Policy concerning records about individuals.
</p><p><b>Subpart B--Food and Drug Administration Privacy Act Record Systems
</b></p>
<p>21.20 Procedures for notice of Food and Drug Administration Privacy Act Record Systems.
</p>
<p>21.21 Changes in systems and new systems.
</p><p><b>Subpart C--Requirements for Specific Categories of Records
</b></p>
<p>21.30 Records of contractors.
</p>
<p>21.31 Records stored by the National Archives and Records Administration.
</p>
<p>21.32 Personnel records.
</p>
<p>21.33 Medical records.
</p><p><b>Subpart D--Procedures for Notification of and Access to Records in Privacy Act Record Systems
</b></p>
<p>21.40 Procedures for submitting requests for notification and access.
</p>
<p>21.41 Processing of requests.
</p>
<p>21.42 Responses to requests.
</p>
<p>21.43 Access to requested records.
</p>
<p>21.44 Verification of identity.
</p>
<p>21.45 Fees.
</p><p><b>Subpart E--Procedures for Requests for Amendment of Records
</b></p>
<p>21.50 Procedures for submitting requests for amendment of records.
</p>
<p>21.51 Responses to requests for amendment of records.
</p>
<p>21.52 Administrative appeals of refusals to amend records.
</p>
<p>21.53 Notation and disclosure of disputed records.
</p>
<p>21.54 Amended or disputed records received from other agencies.
</p><p><b>Subpart F--Exemptions
</b></p>
<p>21.60 Policy.
</p>
<p>21.61 Exempt systems.
</p>
<p>21.65 Access to records in exempt systems.
</p><p><b>Subpart G--Disclosure of Records in Privacy Act Record Systems to Persons Other Than the Subject Individual
</b></p>
<p>21.70 Disclosure and intra-agency use of records in Privacy Act Record Systems; no accounting required.
</p>
<p>21.71 Disclosure of records in Privacy Act Record Systems; accounting required.
</p>
<p>21.72 Individual consent to disclosure of records to other persons.
</p>
<p>21.73 Accuracy, completeness, timeliness, and relevance of records disclosed from Privacy Act Record Systems.
</p>
<p>21.74 Providing notice that a record is disputed.
</p>
<p>21.75 Rights of legal guardians.
</p>
<p><b>Authority:</b> 21 U.S.C. 371; 5 U.S.C. 552, 552a.
</p>
<p><b>Source:</b> 42 FR 15626, Mar. 22, 1977, unless otherwise noted.
</p><p><b>Subpart A--General Provisions
</b></p><p><b>&#167; 21.1
 Scope.
</b></p>
<p>(a) This part establishes procedures to implement the Privacy Act of 1974 (5 U.S.C. 552a). It applies to records about individuals
that are maintained, collected, used, or disclosed by the Food and Drug Administration and contained in Privacy Act Record Systems.
</p>
<p>(b) This part does not:
</p>
<p>(1) Apply to Food and Drug Administration record systems that are not Privacy Act Record Systems or make available to an individual records
that may include references to him but that are not retrieved by his name or other personal identifier, whether or not contained in a Privacy
Act Record System. part 20 of this chapter (the public information regulations) and other regulations referred to therein determine when
records are made available in such cases.
</p>
<p>(2) Make any records available to persons other than (i) individuals who are the subjects of the records, (ii) persons accompanying such
individuals under &#167; 21.43, (iii) persons provided records pursuant to individual consent under &#167; 21.72, or (iv) persons
acting on behalf of such individuals as legal guardians under &#167; 21.75. Part 20 of this chapter (the public information regulations)
and other regulations referred to therein determine when Food and Drug Administration records are disclosable to members of the public
generally. Subpart G of this part limits the provisions of part 20 of this chapter with respect to disclosures of records about individuals
from Privacy Act Record Systems to persons other than individuals who are the subjects of the records.
</p>
<p>(3) Make available information compiled by the Food and Drug Administration in reasonable anticipation of court litigation or formal
administrative proceedings. The availability of such information to any member of the public, including any subject individual or party to
such litigation or proceeding shall be governed by applicable constitutional principles, rules of discovery, and part 20 of this chapter (the
public information regulations).
</p>
<p>(4) Apply to personnel records maintained by the Division of Human Resources Management, Food and Drug Administration, except as provided
in &#167; 21.32. Such records are subject to regulations of the Office of Personnel Management in 5 CFR parts 293, 294, and 297.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985]
</p><p><b>&#167; 21.3
 Definitions.
</b></p>
<p>As used in this part:
</p>
<p>(a) <i>Individual</i> means a natural living person who is a citizen of the United States or an alien lawfully admitted for permanent
residence. Individual does not include sole proprietorships, partnerships, or corporations engaged in the production or distribution of
products regulated by the Food and Drug Administration or with which the Food and Drug Administration has business dealings. Any such business
enterprise that is identified by the name of one or more individuals is not an individual within the meaning of this part. Employees of
regulated business enterprises are considered individuals. Accordingly, physicians and other health professionals who are engaged in business
as proprietors of establishments regulated by the Food and Drug Administration are not considered individuals; however, physicians and other
health professionals who are engaged in clinical investigations, employed by regulated enterprises, or the subjects of records concerning
their own health, e.g., exposure to excessive radiation, are considered individuals. Food and Drug Administration employees, consultants, and
advisory committee members, State and local officials, and consumers are considered individuals.
</p>
<p>(b) <i>Records about individuals</i> means items, collections, or groupings of information about individuals contained in Privacy Act
Record Systems, including, but not limited to education, financial transactions, medical history, criminal history, or employment history,
that contain names or personal identifiers.
</p>
<p>(c) <i>Privacy Act Record System</i> means a system of records about individuals under the control of the Food and Drug Administration from
which information is retrieved by individual names or other personal identifiers. The term includes such a system of records whether subject
to a notice published by the Food and Drug Administration, the Department, or another agency. Where records are retrieved only by personal
identifiers other than individual names, a system of records is not a Privacy Act Record System if the Food and Drug Administration cannot, by
reference to information under its control, or by reference to records of contractors that are subject to this part under &#167; 21.30,
ascertain the identity of individuals who are the subjects of the records.
</p>
<p>(d) <i>Personal identifiers</i> includes individual names, identifying numbers, symbols, or other identifying designations assigned to
individuals. <i>Personal identifiers</i> does not include names, numbers, symbols, or other identifying designations that identify products,
establishments, or actions.
</p>
<p>(e) <i>Personnel records</i> means any personal information maintained in a Privacy Act Record System that is needed for personnel
management programs or processes such as staffing, employee development, retirement, and grievances and appeals.
</p>
<p>(f) <i>Department</i> means Department of Health and Human Services.
</p><p><b>&#167; 21.10
 Policy concerning records about individuals.
</b></p>
<p>Information about individuals in Food and Drug Administration records shall be collected, maintained, used, and disseminated so as to
protect the right to privacy of the individual to the fullest possible extent consistent with laws relating to disclosure of information to
the general public, the law enforcement responsibilities of the agency, and administrative and program management needs.
</p><p><b>Subpart B--Food and Drug Administration Privacy Act Record Systems
</b></p><p><b>&#167; 21.20
 Procedures for notice of Food and Drug Administration Privacy Act Record Systems.
</b></p>
<p>(a) The Food and Drug Administration shall issue in the <i>Federal Register</i> on or before August 30 of each year a notice
concerning each Privacy Act Record System as defined in &#167; 21.3(c) that is not covered by a notice published by the Department, the
Office of Personnel Management, or another agency.
</p>
<p>(b) The notice shall include the following information:
</p>
<p>(1) The name and location(s) of the system.
</p>
<p>(2) The categories of individuals about whom records are maintained in the system.
</p>
<p>(3) The categories of records maintained in the system.
</p>
<p>(4) The authority for the system.
</p>
<p>(5) Each routine use of the records contained in the system (i.e., use outside the Department of Health and Human Services that is
compatible with the purpose for which the records were collected and described in the notice) including the categories of users and the
purposes of such use.
</p>
<p>(6) The policies and practices of the Food and Drug Administration regarding storage, retrievability (i.e., how the records are indexed and
what intra-agency uses are made of the records), access controls, retention, and disposal of the records in that system.
</p>
<p>(7) The title and business address of the official who is responsible for the system of records.
</p>
<p>(8) The notification procedure, i.e., the address of the FDA Privacy Act Coordinator, whom any individual can contact to seek notification
whether the system contains a record about him/her.
</p>
<p>(9) The record access and contest procedures, which shall be the same as the notification procedure except that a reference shall be
included to any exemption from access and contest.
</p>
<p>(10) Where any records in the system are subject to an exemption under &#167; 21.61, a reference to this exemption.
</p>
<p>(11) The categories of sources of records in the system.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981]
</p><p><b>&#167; 21.21
 Changes in systems and new systems.
</b></p>
<p>(a) The Food and Drug Administration shall notify the designated Department official, the Office of Management and Budget (Information
Systems Division), and the Congress of proposals to change or establish Privacy Act Record Systems in accordance with procedures of the
Department and the Office of Management and Budget.
</p>
<p>(b) The Food and Drug Administration shall issue a notice, in accordance with paragraph (d) of this section and &#167; 21.20(b), of
any change in a Privacy Act Record System which:
</p>
<p>(1) Increases the number or types of individuals about whom records are maintained;
</p>
<p>(2) Expands the type or amount of information about individuals that is maintained;
</p>
<p>(3) Increases the number of categories of agencies or other persons who may have access to those records;
</p>
<p>(4) Alters the manner in which the records are organized so as to change the nature or scope of those records, such as the combining of two
or more existing systems;
</p>
<p>(5) Modifies the way in which the system operates or its location(s) in a manner that alters the process by which individuals can exercise
their rights under this part, such as the ways in which they seek access or request amendment of a record; or
</p>
<p>(6) Changes the equipment configuration on which the system is operated so as to create the potential for greater access, such as adding a
telecommunications capability.
</p>
<p>(c) The Food and Drug Administration shall issue a notice of its intention to establish new Privacy Act Record Systems in accordance with
paragraph (d) of this section and &#167; 21.20(b).
</p>
<p>(d) Notices under paragraphs (b) and (c) of this section shall be published in the <i>Federal Register</i> for comment at least 30 days
prior to implementation of the proposed changes or establishment of new systems. Interested persons shall have the opportunity to submit
written data, views, or arguments on such proposed new uses or systems.
</p><p><b>Subpart C--Requirements for Specific Categories of Records
</b></p><p><b>&#167; 21.30
 Records of contractors.
</b></p>
<p>(a) Systems of records that are required to be operated, or as a matter of practical necessity must be operated, by contractors to
accomplish Food and Drug Administration functions, from which information is retrieved by individual names or other personal identifiers, may
be subject to the provisions of this part. If the contract is agreed to on or after September 27, 1975, the criminal penalties set forth in 5
U.S.C. 552a(i) are applicable to such contractor, and any employee of such contractor, for disclosures prohibited in &#167; 21.71 or for
maintenance of a system of records without notice as required in &#167; 21.20.
</p>
<p>(b) A contract is considered to accomplish a Food and Drug Administration function if the proposal or activity it supports is principally
operated on behalf of and is under the direct management of the Food and Drug Administration. Systems of records from which information is
retrieved by individual names or other personal identifiers and that are operated under contracts to accomplish Food and Drug Administration
functions are deemed to be maintained by the agency and shall be subject to the procedures and requirements of this part.
</p>
<p>(c) A contract is not considered to accomplish a Food and Drug Administration function if the program or activity it supports is not
principally operated on behalf of, or is not under the direct management of, the Food and Drug Administration. For example, this part does not
apply to systems of records:
</p>
<p>(1) Operated under contract with the Food and Drug Administration by State or local government agencies, or organizations representing such
agencies, when such agencies or organizations are also performing State or local government functions.
</p>
<p>(2) Operated by contractors with the Food and Drug Administration by individuals or organizations whose primary function is delivery of
health services, such as hospitals, physicians, pharmacists, and other health professionals, and that report information concerning products,
e.g., injuries or product defects, to the Food and Drug Administration. Before such contractors submit information to the Food and Drug
Administration, the names and other personal identifiers of patients or research subjects in any medical or similar report, test, study, or
other research project shall be deleted, unless the contract provides otherwise. If the Food and Drug Administration subsequently needs the
names of such individuals, a separate request will be made.
</p>
<p>(3) Relating to individuals whom the contractor employs, or with whom the contractor otherwise deals, in the course of providing goods and
services to the Food and Drug Administration.
</p>
<p>(4) Operated under grants.
</p>
<p>(d) The requirements of this part shall apply when a contractor who operates a system of records not subject to this part reports to the
Food and Drug Administration information that is a system of records about individuals from which personal information is retrieved by names
or other personal identifiers. Where the information would be a new Privacy Act Record System, or a change in an existing Privacy Act Record
System of a type described in &#167; 21.21, the Food and Drug Administration shall comply with the requirements of &#167; 21.21.
</p>
<p>(e) The Food and Drug Administration will review all contracts before award to determine whether operation of a system from which
information is retrieved by individual names or other personal identifiers will be required of the contractor, by the terms of the contract or
as a matter of practical necessity. If such operation will be required, the solicitation and contract shall include the following clause, or a
clause of similar effect:
</p>
<p>Whenever the contractor or any of his employees is required by this contract to operate a system of records from which information is
retrieved by individual names or other personal identifiers in order to accomplish a Food and Drug Administration function, the contractor and
every employee is considered to be an employee of the Food and Drug Administration and shall operate such system of records in accordance with
the Privacy Act of 1974 (5 U.S.C. 552a), regulations of the Food and Drug Administration in 21 CFR part 21, and rules of conduct that apply to
Food and Drug Administration employees who work with such systems of records. The contractor and his employees are subject to the criminal
penalties set forth in 5 U.S.C. 552a(i) for violations of the Privacy Act.
</p><p><b>&#167; 21.31
 Records stored by the National Archives and Records Administration.
</b></p>
<p>(a) Food and Drug Administration records that are stored, processed, and serviced by the National Archives and Records Administration
in accordance with 44 U.S.C. 3103 shall be considered to be maintained by the Food and Drug Administration. The National Archives and Records
Administration shall not disclose the record except to authorized Food and Drug Administration employees.
</p>
<p>(b) Each Food and Drug Administration record pertaining to an identifiable individual that was transferred to the National Archives of the
United States as a record determined by the National Archives to have sufficient historical or other value to warrant its continued
preservation shall be considered to be maintained by the National Archives and shall not be subject to the provisions of this part.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985]
</p><p><b>&#167; 21.32
 Personnel records.
</b></p>
<p>(a) Present and former Food and Drug Administration employees desiring access to personnel records about themselves should consult
system notices applicable to the agency's personnel records that are published by the Office of Personnel Management and the Department as
well as any notice issued by the Food and Drug Administration.
</p>
<p>(b)(1) The procedures of the Office of Personnel Management at 5 CFR parts 293, 294, and 297 rather than the procedures in &#167; 
21.33 and subparts D through F of this part, govern systems of personnel records about Food and Drug Administration employees that are subject
to notice published by the Office of Personnel Management, i.e., systems that:
</p>
<p>(i) The Office of Personnel Management maintains.
</p>
<p>(ii) Are maintained by the Division of Human Resources Management, Food and Drug Administration.
</p>
<p>(iii) Are maintained by Department Regional Offices, concerning field employees.
</p>
<p>(2) The Office of Personnel Management's procedures may, if necessary, be supplemented in the Food and Drug Administration Staff Manual
Guide. Current Food and Drug Administration employees should mail or deliver written requests under the Privacy Act for access to personnel
records described in this paragraph to the Office of Personnel Management in accordance with 5 CFR 297.106, the Director, Division of Human
Resources Management (HFA-400), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857, or the personnel officer in the
servicing HHS Regional Personnel Office. An employee may consult with or direct his or her request to the FDA Privacy Act Coordinator (ELEM
-1029). Requests for access to personnel records of former employees that are located in Federal Records Centers should be directed to
the Office of Personnel Management. Requests under the Privacy Act for amendment of personnel records should be directed to these same
officials who are responsibile for access to personnel records under this paragraph.
</p>
<p>(3) With respect to records subject to paragraph (b)(1) of this section:
</p>
<p>(i) Refusal to grant access to a record, or refusal to amend a record upon request of an employee, shall only be made by the Associate
Commissioner for Management and Operations or his or her designate; and
</p>
<p>(ii) Appeals of refusals under paragraph (b)(3)(i) of this section may be made to the Office of Personnel Management in accordance with 5
CFR 297.108(g)(3) and 297.113(b).
</p>
<p>(c) Any other Privacy Act Record Systems that contain personnel records, or records that otherwise concern agency employees, that are
maintained by offices of the Food and Drug Administration rather than the Division of Human Resources Management but which are not subject to
the Department's notice for personnel records in operating offices are subject to this part, except that refusals under this part to grant
access to or amend records about present or former employees shall be made by the Associate Commissioner for Management and Operations rather
than the Associate Commissioner for Public Affairs.
</p>
<p>(d) The following procedures shall govern requests under the Privacy Act for personnel records that are maintained by the operating offices
of the Food and Drug Administration in which employees work:
</p>
<p>(1) An employee shall upon request be told whether records about him are maintained. An employee shall be given access to records about
himself that are subject to this paragraph in response to an oral or written request and through informal procedures, rather than the
procedures specified in &#167;&#167; 21.40 through 21.43.
</p>
<p>(2) Employee identity may be verified, if necessary, by an FDA ID card rather than in accordance with &#167; 21.44.
</p>
<p>(3) Generally no fee shall be charged for records requested under this paragraph. However, in cases where the records requested are
voluminous, a fee may be charged in accordance with &#167; 21.45.
</p>
<p>(4) Records that are subject to this paragraph shall be available for access to an individual, except to the extent that access is refused
by the Associate Commissioner for Management and Operations or his or her designate on the grounds that the record is subject to an exemption
under &#167; 21.61 or 5 CFR 297.111.
</p>
<p>(5) Requests under the Privacy Act for amendment of records subject to this paragraph should be directed to the Director, Division of Human
Resources Management (HFA-400). Such requests shall be reviewed in accordance with subpart E of this part. Refusal to amend a record
subject to this paragraph (d)(5) shall only be made by the Associate Commissioner for Management and Operations or his or her designate.
</p>
<p>(6) Appeals of refusals under paragraph (d) (4) or (5) of this section may be made to the Commissioner of Food and Drugs, except where the
Associate Commissioner for Management and Operations or his or her designate indicates with his or her refusal that the appeal should be made
to the Office of Personnel Management.
</p>
<p>(7) Disclosures of records subject to this paragraph are subject to subpart G of this part.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985; 76 FR 31470, June 1, 2011]

</p><p><b>&#167; 21.33
 Medical records.
</b></p>
<p>(a) In general, an individual is entitled to have access to any medical records about himself in Privacy Act Record Systems maintained
by the Food and Drug Administration.
</p>
<p>(b) The Food and Drug Administration may apply the following special procedures in disclosing medical records to an individual:
</p>
<p>(1) The agency may review the records to determine whether disclosure of the record to the individual who is the subject of the records
might have an adverse effect on him. If it is determined that disclosure is not likely to have an adverse effect on the individual, the record
shall be disclosed to him. If it is determined that disclosure is very likely to have an adverse effect on the individual, he may be requested
to designate, in writing, a representative to whom the record shall be disclosed. Such representative may be a physician, other health
professional, or other responsible person who would be willing to review the record and discuss it with the individual.
</p>
<p>(2) The availability of the record may be subject to any procedures for disclosure to an individual of medical records about himself under
part 20 of this chapter, in addition to or in lieu of the procedures in paragraph (b)(1), that are not inconsistent with &#167; 21.41(f).</p>
<p><b>Subpart D--Procedures for Notification of and Access to Records in Privacy Act Record Systems
</b></p><p><b>&#167; 21.40
 Procedures for submitting requests for notification and access.
</b>
</p>
<p>(a) An individual may request that the Food and Drug Administration notify him whether a Privacy Act Record System contains records about
him that are retrieved by reference to his name or other personal identifier. An individual may at the same time, or after receiving
notification that such a record about him exists, requests that he be given access to the record.
</p>
<p>(b) An individual desiring notification or access to records shall mail or deliver a request for records in any Food and Drug
Administration Privacy Act Records System to the FDA Privacy Act Coordinator (ELEM-1029), Food and Drug Administration, 12420 Parklawn
Dr., Element Bldg., Rockville, MD 20857.
</p>
<p>(c) Requests shall be in writing and shall name the Privacy Act Record System or Systems concerning which the individual requests
notification of whether there are records about him that are retrieved by reference to his name or other personal identifier. To help assure a
prompt response, an individual should indicate that he is making a Ã¢â‚¬Å"Privacy Act RequestÃ¢â‚¬Â on the envelope and in a prominent manner
in the letter.
</p>
<p>(d) An individual who merely wishes to be notified whether a Privacy Act Record System contains a record about him ordinarily need not
provide any verification of his identity other than his name. The mere fact that the Food and Drug Administration has a record about an
individual in any of its Privacy Act Records Systems would not be likely to constitute a clearly unwarranted invasion of personal privacy.
Where mere disclosure of the fact that a record about the individual exists would be a clearly unwarranted invasion of personal privacy,
further verification of the identity of the individual shall be required.
</p>
<p>(e) An individual who requests that he be given access to a copy of records about himself, if any exist, should indicate whether he prefers
(1) to have copies of any such records mailed to him in accordance with &#167; 21.43(a)(1), which may involve a fee under &#167; 
21.45, including information to verify his identity under &#167; 21.44 or (2) to use the procedures for access in person under
&#167; 21.43(a)(2).
</p>
<p>(f) A request for notification and access may be submitted under this subpart concerning any Privacy Act Record System that is exempt under
&#167; 21.61, as indicated in the notice for the system. An individual seeking access to records under &#167; 21.65(b)(2) to
investigatory records compiled for law enforcement purposes other than criminal law enforcement purposes should submit a description of the
right, benefit, or privilege that he believes he was denied as the result of the Food and Drug Administration's maintenance of the records.
Where the system is exempt under &#167; 21.61, and access to the requested records is not granted under &#167; 21.65, the request
shall be handled under the provisions of part 20 of this chapter (the public information regulations).
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985; 76 FR 31470, June 1, 2011]

</p><p><b>&#167; 21.41
 Processing of requests.
</b></p>
<p>(a) An individual or his guardian under &#167; 21.75 shall not be required to show any justification or need to obtain
notification under &#167; 21.42 or access to a record under &#167; 21.43.
</p>
<p>(b) The Food and Drug Administration will determine whether a request by an individual for records about himself is appropriately treated
as a request under this subpart, or under the provision of part 20 of this chapter (the public information regulations), or both. Where
appropriate, the Food and Drug Administration will consult with the individual concerning the appropriate treatment of the request.
</p>
<p>(c) The FDA Privacy Act Coordinator in the Division of Freedom of Information (ELEM-1029) shall be responsibile for the handling of
Privacy Act requests received by the Food and Drug Administration. Requests mailed or delivered to any other office shall be promptly
redirected to the FDA Privacy Act Coordinator. Where this procedure would unduly delay the agency's response, however, the agency employee who
received the request should consult with the FDA Privacy Act Coordinator and obtain advice as to whether the employee can respond to the
request directly.
</p>
<p>(d) Upon receipt of a request by the FDA Privacy Act Coordinator, a record shall promptly be made that a request has been received and the
date.
</p>
<p>(e) A letter in accordance with &#167; 21.42 responding to the request for notification shall issue as promptly as possible after
receipt of the request by the Food and Drug Administration. Upon determination by the Division of Freedom of Information (ELEM-1029)
that a request for access to records is appropriately treated as a request under part 20 of this chapter rather than part 21, or under both
parts, the time limitations prescribed in &#167; 21.41 shall apply. In any case, access to available records shall be provided as
promptly as possible.
</p>
<p>(f) Except as provided in &#167; 21.32, an individual's access to records about him/herself that are retrieved by his/her name or
other personal identifiers and contained in any Privacy Act Record System may only be denied by the Associate Commissioner for Public Affairs
or his or her designate. An individual shall not be denied access to any record that is otherwise available to him/her under this part except
on the grounds that it is exempt under &#167; 21.65(a)(2), that it was compiled in reasonable anticipation of court litigation of formal
administrative proceedings, or to the extent that it is exempt or prohibited from disclosure because it includes a trade secret or commercial
or financial information that is privileged or confidential information the disclosure of which would constitute a clearly unwarranted
invasion of personal privacy of another individual.
</p>
<p>(g) The FDA Privacy Act Coordinator shall ensure that records are maintained of the number, status, and disposition of requests under this
subpart, including the number of requests for records exempt from access under this subpart and other information required for purposes of the
annual report to Congress under the Privacy Act. These temporary administrative management records shall not be considered to be Privacy Act
Record Systems. All records required to be kept under this paragraph shall only include requesting individuals' names or personal identifiers
for so long as any request for notification, access, or amendment is pending. The identity of individuals making request under this subpart
shall be regarded as confidential and shall not be disclosed under part 20 of this chapter (the public information regulations) to any other
person or agency except as is necessary for the processing of requests under this subpart.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 76 FR 31470, June 1, 2011]
</p><p><b>&#167; 21.42
 Responses to requests.
</b></p>
<p>(a) The FDA shall respond to an individual's request for notification as to whether a Privacy Act Record System contains records about
him that are retrieved by his name or other personal identifier by sending a letter under this paragraph.
</p>
<p>(1) If there are no records about the individual that are retrieved by his name or other personal identifier in the named Privacy Act
Record System, or the requester is not an "individual" under &#167; 21.3(a), the letter shall so state. Where appropriate, the letter
shall indicate that the Food and Drug Administration's public information regulations in part 20 of this chapter prescribe general rules
governing the availability of information to members of the public, and that a request may be made in accordance with part 20 of this chapter
for records that are not retrieved by the requester's name or other personal identifier from a Privacy Act Record System.
</p>
<p>(2) If there are records about the individual that are retrieved by his name or other personal identifier and the named Privacy Act Record
System is not exempt from individual access and contest under &#167; 21.61, or the system is exempt but access is allowed or required
under &#167; 21.65, the letter shall inform him that the records exist and shall either:
</p>
<p>(i) Enclose a copy of the records under &#167; 21.43(a)(1) or indicate that the records will be sent under separate cover, where there
has been adequate verification of the identity of the individual under &#167; 21.44 and the fees under &#167; 21.45 do not exceed
$25, or
</p>
<p>(ii) Inform the individual of the procedures to obtain access to the records by mail or in person under &#167; 21.43(a)(2), as well as
the approximate dates by which the requested records can be provided (if the records are not then available), the locations at which access in
person may be had, and the information needed, if any, to verify the identity of the individual under &#167; 21.44.
</p>
<p>(3) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal
identifier, and the system is exempt from individual access and contest under &#167; 21.61 and access is not allowed or required under
&#167; 21.65, the letter should inform him that the records are exempted from access and contest by &#167; 21.61. The letter shall
also inform him if the records sought are not available because they were compiled in reasonable anticipation of court litigation or formal
administrative proceedings or are otherwise not available under &#167; 21.41(b). Where appropriate, the letter shall also indicate
whether the records are available under part 20 of this chapter (the public information regulations), and it may disclose the records in
accordance with part 20.
</p>
<p>(4) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal
identifier, but a final determination has not yet been made with respect to disclosure of all of the records covered by the request, e.g.,
because it is necessary to consult another person or agency having an interest in the confidentiality of the records, the letter shall explain
the circumstances and indicate when a final answer will be given.
</p>
<p>(b) Except as provided in &#167; 21.32, access to a record may only be denied by the Associate Commissioner for Public Affairs or his
or her designate. If access to any record is denied wholly or in substantial part, the letter shall state the right of the individual to
appeal to the Commissioner of Food and Drugs.
</p>
<p>(c) If a request for a copy of the records will result in a fee of more than $25, the letter shall specify or estimate the fee involved.
Where the individual has requested a copy of any records about him and copying the records would result in a fee of over $50, the Food and
Drug Administration shall require advance deposit as well as payment of any amount not yet received as a result of any previous request by the
individual for a record about himself, under this subpart or part 20 of this chapter (the public information regulations) before the records
are made available. If the fee is less than $50, prepayment shall not be required unless payment has not yet been received for records
disclosed as a result of a previous request by the individual for a record about himself under this subpart or part 20 of this chapter.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981]
</p><p><b>&#167; 21.43
 Access to requested records.
</b></p>
<p>(a) Access may be granted to requested records by:
</p>
<p>(1) Mailing a copy of the records to the requesting individual, or
</p>
<p>(2) Permitting the requesting individual to review the records in person between 9 a.m. and 4 p.m. at the office of the FDA Privacy Act
Coordinator, at the Division of Freedom of Information Public Reading Room at the address shown in &#167; 20.30 of this chapter, or at
any Food and Drug Administration field office, listed in part 5, subpart M of this chapter, or at another location or time upon which the Food
and Drug Administration and the individual agree. Arrangement for such review can be made by consultation between the FDA Privacy Act
Coordinator and the individual. An individual seeking to review records in person shall generally be permitted access to the file copy, except
that where the records include nondisclosable information, a copy shall be made of that portion of the records, with the nondisclosable
information blocked out. Where the individual is not given a copy of the record to retain, no charge shall be made for the cost of copying a
record to make it available to an individual who reviews a record in person under this paragraph.
</p>
<p>(b) An individual may request that a record be disclosed to or discussed in the presence of another individual, such as an attorney. The
individual may be required to furnish a written statement authorizing the disclosure or discussion in such other individual's presence.
</p>
<p>(c) The Food and Drug Administration will make every reasonable effort to assure that records made available under this section can be
understood by the individual, such as by providing an oral or written explanation of the records.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 69 FR 17290, Apr. 2, 2004; 76 FR 31470, June 1, 2011]

</p><p><b>&#167; 21.44
 Verification of identity.
</b></p>
<p>(a) An individual seeking access to records in a Privacy Act Record System may be required to comply with reasonable requirements to
enable the Food and Drug Administration to determine his identity. The identification required shall be suitable considering the nature of the
records sought. No identification shall be required to receive access to information that is required to be disclosed to any member of the
public under part 20 of this chapter (the public information regulations).
</p>
<p>(b) An individual who appears in person for access to records about himself shall be required to provide at least one document to identify
himself, e.g., driver's license, passport, or alien or voter registration card to verify his identity. If an individual does not have any such
document or requests access to records about himself without appearing in person under circumstances in which his identity cannot be verified
from the request itself, he shall be required to certify in writing that he is the individual he claims to be and that he understands that the
knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to
a $5,000 fine.
</p>
<p>(c) In making requests under &#167; 21.75, a parent of a minor child or legal guardian of an incompetent individual may be required to
verify his relationship to the minor child or the incompetent individual, in addition to verifying his own identity, by providing a copy of
the minor's birth certificate, a court order, or other evidence of guardianship.
</p>
<p>(d) Where an individual seeks access to particularly sensitive records, such as medical records, the individual may be required to provide
additional information beyond that specified in paragraph (b) or (c) of this section, such as the individual's years of attendance at a
particular educational institution, rank attained in the uniformed services, date or place of birth, names of parents, an occupation, or the
specific times the individual received medical treatment.
</p><p><b>&#167; 21.45
 Fees.
</b></p>
<p>(a) Where applicable, fees for copying records shall be charged in accordance with the schedule set forth in this section. Fees may
only be charged where an individual has requested that a copy be made of a record to which he is granted access. No fee may be charged for
making a search of a Privacy Act Record System whether the search is manual, mechanical, or electronic. Where a copy of the record must be
made to provide access to the record, e.g., computer printout where no screen reading is available, the copy shall be made available to the
individual without cost. Where a medical record is made available to a representative designated by the individual under &#167; 21.33, no
fee will be charged.
</p>
<p>(b) The fee schedule is as follows:
</p>
<p>(1) Copying of records susceptible to photocopying--$.10 per page.
</p>
<p>(2) Copying of records not susceptible to photocopying, e.g., punch cards or magnetic tapes--at actual cost to the determined on a
case-by-case basis.
</p>
<p>(3) No charge will be made if the total amount of copying for an individual does not exceed $25.
</p>
<p>(c) When a fee is to be assessed, the individual shall be notified prior to the processing of the copies, and be given an opportunity to
amend his request. Payment shall be made by check or money order made payable to the "Food and Drug Administration," and shall be sent to the
Accounting Branch (HFA-120), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857. Advance deposit shall be required
where the total amount exceeds $50.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 54 FR 9038, Mar. 3, 1989]
</p><p><b>Subpart E--Procedures for Requests for Amendment of Records
</b></p><p><b>&#167; 21.50
 Procedures for submitting requests for amendment of records.
</b></p>
<p>(a) An individual who received access to a record about himself under subpart D of this part may request that the record be amended if
he believes that the record or an item of information is not accurate, relevant to a Food and Drug Administration purpose, timely, or
complete.
</p>
<p>(b) Amendments under this subpart shall not violate existing statute, regulation, or administrative procedure.
</p>
<p>(1) This subpart does not permit alteration of evidence presented in the course of judicial proceedings or Food and Drug Administration
adjudicatory or rule making proceedings or collateral attack upon that which has already been the subject of any such proceedings.
</p>
<p>(2) If the accuracy, relevancy, timeliness, or completeness of the records may be contested in any other pending or imminent agency
proceeding, the Food and Drug Administration may refer the individual to the other proceeding as the appropriate means to obtain relief. If
the accuracy, relevance, timeliness, or completeness of a record is, or has been, an issue in another agency proceeding, the request under
this section shall be disposed of in accordance with the decision in the other proceeding, absent unusual circumstances.
</p>
<p>(c) Requests to amend records shall be submitted, in writing, to the FDA Privacy Act Coordinator in accordance with &#167; 21.40(b).
Such requests shall include information sufficient to enable the Food and Drug Administration to locate the record, a brief description of the
items of information requested to be amended, and the reasons why the record should be amended together with any appropriate documentation or
arguments in support of the requested amendment. An edited copy of the record showing the described amendment may be included. Verification of
identity should be provided in accordance with &#167; 21.44.
</p>
<p>(d) Written acknowledgement of the receipt of a request to amend a record shall be provided within 10 working days to the individual who
requested the amendment. Such acknowledgement may request any additional information needed to verify identity or make a determination. No
acknowledgement need be made if the request can be reviewed, processed, and the individual notified of the agency's agreement with the request
or refusal within the 10-day period.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8459, Jan. 27, 1981]
</p><p><b>&#167; 21.51
 Responses to requests for amendment of records.
</b></p>
<p>(a) The Food and Drug Administration shall take one of the following actions on a request for amendment of records as promptly as
possible:
</p>
<p>(1) Amend any portion of the record which the agency has determined, based upon a preponderance of the evidence, is not accurate, relevant
to a Food and Drug Administration purpose, timely, or complete, and, in accordance with paragraph (d)(3) of this section, inform the
individual and previous recipients of the record that has been amended of the amendment.
</p>
<p>(2) Inform the individual of its refusal to amend any portion of the record in the manner requested, the reason for the refusal, and the
opportunity for administrative appeal to the Commissioner of Food and Drugs. Except as provided in &#167; 21.32, such refusal may only be
issued by the Associate Commissioner for Public Affairs or his or her designate.
</p>
<p>(3) Where another agency was the source of and has control of the record, refer the request to that agency.
</p>
<p>(b) The agency may, for good cause, extend the period for taking action an additional 30 working days if notice is provided to the
individual explaining the circumstances of the delay.
</p>
<p>(c) The officials charged with reviewing a record to determine how to respond to a request to amend it, shall assess its accuracy,
relevance to a Food and Drug Administration purpose, timeliness, or completeness. The determination shall be made in the light of the purpose
for which the records or system is used, the agency's need for the record, and the possible adverse consequences to the individual from the
record if not amended. Whenever the Food and Drug Administration receives a request for deletion of a record, or portions of a record, it
shall consider anew whether the contested information in the record is relevant and necessary to a Food and Drug Administration purpose.
</p>
<p>(d) If the Food and Drug Administration agrees with an individual's request, it shall take the following actions:
</p>
<p>(1) So inform the individual in writing.
</p>
<p>(2) In accordance with statute, regulation, or procedure, amend the record to make it accurate, relevant to a Food and Drug Administration
purpose, timely, or complete, making note of the date and fact of the amendment.
</p>
<p>(3) If an accounting was made under &#167; 21.71(d) of a disclosure of the record under &#167; 21.71(a), provide a copy of the
record as amended, to all previous recipients of the record.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8459, Jan. 27, 1981]
</p><p><b>&#167; 21.52
 Administrative appeals of refusals to amend records.
</b></p>
<p>(a) If an individual disagrees with a refusal under &#167; 21.51(a)(2) to amend a record, he or she may appeal that refusal to
the Commissioner of Food and Drugs, Rm. 14-71, 5600 Fishers Lane, Rockville, MD 20857.
</p>
<p>(b) If, upon appeal, the Commissioner upholds the refusal to amend the record as requested, he shall inform the individual:
</p>
<p>(1) Of his decision and the reasons for it.
</p>
<p>(2) Of the individual's right to file with the Food and Drug Administration a concise statement of the individual's reasons for disagreeing
with the agency's decision not to amend the record as requested.
</p>
<p>(3) That the statement of disagreement will be made available to all persons listed in an accounting as having previously received the
record and any person to whom the record is subsequently disclosed together with, in the discretion of the Food and Drug Administration, a
brief statement summarizing its reasons for refusing to amend the record. Any individual who includes false information in the statement of
disagreement filed with the Food and Drug Administration may be subject to penalties under 18 U.S.C. 1001, the False Reports to the Government
Act.
</p>
<p>(4) That the individual has a right to seek judicial review of the refusal to amend the record.
</p>
<p>(c) If the Commissioner on administrative appeal or a court on judicial review determines that the record should be amended in accordance
with the individual's request, the Food and Drug Administration shall proceed in accordance with &#167; 21.51(d).
</p>
<p>(d) A final determination on the individual's administrative appeal of the initial refusal to amend the record shall be concluded within 30
working days of the request for such review under paragraph (a) of this section, unless the Commissioner extends such period for good cause
and informs the individual in writing of the reasons for the delay and of the approximate date on which a decision of the appeal can be
expected.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985]
</p><p><b>&#167; 21.53
 Notation and disclosure of disputed records.
</b></p>
<p>When an individual has filed a statement of disagreement under &#167; 21.52(b)(2), the Food and Drug Administration shall:
</p>
<p>(a) Mark any portion of the record that is disputed to assure that the record will clearly show that portion is disputed whenever the
record is disclosed.
</p>
<p>(b) In any subsequent disclosure under &#167; 21.70 or &#167; 21.71(a), provide a copy of the statement of disagreement and, if
the Food and Drug Administration deems it appropriate, a concise statement of the agency's reasons for not making the amendment(s) requested.
While the individual shall have access to any such statement, it shall not be subject to a request for amendment under &#167; 21.50.
</p>
<p>(c) If an accounting was made under &#167; 21.71(d) and (e) of a disclosure of the record under &#167; 21.71(a), provide to all
previous recipients of the record a copy of the statement of disagreement and the agency statement, if any.
</p><p><b>&#167; 21.54
 Amended or disputed records received from other agencies.
</b></p>
<p>Whenever the Food and Drug Administration is notified that a record that it received from another agency was amended or is the subject
of a statement of disagreement, the Food and Drug Administration shall:
</p>
<p>(a) Discard the record, or clearly note the amendment or the fact of disagreement in its copy of the record, and
</p>
<p>(b) Refer persons who subsequently request the record to the agency that provided it.
</p>
<p>(c) If an accounting was made under &#167; 21.71 (d) and (e) of the disclosure of the record under &#167; 21.71(a), inform all
previous recipients of the record about the amendment or provide to them the statement of disagreement and the agency statement, if any.
</p><p><b>Subpart F--Exemptions
</b></p><p><b>&#167; 21.60
 Policy.
</b></p>
<p>It is the policy of the Food and Drug Administration that record systems should be exempted from the Privacy Act only to the extent
essential to the performance of law enforcement functions under the laws that are administered and enforced by the Food and Drug
Administration or that govern the agency.
</p><p><b>&#167; 21.61
 Exempt systems.
</b></p>
<p>(a) Investigatory records compiled for law enforcement purposes, including criminal law enforcement purposes, in the Food and Drug
Administration Privacy Act Record Systems listed in paragraph (b) of this section are exempt from the following provisions of the Privacy Act
(5 U.S.C. 552a) and of this part:
</p>
<p>(1) Such records are exempt from 5 U.S.C. 552a(c)(3) and &#167; 21.71(e)(4), requiring that an individual be provided with the
accounting of disclosures of records about himself from a Privacy Act Record System.
</p>
<p>(2) Except where access is required under 5 U.S.C. 552a(k)(2) and &#167; 21.65(a)(2), (such records are exempt from 5 U.S.C. 552a(d)
(1) through (4) and (f)) and &#167;&#167; 21.40 through 21.54, requiring procedures for an individual to be given notification of and
access to records about himself in a Privacy Act Record System and to be allowed to challenge the accuracy, relevance, timeliness, and
completeness of such records.
</p>
<p>(3) Such records are exempt from 5 U.S.C. 552a(e)(4)(G) and (H) and &#167; 21.20(b)(1) requiring inclusion in the notice for the
system of information about agency procedures for notification, access, and contest.
</p>
<p>(4) Such records are exempt from 5 U.S.C. 552a(e)(3) requiring that individuals asked to supply information be provided a form outlining
the authority for the request, the purposes for which the information will be used, the routine uses in the notice for the Privacy Act Record
System, and the consequences to the individual of not providing the information, but only with respect to records compiled by the Food and
Drug Administration in a criminal law enforcement investigation where the conduct of the investigation would be prejudiced by such procedures.
</p>
<p>(b) Records in the following Food and Drug Administration Privacy Act Record Systems that concern individuals who are subject to Food and
Drug Administration enforcement action and consist of investigatory records compiled for law enforcement purposes, including criminal law
enforcement purposes, are exempt under 5 U.S.C. 552a(j)(2) and (k)(2) from the provisions enumerated in paragraph (a) of this section:
</p>
<p>(1) Bio-research Monitoring Information System--HHS/FDA/09-10-0010.
</p>
<p>(2) Regulated Industry Employee Enforcement Records--HHS/FDA/ACMO/09-10-002.
</p>
<p>(3) Employee Conduct Investigative Records--HHS/FDA/ACMO/09-10-0013.
</p>
<p>(c) The system described in paragraph (b)(3) of this section includes investigatory records compiled solely for the purpose of determining
suitability, eligibility, or qualification for Federal civilian employment, military service, Federal contracts, and access to classified
information. These records are exempt from disclosure under 5 U.S.C. 552a(k)(5) to the extent that the disclosure would reveal the identity of
a source who furnished information to the Government under a promise of confidentiality, which must be an express promise if the information
was furnished after September 27, 1975. Any individual who is refused access to a record that would reveal a confidential source shall be
advised in a general way that the record includes information that would reveal a confidential source.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8459, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985]
</p><p><b>&#167; 21.65
 Access to records in exempt systems.
</b></p>
<p>(a) Where a Privacy Act Record System is exempt and the requested records are unavailable under &#167; 21.61, an individual may
nevertheless make a request under &#167; 21.40 for notification concerning whether any records about him exist and request access to such
records where they are retrieved by his name or other personal identifier.
</p>
<p>(b) An individual making a request under paragraph (a) of this section;
</p>
<p>(1) May be given access to the records where available under part 20 of this chapter (the public information regulations) or the
Commissioner may, in his discretion, entertain a request under any or all of the provisions of &#167;&#167; 21.40 through 21.54; and
</p>
<p>(2) Shall be given access upon request if the records requested are subject to 5 U.S.C. 552a(k)(2) and not to 5 U.S.C. 552a(j)(2) (i.e.,
because they consist of investigatory material compiled for law enforcement purposes other than criminal law enforcement purposes) and
maintenance of the records resulted in denial to the individual of any right, benefit, or privilege to which he would otherwise be entitled by
Federal law, or for which he would otherwise be eligible. An individual given access to a record under this paragraph (b)(2) is not entitled
to seek amendment under subpart E of this part. The FDA may refuse to disclose a record that would reveal the identity of a source who
furnished information to the Government under a promise of confidentiality, which must be an express promise if the information was furnished
on or after September 27, 1975. Any individual refused access to a record that would reveal a confidential source shall be advised in a
general way that the record contains information that would reveal a confidential source.
</p>
<p>(c) The Commissioner shall not make available any record that is prohibited from public disclosure under &#167; 20.82(b) of this
chapter.
</p>
<p>(d) Discretionary disclosure of a record pursuant to paragraph (b)(1) of this section shall not set a precedent for discretionary
disclosure of a similar or related record and shall not obligate the Commissioner to exercise his discretion to disclose any other record in a
system that is exempt under &#167; 21.61.
</p><p><b>Subpart G--Disclosure of Records in Privacy Act Record Systems to Persons Other Than the Subject Individual
</b></p><p><b>&#167; 21.70
 Disclosure and intra-agency use of records in Privacy Act Record Systems; no accounting required.
</b></p>
<p>(a) A record about an individual which is contained in a Privacy Act Record System may be disclosed:
</p>
<p>(1) To the individual who is the subject of the record, or his legal guardian under &#167; 21.75;
</p>
<p>(2) To a third party pursuant to a written request by, or within a written consent of, the individual to whom the record pertains, or his
legal guardian under &#167; 21.75;
</p>
<p>(3) To any person:
</p>
<p>(i) Where the names and other identifying information are first deleted, and under circumstances in which the recipient is unlikely to know
the identity of the subject of the record;
</p>
<p>(ii) Where disclosure is required by part 20 of this chapter (the public information regulations); or
</p>
<p>(4) Within the Department of Health and Human Services to officers and employees who have a need for the record in the performance of their
duties in connection with the laws administered and enforced by the Food and Drug Administration or that govern the agency. For purposes of
this section, officers or employees of the Department shall include the following categories of individuals, who shall thereafter be subject
to the same restrictions with respect to disclosure as any Food and Drug Administration employee: Food and Drug Administration consultants and
advisory committees, State and local government employees for use only in their work with the Food and Drug Administration, and contractors
and their employees to the extent that the records of such contractors are subject to the requirements of this part under &#167; 21.30.
</p>
<p>(b) No accounting is required for any disclosure or use under paragraph (a) of this section.
</p><p><b>&#167; 21.71
 Disclosure of records in Privacy Act Record Systems; accounting required.
</b></p>
<p>(a) Except as provided in &#167; 21.70, a record about an individual that is contained in a Privacy Act Record System shall not
be disclosed by any method of communication except under any of the following circumstances, which are subject to the limitations of
paragraphs (b) and (c) of this section and to the accounting requirement of paragraph (d) of this section:
</p>
<p>(1) To those officers and employees of the agency which maintains the record who have a need for the record in the perfomance of their
duties;
</p>
<p>(2) Required under section 552 of the Freedom of Information Act;
</p>
<p>(3) For a routine use as described in the routine use section of each specific system notice;
</p>
<p>(4) To the Bureau of Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of
title 13 of the U.S. Code;
</p>
<p>(5) To a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical
research or reporting record, and that the record is to be transferred in a form that is not individually identifiable;
</p>
<p>(6) To the National Archives and Records Administration of the United States as a record which has sufficient historical or other value to
warrant its continued preservation by the U.S. Government, or to the Archivist of the United States or his or her designee for evaluation to
determine whether the record has such value;
</p>
<p>(7) To another agency or to an instrumentality of any government jurisdiction within or under the control of the United States for a civil
or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written
request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the
record is sought;
</p>
<p>(8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if, upon such disclosure,
notification is transmitted to the last known address of such individual;
</p>
<p>(9) To either House of Congress or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint
committee of Congress or subcommittee of any such joint committee;
</p>
<p>(10) To the Comptroller General, or any of his or her authorized representatives in the course of the performance of the duties of the
General Accounting Office;
</p>
<p>(11) Pursuant to the order of a court of competent jurisdiction; or
</p>
<p>(12) To a consumer reporting agency in accordance with section 3(d) of the Federal Claims Collection Act of 1966 (31 U.S.C. 952(d)). (This
"Special Disclosure" statement does not apply to any FDA system of records.)
</p>
<p>(b) The Food and Drug Administration may in its discretion refuse to make a disclosure permitted under paragraph (a) of this section, if
the disclosure would in the judgment of the agency, invade the privacy of the individual or be inconsistent with the purpose for which the
information was collected.
</p>
<p>(c) The Food and Drug Administration may require any person requesting a disclosure of a record under paragraph (a) of this section to
provide:
</p>
<p>(1) Information about the purposes to which the disclosed record is to be put, and
</p>
<p>(2) A written statement certifying that the record will be used only for the stated purposes and will not be further disclosed without the
written permission of the Food and Drug Administration.
</p>
<p>Under 5 U.S.C. 552a(i)(3), any person who knowingly or willfully requests or obtains any record concerning an individual from an agency
under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000. Such person may also be subject to prosecution under
the False Reports to the Government Act, 18 U.S.C. 1001.
</p>
<p>(d) An accounting shall be made, in accordance with paragraph (e) of this section, of any disclosure under paragraph (a) of this section of
a record that is not a disclosure under &#167; 21.70.
</p>
<p>(e) Where an accounting is required under paragraph (d) of this section, the Food and Drug Administration shall:
</p>
<p>(1) Record the name and address of the person or agency to whom the disclosure is made and the date, nature, and purpose of the disclosure.
The accounting shall not be considered a Privacy Act Record System.
</p>
<p>(2) Retain the accounting for 5 years or for the life of the record, whichever is longer, following the disclosure.
</p>
<p>(3) Notify those recipients listed in the accounting of amendments or disputes concerning the records previously disclosed to them pursuant
to &#167; 21.51(d)(3), &#167; 21.53(c), or &#167; 21.54(c).
</p>
<p>(4) Except when the record is exempt from individual access and contest under &#167; 21.61 or to the extent that the accounting
describes a transfer for a law enforcement purpose pursuant to paragraph (a)(7) of this section, make the accounting available to the
individual to whom the record pertains, in accordance with procedures of subpart D of this part.
</p>
<p>(f) A single accounting may be used to cover disclosure(s) that consist of a continuing dialogue between two agencies over a prolonged
period, such as discussion of an enforcement action between the Food and Drug Administration and the Department of Justice. In such cases, a
general notation may be made that, as of a certain date, contract was initiated, to continue until resolution of the matter.
</p>
<p>[42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985; 54 FR 9038, Mar. 3, 1989]
</p><p><b>&#167; 21.72
 Individual consent to disclosure of records to other persons.
</b></p>
<p>(a) Individuals may consent to disclosure of records about themselves to other persons in several ways, for example:
</p>
<p>(1) An individual may give consent at the time that the information is collected for disclosure for specific purposes or to specific
persons.
</p>
<p>(2) An individual may give consent for disclosure of his records to a specific person.
</p>
<p>(3) An individual may request the Food and Drug Administration to transcribe a specific record for submission to another person.
</p>
<p>(b) In each case the consent shall be in writing and shall specify the individual, organizational unit, or class of individuals or
organizational units to whom the record may be disclosed, which record may be disclosed, and, if applicable, for what time period. A blanket
consent to release all of an individual's records to unspecified individuals or organizational units will not be honored. Verification of the
identity of the individual and, where applicable, of the person to whom the record is to be disclosed shall be made in accordance with
&#167; 21.44. Consent documents shall be retained for a period of at least 2 years. If such documents are used as a means of accounting
for the disclosure, they shall be retained as provided in &#167; 21.71(e)(2).
</p><p><b>&#167; 21.73
 Accuracy, completeness, timeliness, and relevance of records disclosed from Privacy Act Record Systems.
</b></p>
<p>(a) The Food and Drug Administration shall make reasonable efforts to assure that a record about an individual in a Privacy Act Record
System is accurate, relevant to a Food and Drug Administration purpose, timely, and complete before such record is disclosed under
&#167; 21.71.
</p>
<p>(b) Paragraph (a) of this section shall not apply to disclosures that are required under part 20 of this chapter (the public information
regulations) or made to other Federal Government departments and agencies. Where appropriate, the letter disclosing the information shall
indicate that the Food and Drug Administration has not reviewed the record to assure that it is accurate, relevant, timely, and complete.
</p><p><b>&#167; 21.74
 Providing notice that a record is disputed.
</b></p>
<p>Whenever an individual has filed a statement of disagreement with the Food and Drug Administration concerning a refusal to amend a
record under &#167; 21.51(a)(2) or with another agency that provides the record to the Food and Drug Administration, the Food and Drug
Administration shall in any subsequent disclosure under this subpart provide a copy of the statement of disagreement and a concise statement
by the agency, if one has been prepared, of the reasons for not making the amendment(s) requested.
</p><p><b>&#167; 21.75
 Rights of legal guardians.
</b></p>
<p>For the purposes of this part, the parent of any individual who is a minor or the legal guardian of any individual who has been
declared to be incompetent due to physical or mental incapacity or age by a court of competent jurisdiction may act on behalf of the
individual.

</p>
</xhtmlContent>
</regulationsPart>
    </regulationsChapter>
</regulationsTitle>
</regulations>
<regulations id="reg" toc="yes">
<regulationsTitle number="48">
<heading> Federal Acquisition Regulations System </heading>
<regulationsChapter number="3">
<heading> Department of Health and Human Services </heading>
<regulationsPart number="324">
<heading> PROTECTION OF PRIVACY AND FREEDOM OF INFORMATION </heading>
<xhtmlContent><p>
<b>Subpart 324.1--Protection of Individual Privacy
</b></p>
<p>Sec.
</p>
<p>324.000 Scope of subpart.
</p>
<p>324.102 General.
</p>
<p>324.103 Procedures.
</p>
<p><b>Authority:</b> 5 U.S.C. 301; 40 U.S.C. 486(c).
</p>
<p><b>Source:</b> 66 FR 4245, Jan. 17, 2001, unless otherwise noted.
</p><p><b>Subpart 324.1--Protection of Individual Privacy
</b></p>
<p>324.000
 Scope of subpart.
</p>
<p>This part prescribes policies and procedures that apply requirements of the Privacy Act of 1974 (5 U.S.C. 552a) (the Act) and OMB Circular
A-130, Revised, November 30, 2000, to Government contracts and cites the Freedom of Information Act (5 U.S.C. 552, as amended).
</p>
<p>[70 FR 40, Jan. 3, 2005]
</p>
<p>324.102
 General.
</p>
<p>(a) It is the Department's policy to protect the privacy of individuals to the maximum possible extent while permitting the exchange of
records required to fulfill the Department's administrative and program responsibilities and its responsibilities for disclosing records to
which the general public is entitled under the Freedom of Information Act (5 U.S.C. 552). The Privacy Act of 1974 and the Department's
implementation under 45 CFR part 5b apply "when an agency provides by a contract for the operation by or on behalf of the agency of a system
of records to accomplish any agency function* * *" The key factor is whether a departmental function is involved. Therefore, the
Privacy Act requirements apply to a departmental contract when, under the contract, the contractor must maintain or operate a system of
records to accomplish a departmental function.
</p>
<p>(e) The program official, and, as necessary, the official designated as the activity's Privacy Act Coordinator and the Office of General
Counsel, shall determine the applicability of the Act to each proposed acquisition. The program official is required to include a statement in
the request for contract indicating whether the Privacy Act is or is not applicable to the proposed acquisition.
</p>
<p>(f) Whenever the contracting officer is informed that the Privacy Act is not applicable, but the resultant contract will involve the
collection of individually identifiable personal data by the contractor, the contracting officer shall include provisions to protect the
confidentiality of the records and the privacy of individuals identified in the records (see subpart 324.70).
</p>
<p>324.103
 Procedures.
</p>
<p>(a) All requests for contract shall be reviewed by the contracting officer to determine whether the Privacy Act requirements are
applicable. The Privacy Act requirements are applicable when the contract will require the contractor to design, develop, or operate any
Privacy Act system of records on individuals to accomplish an agency function. When applicable, the contracting officer shall include the
solicitation notification and contract clause required by FAR 24.104 in the solicitation, and the contract clause in the resultant contract.
In addition, the contracting officer shall ensure that the solicitation notification, contract clause, and other pertinent information
specified in this subpart are included in any contract modification which results in the Privacy Act requirements becoming applicable to a
contract.
</p>
<p>(b)(1) The Contracting Officer shall identify in the contract work statement the system(s) of records to which the Privacy Act and the
implementing regulations are applicable.
</p>
<p>(2) The Contracting Officer shall include the clause specified in 352.270-11 in Section H of any RFP or resulting contract to notify
the contractor that it and its employees are subject to criminal penalties for violations of the Act (5 U.S.C. 552a(i)) to the same extent as
HHS employees. The clause also requires that the contractor ensure that each of its employees knows the prescribed rules of conduct and each
contractor employee is aware that he/she is subject to criminal penalties for violations of the Act. These provisions also apply to all
subcontracts awarded under the contract which require the design, development or operation of a system of records. The Contracting Officer
shall send the contractor a copy of 45 CFR part 5b, which includes the rules of conduct and other Privacy Act requirements.
</p>
<p>(c) The Contracting Officer shall specify in the contract work statement and award the disposition to be made of the system(s) of records
upon completion of contract performance. The contract work statement may require the contractor to destroy the records, remove personal
identifiers, or turn the records over to the Contracting Officer. If there is a legitimate need for a contractor to keep copies of the records
after completion of a contract, the contractor must take measures, as approved by the Contracting Officer, to keep the records confidential
and protect the individuals' privacy.
</p>
<p>(d) Whenever an acquisition is determined to be subject to the Privacy Act requirements, a "system notice," prepared by the program
official and describing the Department's intent to establish a new system of records on individuals, to make modifications to an existing
system, or to disclose information in regard to an existing system, is required to be published in the <i>Federal Register.</i> A copy of the
"system notice" shall be attached to the request for contract or purchase request. If a "system notice" is not attached, the contracting
officer shall inquire about its status and shall obtain a copy from the program official for inclusion in the contract file. If a "system
notice" has not been published in the <i>Federal Register,</i> the contracting officer may proceed with the acquisition but shall not award
the contract until the "system notice" is published, and publication is verified by the contracting officer.
</p>
<p>[66 FR 4245, Jan. 17, 2001, as amended at 71 FR 76501, Dec. 20, 2006]
</p>
</xhtmlContent>
</regulationsPart>
</regulationsChapter>
</regulationsTitle>
</regulations>
</agency>
</pai>
