[Federal Register Volume 63, Number 35 (Monday, February 23, 1998)]
[Rules and Regulations]
[Pages 8840-8847]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-4452]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

Office of Federal Housing Enterprise Oversight

12 CFR Part 1720

RIN 2550-AA05


Implementation of the Privacy Act of 1974

AGENCY: Office of Federal Housing Enterprise Oversight, HUD.

ACTION: Interim regulation with request for comments.

-----------------------------------------------------------------------

SUMMARY: The Office of Federal Housing Enterprise Oversight is issuing 
an interim regulation to implement the Privacy Act of 1974. The 
regulation sets forth the procedures by which an individual may request 
access to records about him/her that are maintained by OFHEO, amendment 
of such records, or an accounting of disclosures of such records. OFHEO 
is requesting comments on the regulation.

DATES: This interim regulation is effective February 23, 1998. Comments 
regarding the regulation must be received in writing on or before April 
24, 1998.

ADDRESSES: Send written comments to Anne E. Dewey, General Counsel, 
Office of General Counsel, Office of Federal Housing Enterprise 
Oversight, 1700 G Street, NW., Fourth Floor, Washington, DC 20552. 
Copies of all comments received will be available for examination by 
interested parties at the Office of Federal Housing Enterprise

[[Page 8841]]

Oversight, 1700 G Street, NW., Fourth Floor, Washington, DC 20552.

FOR FURTHER INFORMATION CONTACT: Gary L. Norton, Deputy General 
Counsel, or Isabella W. Sammons, Associate General Counsel, Office of 
General Counsel, Office of Federal Housing Enterprise Oversight, 1700 G 
Street, NW., Fourth Floor, Washington, DC 20552, telephone (202) 414-
3800 (not a toll-free number). The toll-free telephone number for the 
Telecommunications Device for the Deaf is (800) 877-8339.

SUPPLEMENTARY INFORMATION:

Effective Date

    The Office of Federal Housing Enterprise Oversight (OFHEO) has 
determined that it is in the public interest to publish an interim 
regulation that is effective immediately in order to give effect to the 
OFHEO Notice of Systems of Records published elsewhere in this issue of 
the Federal Register. The immediate effective date will permit the 
public to gain access to information pertaining to themselves without 
delay. The Administrative Procedure Act (APA) permits agencies to forgo 
the notice and comment period and to make a regulation effective 
immediately if doing so would be in the public interest. 5 U.S.C. 
553(b) and (d).

Request for Public Comment

    OFHEO is seeking comments on the interim regulation. Before making 
this interim regulation final, OFHEO will carefully review and consider 
all comments.

Discussion of Regulation

Section 1720.1  Scope

    This section explains that the regulation implements the provisions 
of the Privacy Act of 1974, as amended (Privacy Act) (5 U.S.C. 552a). 
The regulation sets forth the procedures by which an individual may 
request access to records about him/her that are maintained by OFHEO in 
a designated system of records, may request amendment of such records, 
or may request an accounting of disclosures of such records.
    This section further explains that a request from an individual for 
a record about that individual that is not contained in an OFHEO 
designated system of records will be considered to be a Freedom of 
Information Act (FOIA) (5 U.S.C. 552) request and will be processed 
under the FOIA.

Section 1720.2  Definitions

    This section defines various terms as follows:
    Amendment means any correction of, addition to, or deletion from a 
record.
    Designated system of records means a system of records that OFHEO 
has listed and summarized in the Federal Register pursuant to the 
requirements of 5 U.S.C. 552a(e).
    Individual means a natural person who is either a citizen of the 
United States of America or an alien lawfully admitted for permanent 
residence.
    Maintain includes collect, use, disseminate, or control.
    Privacy Act Appeals Officer means the OFHEO employee who has been 
delegated the authority to determine Privacy Act appeals.
    Privacy Act Officer means the OFHEO employee who has been delegated 
the authority to determine Privacy Act requests.
    Record means any item, collection, or grouping of information about 
an individual that is maintained by OFHEO and that contains his/her 
name, or the identifying number, symbol, or other identifying 
particular assigned to the individual.
    Routine use, with respect to disclosure of a record, means the use 
of such record for a purpose that is compatible with the purpose for 
which it was created.
    Statistical Record means a record in a system of records maintained 
only for statistical research or reporting purposes and not used, in 
whole or in part, in making any determination about an identifiable 
individual, except as provided by 13 U.S.C. 8.
    System of records means a group of records under the control of 
OFHEO from which information is retrieved by the name of the individual 
or some identifying number, symbol, or other identifying particular 
assigned to the individual.

Section 1720.3  Requests for Access to Individual Records

    This section explains how individuals may request access to records 
about themselves that are maintained by OFHEO. The procedure depends on 
whether or not the records are contained in a governmentwide system of 
records of another Federal agency or in a system of records of OFHEO.
    If the records are contained in a governmentwide system of records 
of the U.S. Office of Personnel Management (OPM), the request is 
submitted to the agency specified (which may be other than OFHEO) as 
prescribed by OPM in its regulations found at 5 CFR part 297 and in the 
OPM Federal Register Privacy Act notice for the specific governmentwide 
system. If the records are contained in a governmentwide system of 
records of another Federal Register Privacy Act notice for the specific 
governmentwide system. Federal agencies that have published 
governmentwide systems of records include the Equal Employment 
Opportunity Commission, the General Services Administration, the 
Department of Labor, the Office of Government Ethics, and the Office of 
Personnel Management.
    If the records are contained in a system of records of OFHEO, a 
written request must be submitted to the OFHEO Privacy Act Officer. The 
written request should describe the records sought and identify the 
designated systems of records in which such records may be contained. 
(A copy of the designated systems of records published by OFHEO in the 
Federal Register is available upon request from the Privacy Act 
Officer.) No individual will be required to state a reason or otherwise 
justify a request for access to records about him/her.

Section 1720.4  Decision To Grant or Deny Requests for Access to 
Individual Records

    This section provides that access to records contained in an OFHEO 
system of records will be granted unless the records were compiled in 
reasonable anticipation of a civil action or proceeding or require 
special procedures for medical records. It also describes the 
procedures for notifying individuals of the decision to grant or deny 
requests for access.
    Although the Privacy Act does not prescribe a time period for 
responding to requests for access, this section requires the Privacy 
Act Officer to send a written acknowledgment of receipt within 20 
business days of receipt of a request. It also requires the Privacy Act 
Officer to inform the requesting individual, as soon as reasonably 
possible, normally within 20 business days following receipt of the 
request, whether the requested records exist and whether access is 
granted or denied.
    If access is granted, this section requires the Privacy Act Officer 
to provide the individual with a reasonable period of time to inspect 
the records at OFHEO during normal business hours or to mail a copy of 
the records to the individual. If access is denied, this section 
requires the Privacy Act Officer to inform the individual of the reason 
for the denial and the right to appeal.

Section 1720.5  Special Procedures for Medical Records

    With respect to medical records, this section requires the Privacy 
Act Officer

[[Page 8842]]

to disclose such records directly to the requesting individual, unless, 
in the judgment of OFHEO, such disclosure may have an adverse effect on 
that individual. If medical records are not disclosed directly to the 
individual, the medical records will be submitted to a licensed medical 
doctor named by the individual.

Section 1720.6  Requirements for Verification of Identity

    To protect the privacy of individuals, this section provides for 
verification of identity. If an individual submits a written request in 
person, he/she may be required to present two forms of identification, 
such as an employment identification card, driver's license, passport, 
or other document typically used for identification purposes. One of 
the two forms of identification must contain the individual's 
photograph and signature.
    If an individual submits a written request, other than in person, 
for access to or amendment of records, he/she may be required to 
provide either one or both of the following: (1) Minimal identifying 
information, such as full name, date and place of birth, or other 
personal information; (2) at the election of the individual, either a 
certification of a duly commissioned notary public of any State or 
territory or the District of Columbia attesting to the requesting 
individual's identity or an unsworn declaration subscribed to as true 
under penalty of perjury under the laws of the United States of 
America.

Section 1720.7  Requests for Amendment of Individual Records

    This section explains how an individual may request amendment of 
any record about him/her that the individual believes is not accurate, 
relevant, timely, or complete. To request amendment, the individual 
must submit a written request to the Privacy Act Officer. The request 
should include the reason for requesting the amendment; a description 
of the record, or portion thereof, including the name of the 
appropriate designated system of record; and, if available, a copy of 
the record on which the specific portion requested to be amended is 
notated.
    As with requests for access, this section provides that the Privacy 
Act Officer may require the individual making the request for amendment 
to provide identifying information.

Section 1720.8  Decision To Grant or Deny Requests for Amendment of 
Individual Records

    This section explains the procedures that must be followed by the 
Privacy Act Officer in processing requests for amendment of individual 
records. Within 10 business days following receipt of a request for 
amendment of records, the Privacy Act Officer must send a written 
acknowledgment of receipt to the requesting individual.
    The Privacy Act does not require a specific time in which the 
Privacy Act Officer must respond to the request for amendment. This 
section requires that, as soon as reasonably possible, normally within 
30 business days from the receipt of the request for amendment, the 
Privacy Act Officer must inform the individual in writing of the 
decision to grant or deny the request for amendment. If the request for 
amendment is granted, the regulation provides that the amendment must 
be made. If the request for amendment is denied, the written 
notification must include the reason for the denial and an explanation 
of the right to appeal.

Section 1720.9  Appeals of the Initial Decision To Deny Access to or 
Amendment of Individual Records

    The Privacy Act requires that agencies establish procedures by 
which an individual may appeal an initial denial of access to or 
amendment of records. This section provides that the individual must 
submit a written appeal, within 30 business days following receipt of 
notification of the denial, to the Privacy Act Appeals Officer. Both 
the envelope and the appeal request should be marked ``Privacy Act 
Appeal.'' The appeal should include the information specified for 
requests for access or for requests for amendment, a copy of the 
initial denial notice, and any other relevant information for 
consideration by the Privacy Act Appeals Officer.

Section 1720.10  Decision To Grant or Deny Appeals

    This section describes the notification process with respect to 
appeals. It requires, within 30 business days following receipt of the 
appeal, that the Privacy Act Appeals Officer send a written 
notification of the decision to the appealing individual. The Privacy 
Act Appeals Officer may extend the 30-day notification period for good 
cause. If the time period is extended, the Privacy Act Appeals Officer 
must provide written notice of the reason for the extension and the 
expected date of the final decision.
    If the Privacy Act Appeals Officer grants the appeal for access or 
amendment, this section provides that, as appropriate, the individual 
must be provided access to the records or the amendment must be made. 
If the Privacy Act Appeals Officer denies the appeal for access or 
amendment, this section provides that the written notification of the 
decision must include the reason for the denial, the right to seek 
judicial review of the final decision, and, if applicable, the right to 
submit a statement of disagreement.
    An individual may file a statement with the Privacy Act Appeals 
Officer that sets forth the reason he/she disagrees with the decision 
to deny the appeal for amendment. If filed, the statement of 
disagreement must be attached to the record that is the subject of the 
request for amendment. The Privacy Act Appeals Officer has the 
discretion to prepare a statement in response to the statement of 
disagreement that explains why the requested amendment was not made. If 
prepared, the statement of explanation must be attached to the subject 
record and a copy provided to the individual.
    This section explains that, if the final decision on the appeal for 
amendment of records is not made within 30 working days (unless the 30-
day notification period is extended), the individual may bring a civil 
action against OFHEO in the appropriate district court of the United 
States.

Section 1720.11  Disclosure of Individual Records to Other Persons or 
Agencies

    The Privacy Act provides for certain circumstances in which 
individual records may be disclosed to a person or agency other than 
the individual about whom the record pertains (third parties). These 
circumstances are--
     Upon written request and authorization by the individual;
     With the prior written consent of the individual;
     If required under the Freedom of Information Act;
     For a routine use, with respect to a designated system of 
records as described by OFHEO in its notice of systems of records 
published in the Federal Register;
     Pursuant to the order of a court of competent 
jurisdiction;
     To those officers and employees of OFHEO who have a need 
for the record in the performance of their duties. For purposes of the 
regulation, officers and employees of OFHEO include officers and 
employees of other federal agencies with whom OFHEO has an interagency 
agreement to provide services and contractors with whom OFHEO has a 
contract for services;
     To the Bureau of the Census for purposes of planning or 
carrying out a census or survey or related activity

[[Page 8843]]

pursuant to the provisions of title 13 of the United States Code;
     To a recipient who has provided OFHEO with advance, 
adequate written assurance that the record will be used solely as a 
statistical research or reporting record, and that the record is to be 
transferred in a form that is not individually identifiable;
     To the National Archives and Records Administration as a 
record which has sufficient historical or other value to warrant its 
continued preservation by the U.S. Government, or for evaluation by the 
Archivist of the United States to determine whether the record has such 
value;
     To an agency or to an instrumentality of any governmental 
jurisdiction within or under the control of the United States for a 
civil or criminal law enforcement activity if the activity is 
authorized by law, and if the head of the agency or instrumentality has 
made a written request to OFHEO specifying the particular portion of 
the record desired and the law enforcement activity for which the 
record is sought;
     To a person pursuant to a showing of compelling 
circumstances affecting the health or safety of an individual if, 
concurrently with such disclosure, notification is transmitted to the 
last known address of the individual to whom the record pertains;
     To either House of Congress, or, to the extent of matter 
within its jurisdiction, any committee or subcommittee thereof, any 
joint committee of Congress, or subcommittee of any such joint 
committee;
     To the Comptroller General, or any of his/her authorized 
representatives, in the course of the performance of the duties of the 
General Accounting Office; or
     To a consumer reporting agency in accordance with 31 
U.S.C. 3711(e). Section 3711(e) of title 31, United States Code, 
provides, in connection with the collection and compromise of claims of 
the U.S. Government, that certain information from a system of records 
may be disclosed to a consumer reporting agency.

Section 1720.12  Accounting of Disclosures

    The Privacy Act requires that agencies keep an accounting of 
disclosures made to third parties. This section provides that OFHEO 
keep an accurate accounting of the date, nature, and purpose of each 
disclosure of a record and the name and address of each person to whom 
a disclosure was made. There are two exceptions to the requirement for 
accounting. The first exception is disclosure to those officers and 
employees of OFHEO who have a need for the record in the performance of 
their duties; the second exception is disclosure required under the 
Freedom of Information Act.
    This section further requires that OFHEO retain the accounting for 
at least 5 years or the life of the record, whichever is longer, after 
the disclosure for which the accounting is made.
    Furthermore, this section explains that, when a record has been 
amended or when a statement of disagreement has been filed, a copy of 
the amended record and any statement of disagreement must be provided, 
and any statement of explanation may be provided, to all prior and 
subsequent recipients of the affected record whose identities can be 
determined pursuant to the required disclosure of accountings.

Section 1720.13  Requests for Accounting of Disclosures

    This section explains that any individual may request an accounting 
of disclosures of records about him/her for which an accounting is 
required to be maintained by submitting a written request to the 
Privacy Act Officer. Before processing the request, the Privacy Act 
Officer may require that the individual provide identifying 
information.
    The Privacy Act Officer must provide the accounting of disclosures 
with one exception to the requesting individual. The Privacy Act 
Officer is not required to provide an accounting of any disclosures 
made to another agency or to an instrumentality of any governmental 
jurisdiction within or under the control of the United States for a 
civil or criminal law enforcement activity.

Section 1720.14  Fees

    Generally, it will be more convenient for OFHEO and the individual 
to have access to the requested records by receiving a copy rather than 
inspecting the records at OFHEO. Therefore, this section provides that 
OFHEO will not charge a fee for providing a copy of the requested 
record or any portion thereof.

Section 1720.15  Preservation of Records

    This section requires that OFHEO preserve all correspondence 
relating to the written requests it receives and all records processed 
pursuant to such requests, in accordance with the records retention 
provisions of General Records Schedule 14, Informational Services 
Records. Furthermore, this section provides that OFHEO must not destroy 
records that are subject to a pending request for access, amendment, 
appeal, or lawsuit pursuant to the Privacy Act.

Section 1720.16  Rights of Parents and Legal Guardians

    This section provides that a parent of any minor or the legal 
guardian of any individual who has been declared to be incompetent due 
to a physical or mental incapacity or age by a court of competent 
jurisdiction may act on behalf of the individual.

Section 1720.17  Penalties

    This section notes that the Privacy Act makes it a misdemeanor, 
subject to a maximum fine of $5,000, to knowingly and willfully request 
or obtain any record concerning an individual from OFHEO under false 
pretenses.

Regulatory Impact

Executive Order 12612, Federalism

    Executive Order 12612 requires that Executive departments and 
agencies identify regulatory actions that have significant federalism 
implications. A regulation has federalism implications if it has 
substantial direct effects on the States, on the relationship or 
distribution of power between the Federal Government and the States, or 
on the distribution of power and responsibilities among various levels 
of government. OFHEO has determined that this regulation has no 
federalism implications that warrant the preparation of a Federalism 
Assessment in accordance with Executive Order 12612.

Executive Order 12866, Regulatory Planning and Review

    The regulation has been reviewed by the Office of Management and 
Budget (OMB) pursuant to Executive Order 12866.

Executive Order 12988, Civil Justice Reform

    Executive Order 12988 sets forth guidelines to promote the just and 
efficient resolution of civil claims and to reduce the risk of 
litigation to the Federal Government. The regulation meets the 
applicable standards of sections 3(a) and 3(b) of Executive Order 
12988.

Regulatory Flexibility Act

    The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires that 
a regulation that has a significant economic impact on a substantial 
number of small entities, small businesses, or small organizations must 
include an initial regulatory flexibility analysis describing the 
regulation's impact on small entities. Such an

[[Page 8844]]

analysis need not be undertaken if the agency has certified that the 
regulation will not have a significant economic impact on a substantial 
number of small entities. 5 U.S.C. 605(b).
    OFHEO has considered the impact of the regulation under the 
Regulatory Flexibility Act. The regulation only affects individuals and 
has no effect on small entities. Therefore, the General Counsel of 
OFHEO has certified that the regulation will not have a significant 
economic impact on a substantial number of small entities.

Paperwork Reduction Act

    The Paperwork Reduction Act of 1995, 44 U.S.C. chapter 35, requires 
that regulations involving the collection of information receive 
clearance from OMB. The regulation contains no such collection of 
information requiring OMB approval under the Paperwork Reduction Act. 
Consequently, no information has been submitted to OMB for review under 
the Paperwork Reduction Act.

Unfunded Mandates Reform Act of 1995

    The regulation does not require the preparation of an assessment 
statement in accordance with the Unfunded Mandates Reform Act of 1995. 
Assessment statements are not required for regulations that incorporate 
requirements specifically set forth in law. As explained in the 
preamble, the regulation implements the Privacy Act. In addition, the 
regulation does not include a Federal mandate that may result in the 
expenditure by State, local, and tribal governments, in the aggregate, 
or by the private sector, of $100,000,000 or more (adjusted annually 
for inflation) in any 1 year.

List of Subjects in 12 CFR Part 1720

    Privacy.

    For the reasons set forth in the preamble, OFHEO is amending on an 
interim basis Chapter XVII of title 12 of the Code of Federal 
Regulations by adding part 1720 to read as follows:

PART 1720--IMPLEMENTATION OF THE PRIVACY ACT OF 1974

Sec.
1720.1  Scope.
1720.2  Definitions.
1720.3  Requests for access to individual records.
1720.4  Decision to grant or deny requests for access to individual 
records.
1720.5  Special procedures for medical records.
1720.6  Requirements for verification of identity.
1720.7  Requests for amendment of individual records.
1720.8  Decision to grant or deny requests for amendment of 
individual records.
1720.9  Appeals of the initial decision to deny access to or 
amendment of individual records.
1720.10  Decision to grant or deny appeals.
1720.11  Disclosure of individual records to other persons or 
agencies.
1720.12  Accounting of disclosures.
1720.13  Requests for accounting of disclosures.
1720.14  Fees.
1720.15  Preservation of records.
1720.16  Rights of parents and legal guardians.
1720.17  Penalties.

    Authority: 5 U.S.C. 552a, 12 U.S.C. 4513(b).


Sec. 1720.1  Scope.

    (a) This part 1720 sets forth the procedures by which an individual 
may request access to records about him/her that are maintained by the 
Office of Federal Housing Enterprise Oversight (OFHEO) in a designated 
system of records, amendment of such records, or an accounting of 
disclosures of such records. This part 1720 implements the provisions 
of the Privacy Act of 1974, as amended (Privacy Act) (5 U.S.C. 552a).
    (b) A request from an individual for a record about that individual 
that is not contained in an OFHEO designated system of records will be 
considered to be a Freedom of Information Act (FOIA) (5 U.S.C. 552) 
request and will be processed under the FOIA.


Sec. 1720.2  Definitions.

    For the purposes of this part 1720--
    Amendment means any correction of, addition to, or deletion from a 
record.
    Designated system of records means a system of records that OFHEO 
has listed and summarized in the Federal Register pursuant to the 
requirements of 5 U.S.C. 552a(e).
    Individual means a natural person who is either a citizen of the 
United States of America or an alien lawfully admitted for permanent 
residence.
    Maintain includes collect, use, disseminate, or control.
    Privacy Act Appeals Officer means the OFHEO employee who has been 
delegated the authority to determine Privacy Act appeals.
    Privacy Act Officer means the OFHEO employee who has been delegated 
the authority to determine Privacy Act requests.
    Record means any item, collection, or grouping of information about 
an individual that is maintained by OFHEO and that contains his/her 
name, or the identifying number, symbol, or other identifying 
particular assigned to the individual.
    Routine use, with respect to disclosure of a record, means the use 
of such record for a purpose that is compatible with the purpose for 
which it was created.
    Statistical Record means a record in a system of records maintained 
only for statistical research or reporting purposes and not used, in 
whole or in part, in making any determination about an identifiable 
individual, except as provided by 13 U.S.C. 8.
    System of records means a group of records under the control of 
OFHEO from which information is retrieved by the name of the individual 
or some identifying number, symbol, or other identifying particular 
assigned to the individual.


Sec. 1720.3  Requests for access to individual records.

    (a) Any individual may request records about him/her that are 
maintained by OFHEO.
    (b) The procedures for submitting requests are as follows:
    (1) If the records are contained in a governmentwide system of 
records of the U.S. Office of Personnel Management (OPM), the request 
must be submitted as prescribed by the regulations of OPM (5 CFR part 
297).
    (2) If the records are contained in a record in a system of records 
of another Federal agency, the request must be submitted as prescribed 
in the Federal Register Privacy Act notice for the specific 
governmentwide system.
    (3) If the records are contained in a system of records of OFHEO, 
the request must be submitted in writing to the Privacy Act Officer, 
Office of Federal Housing Enterprise Oversight, 1700 G Street, NW., 
Fourth Floor, Washington, DC 20552. The written request should describe 
the records sought and identify the designated systems of records in 
which such records may be contained. (A copy of the designated systems 
of records published by OFHEO in the Federal Register is available upon 
request from the Privacy Act Officer.) No individual shall be required 
to state a reason or otherwise justify a request for access to records 
about him/her.


Sec. 1720.4  Decision to grant or deny requests for access to 
individual records.

    (a) Basis for the decision. The Privacy Act Officer shall grant 
access to records upon receipt of a request submitted under 
Sec. 1720.3(b)(3), unless the records--
    (1) Were compiled in reasonable anticipation of a civil action or 
proceeding; or
    (2) Require special procedures for medical records provided for in 
Sec. 1720.5.
    (b) Notification procedures. (1) Within 20 business days of receipt 
of a request

[[Page 8845]]

submitted under Sec. 1720.3(b)(3), the Privacy Act Officer shall send a 
written acknowledgment of receipt to the requesting individual.
    (2) As soon as reasonably possible, normally within 20 business 
days following receipt of the request, the Privacy Act Officer shall 
send a written notification that informs the individual whether the 
requested records exist and, if the requested records exist, whether 
access is granted or denied, in whole or in part.
    (c) Access procedures. If access is granted, in whole or in part, 
the Privacy Act Officer shall provide the individual with a reasonable 
period of time to inspect the records at OFHEO during normal business 
hours or shall mail a copy of the requested records to the individual.
    (d) Denial procedures. If access is denied, in whole or in part, 
the Privacy Act Officer shall inform the individual of the reasons for 
the denial and of the right to appeal the denial, as set forth in 
Sec. 1720.9.


Sec. 1720.5  Special procedures for medical records.

    The Privacy Act Officer shall grant access to medical records to 
the requesting individual to whom the medical records pertain. However, 
if, in the judgment of OFHEO, such direct access may have an adverse 
effect on that individual, the Privacy Act Officer shall transmit the 
medical records to a licensed medical doctor named by the individual.


Sec. 1720.6  Requirements for verification of identity.

    (a) Written requests submitted in person. Any individual who 
submits in person a written request under this part, may be required to 
present two forms of identification, such as an employment 
identification card, driver's license, passport, or other document 
typically used for identification purposes. One of the two forms of 
identification must contain the individual's photograph and signature.
    (b) Other written requests. Any individual who submits, other than 
in person, a written request under this part may be required to provide 
either one or both of the following:
    (1) Minimal identifying information, such as full name, date and 
place of birth, or other personal information.
    (2) At the election of the individual, either a certification of a 
duly commissioned notary public of any State or territory or the 
District of Columbia attesting to the requesting individual's identity 
or an unsworn declaration subscribed to as true under penalty of 
perjury under the laws of the United States of America.


Sec. 1720.7  Requests for amendment of individual records.

    (a) Procedures for requesting amendment of a record. Any individual 
may request amendment of any record about him/her that the individual 
believes is not accurate, relevant, timely, or complete. To request 
amendment, the individual must submit a written request to the Privacy 
Act Officer, Office of Federal Housing Enterprise Oversight, 1700 G 
Street, NW., Fourth Floor, Washington, DC 20552. The request should 
include--
    (1) The reason for requesting the amendment;
    (2) A description of the record, or portion thereof, including the 
name of the appropriate designated system of records, sufficient to 
enable the Privacy Act Officer to identify the particular record or 
portion thereof; and
    (3) If available, a copy of the record, or portion thereof, on 
which the specific portion requested to be amended is notated.
    (b) Requirement for identifying information. The Privacy Act 
Officer may require the individual making the request for amendment to 
provide the identifying information specified in Sec. 1720.6.


Sec. 1720.8  Decision to grant or deny requests for amendment of 
individual records.

    (a) Notification procedures. Within 10 business days following 
receipt of a request for amendment of records, the Privacy Act Officer 
shall send a written acknowledgment of receipt to the requesting 
individual. As soon as reasonably possible, normally within 30 business 
days from the receipt of the request for amendment, the Privacy Act 
Officer shall send a written notification to the individual that 
informs him/her of the decision to grant or deny, in whole or in part, 
the request for amendment.
    (b) Amendment procedures. If the request is granted, in whole or in 
part, the requested amendment shall be made to the subject record. A 
copy of the amended record shall be provided to all prior recipients of 
the subject record in accordance with Sec. 1720.12(b).
    (c) Denial procedures. If the request is denied, in whole or in 
part, the Privacy Act Officer shall include in the written notification 
the reasons for the denial and an explanation of the right to appeal 
the denial, as set forth in Sec. 1720.9.


Sec. 1720.9  Appeals of the initial decision to deny access to or 
amendment of individual records.

    Any individual may appeal the initial denial, in whole or in part, 
of a request for access to or amendment of his/her record. To appeal, 
the individual must submit a written appeal, within 30 business days 
following receipt of written notification of denial, to the Privacy Act 
Appeals Officer, Office of Federal Housing Enterprise Oversight, 1700 G 
Street, NW., Fourth Floor, Washington, DC 20552. Both the envelope and 
the appeal request should be marked ``Privacy Act Appeal.'' The appeal 
should include--
    (a) The information specified for requests for access in 
Sec. 1720.3(b)(3) or for requests for amendment in Sec. 1720.7, as 
appropriate;
    (b) A copy of the initial denial notice; and
    (c) Any other relevant information for consideration by the Privacy 
Act Appeals Officer.


Sec. 1720.10  Decision to grant or deny appeals.

    (a) Notification of decision. Within 30 business days following 
receipt of the appeal, the Privacy Act Appeals Officer shall send a 
written notification of the decision to grant or deny to the individual 
making the appeal. The Privacy Act Appeals Officer may extend the 30-
day notification period for good cause. If the time period is extended, 
the Privacy Act Appeals Officer shall inform in writing the individual 
making the appeal of the reason for the extension and the expected date 
of the final decision.
    (b) Appeal granted. If the appeal for access is granted, in whole 
or in part, the Privacy Act Appeals Officer shall provide the 
individual with reasonable time to inspect the requested records at 
OFHEO during normal business hours or mail a copy of the requested 
records to the individual. If the appeal for amendment is granted, in 
whole or in part, the requested amendment shall be made. A copy of the 
amended record shall be provided to all prior recipients of the subject 
record in accordance with Sec. 1720.12(b).
    (c) Appeal denied. If the Privacy Act Appeals Officer denies, in 
whole or in part, the appeal for access or amendment, he/she shall 
include in the written notification of the reasons for the denial an 
explanation of the right to seek judicial review of the final decision, 
and, with respect to an appeal for amendment, the right to submit a 
statement of disagreement under paragraph (d) of this section.

[[Page 8846]]

    (d) Statements of disagreement and explanation. (1) Upon receipt of 
a decision to deny, in whole or in part, the appeal for amendment of 
records, the individual may file a statement with the Privacy Act 
Appeals Officer that sets forth his/her reasons for disagreeing with 
the decision. The Privacy Act Appeals Officer shall attach the 
statement of disagreement to the record that is the subject of the 
request for amendment. In response to the statement of disagreement, 
the Privacy Act Appeals Officer has the discretion to prepare a 
statement that explains why the requested amendment was not made. If 
prepared, the statement of explanation shall be attached to the subject 
record and a copy of the statement provided to the individual who filed 
the statement of disagreement.
    (2) The Privacy Act Appeals Officer shall provide a copy of any 
statement of disagreement, and may provide any statement of 
explanation, to prior recipients of the subject record in accordance 
with Sec. 1720.12(b).
    (e) Right to judicial review. If OFHEO does not comply with the 
notification procedures under paragraph (a) of this Sec. 1720.10 with 
respect to an appeal for amendment of records, the appealing individual 
may bring a civil action against OFHEO in the appropriate district 
court of the United States, as provided for under 5 U.S.C. 
552a(g)(1)(A) and 552a(g)(5) before receiving the written notification 
of the decision.


Sec. 1720.11  Disclosure of individual records to other persons or 
agencies.

    (a) OFHEO may disclose a record to a person or agency other than 
the individual about whom the record pertains only under one or more of 
the following circumstances:
    (1) If requested and authorized in writing by the individual.
    (2) With the prior written consent of the individual.
    (3) If such disclosure is required under the Freedom of Information 
Act.
    (4) For a routine use, as defined in Sec. 1720.2, with respect to a 
designated system of records as described by OFHEO in its notice of 
systems of records published in the Federal Register.
    (5) Pursuant to the order of a court of competent jurisdiction.
    (6) To the following persons or agencies--
    (i) Officers and employees of OFHEO who have a need for the record 
in the performance of their duties;
    (ii) The Bureau of the Census for purposes of planning or carrying 
out a census or survey or related activity pursuant to the provisions 
of title 13 of the United States Code;
    (iii) A recipient who has provided OFHEO with advance, adequate 
written assurance that the record will be used solely as a statistical 
research or reporting record, and the record is to be transferred in a 
form that is not individually identifiable;
    (iv) The National Archives and Records Administration as a record 
which has sufficient historical or other value to warrant its continued 
preservation by the U.S. Government, or for evaluation by the Archivist 
of the United States to determine whether the record has such value;
    (v) An agency or an instrumentality of any governmental 
jurisdiction within or under the control of the United States for a 
civil or criminal law enforcement activity if the activity is 
authorized by law, and if the head of the agency or instrumentality has 
made a written request to OFHEO specifying the particular portion of 
the record desired and the law enforcement activity for which the 
record is sought;
    (vi) A person pursuant to a showing of compelling circumstances 
affecting the health or safety of an individual if, concurrently with 
such disclosure, notification is transmitted to the last known address 
of the individual to whom the record pertains;
    (vii) Either House of Congress, or, to the extent of matter within 
its jurisdiction, any committee or subcommittee thereof, any joint 
committee of Congress, or subcommittee of any such joint committee;
    (viii) The Comptroller General, or any of his/her authorized 
representatives, in the course of the performance of the duties of the 
General Accounting Office; or
    (ix) A consumer reporting agency in accordance with 31 U.S.C. 
3711(e).
    (b) Before a record is disclosed to other persons or agencies under 
paragraph (a)(1) or (2) of this section, the identifying information 
specified in Sec. 1720.6 may be required.


Sec. 1720.12  Accounting of disclosures.

    (a) OFHEO shall keep an accurate accounting of the date, nature, 
and purpose of each disclosure of a record, and the name and address of 
each person or agency to whom a disclosure was made under Sec. 1720.11, 
except for disclosures made under Sec. 1720.11(a)(3) or (a)(6)(i). 
OFHEO shall retain such accounting for at least 5 years or the life of 
the record, whichever is longer, after the disclosure for which the 
accounting was made.
    (b) When a record has been amended, in whole or in part, or when a 
statement of disagreement has been filed, a copy of the amended record 
and any statement of disagreement must be provided, and any statement 
of explanation may be provided, to all prior and subsequent recipients 
of the affected record whose identities can be determined pursuant to 
the disclosure accountings required under paragraph (a) of this 
section.


Sec. 1720.13  Requests for accounting of disclosures.

    (a) Any individual may request an accounting of disclosures of 
records about him/her for which an accounting is required to be 
maintained under Sec. 1720.12(a) by submitting a written request to the 
Privacy Act Officer, Office of Federal Housing Enterprise Oversight, 
1700 G Street, NW., Fourth Floor, Washington, DC 20552. Before 
processing the request, the Privacy Act Officer may require that the 
individual provide the identifying information specified under 
Sec. 1720.6.
    (b) The Privacy Act Officer shall make available the accounting of 
disclosures required to be maintained under Sec. 1720.12, except for an 
accounting made under Sec. 1720.11(a)(6)(v).


Sec. 1720.14  Fees.

    OFHEO shall not charge any fees for providing a copy of any 
records, pursuant to a request for access under this part.


Sec. 1720.15  Preservation of records.

    OFHEO shall preserve all correspondence relating to the written 
requests it receives and all records processed pursuant to such 
requests under this part, in accordance with the records retention 
provisions of General Records Schedule 14, Informational Services 
Records. OFHEO shall not destroy records that are subject to a pending 
request for access, amendment, appeal, or lawsuit pursuant to the 
Privacy Act.


Sec. 1720.16  Rights of parents and legal guardians.

    For purposes of this part, a parent of any minor or the legal 
guardian of any individual who has been declared to be incompetent due 
to physical or mental incapacity or age by a court of competent 
jurisdiction may act on behalf of the individual.


Sec. 1720.17  Penalties.

    The Privacy Act (5 U.S.C. 552a(i)(3)) makes it a misdemeanor, 
subject to a maximum fine of $5,000, to knowingly and willfully request 
or obtain any record concerning an individual from OFHEO under false 
pretenses.


[[Page 8847]]


    Dated: February 12, 1998.
Mark A. Kinsey,
Acting Director.
[FR Doc. 98-4452 Filed 2-20-98; 8:45 am]
BILLING CODE 4220-01-P