[Federal Register Volume 66, Number 158 (Wednesday, August 15, 2001)]
[Notices]
[Pages 42865-42869]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 01-20478]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Disease Control and Prevention


Privacy Act of 1974; Addition of New Routine Use to an Existing 
System of Records

AGENCY: Department of Health and Human Services (HHS), Centers for 
Disease Control and Prevention (CDC).

ACTION: Notification of the Addition of a New Routine Use.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act, the 
Centers for Disease Control and Prevention (CDC) is publishing notice 
of a proposal to add a new routine use to an existing National 
Institute for Occupational Safety and Health (NIOSH) system of records, 
09-20-0147, ``Occupational Health Epidemiological Studies. HHS/CDC/
NIOSH.'' The purpose of the new routine use is to contribute dose 
reconstructions, and supporting information for cancer-related 
claimants to the Department of Labor (DOL), which will enable DOL to 
determine award of benefits under the Energy Employees Occupational 
Illness Compensation Program Act of 2000.

DATES: CDC invites interested parties to submit comments on the 
proposed routine use on or before September 14, 2001. The CDC will 
adopt the new routine use without further notice 30 days after the date 
of publication, unless CDC receives comments which would result in a 
contrary determination.

ADDRESSES: Comments should be addressed to the Centers for Disease 
Control and Prevention (CDC) Privacy Act Officer at the address listed 
below. Comments received will be available for inspection from 8:30 
a.m. to 4 p.m. Monday through Friday in the CDC Executive Park 
Facility, Building 22 Executive Park Drive, Room 2238, Atlanta, 
Georgia.

FOR FURTHER INFORMATION CONTACT: Betsey S. Dunaway, Privacy Act 
Officer, Centers for Disease Control and Prevention, 1600 Clifton Road 
NE, Executive Park Facility, Building 22, Room 2238, Mailstop E-11, 
Atlanta, Georgia 30333, (404) 498-1506. This is not a toll-free number.

SUPPLEMENTARY INFORMATION: CDC proposes to add a new routine use to an 
existing system of records within its National Institute for 
Occupational Safety and Health (NIOSH): 09-20-0147, ``Occupational 
Health Epidemiological Studies. HHS/CDC/NIOSH.'' The new routine use, 
i.e., disclosure of epidemiologic and related data to the Department of 
Labor (DOL), is compatible with the NIOSH system purpose to evaluate 
the mortality, morbidity, and prevention of occupationally related 
diseases. This routine use is compatible in that it will permit NIOSH 
to participate with the DOL by contributing dose reconstructions, and 
supporting information for cancer-related claimants to DOL, which 
enable DOL to determine award of benefits under the Energy Employees 
Occupational Illness Compensation Program Act of 2000 (EEOICPA), 
hereinafter ``the Act'' or EEOICPA, Public Law 106-398.
    In the EEOICPA, Congress recognized the fact that since World War 
II, Federal nuclear activities have been explicitly recognized under 
Federal law as activities that are ultra-hazardous. Nuclear weapons 
production and testing have involved unique dangers, including 
potential catastrophic nuclear accidents that private insurance 
carriers have not covered. It is further recognized that recurring 
exposures to radioactive substances and beryllium, even in small 
amounts, can cause medical harm. Since the inception of the nuclear 
weapons program and for several decades afterwards, a large number of 
nuclear weapons workers at sites of the Department of Energy and at 
sites of vendors who supplied the Cold War effort were put at risk.
    Because of this, Congress established the ``Energy Employees 
Occupational Illness Compensation Program.'' The purpose of the program 
is to provide for timely, equitable, and adequate compensation of 
covered employees and, where applicable, survivors of such employees, 
who incurred illnesses during the performance of their duties for the 
Department of Energy and certain of its contractors and subcontractors. 
The Department of Labor is the federal agency with lead responsibility 
and is to administer the program. Within HHS, NIOSH's Office of 
Compensation Analysis and Support (OCAS) has responsibility under the 
Act to prepare individual dose reconstructions for specified cancer-
related claims.
    Providing the Department of Labor with dose reconstruction reports 
based on employment, work history, exposure monitoring, and medical-
related

[[Page 42866]]

information about an EEOICPA claimant is consistent with the purpose(s) 
for which the records within this NIOSH Privacy Act system were 
collected. Pertinent information and records used to develop individual 
dose reconstruction from the NIOSH system of records are acquired from 
two NIOSH program efforts. NIOSH's Health-Related Energy Research 
Branch (HERB) has been given access to the Department of Energy's 
system of records to collect information, records, and data for the 
purpose(s) of evaluating the mortality and morbidity of occupationally 
related diseases to determine the cause and prevention of 
occupationally related diseases (Memorandum of Understanding with 
Department of Energy (DOE), 56 FR 9701, March 7, 1991 renewed 1995 as 
part of DOE's Radiation Research Program; routine use formalizing data 
exchange between DOE and HHS added to Privacy Act system of Records 
DOE-10, `` Worker Advocacy Records''). Additionally, through its 
research program, NIOSH acquires vital status information, death 
certificates, and records from the National Death Index and from State 
Vital Registrars. NIOSH (OCAS) will receive additional records and 
information during the dose reconstruction process for cancer-related 
claimants from DOE's existing system of records. This will include 
employment histories of claimants, production process and work history 
information, exposure and dosimetry monitoring data, safety and 
accident reports, and pertinent excerpts from employee medical records.
    Claimants will also individually supply information to NIOSH, OCAS 
consisting of personal records, relevant information from claimants' 
physicians, affidavits, claimant interview summaries, and/or cancer 
type diagnosis from the DOL claims form. The claimant information will 
be augmented by that acquired from DOE and used by NIOSH or its 
contractors for the purpose of performing dose reconstructions for 
covered employees with cancer: (1) Who were not monitored for exposure 
to radiation at a Department of Energy facility or an atomic weapons 
employer facility, (2) who were monitored inadequately for exposure to 
radiation at such facility, or (3) whose records of exposure to 
radiation at such facility are missing or incomplete.
    This routine use amendment will enable NIOSH to provide the 
Department of Labor the information needed to determine, with regard to 
each covered employee with cancer, whether the cancer was at least as 
likely as not related to employment at a facility specified in the 
EEOICPA. The disclosures will also supply the Department of Labor with 
supporting information needed to defend its determinations under the 
Act in administrative appeals by claimants. Provision of information 
from NIOSH's system of records to the Department of Labor is, 
therefore, consistent with the intent of Congress as represented in the 
Act.
    Provision of this information to the Department of Labor will 
significantly decrease the administrative cost and effort required to 
implement the Act. Without this routine use and disclosure, the 
Department of Health and Human Services would be forced to require each 
claimant for whom it performs a dose reconstruction, to provide written 
consent for the Labor Department to obtain access to the claimant's 
employment, dosimetry, and medical-related information. The Department 
of Health and Human Services would spend resources and time 
unnecessarily in transmitting each written consent to the Department of 
Labor and following up on each request for data. A routine use 
permitting disclosure of such information to Labor Department personnel 
would be cost effective, eliminate these inefficiencies, and be 
claimant friendly.
    Permitting the Department of Labor to receive and use the 
information /data would not result in the unauthorized release of 
private information contained in the records. Information received by 
the Department of Labor will be maintained in a secure manner in the 
Department of Labor system of records DOL/ESA-49 (Office of 
Workers'Compensation Programs, Energy Employees Occupational Illness 
Compensation Program Act File). Access will be limited to Labor
    Department employees whose official duties require access to the 
records. Files and automated systems are maintained under supervision 
of DOL personnel during normal working hours. Only authorized personnel 
with the appropriate password may handle, retrieve, or disclose any 
information contained therein. Access to electronic records is 
controlled by password.
    We have also made editorial changes throughout the system notice to 
enhance clarity and specificity and to accommodate normal updating 
changes.

    Dated: August 9, 2001.
James D. Seligman,
Associate Director for Program Services, Centers for Disease Control 
and Prevention.
[09-20-0147]

System name:
    Occupational Health Epidemiological Studies. HHS/CDC/NIOSH.

Security classification:
    None.

System location:
    Division of Surveillance, Hazard Evaluation, and Field Studies 
(DSHEFS), National Institute for Occupational Safety and Health 
(NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, 
Cincinnati, OH 45226.
    Division of Respiratory Disease Studies (DRDS), National Institute 
for Occupational Safety and Health (NIOSH), 1095 Willowdale Road, 
Morgantown, WV 20505-2888.
    Pittsburgh Research Laboratory, NIOSH, 626 Cochrans Mill Road, 
Pittsburgh, PA 15236.
    Spokane Research Laboratory, NIOSH, 315 E. Montgomery Avenue, 
Spokane, WA 99207.
    Office of Compensation Analysis and Support (OCAS), NIOSH, Robert 
A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226.
    and
    Federal Records Center, 3150 Bertwynn Drive, Dayton, OH 45439.
    Data are also occasionally located at contractor sites as studies 
are developed, data collected, and reports written. A list of 
contractor sites where individually identifiable data are currently 
located is available upon request to the system manager.
    Also, occasionally data may be located at the facilities of 
collaborating researchers where analyses are performed, data collected 
and reports written. A list of these facilities is available upon 
request to the system manager. Data may be located only at those 
facilities that have an adequate data security program and the 
collaborating researcher must return the data to NIOSH or destroy 
individual identifiers at the conclusion of the project.

Categories of individuals covered by the system:
    Working population exposed to physical and/or chemical agents or 
other workplace hazards that may damage the human body in any way. Some 
examples are: (1) Organic carcinogens; (2) inorganic carcinogens; (3) 
mucosal or dermal irritants; (4)

[[Page 42867]]

fibrogenic materials; (5) acute toxic agents including sensitizing 
agents; (6) neurotoxic agents; (7) mutagenic (male and female) and 
teratogenic agents; (8) bio-accumulating non-carcinogen agents; and (9) 
chronic vascular disease-causing agents. Also included are those 
individuals in the general population who have been selected as control 
groups. Workers employed by the Department of Energy and its 
predecessor agencies and their contractors are also included.

Categories of records in the system:
    Physical exams, sputum cytology results, questionnaires, urine test 
records, X-rays, medical history, pulmonary function test records, 
medical disability forms, blood test records, hearing test results, 
smoking history, occupational histories, previous and current 
employment records, union membership records, driver's license data, 
demographic information, exposure history information and test results 
are examples of the records in this system. The specific types of 
records collected and maintained are determined by the needs of the 
individual study.

Authority for maintenance of the system:
    Public Health Service Act, section 301, ``Research and 
Investigation'' (42 U.S.C. 241); Occupational Safety and Health Act, 
section 20, ``Research and Related Activities'' (29 U.S.C. 669); the 
Federal Mine Safety and Health Act of 1977, section 501, ``Research'' 
(30 U.S.C. 951); and the Energy Employees Occupational Illness 
Compensation Program Act of 2000 (EEOICPA) (Pub. L. 106-398, 114 Stat. 
1654, 1654A-1231, October 30, 2000).

Purpose(s):
    Studies carried out under this system are to evaluate mortality and 
morbidity of occupationally related diseases and injuries, to determine 
their causes, and to lead toward prevention of occupationally related 
diseases and injuries in the future.

Routine uses of records maintained in the system, including categories 
of users and the purposes of such uses:
    Disclosure may be made to a congressional office from the record of 
an individual in response to a verified inquiry from the congressional 
office made at the written request of that individual.
    Portions of records (name, Social Security number if known, date of 
birth, and last known address) may be disclosed to one or more of the 
sources selected from those listed in Appendix I, as applicable. This 
may be done for obtaining a determination regarding an individual's 
health status and last known address. If the sources determine that the 
individual is dead, NIOSH may obtain death certificates, which state 
the cause of death, from the appropriate Federal, State or local 
agency. If the individual is alive, NIOSH may obtain information on 
health status from disease registries or on last known address in order 
to contact the individual for a health study or to inform him or her of 
health findings. This information on health status enables NIOSH to 
evaluate whether excess occupationally related mortality or morbidity 
is occurring.
    In the event of litigation where the defendant is: (a) The 
Department, any component of the Department, or any employee of the 
Department in his or her official capacity; (b) the United States where 
the Department determines that the claim, if successful, is likely to 
directly affect the operations of the Department or any of its 
components; or (c) any Department employee in his or her individual 
capacity where the Department of Justice has agreed to represent such 
employee, for example, in defending a claim against the Public Health 
Service based upon an individual's mental or physical condition and 
alleged to have arisen because of activities of the Public Health 
Service in connection with such individual, disclosure may be made to 
the Department of Justice to enable that Department to present an 
effective defense, provided that such disclosure is compatible with the 
purpose for which the records were collected. Records may also be 
disclosed when deemed desirable or necessary, to the Department of 
Justice, to enable that Department to effectively represent the 
Department of Health and Human Services and the Department of Labor in 
litigation involving the Energy Employees Occupational Illness 
Compensation Program Act of 2000 (EEOICPA).
    Records subject to the Privacy Act are disclosed to private firms 
for data entry, scientific support services, nosology coding, computer 
systems analysis and computer programming services. The contractors 
promptly return data entry records after the contracted work is 
completed. The contractors are required to maintain Privacy Act 
safeguards.
    Certain diseases or exposures may be reported to State and/or local 
health departments where the State has a legally constituted reporting 
program for communicable diseases and which provides for the 
confidentiality of the information.
    In the event of litigation initiated at the request of NIOSH, the 
Institute may disclose such records as it deems desirable or necessary 
to the Department of Justice and to the Department of Labor, Office of 
the Solicitor, where appropriate, to enable the Departments to 
effectively represent the Institute, provided such disclosure is 
compatible with the purpose for which the records were collected. The 
only types of litigative proceedings that NIOSH is authorized to 
request are: (1) Enforcement of a subpoena issued to an employer to 
provide relevant information; and (2) administrative search warrants to 
obtain access to places of employment and relevant information therein 
and related contempt citations against an employer for failure to 
comply with a warrant obtained by the Institute; and (3) injunctive 
relief against employers or mine operators to obtain access to relevant 
information.
    Disclosure may be made to NIOSH collaborating researchers (NIOSH 
contractors, grantees, cooperative agreement holders, or other Federal 
or State scientists) in order to accomplish the research purpose for 
which the records are collected. The collaborating researchers must 
agree in writing to comply with the confidentiality provisions of the 
Privacy Act and NIOSH must have determined that the researchers' data 
security procedures will protect confidentiality.
    Disclosure of epidemiologic study records pertaining to uranium 
workers may be made to the Department of Justice to be used in 
determining eligibility for compensation payments to the uranium 
workers or their survivors.
    Records may be disclosed by CDC in connection with public health 
activities to the Social Security Administration for sources of 
locating information to accomplish the research or program purposes for 
which the records were collected.
    Disclosure of dose reconstructions, epidemiologic study records and 
employment and medical information pertaining to Department of Energy 
employees and other cancer-related claimants covered under the Energy 
Employees Occupational Illness Compensation Program Act may be made to 
the Department of Labor to be used in determining eligibility for 
compensation payments to such claimants and in defending its 
determinations under the Act.

[[Page 42868]]

Policies and practices for storing, retrieving, accessing, retaining, 
and disposing of records in the system:
Storage:
    Manager files, card files, computer tapes/disks and printouts, 
microfilm, microfiche, and other files as appropriate.

Retrievability:
    Name, assigned number, plant name, and year tested are some of the 
indices used to retrieve records from these systems. Other retrieval 
methods are utilized as individual research dictates.

Safeguards:
    1. Authorized Users: A database software security package is 
utilized to control unauthorized access to the system. Access is 
granted to only a limited number of physicians, scientists, 
statisticians, and designated support staff or contractors, as 
authorized by the system manager to accomplish the stated purposes for 
which the data in this system have been collected.
    2. Physical Safeguards: Hard copy records are kept in locked 
cabinets in locked rooms. Guard service in buildings provides screening 
of visitors. The limited access, secured computer room contains fire 
extinguishers and an overhead sprinkler system. Computer terminals and 
automated records are located in secured areas. Electronic anti-
intrusion devices are in operation at the Federal Records Center.
    3. Procedural Safeguards: Data sets are password protected and/or 
encrypted. Protection for computerized records both on the mainframe 
and the CIO Local Area Network (LAN) includes programmed verification 
of valid user identification code and password prior to logging on to 
the system, mandatory password changes, limited log-ins, virus 
protection, and user rights/file attribute restrictions. Password 
protection imposes user name and password log-in requirements to 
prevent unauthorized access. Each user name is assigned limited access 
rights to files and directories at varying levels to control file 
sharing. There are routine daily backup procedures and Vault Management 
System for secure off-site storage is available for backup tapes. 
Additional safeguards may be built into the program by the system 
analyst as warranted by the sensitivity of the data.
    Employees and contractor staff who maintain records are instructed 
to check with the system manager prior to making disclosures of data. 
When individually identified data are being used in a room, admittance 
at either government or contractor sites is restricted to specifically 
authorized personnel. Privacy Act provisions are included in contracts, 
and the Project Director, contract officers and project officers 
oversee compliance with these requirements. Upon completion of the 
contract, all data will be either returned to CDC or destroyed, as 
specified by the contract.
    4. Implementation Guidelines: The safeguards outlined above are 
developed in accordance with Chapter 45-13, ``Safeguarding Records 
Contained in Systems of Records,'' of the HHS General Administration 
Manual; and Part 6, ``Automated Information System Security,'' of the 
HHS Information Resources Management Manual. FRC safeguards are in 
compliance with GSA Federal Property Management Regulations, Subchapter 
B--Archives and Records. Data maintained in CDC Atlanta's Processing 
Center are in compliance with OMB Circular A-130, Appendix III. 
Security is provided for information collection, processing, 
transmission, storage, and dissemination in general support systems and 
major applications. The CIO LANs operate under the current CDC approved 
version of Novell Netware, and are in compliance with ``CDC & ATSDR 
Security Standards for Novell File Servers.''

Retention and disposal:
    Records are maintained in agency for three years after the close of 
the study. Records transferred to the Federal Records Center when no 
longer needed for evaluation and analysis are destroyed 75 years for 
epidemiologic studies, unless needed for further study. Records from 
health hazard evaluations will be retained at least 20 years, and then 
disposed of in accordance with the CDC Records Control Schedule. 
Disposal methods include erasing computer tapes and burning or 
shredding paper materials.

System manager(s) and address:
    Program Management Officer, Division of Surveillance, Hazard 
Evaluations, and Field Studies (DSHEFS), National Institute for 
Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 
Rm. 40A, MS R12, 4676 Columbia Parkway, Cincinnati, OH 45226.
    Director, Division of Respiratory Disease Studies (DRDS), National 
Institute for Occupational Safety and Health (NIOSH), Bldg. ALOSH, Rm. 
H-2920, MS H2900, 1095 Willowdale Road, Morgantown, WV 26505.
    Director, Pittsburgh Research Laboratory, NIOSH, 626 Cochrans Mill 
Road, Pittsburgh, PA 15236.
    Director, Spokane Research Laboratory, NIOSH, 315 E. Montgomery 
Avenue, Spokane, WA 99207.
    Director, Office of Compensation and Support (OCAS), NIOSH, Robert 
A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, OH 45226.
    Policy coordination is provided by: Director, National Institute 
for Occupational Safety and Health (NIOSH), Bldg. HHH, Rm. 715H, MS P-
12, 200 Independence Avenue, SW, Washington, DC 20201.

Notification procedure:
    An individual may learn if a record exists about himself or herself 
by contacting the system manager at the above address. Requesters in 
person must provide driver's license or other positive identification. 
Individuals who do not appear in person must either: (1) Submit a 
notarized request to verify their identity; or (2) certify that they 
are the individuals they claim to be and that they understand that the 
knowing and willful request for or acquisition of a record pertaining 
to an individual under false pretenses is a criminal offense under the 
Privacy Act subject to a $5,000 fine.
    An individual who requests notification of or access to medical 
records shall, at the time the request is made, designate in writing a 
responsible representative who is willing to review the record and 
inform the subject individual of its contents at the representative's 
discretion. A subject individual will be granted direct access to a 
medical record if the system manager determines direct access is not 
likely to have adverse effect on the subject individual.
    The following information must be provided when requesting 
notification: (1) Full name; (2) the approximate date and place of the 
study, if known; and (3) nature of the questionnaire or study in which 
the requester participated.

Record access procedures:
    Same as notification procedures. Requesters should also reasonably 
specify the record contents being sought. An accounting of disclosures 
that have been made of the record, if any, may be requested.

Contesting record procedures:
    Contact the official at the address specified under System Manager 
above, reasonably identify the record and specify the information being 
contested, the corrective action sought, and the reasons for requesting 
the correction, along with supporting information to show how the 
record is inaccurate, incomplete, untimely, or irrelevant.

[[Page 42869]]

Record source categories:
    Vital status information is obtained from Federal, State and local 
governments and other available sources selected from those listed in 
Appendix I. Information is obtained directly from the individual and 
employer records, whenever possible.

Systems exempted from certain provisions of the act:
    None.

Appendix I--Potential Sources for Determination of Health Status, Vital 
Status and/or Last Known Address

Military records
Appropriate State Motor Vehicle Registration Departments
Appropriate State Driver's License Departments
Appropriate State Government Division of: Assistance Payments 
(Welfare), Social Services, Medical Services, Food Stamp Program, 
Child Support, Board of Corrections, Aging, Indian Affairs, Worker's 
Compensation, Disability Insurance
Retail Credit Association follow-up
Veterans Administration files
Appropriate employee union or association records
Appropriate company pension or employment records
Company group insurance records
Appropriate State Vital Statistics Offices
Life insurance companies
Railroad Retirement Board
Area nursing homes
Area Indian Trading Posts
Mailing List Correction Cards (U.S. Postal Service)
Letters and telephone conversations with former employees of the 
same establishment as cohort member
Appropriate local newspaper (obituaries)
Social Security Administration
Internal Revenue Service
National Death Index
Health Care Finance Administration
Pension Benefit Guarantee Corporation
State Disease Registries
[FR Doc. 01-20478 Filed 8-14-01; 8:45 am]
BILLING CODE 4160-18-P