[Federal Register Volume 72, Number 122 (Tuesday, June 26, 2007)]
[Notices]
[Pages 35052-35055]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 07-3097]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES


Office of the Assistant Secretary for Preparedness & Response, 
Office of Preparedness & Emergency Operations; Privacy Act of 1974; 
Report of a New System of Records

AGENCY: Department of Health and Human Services (HHS), Office of the 
Assistant Secretary for Preparedness and Response (ASPR), Office of 
Preparedness and Emergency (OPEO).

ACTION: Notice of a new System of Records (SOR).

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, we are proposing to establish a new system titled, ``The National 
Disaster Medical System (NDMS) Patient Treatment and Tracking Records 
System,'' System Number 09-90-0040. The primary purpose of the NDMS 
Patient Treatment and Tracking Records System is to collect data from 
individuals using the medical care capabilities provided by NDMS.

EFFECTIVE DATES: NDMS filed a new SOR report with the Chair of the 
House Committee on Oversight and Government Reform; the Chair of the 
Senate Committee on Homeland Security and Governmental Affairs; and the 
Administrator, Office of Information and Regulatory Affairs, Office of 
Management and Budget (OMB) on June 18, 2007. The proposed SOR will be 
effective 30 days from the publication of the notice or 40 days from 
the date mailed to ensure that all parties have adequate time in which 
to comment. However, a request has been submitted to the OMB to grant 
HHS a 10 day waiver of the review period due to the impending start of 
the hurricane season. We may defer implementation of this system and 
retrieve the request for waiver should we receive comments that are 
contrary and requires the document to be altered.

ADDRESSES: You may submit comments, identified by one of the following 
methods: The Federal e-Rulemaking Portal at http://www.regulations.gov 
and following the instructions for submitting comments, or send to the 
NDMS Chief Medical Officer, National Disaster Medical System, 330 
Independence Avenue, SW., Room G-644, Washington, DC 20201.

FOR FURTHER INFORMATION CONTACT: CAPT Ana Marie Balingit-Wines, Chief 
Nurse, NDMS Electronic Medical Records Project Officer, ASPR/OPEO/NDMS, 
330 Independence Avenue, SW., Room G-644, Washington, DC 20201. CAPT 
Balingit-Wines can be contacted by telephone at 202-205-8088, or e-mail 
at [email protected] for issues related to the SOR.

SUPPLEMENTARY INFORMATION: NDMS operates pursuant to Section 2812 of 
the Public Health Service Act (42 U.S.C. 300hh-11), and currently 
resides in HHS under ASPR in accordance with the Pandemic and All 
Hazards Preparedness Act (PAHPA), Public Law 109-417. With the passage 
of PAHPA, ASPR has been designated as the agency responsible for 
medical response to include the deployment of NDMS and Field Medical 
Station assets as well as the management of the officers of the Public 
Health Service Commissioned Corps deployed during a response. ASPR 
medical components, in particular NDMS, function in a coordinated 
effort with DHS, DoD, and the VA. In a disaster situation, NDMS and 
other ASPR components will augment the public health and health care 
activities of State and local governments.
    The Privacy Act embodies fair information principles in a statutory 
framework governing the means by which the United States Government 
collects, maintains, uses, and disseminates personally identifiable 
information. The Privacy Act applies to information that is maintained 
in a SOR, which is a group of any records under the control of an 
agency from which information is retrieved by the name of the 
individual or by some identifying number, symbol, or other identifying 
particular, such as property address, mailing address, assigned to the 
individual. As a component of Emergency Support Function (ESF) 
8, NDMS has shared medical records with the other agencies and 
departments that comprise ESF 8, due to the Function's shared 
statutory authority over the collection of medical information. NDMS 
has three key functions to which each of the ESF partners contribute 
and require the collection of medical information: medical response, 
patient evacuation, and definitive medical care.
    The medical response function of NDMS is related to the activation 
and deployment of NDMS response teams, comprised of medical and 
logistical personnel, to assess the health and medical needs of 
disaster victims. In response to the overall needs of the patients, 
NDMS teams are activated to provide physical and mental health, as well 
as evacuation during a public health emergency as cause for activation 
as defined in 42 U.S.C. 300hh-11(a)(3)(A).

[[Page 35053]]

    The patient evacuation function of NDMS relates to the 
establishment of communications, transportation, and a medical 
regulating system to evacuate and move patients from a staging center 
near a disaster site to patient reception sites known as Federal 
Coordinating Centers (FCCs). The DoD and VA have the prime 
responsibility for activating and managing the FCCs. In turn, upon 
receiving the patients, the FCCs have the authority to arrange for 
necessary referrals and admissions or NDMS evacuated patients.
    CMS is responsible for establishing and administering the 
reimbursement process for health care rendered to patients provided 
under the umbrella of NDMS in accordance with Section 2812 of the 
Public Health Service Act, 42 U.S.C. 300hh-11, for ``definitive care.'' 
The SOR for the collection of information for the purpose of 
reimbursement has been filed separately and was published on November 
23, 2005, under 70 FR 70849. NDMS health care providers, in the course 
of providing health care, collect data that identifies the patient's 
name, address, contact information, gender, insurance information, 
prior medical history, and all treatment information to include, but 
not limited to, symptoms, vital signs, diagnosis, and medications 
prescribed through the health care continuum. NDMS veterinary 
providers, in the course of providing care to animals, may collect 
contact information from the animal's owner. The medical records could 
also include x-rays, lab results, and providers' comments relative to 
their observations about the patient. NDMS has a need for the 
collection of information for health care, patient movement, and 
tracking, as well as for reimbursement of health care rendered.
    The collection of the data as a result of illness or injury from a 
disaster or other event mandating the deployment of NDMS medical 
personnel is accomplished through a combination of paper and electronic 
records. The patient data collected will also be used for tracking the 
patient through the continuum. The collection of information during an 
event such as a patient evacuation will assist NDMS in quickly tracking 
and sending the patient and the medical information from the casualty 
collection site to the designated FCC. The system will also allow NDMS 
to track how many patients are sent to each FCC along with their 
discharge and location status. The information will include but not be 
limited to name, address, phone numbers, ethnic background, and other 
contact and/or identifying information as well as medical information 
including laboratory tests performed, diagnosis, treatment provided, 
medications prescribed, referrals, and any treatment advice provided by 
the medical professional to the patient. Pursuant to 5 U.S.C. 
552a(b)(1), information collected would be disclosed to other 
Department of Health and Human Services (HHS) agencies such as the 
Centers for Disease Control and Prevention (CDC), the Centers for 
Medicare and Medicaid Services (CMS), and the Agency for Health Care 
Research and Quality (AHRQ), for the purpose of research, evaluation or 
epidemiologic and longitudinal surveillance studies related to health 
care, which may impact the care provided to disaster victims.
    Information in this system will be disclosed as ``routine uses'' to 
the following entities:
    1. Emergency Support Function 8 (ESF 8) is a 
coordinated effort between the Department of Health and Human Service 
(HHS), the Department of Homeland Security (DHS), the Department of 
Defense (DoD), and the Department of Veterans Affairs (VA). As such, 
the medical treatment and evacuation of patients is a shared 
responsibility between these agencies and disclosure of health related 
information is necessary to adequately manage the overall care of the 
patient.
    2. Disclosure to a member of Congress on behalf of a constituent's 
inquiry.
    3. Disclosure to the Department of Justice (DOJ), court or 
adjudicatory body when the agency is involved in litigation or has an 
interest in litigation.
    4. Disclosure to agency contractors, consultants, or grantees 
engaged in the performance of service related to this collection and 
who may need to have access to the records in order to perform the 
activity.
    5. To assist another Federal or State agency, agency of a state 
government, an agency established by State law, or its fiscal agent to 
assess the location or the status of their beneficiary.
    6. Disclosure to family members of a patient about the location or 
the status of the patient.
    The Privacy Act requires each agency to publish in the Federal 
Register a description denoting the type and character of each system 
of records that the agency maintains, and the routine uses that are 
contained in each system in order to make agency recordkeeping 
practices transparent, to notify individuals regarding the uses to 
which personally identifiable information is annotated, and to assist 
individuals to easily find such files within the agency. NDMS, as a 
component of the OPEO, which resides within ASPR, intends to create a 
separate and distinct system of records. Below is the description of 
the NDMS Patient Treatment and Tracking Records System.

    Dated: June 14, 2007.
Kevin Yeskey,
Deputy Assistant Secretary, Office of Preparedness and Emergency 
Operations.
SYSTEM NO. 09-90-0040

SYSTEM NAME:
    ``National Disaster Medical System (NDMS) Patient Treatment and 
Tracking,'' HHS/ASPR/OPEO.

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    For a specified period and in accordance with the archiving rules, 
the paper records will be resident at NDMS headquarters, located at 409 
3rd Street SW., Suite 330, Washington, DC 20024. The electronic copy of 
the record will be resident at the data center at the Unisys 
Corporation, 11720 Plaza America Drive, Reston, VA 20190.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The individuals covered by the system are all persons and owners of 
animals treated by NDMS medical personnel when the NDMS Disaster 
Medical Assistance Teams (DMATs) and Veterinary Medical Assistance 
Teams (VMATs) are activated to respond to emergency situations, or as a 
response to any other situation for which they are activated.

CATEGORIES OF RECORDS IN THE SYSTEM:
    All records pertaining to treatment and movement of patients to 
include the following (both in hard copy and electronic format):
    Category A: Completed Patient Treatment Record form that includes:
    1. NDMS Team Identification.
    2. Chart Number.
    3. Time and Date Patient seeks treatment.
    4. Triage Category and health status.
    5. Location where Patient is seen and transferred.
    6. Patient Identification--Name, Address, City, State, Zip, Date of 
Birth, Phone Number, Employment, Weight, Next of Kin.
    7. Complaints/Symptoms.
    8. Vital Signs/Treatment Recommended and/or Prescribed.
    9. Discharge--Time, Date, Disposition, Recommendations.
    10. Patient Authorization--Requires Patient Signature in Front of 
Witness and Witness Verification through Signature.

[[Page 35054]]

    11. Any potential attachments such as X-rays and laboratory reports 
showing test results.
    Category B: Veterinarian Treatment Records on animals:
    1. Privacy Act Data such as the name, address and telephone contact 
information of owners of animals will be maintained to be associated 
with the animal patient. However, animal treatment records themselves 
are not subject to the Privacy Act protections.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    NDMS Statute, 42 U.S.C. 300hh-11; Title VI of the Civil Rights Act 
of 1964; and Section 504 of the Rehabilitation Act of 1973. Records 
disposition of this medical SOR is determined under laws governing 
federal records through the National Archives, 44 U.S.C. 3303a.

PURPOSE(S):
    Medical and demographic information is collected on all patients 
seen and/or treated by NDMS or ASPR personnel. This SOR will also 
provide the location, time, and date the patient was transported during 
an evacuation. The information collected will include but not be 
limited to the patient's (1) Medical treatment history, (2) their pre-
existing conditions, (3) their described symptoms, (4) any medical 
opinion rendered by an attending medical professional(s), (5) 
medications that were prescribed, or (6) any other medical advice 
provided. The collection of data contained in medical records provides 
a mechanism by which teams can have the ability to conduct medical 
quality assurance and establish a quality improvement process (QIP). 
Through QIP, teams can analyze and judge their performance on a 
specific deployment and if necessary enable them to better plan for 
future deployments. These patient records are also important sources of 
information to be used for research projects related to the prevention 
of disease or disability as a result of a disaster. Most importantly, 
these patient records document medical treatment rendered, especially 
if questions of liability arise about the treatment or the subsequent 
condition of the patient while he/she is under the care of NDMS.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTENM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    In addition to those disclosures generally permitted under 5 U.S.C. 
552a(b) of the Privacy Act, all or a portion of the records or 
information contained in this system may be disclosed outside HHS as a 
routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:
    1. ESF 8 is a coordinated effort between HHS, DHS, DoD, 
and the VA. As such, the medical treatment and movement of patients is 
a shared responsibility between the ESF 8 partnership 
agencies. The medical and demographic information collected during the 
treatment of a patient is shared with the partners to ensure that 
patients treated through NDMS receive the maximum level of health care 
possible.
    2. Disclosure to a member of Congress or a Congressional staff 
member in response to an inquiry from the Congressional office made at 
the behest of the constituent about whom the record is maintained.
    3. Disclosure to the Department of Justice (DOJ), court, or 
adjudicatory body when the following situations arise:
     a. The agency or any component thereof, or
    b. Any employee of the agency whether in his/her official or 
individual capacity, where DOJ has agreed to represent the employee, or
    c. The United States government is a party to litigation or has an 
interest in such litigation and after careful review, the agency deems 
that the records requested are relevant and necessary to the litigation 
and that the use of such records by DOJ, court, or adjudicatory body is 
compliant with the purpose for which the agency collected the records.
    4. Disclosure to agency contractors, consultants, or grantees who 
have been engaged by the agency to assist in the performance of a 
service related to this collection and who need to have access to the 
records in order to perform the activity.
    5. To assist another Federal and/or State agency, agency of a state 
government, an agency established by State law, or its fiscal agent:
    a. To establish the benefit entitlement of the patient.
    b. To establish the relationship between the existing state benefit 
and the benefit funded in whole or part with Federal funds, such as the 
one associated with the NDMS definitive care.
    c. To collaborate with the state and state agencies on behalf of 
family members regarding the current location and placement of their 
evacuated family member or patient population.
    6. Disclosure to family members of a patient about the location or 
the status of the patient.

Policies and Practices for Storing, Retrieving, Accessing, Retaining, 
and Disposing of Records in the System:
    Category A: Patient Care Forms or other Medical Records:
    Records in this system will be retained in accordance with the 
records disposition authority approved by the National Archives and 
Records Administration (NARA) for the Office of Public Health and 
Emergency Preparedness (OPHEP) in compliance with N1-468-07-1. The 
Pandemic and All Hazards Preparedness Act (Pub. L. 109-417), 
established the ASPR to serve in a similar capacity as OPHEP for 
medical disaster response. The records disposition authority used for 
these records will N1-468-07-1.
    Disposition authority:
    Patient Care Forms or other Medical Records regulated under the 
Health Insurance Portability and Accountability Act (HIPAA), created by 
the Federal Medical Station(s) or by any component of HHS/ASPR during a 
response to an event while caring for victims of that event. 
Disposition: Cutoff is at the end of the response activity by the 
Federal Medical Station(s) for a particular event. Retire to the 
Washington National Records Center 2 years after cutoff. Destroy 75 
years after cutoff. This disposition instruction is media neutral; it 
applies regardless of media or format of the records.
    Category B--The information collected on animals and their owners 
will not be destroyed until NARA approves a disposition schedule for 
those records.

Storage:
    Paper records from this system are stored in the NDMS headquarters 
at 409 3rd Street, SW., Suite 330, Washington, DC 20024. The electronic 
database or server where information is entered and stored is 
maintained at the HHS data center located at Unisys Corporation, 11720 
Plaza America Drive, Reston, VA 20190. During deployments, NDMS stores 
the records securely in their deployed location, the electronic data is 
stored in a secured server, and all procedures required for protection 
of Privacy Act documents are implemented as identified in 
``Safeguards'' section below.

Retrievability:
    NDMS Patient Treatment and Tracking Records in electronic and paper 
copy are organized by event, location, and date of treatment. Data from 
the records are stored in an electronic database enabling data from the 
records to be retrievable by name and other demographic information 
provided by the patient (or for veterinary records, by pet owner), as 
well as by location of treatment, diagnosis, and other data fields 
within the database.

[[Page 35055]]

Safeguards:
    NDMS has safeguards in place for authorized users and monitors such 
users to ensure against unauthorized use. Personnel having access to 
the system have been trained in the Privacy Act and information 
security requirements for both paper copies and electronically stored 
information. Information in this system is safeguarded in accordance 
with applicable laws, rules and policies, including the HHS Information 
Technology Security Program Handbook, all pertinent National Institutes 
of Standards and Technology publications and OMB Circular A-130, 
Management of Federal resources. All records are protected from 
unauthorized access through appropriate administrative, physical, and 
technical safeguards. These safeguards include restricting access to 
authorized personnel who have a need-to-know, using physical locks in 
the office environment, and the process of authentication using user 
IDs and passwords function as protection identification features. HHS 
file areas are locked after normal duty hours and the facilities are 
protected from the outside by security personnel.

SYSTEM MANAGER AND ADDRESS:
    The NDMS Chief Medical Officer located at 409 3rd Street, SW., 
Washington, DC 20024. Mailing address: 330 Independence Avenue, SW., 
Room G-644, Washington, DC 20201.

NOTIFICATION PROCEDURES:
    Requests for Privacy Act protected information generally are 
governed by HHS regulations found at 45 CFR, Part 5b. They must be made 
in writing and clearly marked as a ``Privacy Act Request'' on the 
envelope and letter. Inquiries regarding this SOR should be addressed 
to the System Manager. Inquiries related to patient medical records 
should include the full name of the individual, the appropriate 
personal identification, and the current address, and should be sent to 
the Chief Medical Officer, NDMS, 330 Independence Avenue, SW., Room G-
644, Washington, DC 20201. The name of the requester, the nature of the 
record sought, and the verification of identify must be clearly 
indicated, as required by HHS regulations at 45 CFR 5b.5. Requests may 
also be sent to: HHS Privacy Act Officer 200 Independence Avenue, SW., 
Washington, DC 20201.

RECORD ACCESS PROCEDURES:
    Same as Notification Procedure above.

CONTESTING RECORD PROCEDURES:
    Same as the Notification Procedure above. The letter should state 
clearly and concisely what information you are contesting, the reasons 
for contesting it, and the proposed amendment to the information that 
you seek pursuant to HHS Privacy Act regulations, 45 CFR 5b.7.

RECORD SOURCE CATEGORIES:
    Sources for providing data for NDMS Patient Treatment Records will 
only be provided by patients, medical personnel treating the patients 
or by accessing their personal health records (PHR). In the case of 
minors or other individuals unable to explain symptoms, information may 
be sought from a parent or guardian. For animals, information will be 
gathered by NDMS veterinary personnel and/or owners or caretakers of 
animals.

EXEMPTIONS CLAIMED FOR THE SYSTEM:
    None.
[FR Doc. 07-3097 Filed 6-25-07; 8:45 am]
BILLING CODE 4150-37-M