[Federal Register Volume 68, Number 212 (Monday, November 3, 2003)]
[Notices]
[Pages 62301-62304]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 03-27562]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Health Resources and Services Administration


Privacy Act of 1974; New System of Records

AGENCY: Health Resources and Services Administration, HHS.

ACTION: Notification of new system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act, the 
Health Resources and Services Administration (HRSA) is publishing 
notice of a proposal to add a new system of records. The Smallpox 
Vaccine Injury Compensation Act of 2003 (``the Act''), amended title II 
of the Public Health Service Act (42 U.S.C. 202 et seq.) to provide 
benefits and other compensation for certain individuals with injuries 
resulting from the administration of smallpox countermeasures or as a 
result of vaccinia contracted through accidental vaccinia inoculation. 
The Act directs the Secretary, HHS, to establish administrative 
procedures to compensate certain individuals who sustained a covered 
injury as the direct result of the administration of smallpox vaccine, 
and certain individuals who sustained a covered injury as a direct 
result of accidental vaccinia inoculation through contact with the 
foregoing persons or with individuals accidently inoculated by them. 
This system of records is required to comply with the implementation 
directives of the Act, Public Law 108-20. The records will be used for 
the Smallpox Vaccine Injury Compensation Program's (SVICP) planning, 
implementation, payment, evaluation, monitoring, and document storage 
purposes.

DATES: HRSA invites interested parties to submit comments on the 
proposed New System of Records on or before December 15, 2003. As of 
the date of the publication of this Notice, HRSA has sent a Report of 
New System of Records to Congress and to the Office of Management and 
Budget (OMB). The New System of Records will be effective 40 days from 
the date submitted to OMB unless HRSA receives comments that would 
result in a contrary determination.

ADDRESSES: Please address comments to Health Resources and Services 
Administration (HRSA) Privacy Act Officer, 5600 Fishers Lane, Room 14A-
20, Rockville, Maryland 20857; telephone (301) 443-3780. This is not a 
toll-free number. Comments received will be available for inspection at 
this same address from 9 a.m. to 3 p.m., Monday through Friday.

FOR FURTHER INFORMATION CONTACT: Director, Office of Special Programs, 
Health Resources and Services Administration, 5600 Fishers Lane, Room 
16C-17, Rockville, Maryland 20857; telephone (301) 443-3300. This is 
not a toll-free number.

[[Page 62302]]


SUPPLEMENTARY INFORMATION: The Health Resources and Services 
Administration (HRSA) proposes to establish a new system of records: 
``The Smallpox Vaccine Injury Compensation Program, HHS/HRSA/OSP.'' The 
Act authorizes the creation of a Smallpox Vaccine Injury Compensation 
Program (``the Program'') by directing the Secretary, HHS, to establish 
administrative procedures designed to provide benefits and other 
compensation to certain individuals who sustained a covered injury as 
the direct result of the administration of smallpox countermeasures, 
and certain individuals who sustained a covered injury as a direct 
result of accidental vaccinia inoculation through contact with the 
foregoing persons or with individuals accidently inoculated by them. 
The Secretary will issue regulations implementing the Program. 
Individuals eligible to be considered for benefits and other 
compensation are:
    1. (a) Health care workers, law enforcement officers, firefighters, 
security personnel, emergency medical personnel, other public safety 
personnel, or support personnel for such occupational specialties;
    (b) Who are or will be functioning in a role identified in a State, 
local, or HHS smallpox emergency response plan approved by the 
Secretary;
    (c) Who have volunteered for, and been selected to be members of, a 
smallpox emergency response plan prior to the time at which the 
Secretary publicly announces that an active case of smallpox has been 
identified either within or outside of the United States;
    (d) To whom a smallpox vaccine is administered pursuant to such an 
approved plan during the effective period of the Declaration Regarding 
Administration of Smallpox Countermeasures (``the Declaration'') issued 
by the Secretary, HHS, on January 24, 2003, and published in the 
Federal Register on January 28, 2003 (68 FR 4212); and
    (e) Who sustain a covered injury, disability, illness, condition, 
or death as a direct result of receiving a covered countermeasure, 
including the smallpox vaccine, during the effective period of the 
Declaration; or
    2. Certain individuals who sustain a covered injury, disability, 
illness, condition, or death as a direct result of vaccinia contracted 
through contact with one or more of the individuals described above or 
through contact with individuals accidently inoculated by those 
individuals, during the specified time frame.
    Subject to certain provisions, the Act authorizes benefits and 
other compensatory payments, generally secondary to other available 
coverage, for the following:
    (1) Reasonable and appropriate medical items and services to treat 
a covered injury.
    (2) Lost employment income incurred as a result of a covered injury 
beyond the first five days of work missed unless the loss of employment 
extends beyond nine days, to a maximum of $50,000 for any given year 
with a limited exception for persons with a permanent and total 
disability, through the age of 65.
    (3) Death payment to survivors in circumstances in which death is 
determined to have resulted from a covered injury.
    This system of records is required to comply with the 
implementation directive set forth in the Act. It will be used for 
Program planning, implementation, payment, evaluation, monitoring, and 
document storage purposes.
    HRSA permits disclosure of the records to third parties pursuant to 
the following routine uses: The first routine use permits disclosure to 
a congressional office to allow subject individuals to obtain 
assistance from their representatives in Congress, if they wish to do 
so. The second routine use allows disclosure to Federal, State or local 
Government entities or to private entities for the purpose of their 
providing information relevant to medical or legal documentation 
required for determinations of eligibility or payment. The third 
routine use allows disclosure of records to contractors engaged by the 
Department who need access to the records in order to assist the 
Department, e.g., expert consultants providing advice on requesters' 
eligibility for benefits and/or compensation. The fourth routine use 
allows disclosure of records to individuals and/or entities as 
necessary for the purposes of obtaining financial advice and providing 
benefits and other compensation to requesters approved for payment 
under the Program. The fifth routine use allows disclosure to a Federal 
agency administering aspects of the Program under a Memorandum of 
Agreement or assisting in the accomplishment of a Departmental function 
related to the purposes of the Program. The sixth routine use allows 
disclosure of records to the Department of Justice or a court, in the 
event of litigation. The seventh routine use allows disclosure to the 
appropriate Federal, State or local agency in the event of a violation 
of law. The eighth routine use allows disclosure of records for certain 
medical research purposes.
    The following notice is written in the present tense, rather than 
the future tense, in order to avoid the unnecessary expenditure of 
public funds to republish the notice after the system becomes 
effective.

    Dated: October 28, 2003.
Elizabeth M. Duke,
Administrator, Health Resources and Services Administration.
09-15-0065

SYSTEM NAME:
    Smallpox Vaccine Injury Compensation Program, HHS/HRSA/OSP.

SECURITY CLASSIFICATION:
    None.

SYSTEM LOCATION:
    Office of Special Programs, Health Resources and Services 
Administration, 4350 East-West Highway, 10th Floor, Bethesda, Maryland 
20814.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Individuals covered by the system are requesters and/or their 
representatives filing for benefits and other compensation under the 
Smallpox Vaccine Injury Compensation Program.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Records consist of documents that may include general or 
congressional correspondence, requests, case number assignment, HHS 
responses, medical and legal documentation, employment documentation, 
documentation concerning services or benefits available from the United 
States or any third party (including any State or local governmental 
entity, private insurance carrier, or employer), payment information, 
and other related case processing documents.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Management of the system is authorized by Pub. L. 108-20, the 
Smallpox Emergency Personnel Protection Act of 2003, enacted April 30, 
2003 (42 U.S.C. 239 et seq.).

PURPOSE(S):
    The purpose of the system is to provide for benefits and other 
compensatory payments to certain individuals who sustained a covered 
injury as the direct result of the administration of smallpox 
countermeasures, and certain individuals who sustained a covered injury 
as a direct result of accidental vaccinia inoculation through contact 
with the foregoing persons or with individuals accidently inoculated by 
them, during a specified time period.

[[Page 62303]]

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    1. Disclosure may be made to a congressional office from the record 
of a subject individual, in response to an inquiry from the 
congressional office made at the written request of that individual or 
his/her representative.
    2. Disclosure may be made to Federal, State or local Government 
entities or to private entities for the purpose of their providing 
information relevant to medical or legal documentation required for 
determinations of eligibility or payment, provided that such disclosure 
is compatible with the purpose for which the records were collected.
    3. Disclosure of records may be made to contractors engaged by the 
Department who need access to the records in order to assist the 
Department, e.g., expert consultants providing advice on requesters' 
eligibility for benefits and/or compensation. All such individuals 
shall be required to maintain Privacy Act safeguards with respect to 
such records and return all records to HRSA.
    4. Disclosure of records may be made to individuals and/or entities 
as necessary for the purposes of obtaining financial advice and 
providing benefits and other compensation to requestors approved for 
payment under the Program. All individuals and/or entities permitted 
disclosure for this use shall be required to maintain Privacy Act 
safeguards with respect to such records and return all records to HRSA.
    5. Disclosure of records may be made to a Federal agency 
administering aspects of the Program, as authorized by a Memorandum of 
Agreement between the Secretary and the head of the Federal agency, or 
to another Federal agency assisting in the accomplishment of a 
Departmental function relating to the purposes of this system of 
records, provided that such disclosure is compatible with the purposes 
for which the records are collected.
    6. Disclosure of records may be made in the event of litigation 
where the defendant is:
    (a) The Department, any component of the Department, or any 
employee of the Department in his or her official capacity;
    (b) The United States where the Department determines that the 
action, if successful, is likely to affect directly the operation of 
the Department or any of its components; or
    (c) Any Department employee in his or her individual capacity where 
the Department of Justice (DoJ) has agreed to represent such employee, 
for example, in defending an action against the Department in 
connection with such individual, disclosure may be made to DoJ to 
enable DoJ to present an effective defense, provided that such 
disclosure is compatible with the purpose for which the records were 
collected.

    7. Disclosure may be made in the event that a system of records 
maintained by this agency to carry out its functions indicates a 
violation or potential violation of law, whether civil, criminal, or 
regulatory in nature, and whether arising by general statute or 
particular program statute, regulation, rule, or order issued pursuant 
thereto, the relevant records in the system of records may be referred 
to the appropriate agency, whether Federal, State or local, charged 
with the responsibility of investigating or prosecuting such violation, 
or charged with enforcing or implementing the statute, rule, regulation 
or order issued pursuant thereto, provided that such disclosure is 
compatible with the purpose for which the records were collected.
    8. A record may be disclosed for a medical research purpose, only 
when the Department has determined:
    (a) That the use or disclosure does not violate legal or policy 
limitations under which the record was provided, collected, or 
obtained;
    (b) That the research purpose is consistent with the purpose for 
which the Program was formed;
    (c) That the proposed research is scientifically sound in its 
methods and analyses and is likely to answer the proposed research 
question;
    (d) That the information sought is not available from any other 
source; and
    (e) That the record made available for medical research is redacted 
of all personal identifiers regarding injured individuals, health care 
practitioners and employers that are not essential for the 
accomplishment of the approved research purpose.
    (f) The recipient must:

    (1) Establish strict limitations acceptable to the Department 
concerning the receipt and use of any patient-identifiable data;
    (2) Establish reasonable administrative, technical, and physical 
safeguards and/or protocols acceptable to the Department to protect the 
confidentiality of the data and to prevent the unauthorized use or 
disclosure of the record;
    (3) Remove or destroy the information that identifies an individual 
at the earliest time at which removal or destruction can be 
accomplished consistent with the purpose of the research project; and
    (4) Make no further use or disclosure of the record except when 
required by law.
    (a) Further, the Department must secure and approve a written 
statement attesting to the recipient's understanding of, and agreement 
to abide by, these conditions of disclosure. Violation of these 
provisions is subject to penalties set forth under 5 U.S.C. 552a(i)(3) 
and any other applicable Federal law.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING 
AND DISPOSING OF RECORDS IN THE SYSTEM: STORAGE:
    Records are maintained in file folders, on computer hard drives 
and/or disk packs, or in electronic media storage.

RETRIEVABILITY:
    Retrievability is by name of the requester, and by case number 
assigned based on the order in which a request form is filed.

SAFEGUARDS:
    1. Assign Responsibility for Security: Responsibility is assigned 
to a management official knowledgeable in the nature of the information 
and process supported by the Smallpox Vaccine Injury Compensation 
Program (SVICP) request and in the management, personnel, operational, 
and technical controls used to protect it.
    2. Perform Risk Assessment: A risk assessment is to be conducted in 
conjunction with the development of, and prior to the approval of, the 
system design and will ensure that vulnerabilities, risks, and other 
security concerns are identified and addressed in the system design and 
throughout the life cycle of the project. This is consistent with the 
HHS Automated Information Systems Security Program Handbook (in 
particular Chapters V and X).
    3. Develop SVICP Request Security Plan: Plan for the adequate 
security of the SVICP request, taking into account the security of all 
systems in which the request will operate. SVICP request security plans 
shall address request rules, training on use of the system, personnel 
security, contingency planning, technical controls, information 
sharing, and public access controls.
    4. Review SVICP Request Controls: Perform an independent review or 
audit of the SVICP request security control in accordance with 
applicable Federal requirements and/or guidelines.
    5. Authorize Processing: Ensure that a management official 
authorizes, in writing, confirmation that the security plan as 
implemented adequately secures

[[Page 62304]]

the SVICP request. The SVICP request must be authorized prior to 
operating and reauthorized in accordance with applicable Federal 
requirements and/or guidelines.
    6. Implementation Guidelines: DHHS Chapter 45-13 and supplementary 
Chapter PHS.hf: 45-13 of the General Administration Manual; the DHHS 
Automated Information Systems Security Program Handbook; and Appendix 
III to OMB Circular No. A-130; Appendix I, ``Federal Agency 
Responsibilities for Maintaining Records About Individuals.''

RETENTION AND DISPOSAL:
    Records will be retained and disposed of in accordance with the 
Records Control Schedule of the Health Resources and Services 
Administration.

SYSTEM MANAGER(S) AND ADDRESS:
    Director, Office of Special Programs, Health Resources and Services 
Administration, 5600 Fishers Lane, Room 16C-17, Rockville, Maryland 
20857, or the Director's designee.

NOTIFICATION PROCEDURE:
    Requests must be made to the System Manager.
    Requests by mail: Requests for information and/or access to records 
received by mail must contain information providing the identity of the 
writer, and a reasonable description of the record desired, and whom it 
concerns. Written requests must contain the name and address of the 
requester, his/her date of birth and his/her signature for comparison 
purposes. Requests must be notarized to verify the identity of the 
requester, or the requester must certify that (s)he is the individual 
who (s)he claims to be and that (s)he understands that to knowingly and 
willfully request or acquire a record pertaining to another individual 
under false pretenses is a criminal offense under the Privacy Act 
subject to a $5,000 fine (45 CFR 5b.5(b)(2)(ii)).
    Requests in person or by telephone, electronic mail or facsimile 
cannot be honored.

RECORD ACCESS PROCEDURES:
    Record access procedures are the same as notification procedures. 
Requesters should also provide a reasonable description of the contents 
of the record being sought. A parent or guardian who requests 
notification of, or access to, a minor's/incompetent person's medical 
record shall designate a family physician or other health professional 
(other than a family member) to whom the record, if any, will be sent. 
The parent or guardian must verify relationship to the minor/
incompetent person as well as his/her own identity. Records will be 
mailed only to the requester=s address that is on file, unless a 
different address is demonstrated by official documentation.

CONTESTING RECORDS PROCEDURES:
    To contest a record in the system, contact the System Manager at 
the address specified above and reasonably identify the record, specify 
the information being contested, and state the corrective action sought 
and the reason(s) for requesting the correction, along with supporting 
documentation to show how the record is inaccurate, incomplete, 
untimely, or irrelevant.

RECORD SOURCE CATEGORIES:
    Sources of records include, but are not limited to, requesters and/
or their representatives under the Smallpox Vaccine Injury Compensation 
Program, and any other sources of information or documentation 
submitted by any other person or entity for inclusion in a request for 
the purpose of determining medical or legal eligibility for, or amount 
of benefits and/or compensation under, the Program (e.g., Federal, 
State, or local government or private health care entities 
participating in the administration of covered countermeasures under 
the Declaration).

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:
    None.
[FR Doc. 03-27562 Filed 10-31-03; 8:45 am]
BILLING CODE 4165-15-P