[Federal Register Volume 68, Number 173 (Monday, September 8, 2003)]
[Notices]
[Pages 52950-52952]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 03-22750]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Health Resources and Services Administration


Privacy Act of 1974: Revision to Existing System of Records; 
Correction

AGENCY: Health Resources and Services Administration, HHS.

ACTION: Notification of an Altered System of Records; correction.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, the Health Resources and Services Administration published in the 
Federal Register of August 18, 2003, a document concerning a notice of 
a proposal to revise an existing system of records, 09-15-0055, Organ 
Procurement and Transplantation Network (OPTN) Data System. In notice 
FR Doc. 03-20685 on page 49491, the last line in the first paragraph of 
the SUPPLEMENTARY INFORMATION section states:

    The notice is published below in its entirety, as amended.

    The system of records notice was inadvertently omitted from the 
document. This document corrects that mistake. Accordingly, the notice 
is published below in its entirety, as amended.

FOR FURTHER INFORMATION CONTACT: James Burdick, M.D., Director, 
Division of Transplantation, Office of Special Programs, Health 
Resources and Services Administration, Parklawn Building, Room 16C-17, 
5600 Fishers Lane, Rockville, Maryland 20857.

    Dated: September 2, 2003.
Jane M. Harrison,
Director, Division of Policy Review and Coordination.
09-15-0055

System Name:
    Organ Procurement and Transplantation Network (OPTN)/Scientific 
Registry of Transplant Recipients (SRTR) Data System, HHS/HRSA/OSP/DoT.

Security Classification:
    None.

System Location:
    Data collected by the OPTN are maintained by the OPTN contractor 
and shared on a monthly basis with the contractor for the SRTR and the 
DoT, within HRSA, the Federal entity that oversees the OPTN and SRTR 
contracts.
    OPTN Contractor: United Network for Organ Sharing (UNOS), P.O. Box 
2484, 700 North Fourth Street, Richmond, Virginia 23218.
    SRTR Contractor: University Renal Research and Education 
Association (URREA), 315 West Huron, Suite 260, Washtenaw County, Ann 
Arbor, Michigan, 48103.
    Division of Transplantation: Office of Special Programs, HRSA, 
Parklawn Building, Room 16C-17, 5600 Fishers Lane, Rockville, Maryland 
20857.

Categories of Individuals Covered by the System:
    Persons from whom organs have been obtained for transplantation, 
persons who are candidates for organ transplantation, and persons who 
have been recipients of transplanted organs.

Categories of Records in the System:
    Donor registration, transplant recipient registration, 
histocompatibility forms, and transplant recipient follow-up forms. 
Data items include: name, Social Security number (voluntary), 
identifiers assigned by OPTN and SRTR contractors, hospital and 
hospital provider number, State and zip code of residence, citizenship, 
race/ethnicity, gender, date and time of organ recovery and 
transplantation, name of transplant center, histocompatibility status, 
donor cause of death and condition, patient condition before and after 
transplantation, immunosuppressive medication, cause of death (if 
appropriate), health care coverage, employment and education level.

Authority for Maintenance of the System:
    42 U.S.C. 274 requires that the Secretary, by contract, provide for 
the establishment and operation of an OPTN, and 42 U.S.C. 274a requires 
that the Secretary, by grant or contract, develop and maintain a 
Scientific Registry of the recipients of organ transplants. 42 CFR part 
121 authorizes collection of the information included in this system by 
the OPTN.

Purpose(s):
    To (1) match donor organs with recipients; (2) monitor compliance 
of member organizations with OPTN requirements; (3) review and report 
periodically to the public on the status of organ donation and 
transplantation in the United States; and (4) provide data to 
researchers and government agencies to study the scientific and 
clinical status of organ transplantation.

Routine Uses of Records Maintained in the System, Including Categories 
of Users and the Purpose of Such Uses:
    1. Departmental contractors who have been engaged by the Department 
to assist in accomplishment of a departmental function relating to the 
purposes for this system of records and who need to have access to the 
records in order to assist the Department.
    2. HRSA, independently and through its contractor(s), may disclose 
records regarding organ donors, organ transplant candidates, and organ 
transplant recipients to transplant centers, histocompatibility 
laboratories, and organ procurement organizations, provided that such 
disclosure is compatible with the purpose for which the records were 
collected including: matching donor organs with recipients, monitoring 
compliance of member organizations with OPTN requirements, reviewing 
and reporting periodically to the public on the status of organ 
donation and transplantation in the United States. These records 
consist of Social Security numbers, other patient identification 
information and pertinent medical information.
    3. In the event of litigation where the defendant is (a) the 
Department, any component of the Department, or any employee of the 
Department in his or her official capacity; (b) the United States where 
the Department determines that the claim, if successful, is likely to 
affect directly the operation of the Department or any of its 
components; or (c) any Department employee in his or her individual 
capacity where the Department of Justice has agreed to represent such 
employee, for example, in defending a claim against the Public Health 
Service in connection with such individual, disclosure may be made to 
the Department of Justice to enable the

[[Page 52951]]

Department to present an effective defense.
    4. Disclosure may be made to a congressional office from the record 
of an individual in response to a verified inquiry from the 
congressional office made at the written request of that individual.
    5. A record may be disclosed for a research purpose, when the 
Department, independently or through its contractor(s):
    (a) Has determined that the use or disclosure does not violate 
legal or policy limitations under which the record was provided, 
collected, or obtained;
    (b) Has determined that a bona fide research/analysis purpose 
exists;
    (c) Has required the recipient to: (1) Establish strict limitations 
concerning the receipt and use of patient-identified data; (2) 
establish reasonable administrative, technical, and physical safeguards 
to protect the confidentiality of the data and to prevent the 
unauthorized use or disclosure of the record; (3) remove, destroy, or 
return the information that identifies the individual at the earliest 
time at which removal or destruction can be accomplished consistent 
with the purpose of the research project, unless the recipient has 
presented adequate justification of a research or health nature for 
retaining such information; and (4) make no further use or disclosure 
of the record except as authorized by HRSA or its contractor(s) or when 
required by law;
    (d) has determined that other applicable safeguards or protocols 
will be followed; and
    (e) has secured a written statement attesting to the recipient's 
understanding of, and willingness to abide by these provisions.

Policies and Practices for Storing, Retrieving, Accessing, Retaining 
and Disposing of Records in the System:
Storage:
    Records are maintained in file folders, magnetic tapes, and disc 
packs.

Safeguards:
    1. Authorized users: Access is limited to authorized HRSA and 
contract personnel responsible for administering the program. 
Authorized personnel include the System Manager and Project Officer, 
and the HRSA Automated Information System (AIS) Systems Security 
Officer; and the program managers/program specialists who have 
responsibilities for implementing the program. Both HRSA and its 
contractor(s) shall maintain current lists of authorized users.
    2. Physical safeguards: Magnetic tapes, disc packs, computer 
equipment, and hard-copy files are stored in areas where fire and life 
safety codes are strictly enforced. All automated and nonautomated 
documents are protected on a 24-hour basis in locked storage areas. 
Security guards perform random checks on the physical security of the 
records storage area. The OPTN and SRTR contractors are required to 
maintain off site a complete copy of the system and all necessary files 
to run the computer organ donor-recipient match and update software.
    3. Procedural safeguards: A password is required to access the 
terminal and a data set name controls the release of data to only 
authorized users. All users of personal information in connection with 
the performance of their jobs protect information from public view and 
from unauthorized personnel entering an unsupervised office. All 
authorized users must sign a nondisclosure statement. Access to records 
is limited to those staff members trained in accordance with the 
Privacy Act and Automated Data Processing (ADP) security procedures. 
The contractor(s) is required to assure that the confidentiality 
safeguards of these records will be employed and that it complies with 
all provisions of the Privacy Act. All individuals who have access to 
these records must have the appropriate ADP security clearances. 
Privacy Act and ADP system security requirements are included in the 
contracts. The HRSA Project Officer(s) and the System Manager(s) 
oversee compliance with these requirements. The HRSA authorized users 
will make visits to the contractors' facilities to assure security and 
Privacy Act compliance. The contractor(s) is/are required to adhere to 
a HRSA approved system security plan.

Retention and Disposal:
    Each donor, candidate, and recipient record shall be retained for 
25 years beyond the known death of the organ recipient.

System Manager and Address:
    Chief, Operations and Analysis Branch, Division of Transplantation, 
HRSA, Parklawn Building, Room 16C-17, 5600 Fishers Lane, Rockville, MD 
20857.

Notification Procedure:
    Requests by mail: To determine if a record about you exists, write 
to the OPTN contractor (see System Location). The request should 
contain the name and address of the individual; the Social Security 
number if the individual chooses to provide it; the name of his/her 
transplant center, a notarized written statement that the requester is 
the person he/she claims to be and that he/she understands that the 
request or acquisition of records pertaining to another individual 
under false pretenses is a criminal offense subject to a $5,000 fine. 
These procedures are in accordance with the Department's regulations 
(45 CFR part 5b).
    Requests in person: The individual must meet all the requirements 
stated above for a request by mail, providing the information in 
written form, or provide at least one piece of tangible identification. 
The individual should recognize that in order to maintain 
confidentiality, and thus the accuracy of data released through 
repeated internal verification, securing the information by request in 
person will be time consuming. These procedures are in accordance with 
the Department's regulations (45 CFR part 5b).
    Requests by telephone: Since positive identification of the caller 
cannot be established, telephone requests are not honored.

Record Access Procedures:
    Same as notification procedures. Requestors should also provide a 
reasonable description of the record being sought. Requestors also may 
request an accounting of disclosures that have been made of their 
records, if any. A parent or guardian who requests notification of, or 
access to, a minor's/incompetent person's medical record shall 
designate a family physician or other health professional (other than a 
family member) to whom the record, if any, will be sent. The parent or 
guardian must verify relationship to the minor/incompetent person as 
well as his/her own identity. These procedures are in accordance with 
the Department's regulations (45 CFR part 5b).

Contesting Records Procedures:
    Contact the official at the address specified under notification 
procedure above and reasonably identify the record, specify the 
information being contested, and the corrective action sought, and your 
reasons for requesting the correction, along with supporting 
information to show how the record is inaccurate, incomplete, untimely, 
or irrelevant.

Record Source Categories:
    Organ procurement organizations, histocompatibility laboratories, 
and organ transplant centers.

[[Page 52952]]

Systems Exempted from Certain Provisions of the Act:
    None.

[FR Doc. 03-22750 Filed 9-5-03; 8:45 am]
BILLING CODE 4165-15-P