[Federal Register Volume 67, Number 163 (Thursday, August 22, 2002)]
[Notices]
[Pages 54441-54444]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 02-21348]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

National Institutes of Health


Privacy Act of 1974; Proposed New System of Records

AGENCY: National Institutes of Health (NIH), HHS.

ACTION: Notification of proposed new system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act, the 
National Institutes of Health (NIH) is publishing a notice of a 
proposal to create a new system of records 09-25-0217, ``NIH Business 
System (NBS), HHS/NIH.'' The main purposes of the

[[Page 54442]]

system include: (1) Tracking of all payments to individuals, exclusive 
of salaries and wages, based upon prior entry into the NIH accounting 
system of the official commitment and obligation of government funds, 
(2) establishment of a receivable record and the tracking of repayment 
status when a person is to repay funds advanced as a loan or 
scholarship, etc., (3) establishment of a receivable record for 
recovery of the amount claimed, in the event of an overpayment to a 
person, and (4) development of reports of taxable income to the 
Internal Revenue Service (IRS) and applicable State and local tax 
offices.

DATES: The NIH invites interested parties to submit comments on the 
proposed uses on or before September 23, 2002. The NIH will send a 
Report of the Proposed New System to the Congress and to the Office of 
Management and Budget (OMB). The proposed new system of records will be 
effective 40 days from the date submitted to the OMB, unless NIH 
receives comments that would result in a contrary determination.

ADDRESSES: Please address comments to: NIH Privacy Act Officer, 6011 
Executive Boulevard, Room 601, MSC 7669, Rockville, Maryland 20892. 
(301) 496-2832 (This is not a toll-free number).
    Comments received will be available for inspection at this same 
address from 9 a.m. to 3 p.m., Monday through Friday.

FOR FURTHER INFORMATION CONTACT: Eric Cole, NBS System Manager, 
National Institutes of Health, 6707 Democracy Boulevard, Suite 1001, 
Bethesda, Maryland 20892-5470. 301-451-0043.

SUPPLEMENTARY INFORMATION: Sections 301 and 302 of United States Code 
(U.S.C.), Title 5, Sections 3101and 3102 of United States Code 
(U.S.C.), title 44, and Executive Order 9397 (Nov. 22, 1943) authorize 
the Secretary to implement and establish the use of accounting systems 
at NIH.
    The following notice is written in the present tense, rather than 
the future tense, in order to avoid the unnecessary expenditure of 
public funds to republish the notice after the system has become 
effective.

    Dated: August 13, 2002.
Charles E. Leasure, Jr.,
Deputy Director for Management, National Institutes of Health.
09-25-0217

Security Classification:
    None.

System Name: Administration:
    NIH Business System (NBS), HHS/NIH.

System Location:
    Records are maintained in databases located within the NIH computer 
facilities and in the files of the NIH functional offices that are 
required to identify individuals in order to manage the Federal 
resources and authorities assigned to them. A current list of sites is 
available by writing the System Manager listed under the Notification 
Procedure below.

Categories of Individuals Covered by the System:
    The proposed system of records covers all persons who receive a 
payment exclusive of salary or wages, from the NIH, and all persons 
owing money to the NIH. Persons receiving payments include, but are not 
limited to, travelers on official business, grantees, contractors, 
consultants, Fellows and recipients of loans and scholarships. Persons 
owing monies include, but are not limited to, persons who have been 
overpaid and who owe the NIH a refund the persons who have received 
from NIH goods or services for which there is a charge or fee (e.g., 
Freedom of Information Act requesters).

Categories of Records in the System:
    Name, Social Security Number (SSN) or EIN/TID, address, email 
address, phone number, purpose of payment or request for payment, bank 
account and routing numbers, accounting classification and the amount 
paid or billed. Also, in the event of an overpayment and for 
outstanding charges, fees, loans, grants or scholarships, the amount of 
the indebtedness, the repayment status and the amount to be collected. 
In the event of an administrative wage garnishment, information about 
the debtor's employment status and disposable pay available for 
withholding will be maintained.

Authority for Maintenance of the System:
    5 U.S.C. 301 and 302, 44 U.S.C. 3101 and 3102, Executive Order 
9397.

Purpose(s):
    These records are an integral part of the accounting system at the 
NIH. The records are used to keep track of all payments to individuals, 
exclusive of salaries and wages, based upon prior entry into the 
systems of the official commitment and obligation of government funds. 
When a person is to repay funds advanced as a loan or scholarship, 
etc., the records will be used to establish a receivable record and to 
track repayment status. In the event of an overpayment to a person, the 
record is used to establish a receivable record for recovery of the 
amount claimed. The records are also used internally to develop reports 
for the Internal Revenue Service (IRS) and applicable State and local 
taxing officials of taxable income.

Routine Uses of Records Maintained in the System, Including Categories 
of Users and the Purposes of Such Use:
    1. Records will be routinely disclosed to the Treasury Department 
in order to effect payment.
    2. Records may be disclosed to Members of Congress concerning a 
Federal financial assistance program in order for members to make 
informed opinions on programs and/or activities impacting on 
legislative decisions. Also, disclosure may be made to a Member of 
Congress or to a Congressional staff member in response to an inquiry 
from the Congressional office made at the written request of the 
individual.
    3. Disclosure may be made to the Department of Justice for the 
purpose of obtaining its advice regarding whether particular records 
are required to be disclosed under the Freedom of Information Act.
    4. A record from this system may be disclosed to a Federal, State 
or local agency maintaining civil, criminal or other relevant 
enforcement records or other pertinent records, such as current 
licenses, if necessary to obtain a record relevant to an agency 
decision concerning the hiring or retention of an employee, the 
issuance of a security clearance, the reporting of an investigation of 
an employee, the letting of a contract or the issuance of a license, 
grant or other benefit by the requesting agency, to the extent that the 
record is relevant and necessary to its decision on the matter.
    5. Where Federal agencies having the power to subpoena other 
Federal agencies' records, such as the Internal Revenue Service (IRS) 
or the Civil Rights Commission, issue a subpoena to the NIH for records 
in this system of records, the NIH will make such records available, 
provided however, that in each case, the NIH determines that such 
disclosure is compatible with the purpose for which the records were 
collected.
    6. Where a contract between a component of HHS and a labor 
organization recognized under E.O. 11491 provides that the agency will 
disclose personal records relevant to the organization's mission, 
records in the system of records may be disclosed to such an 
organization.

[[Page 54443]]

    7. A record may be disclosed to the Department of Justice, to a 
court, or other tribunal, or to another party before such tribunal, 
when: (1) HHS, or any component thereof; (2) any HHS employee in his or 
her official capacity; (3) any HHS employee in his or her individual 
capacity where the Department of Justice (or HHS, where it is 
authorized to do so) has agreed to represent the employee; or (4) the 
United States or any agency thereof where HHS determines that the 
litigation is likely to affect HHS or any of its components, is a party 
to the litigation or has an interest in the litigation, and HHS 
determines that the use of such records by the Department of Justice, 
the tribunal, or the other party is relevant and necessary to the 
litigation and would help in the effective representation of the 
government party, provided however, that in each case, HHS determines 
that such disclosure is compatible with the purpose for which the 
records were collected.
    8. A record about a loan applicant or potential contractor or 
grantee may be disclosed from the system of records to credit reporting 
agencies to obtain a credit report in order to assess and verify the 
person's ability to repay debts owed to the Federal Government.
    9. When a person applies for a loan under a loan program as to 
which the OMB has made a determination under I.R.C. 6103(a)(3), a 
record about his or her application may be disclosed to the Treasury 
Department to find out whether he or she has a delinquent tax account, 
for the sole purpose of determining the person's creditworthiness.
    10. A record from this system may be disclosed to the following 
entities in order to help collect a debt owed the United States:
    a. To another Federal agency so that agency can effect a salary 
offset;
    b. To the Treasury Department or another Federal agency in order to 
effect an administrative offset under common law or under 31 U.S.C. 
3716 (withholding from money payable to, or held on behalf of, the 
individual);
    c. To the Treasury Department to request the person's mailing 
address under I.R.C. 6103(m)(2) in order to help locate the person or 
to have a credit report prepared;
    d. To agents of HHS and to other third parties, including credit 
reporting agencies, to help locate the person or to obtain a credit 
report on him or her, in order to help collect or compromise a debt;
    e. To debt collection agents or contractors under 31 U.S.C. 3718 or 
under common law to help collect a past due amount or locate or recover 
a debtors' assets;
    f. To the Justice Department for litigation or for further 
administrative action; and
    g. To the public, as provided by 31 U.S.C. 3720E, in order to 
publish or otherwise publicly disseminate information regarding the 
identity of the person and the existence of a non-tax debt. Disclosure 
under parts (d) and (g) is limited to the individual's name, address, 
social security number, and other information necessary to identify the 
person. Disclosure under parts (a)-(c) and (e) is limited to those 
items; the amount, status, and history of the claim; and the agency or 
program under which the claim arose. An address obtained from the IRS 
may be disclosed to a credit reporting agency under part (d) only for 
the purpose of preparing a credit report on the individual.
    11. A record from this system may be disclosed to another Federal 
agency that has asked HHS to effect an administrative offset under 
common law or under 31 U.S.C. 3716 to help collect a debt owed the 
United States. Disclosure is limited to name and address, Social 
Security number, and other information necessary to identify the 
individual; information about the money payable to or held for the 
individual; and other information concerning the administrative offset.
    12. Disclosure with regard to claims or debts arising under or 
payable under the Social Security Act may be made from this system to 
``consumer reporting agencies'' as defined in the Fair Credit Reporting 
Act (15 U.S.C. 1681a(f)) of the Federal Claims Collection Act of 1966 
(31 U.S.C. 3701(a)(3)). The purpose of this disclosure is to aid in the 
collection of outstanding debts owed to the Federal Government. 
Disclosure is limited to the individual's name, address, Social 
Security number, and other information necessary to establish the 
individual's identity; the amount, status and history of the claim; and 
the agency or program under which the claim arose.
    13. Information in this system of records is used to prepare W-2s 
and 1099 Forms to submit to the Internal Revenue Service and to 
applicable State and local governments. Items considered to be included 
as income to a person: certain travel related payments to employees, 
all payments made to persons not treated as employees (e.g., fees to 
consultants and experts), and amounts written-off as legally or 
administratively uncollectible, in whole or in part.
    14. A record may be disclosed to banks enrolled in the Treasury 
Credit Card Network to collect a payment or debt when the person has 
given his or her credit card number for this purpose.
    15. Records may be disclosed to a contractor (and/or to its 
subcontractor) who has been engaged to perform services on an automated 
data processing (ADP) system used in processing financial transactions. 
The contractor may have been engaged to develop, modify and test a new 
ADP system, including both software and hardware upgrades or 
enhancements to such a system; perform periodic or major maintenance on 
an existing ADP system; audit or otherwise evaluate the performance of 
such an ADP system; and/or operate such a system.
    16. Records may be disclosed to student volunteers, individuals 
working under a personal services contract, and other individuals 
performing functions for the NIH but technically not having the status 
of agency employees, if they need access to the records in order to 
perform their assigned agency functions.
    17. A record from this system may be disclosed to any Federal 
agency or its agents in order to participate in a computer matching of 
a list of debtors against a list of Federal employees. Disclosure of 
records is limited to debtors' names, names of employers, taxpayers' 
identifying numbers, address (including addresses of employers), dates 
of birth, and other information necessary to establish the person's 
identity.
    18. A record of a person responsible for a current claim may be 
disclosed to a commercial reporting agency in order to aid in the 
collection of claims, typically by providing an incentive to the person 
to repay the claim or a debt timely. Disclosure of records is limited 
to information about a person that is relevant and necessary to meet 
the principal purpose(s) for which it is intended to be used under the 
law.
    19. A record from this system may be disclosed to the Treasury 
Department or to an agency operating a Debt Collection Center 
designated by the Treasury in order to effect a collection of past due 
amounts.
    20. If HHS decides to sell a debt pursuant to 31 U.S.C. 3711(I), a 
record from the system may be disclosed to purchasers, potential 
purchasers, and contractors engaged to assist in the sale or to obtain 
information necessary for potential purchasers to formulate bids and 
information necessary for purchasers to pursue collection remedies.
    21. If HHS decides to administratively garnish wages of a 
delinquent debtor

[[Page 54444]]

under the wage garnishment provision in 31 U.S.C. 3720D, a record from 
the system may be disclosed to the debtor's employer. This disclosure 
will take the form of a wage garnishment order directing that the 
employer pay a portion of the employee/debtor's wages to the Federal 
Government. Disclosure of records is limited to the debtor's name, 
address, and social security number.

Disclosure to Consumer Reporting Agencies:
    Disclosure pursuant to 5 U.S.C. 552a(b)(12): Disclosure may be made 
from this system to ``consumer reporting agencies,'' as defined in 31 
U.S.C. 3701(a)(3). The purpose of this disclosure is to aid in the 
collection of outstanding debts owed to the Federal Government, by 
providing an incentive for debtors to repay these debts by making them 
part of the debtor's credit records. Disclosure of records is limited 
to the individual's name, address, social security number, and other 
information necessary to establish the individual's identity; the 
amount, status and history of the claim; and the agency or program 
under which the claim arose. The disclosure will be made only after the 
procedural requirements of 31 U.S.C. 3711(e) have been followed.

Policies and Practices for Storing, Retrieving, Accessing, Retaining, 
and Disposing of Records in the System:
Storage:
    Records are maintained in file folders and on computer discs and 
tapes. Automated records are stored in controlled access areas. Hard 
copy documents and automated records will both be maintained in 
accordance with Chapter 45-13 of the HHS General Administration Manual, 
``Safeguarding Records Contained in Systems of Records'', and the HHS 
Automated Information System Security Program Handbook.

Retrievability:
    Records are retrieved by name, accounting classification, social 
security number, voucher number or other identifying numbers or 
characteristics.

Safeguards:
    The NBS will conform to applicable law and policy governing the 
privacy and security of Federal automated information systems. These 
include but are not limited to the Privacy Act of 1974, Computer 
Security Act of 1987, Paperwork Reduction Act of 1995, Clinger-Cohen 
Act of 1996, and the Office of Management and Budget (OMB) Circular A-
130, Appendix III, ``Security of Federal Automated Information 
Resources.''

  
    Paragraphs A-C of this section highlight some of the specific 
methods that NIH is using to ensure the security of this system and the 
information within it.
    A. Authorized Users: Personnel having access to the system have 
been trained in the Privacy Act and systems security requirements. 
Employees and contractors who maintain records in the system are 
instructed not to release any data until the intended recipient agrees 
(as part of the user authentication process) to implement appropriate 
administrative, technical, procedural, and physical safeguards 
sufficient to protect the confidentiality of the data and to prevent 
unauthorized access to the data. To insure security of the data, each 
individual user's privilege level is managed via authentication and 
role-based authorizations that ensure minimum and necessary access. 
This prevents unauthorized users from accessing and modifying critical 
data.
    B. Physical Safeguards: All server sites have implemented the 
following minimum requirements. Access to all servers is controlled, 
with access limited to only those support personnel with a demonstrated 
need for access. Servers are to be kept in a locked room accessible 
only by specified management and system support personnel. Each server 
requires a specific log-on process. All entrance doors are identified 
and marked. A log is kept of all personnel who were issued a security 
card, key and/or combination that grants access to the room housing the 
server, and all visitors are escorted while in this room. All servers 
are housed in an area where appropriate environmental security controls 
are implemented, which include measures implemented to mitigate damage 
to automated information system resources caused by fire, electricity, 
water and inadequate climate controls.
    C. Procedural Safeguards: All automated systems must comply with 
Federal laws, guidance, and policies for information systems security 
as stated previously in this section. Each automated information system 
should ensure a level of security commensurate with the level of 
sensitivity of the data and the risk and magnitude of the harm that may 
result from the loss, misuse, disclosure, or modification of the 
information contained in the system.

Retention and Disposal:
    Records are retained and disposed of under the authority of the NIH 
Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 
1--``Keeping and Destroying Records.''

System Manager(s) and Addresses:
    Eric Cole, NBS System Manager, 6707 Democracy Boulevard, Suite 
1001, MSC 5470, Bethesda, MD 20892.

Notification Procedures:
    To determine if a record exists, write to the System Manager listed 
above. A written request must contain the name, address and social 
security number of the requestor and his or her signature that either 
is notarized to verify his or her identify or contain a written 
certification that the requestor is who he or she claims to be and 
understands that the knowing an willful request for acquisition of a 
record pertaining to an individual under false pretenses is a criminal 
offense subject to a five thousand dollar fine.

Record Access Procedures:
    Same as notification procedures. Requestors should also specify the 
record contents being sought. Individuals may also request an 
accounting of disclosures of their records, if any.

Contesting Record Procedures:
    Contact the official at the address specified under notification 
procedure above, identify the record, and specify the information being 
contested, the corrective action sought, and the reasons for requesting 
the correction, along with supporting information to show how the 
record is inaccurate, incomplete, untimely, or irrelevant.

Record Source Categories:
    All persons who receive a payment other than salary or wages, from 
the NIH or owe money to the NIH; officials performing services on 
behalf of HHS; other Federal agencies; consumer reporting agencies/
credit bureaus; travel vouchers submitted by individuals to the NIH; 
grant, contract or loan award documents; delinquent loan, grant or 
scholarship records; invoices of services rendered to the NIH; 
applications for a travel advance submitted to the NIH; NIH Human 
Resource Database (HRDB); NIH electronic Directory (NEDS); and 
employers of debtors subject to administrative wage garnishment.

Systems Exempted from Certain Provisions of the Act:
    None.

[FR Doc. 02-21348 Filed 8-21-02; 8:45 am]
BILLING CODE 4140-01-M