[Federal Register Volume 60, Number 3 (Thursday, January 5, 1995)]
[Notices]
[Pages 1788-1791]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 95-268]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Public Health Service
Office of the Assistant Secretary for Health; Privacy Act of
1974; New System of Records
AGENCY: Public Health Service, HHS.
ACTION: Notification of a new system of records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the requirements of the Privacy Act, the
Public Health Service (PHS) is publishing a notice of a new system of
records, 09-37-0024, ``Studies of Preventive Medicine, Health
Promotion, and Disease Prevention, HHS/OASH/ODPHP.'' records. We are
also proposing routine uses for this new system.
DATES: PHS invites interested parties to submit comments on the
proposed routine use on or before (30 days after publication). PHS has
sent a Report of New System of Records to the Congress and to the
Office of Management and Budget (OMB) on December 28, 1994. The system
of records will be effective 40 days after the date of publication
unless PHS receives comments that [[Page 1789]] would result in a
contrary determination.
ADDRESSES: Please submit comments to: PHS Privacy Act Officer, Room 17-
45, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857,
Telephone: 301-443-2055 (This is not a toll-free number).
Comments received will be available for inspection at the above
address from 8:30 a.m. to 4 p.m. Monday through Friday.
FOR FURTHER INFORMATION CONTACT:
Dr. Hurdis M. Griffith, Senior Policy Advisor, Office of Disease
Prevention and Health Promotion, 2132 Switzer Building, 330 C Street,
SW, Washington, DC 20201, 202-205-8660 (This is not a toll-free
number).
SUPPLEMENTARY INFORMATION: PHS proposes to establish a new system of
records: 09-37-0024, ``Studies of Preventive Medicine, Health
Promotion, and Disease Prevention, HHS/OASH/ODPHP.'' This system of
records will be used by the Office of Disease Prevention and Health
Promotion (ODPHP) in the Office of the Assistant Secretary for Health
(OASH) to study the impact of preventive medicine interventions and
public education efforts on health service delivery, patient behavior,
and health outcome.
The system will contain records of patients of the clinicians
participating in these studies, as well as normal volunteers, relatives
of the patients, and the providers of services. Examples of the
information collected are: Patient or provider name, study
identification number, address, relevant telephone numbers, Social
Security Number (voluntary), date of birth, weight, height, sex, race;
medical, psychological and dental information, laboratory and
diagnostic testing results; registries; social, economic and
demographic data; health services utilization; immunization status;
insurance and hospital cost data, employers; characteristics and
activities of health care providers.
The records in this system will be maintained in a secure manner
commensurate with their content and use. The System Manager will
control access to the data. Access to identifiers and to link files is
strictly limited to the authorized personnel whose duties require such
access. Procedures for determining authorized access to identified data
are established as appropriate for each location. Personnel, including
contractor personnel, who may be so authorized include those directly
involved in data collection and in the design of research studies,
e.g., interviewers and interviewer supervisors; project managers; and
statisticians involved in designing sampling plans. Other one-time and
special access by other employees is granted on a need-to-know basis as
specifically authorized by the System Manager. Researchers authorized
to conduct research will typically access the system through the use of
encrypted identifiers sufficient to link individuals with records in
such a manner that does not compromise confidentiality of the
individual. The collection and maintenance of data is consistent with
legislation and regulations regarding the protection of human subjects,
informed consent, and confidentiality.
The proposed routine uses are compatible with the stated purposes
of the system. The first routine use permits the disclosure of
information to researchers under carefully controlled conditions. The
second routine use permits the disclosure of information to a member of
Congress when a constituent has requested assistance. The third routine
use permits HHS to disclose information to the Department of Justice in
the event of litigation. The fourth routine use permits disclosure of
information to a contractor for the purpose of analyzing or refining
the data. The fifth routine use permits disclosure of information for
the purpose of quality assessment, audit, or utilization review. The
sixth routine use permits disclosure to Federal and State agencies, and
private organizations for the purpose of locating individuals for
follow-up studies. The seventh routine use permits the disclosure of
information to student volunteers who need the records to carry out
their official functions.
The following notice is written in the present, rather than the
future tense, to avoid the unnecessary expenditures of public funds for
republishing the notice after the system has become effective.
Dated: December 30, 1994.
Ellen Wormser,
Director, Office of Organization and Management Systems.
09-37-0024
Studies of Preventive Medicine, Health Promotion, and Disease
Prevention, HHS/OASH/ODPHP.
None.
Records are located at the Office of Disease Prevention and Health
Promotion (ODPHP) and Contractor research facilities that collect or
provide research data for this system. Primary record storage sites are
listed in Appendix I. A current list of additional contractor sites is
available by writing to the System Manager at the address below.
Patients (adults and children) of the clinicians participating in
these studies; individuals who are representative of the general
population or of special groups including, but not limited to: Normal
controls, normal volunteers, family members and relatives; providers of
services.
The system contains records about individuals as relevant to these
studies: (1) Medical records (treatment, laboratory screening and
diagnostic tests, and preventive services); (2) clinician surveys (use
of screening, counseling and preventive services); and (3) patient
surveys (height, weight, race/ethnicity, health behavior, health
conditions). Examples of information include, but are not limited to:
Patient or provider name, study identification number, address,
relevant telephone numbers, Social Security Number (voluntary), date of
birth, weight, height, sex, race; medical, psychological and dental
information, laboratory and diagnostic testing results; registries;
social, economic and demographic data; health services utilization;
immunization status; insurance and hospital cost data, employers;
characteristics and activities of health care providers.
Authorization to collect these data is provided under section 301
of the Public Health Service Act (42 U.S.C. 241), General Powers and
Duties of Public Health Service.
The purpose of this system of records is to enable the study of the
impact of preventive medicine interventions and public education
efforts of health service delivery, patient behavior, and health
outcome. Information from the system of records will be shared within
the Department of Health and Human Services (DHHS) with such Public
Health Service (PHS) agencies as the Centers for Disease Control and
Prevention (CDC) including the National Center for Health Statistics
(NCHS), the Health Resource Services Administration (HRSA), the Indian
Health Service (IHS), the National Institutes for Health (NIH), the
Agency for Health Care Policy and Research [[Page 1790]] (AHCPR), and
the Health Care Financing Administration (HCFA).
1. A record may be disclosed for a research purpose, when the
Department: (A) Has determined that the use or disclosure does not
violate legal or policy limitations under which the record was
provided, collected, or obtained; e.g., disclosure of alcohol or drug
abuse patient records will be made only in accordance with the
restrictions of confidentiality statutes and regulations (42 U.S.C. 290
(dd-2), 42 U.S.C. 241 and 405, 42 CFR part 2), and where applicable, no
disclosures will be made inconsistent with an authorization of
confidentiality under 42 U.S.C. 242a and 42 CFR part 2a; (B) has
determined that the research purpose (1) cannot be reasonably
accomplished unless the record is provided in individually identifiable
form, and (2) warrants the risk to the privacy of the individual that
additional exposure of the record might bring; (C) has required the
recipient to (1) establish reasonable administrative, technical, and
physical safeguards to prevent unauthorized use or disclosure of the
record, (2) remove or destroy the information that identifies the
individual at the earliest time at which removal or destruction can be
accomplished consistent with the purpose of the research project,
unless the recipient has presented adequate justification of a research
or health nature for retaining such information, and (3) make no
further use or disclosure of the record except (a) in emergency
circumstances affecting the health or safety of any individual, (b) for
use in another research project, under these same conditions, and with
written authorization of the Department, (c) for disclosure to a
properly identified person for the purpose of an audit related to the
research project, if information that would enable research subjects to
be identified is removed or destroyed at the earliest opportunity
consistent with the purpose of the audit, or (d) when required by law;
and (D) has secured a written statement attesting to the recipient's
understanding of, and willingness to abide by, these provisions.
Examples of organizations and agencies of which records from this
system may be disclosed include, but are not limited to Health
Maintenance Organizations (HMOs) and other service providers
participating in the studies and various federal and state agencies,
such as the Veteran's Administration, branches of the Armed Forces, and
state and local health department.
2. Disclosure may be made to a congressional office from the record
of an individual in response to a verified inquiry from a congressional
office made at the written request of that individual.
3. In the event of litigation, where the defendant is (a) the
Department, any component of the Department, or any employee of the
Department in his or her official capacity; (b) the United States where
the Department determines that the claim, if successful, is likely to
directly affect the operations of the Department or any of its
components; or (c) any Department employee in his or her individual
capacity where the Justice Department has agreed to represent such
employee, for example, in defending a claim against the Public Health
Service, based upon an individual's mental or physical condition and
alleged to have arisen because of activities of the Public Health
Service in connection with such an individual, the Department may
disclose such records as it deems desirable or necessary to the
Department of Justice to enable that Department to present an effective
defense, provided such disclosure is compatible with the purpose for
which the records were collected.
4. ODPHP may contract with a private firm for the purpose of
collecting, analyzing, aggregating, or otherwise refining records in
this system. Relevant records may be disclosed to such contractor. The
contractor shall be required to maintain Privacy Act safeguards with
respect to such records.
5. Disclosure may be made to organizations deemed qualified by the
Secretary to carry out quality assessments, medical audits or
utilization review.
6. Information from this system may be disclosed to Federal
agencies, State agencies (including the Motor Vehicle Administration
and State vital statistics offices), private organizations, and other
third parties (such as current or prior employers, acquaintances,
relatives), in order to obtain information on morbidity and mortality
experiences and to locate individuals for follow-up studies. Social
Security numbers may be disclosed to the Social Security Administration
to ascertain disabilities and/or location of participants. Social
Security numbers may also be given to other Federal agencies, and State
and local agencies for purposes of locating individuals for
participation in follow-up studies.
7. Records may be disclosed to student volunteers, individuals
working under a personal services contract, and other individuals
performing functions for PHS who do not technically have the status of
agency employees, if they need the records in the performance of their
agency functions.
Records may be stored in hard copy, index cards, file folders,
computer tapes and disks (including optical disks), photography media,
microfiche, microfilm, and audio and video tapes. Typically, factual
data with study code numbers are stored on computer tape or disk, while
the key to personal identifiers is stored separately, without factual
data, in locked paper files.
During data collection stages and follow-up retrieval is by
personal identifier (e.g., name, Social Security Number, medical record
or study identification number etc.). During the data analysis stage,
data are normally retrieved by the variables of interest (e.g.,
diagnosis, age, occupation).
1. Authorized Users: Access to identifiers and to link files is
strictly limited to the authorized personnel whose duties require such
access. Procedures for determining authorized access to identified data
are established as appropriate for each location. Personnel, including
contractor personnel, who may be so authorized include those directly
involved in data collection and in the design of research studies,
e.g., interviewers and interviewer supervisors; project managers, and
statisticians involved in designing sampling plans.
Other one-time and special access by other employees is granted on
a need-to-know basis as specifically authorized by the System Manager.
Researchers authorized to conduct research will typically access
the system through the use of encrypted identifiers sufficient to link
individuals with records in such a manner that does not compromise
confidentiality of the individual.
2. Physical Safeguards: Records are stored in locked rooms, locked
file cabinets, and/or secured computer facilities. Personal identifiers
and link files are separated as much as possible and stored in locked
files. Computer data access is limited through the use of key words
known only to authorized personnel.
A separate key list linking ID codes to respondents will be
maintained by the contractor conducting the survey,
[[Page 1791]] during the data collection period in order to permit
follow-up with non-respondents. This key list will be kept in a locked
file when not actively in use. As soon as data cleaning is completed
this key list will be destroyed. No data that could be used to identify
respondents will be entered on the computer database.
Likewise the name of individual settings will not appear on data
collection forms or the computerized database. Again a separate key
matching the ID code to the hospital name will be maintained during the
course of data collection in order to permit follow-up of non-
respondents. They key listing will be kept in a secure location when
not actively in use, and destroyed as soon as the data cleaning is
completed.
3. Procedural Safeguards: Collection and maintenance of data is
consistent with legislation and regulations regarding the protection of
human subjects, informed consent, and confidentiality. When anonymous
data is provided to research scientists for analysis, study numbers
which can be matched to personal identifiers will be eliminated,
scrambled, or replaced by the agency or contractor with random numbers
which cannot be matched. Contractors who maintain records in this
system are instructed to make no further disclosure of the records.
Privacy Act requirements are specifically included in contracts for
survey and research activities related to this system. The ODPHP
project officers and contract officers oversee compliance with these
requirements.
The records are maintained with individual identifiers only until
analysis and follow-up are completed, generally a two- to three-year
period. Removal or disposal of identifiers will be done according to
the storage medium (e.g., erase computer tape, shred, pulp or burn
paper records etc.). A staff person designated by the System Manager or
an authorized Contractor will oversee and confirm the disposal in
writing. Long-term retention is only in aggregate form without
individual identifiers in accordance with the OASH Records Disposition
Schedule.
Senior Policy Advisor, Office of Disease Prevention and Health
Promotion, 2132 Switzer Building, 330 C Street, SW, Washington, DC
20201.
To determine if a record exists, write to the System Manager listed
above. Notification requests should include: individual's name; current
address; date of birth; date, place and nature of participation in the
research study; address at the time of participation. The System
Manager may accept a written certification that the requester is who he
or she claims to be and understands that the knowing and willful
request for acquisition of a record pertaining to an individual under
false pretenses is a criminal offense under the Act, subject to a five
thousand dollar fine.
An individual who requests notification of, or access to, a
medical/dental record shall, at the time the request is made, designate
in writing a responsible representative who will be willing to review
the record and inform the subject individual of its contents at the
representative's discretion. The representative may be a physician, or
other health professional, or other responsible individual. The subject
individual will be granted direct access unless it is determined that
such access is likely to have a adverse effect on him or her. In this
case, the medical/dental record will be sent to the designated
representative.
Individuals will be informed in writing if the record is sent to
the representative.
A parent or guardian who requests notification of, or access to, a
child's or incompetent person's medical record shall designate a family
physician or other health professional (other than a family member) to
whom the record, if any, will be sent. The parent or guardian must
verify relationship to the child or incompetent person as well as his
or her own identity.
Same as notification procedures. Requesters should also reasonably
specify the record contents being sought. An individual may also
request an accounting of disclosures of his/her record, if any.
Contact the appropriate official at the address specified under
Notification Procedures above and reasonably identify the record,
specify the information being contested, and state the corrective
action sought and the reason(s) for requesting the correction, along
with supporting justification to show how the record is inaccurate,
incomplete, untimely, or irrelevant.
The system contains information obtained directly from the subject
individual by interview (face-to-face or telephone), written
questionnaire, or observations. Information is also obtained from other
sources, including but not limited to: referring physicians; hospitals;
State and local health agencies; relatives; guardians; schools,
employers; and clinical research records.
None.
Appendix I: System Location sites
Office of Disease Prevention and Health Promotion (ODPHP), 2132
Switzer Building, 330 C Street, SW, Washington, DC 20201
Battelle Memorial Institute, Centers for Public Health Research and
Evaluation, 2101 Wilson Boulevard, Suite 800, Arlington, VA 22201
Battelle Memorial Institute, Centers for Public Health Research and
Evaluation, Room 100E, 505 King Avenue, Columbus, OH 43201-2693
Battelle/SRA, 401 North Lindbergh Boulevard, Suite 330, St. Louis,
MO 63141-7816
[FR Doc. 95-268 Filed 1-4-95; 8:45 am]
BILLING CODE 4160-17-M