The FAA issued a notice of proposed rulemaking (NPRM) to amend 14 CFR part 39 by adding an AD that would apply to Pacific Aerospace Limited Model 750XL airplanes. The NPRM was published in the Federal Register on August 6, 2019 (84 FR 38146). The NPRM proposed to correct an unsafe condition of the specified products and was prompted by MCAI AD DCA/750XL/31, dated July 5, 2018, issued by the Civil Aviation Authority (CAA) of New Zealand. The MCAI states:

The CAA advised the design is non-compliant with regard to the fireproof requirements for firewalls. Ineffective sealant may fail to prevent fire propagation through the firewall, which could result in smoke or fire in the cockpit. The CAA issued the MCAI to correct this unsafe condition.

You may examine the MCAI on the internet at: https://www.regulations.gov by searching for FAA-2019-0566-0002.

The FAA gave the public the opportunity to participate in developing this AD. The FAA received no comments on the NPRM or on the determination of the cost to the public.

The FAA reviewed the relevant data and determined that air safety and the public interest require adopting the AD as proposed.

The FAA reviewed Pacific Aerospace Mandatory Service Bulletin PACSB/XL/101, Issue 1, dated May 9, 2018. The service information provides instructions for installing improved firewall sealing for wiring penetration looms and correcting any damaged or chafed looms. This service information is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

The FAA estimates that this AD will affect 22 products of U.S. registry. The FAA also estimates that it will take about 8 work-hours per product to comply with the basic requirements of this AD. The average labor rate is $85 per work-hour. Required parts will cost about $385 per product.

Based on these figures, the FAA estimates the cost of this AD on U.S. operators to be $23,430, or $1,065 per product.

According to the manufacturer, some of the costs of this AD may be covered under warranty, thereby reducing the cost impact on affected individuals. The FAA does not control warranty coverage for affected individuals. As a result, the FAA has included all costs in our cost estimate.

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. Subtitle VII: Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

This AD will not have federalism implications under Executive Order 13132. This AD will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify this AD:

(1) Is not a “significant regulatory action” under Executive Order 12866,

(2) Will not affect intrastate aviation in Alaska, and

(3) Will not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA amends 14 CFR part 39 as follows:

The FAA issued a notice of proposed rulemaking (NPRM) to amend 14 CFR part 39 to supersede AD 2015-13-06, Amendment 39-18193 (80 FR 44835, July 28, 2015) (“AD 2015-13-06”). AD 2015-13-06 applied to certain The Boeing Company Model 747-400 and 747-400F series airplanes. The NPRM published in the Federal Register on March 30, 2020 (85 FR 17510). The NPRM was prompted by a report that an operator found a cracked longeron extension fitting on an airplane not included in the applicability of AD 2015-13-06. The NPRM proposed to continue to require repetitive inspections of the longeron extension fittings for cracking; repetitive HFEC inspections of any modified, repaired, or replaced longeron extension fitting for cracking; and applicable on-condition actions. The NPRM also proposed to add Model 747-100, 747-100B, 747-100B SUD, 747-200B, 747-200C, 747-200F, 747-300, 747-400D, 747SR, and 747SP series airplanes to the applicability, and for those additional airplanes, repetitive inspections of the longeron extension fittings for cracking and repair if necessary. The FAA is issuing this AD to address cracks in the longeron extension fittings, which can become large and adversely affect the structural integrity of the airplane.

The FAA gave the public the opportunity to participate in developing this AD. The following presents the comments received on the NPRM and the FAA's response to each comment.

Boeing stated that it had no comment regarding the NPRM and Hasan Ashour expressed support for the NPRM.

Addison Hull requested that the FAA expand the applicability of the NPRM to include all airplanes. The commenter expressed concern that the NPRM only identified 67 affected airplanes. The commenter also pointed out their belief that all airplanes should have the same minimum requirements, and that this method would be more efficient compared with publishing specific rules to mandate the inspection and maintenance of other types of airplanes that are not affected by the NPRM.

The FAA disagrees with the request. The FAA issues ADs to address potential unsafe conditions in airplanes with similar designs. The FAA has worked closely with the design approval holder (DAH) to determine the group of affected airplanes that may develop this particular unsafe condition. The group of affected airplanes for this particular unsafe condition is an expansion to the group of airplanes addressed by AD 2015-13-06. Therefore, the FAA believes that the entire number of affected airplanes have been captured by this AD. This AD has not been changed in this regard.

The FAA reviewed the relevant data, considered the comments received, and determined that air safety and the public interest require adopting this AD as proposed, except for minor editorial changes. The FAA has determined that these minor changes:

• Are consistent with the intent that was proposed in the NPRM for addressing the unsafe condition; and

• Do not add any additional burden upon the public than was already proposed in the NPRM.

The FAA reviewed Boeing Service Bulletin 747-53A2860, Revision 3, dated November 11, 2019. This service information describes procedures for repetitive inspections of the longeron extension fittings for cracking; repetitive HFEC inspections of any modified, repaired, or replaced longeron extension fitting for cracking; and applicable on-condition actions. On-condition actions include replacement, repair, and modification. This service information is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

The FAA estimates that this AD affects 67 airplanes of U.S. registry. The FAA estimates the following costs to comply with this AD:

The FAA estimates the following costs to do any necessary on-condition actions that would be required. The FAA has no way of determining the number of aircraft that might need these on-condition actions:

Estimated Costs of On-Condition Costs Action Labor cost Parts cost Cost per product Replacement, repair, modification, or preventative modification Up to 908 work-hours × $85 per hour = Up to $77,180 Up to $99,950 Up to $177,130. Authority for This Rulemaking

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, Section 106, describes the authority of the FAA Administrator. Subtitle VII, Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701, General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

The FAA has determined that this AD will not have federalism implications under Executive Order 13132. This AD will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify that this AD:

(1) Is not a “significant regulatory action” under Executive Order 12866,

(2) Will not affect intrastate aviation in Alaska, and

(3) Will not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA amends 14 CFR part 39 as follows:

The FAA issued a notice of proposed rulemaking (NPRM) to amend 14 CFR part 39 by adding an AD that would apply to all Airbus Helicopters Model EC225LP helicopters. The NPRM published in the Federal Register on April 8, 2020 (85 FR 19707). The NPRM was prompted by a mechanical deformation found on the protective cover of the “SHEAR” control pushbutton installed on a copilot collective stick. The NPRM proposed to require modification of the helicopter by replacing the protective cover and re-identifying the part number of the pilot and copilot collective sticks. The FAA is issuing this AD to address mechanical deformation on the protective cover of the “SHEAR” control pushbutton installed on a copilot collective stick, which could lead to unintended shearing of the hoist cable, possibly resulting in loss of a hoisted load or person(s).

The European Aviation Safety Agency (now European Union Aviation Safety Agency) (EASA), which is the Technical Agent for the Member States of the European Union, has issued EASA AD 2018-0106, dated May 10, 2018 (referred to after this as the Mandatory Continuing Airworthiness Information, or “the MCAI”), to correct an unsafe condition for all Airbus Helicopters Model EC225LP helicopters. You may examine the MCAI in the AD docket on the internet at https://www.regulations.gov by searching for and locating Docket No. FAA-2020-0214.

The FAA gave the public the opportunity to participate in developing this final rule. The FAA has considered the comment received. Artem Svetlovsky agreed with the NPRM.

The FAA reviewed the relevant data and determined that air safety and the public interest require adopting this final rule as proposed, except for minor editorial changes. The FAA has determined that these minor changes:

• Are consistent with the intent that was proposed in the NPRM for addressing the unsafe condition; and

• Do not add any additional burden upon the public than was already proposed in the NPRM.

Airbus Helicopters has issued Alert Service Bulletin EC225-67A017, Revision 0, dated March 26, 2018. This service information describes procedures for modification of the helicopter by replacing the protective cover of the “SHEAR” control pushbutton and re-identifying the part number of the pilot and copilot collective sticks. This service information is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

The FAA estimates that this AD affects 12 helicopters of U.S. registry. The FAA estimates the following costs to comply with this AD:

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. Subtitle VII: Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

This AD will not have federalism implications under Executive Order 13132. This AD will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify that this AD:

(1) Is not a “significant regulatory action” under Executive Order 12866,

(2) Will not affect intrastate aviation in Alaska, and

(3) Will not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA amends 14 CFR part 39 as follows:

The EASA, which is the Technical Agent for the Member States of the European Union, has issued EASA AD 2020-0054, dated March 11, 2020 (“EASA AD 2020-0054”) (also referred to as the Mandatory Continuing Airworthiness Information, or “the MCAI”), to correct an unsafe condition for all Airbus SAS Model A330-941 airplanes.

The FAA issued a notice of proposed rulemaking (NPRM) to amend 14 CFR part 39 by adding an AD that would apply to all Airbus SAS Model A330-941 airplanes. The NPRM published in the Federal Register on April 27, 2020 (85 FR 23255). The NPRM was prompted by a report that seven SSCs lost hydraulic locking function due to a sheared seal on the blocking valve. The NPRM proposed to require repetitive operational tests of the hydraulic locking function on each SSC and replacement if necessary, as specified in a EASA AD.

The FAA is issuing this AD to address loss of hydraulic locking function on the SSCs, which in combination with one engine inoperative at takeoff, could result in reduced controllability of the airplane. See the MCAI for additional background information.

The FAA gave the public the opportunity to participate in developing this final rule. The FAA has considered the comments received. The Air Line Pilots Association, International (ALPA) indicated its support for NPRM.

The FAA reviewed the relevant data, considered the comment received, and determined that air safety and the public interest require adopting this final rule as proposed, except for minor editorial changes. The FAA has determined that these minor changes:

• Are consistent with the intent that was proposed in the NPRM for addressing the unsafe condition; and

• Do not add any additional burden upon the public than was already proposed in the NPRM.

EASA AD 2020-0054 describes procedures for repetitive operational tests of the hydraulic locking function on each SSC (any type), when fitted on the blue or yellow hydraulic circuits, and replacing any affected SSC with a serviceable part. This material is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

The FAA estimates that this AD affects 5 airplanes of U.S. registry. The FAA estimates the following costs to comply with this AD:

The FAA estimates the following costs to do any necessary on-condition action that would be required based on the results of any required actions. The FAA has no way of determining the number of aircraft that might need this on-condition action:

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. Subtitle VII: Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

This AD will not have federalism implications under Executive Order 13132. This AD will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify that this AD:

(1) Is not a “significant regulatory action” under Executive Order 12866,

(2) Will not affect intrastate aviation in Alaska, and

(3) Will not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA amends 14 CFR part 39 as follows:

The FAA learned of an uncommanded IFSD of a RRC AE 3007A1 model turbofan engine installed on an Embraer S.A. ERJ-145 airplane conducting a revenue flight. The manufacturer's investigation of this incident revealed that the IFSD resulted from a low-cycle fatigue crack in the dovetail slot for the blade attachment in the 3rd-stage compressor wheel, causing one 3rd-stage compressor blade to release. The crack initiated in the dovetail slot due to a sharp corner in the wheel slot geometry. The broaching process was identified as the cause and parts from this manufacturing lot require removal from service. This condition, if not addressed, could result in uncontained release of the 3rd-stage compressor wheel, damage to the engine, and damage to the airplane. The FAA is issuing this AD to address the unsafe condition on these products.

The FAA is issuing this AD because the agency evaluated all the relevant information and determined the unsafe condition described previously is likely to exist or develop in other products of the same type design.

The FAA reviewed Rolls-Royce Alert Service Bulletin (ASB) AE 3007A-A-72-446, Revision 2, dated July 28, 2020. The ASB describes procedures for replacing certain 3rd-stage compressor wheels.

This AD requires replacement of certain 3rd-stage compressor wheels before they accumulate a specified number of cycles.

Section 553(b)(3)(B) of the Administrative Procedure Act (APA) (5 U.S.C.) authorizes agencies to dispense with notice and comment procedures for rules when the agency, for “good cause,” finds that those procedures are “impracticable, unnecessary, or contrary to the public interest.” Under this section, an agency, upon finding good cause, may issue a final rule without providing notice and seeking comment prior to issuance. Further, section 553(d) of the APA authorizes agencies to make rules effective in less than 30 days, upon a finding of good cause.

An unsafe condition exists that requires the immediate adoption of this AD without providing an opportunity for public comments prior to adoption. The FAA has found that the risk to the flying public justifies waiving notice and comment prior to adoption of this rule. RRC inspected a RRC AE3007A1 model turbofan engine after it experiences an uncommanded IFSD during a revenue flight on an Embraer ERJ-145 airplane.

The manufacturer's inspection discovered a low-cycle fatigue crack in a 3rd-stage compressor wheel that allowed a 3rd-stage compressor blade to release during the flight. The manufacturer traced the cause of the cracked 3rd-stage compressor wheel to a specific machining process that occurred during manufacture of the 3rd-stage compressor wheels. The manufacturer's subsequent investigation discovered multiple 3rd-stage compressor wheels in the affected serial numbered population with similar low-cycle fatigue cracks. The 3rd-stage compressor wheels identified in this AD are unable to remain in service beyond the cycles since new limits listed in paragragh (g) of this AD. As a result of the shortened compliance times established based on the FAA's risk assessment, the FAA has determined that there is insufficient time available to allow for notice and opportunity for prior public comment.

The FAA considers the removal of these 3rd-stage compressor wheels from service to be an urgent safety issue. Exceeding the reduced cycle limits on the 3rd-stage compressor wheels required by this AD could lead to failure of the 3rd-stage compressor wheel and high-energy release of the 3rd-stage compressor wheel, resulting in damage to the engine and damage to the airplane. Accordingly, notice and opportunity for prior public comment are impracticable and contrary to public interest pursuant to 5 U.S.C. 553(b)(3)(B).

In addition, the FAA finds that good cause exists pursuant to 5 U.S.C. 553(d) for making this amendment effective in less than 30 days, for the same reasons the FAA found good cause to forgo notice and comment.

The FAA issued a notice of proposed rulemaking (NPRM) to amend 14 CFR part 39 by adding an AD that would apply to certain Leonardo Model AB139, AW139, AW169, and AW189 helicopters. The NPRM published in the Federal Register on April 14, 2020 (85 FR 20618). The NPRM was prompted by reports of uncommanded deployment of the EFS due to improper accomplishment of the reset procedure of the SMA inflation system actuation device. The NPRM proposed to require removal of affected SMA inflation systems and installation of serviceable SMA inflation systems. The FAA is issuing this AD to address uncommanded EFS deployment, which could result in reduced control of the helicopter.

The European Aviation Safety Agency (now European Union Aviation Safety Agency) (EASA), which is the Technical Agent for the Member States of the European Union, has issued EASA AD 2018-0208, dated September 20, 2018 (referred to after this as the Mandatory Continuing Airworthiness Information, or “the MCAI”), to correct an unsafe condition for certain Leonardo Model AB139, AW139, AW169, and AW189 helicopters. You may examine the MCAI in the AD docket on the internet at https://www.regulations.gov by searching for and locating Docket No. FAA-2020-0215.

The FAA gave the public the opportunity to participate in developing this final rule. After the NPRM was published, the FAA received a comment from one commenter. However, the comment addressed neither the proposed actions nor the determination of the cost to the public. Therefore, the FAA has made no changes based on this comment.

The FAA reviewed the relevant data and determined that air safety and the public interest require adopting this final rule as proposed, except for minor editorial changes. The FAA has determined that these minor changes:

• Are consistent with the intent that was proposed in the NPRM for addressing the unsafe condition; and

• Do not add any additional burden upon the public than was already proposed in the NPRM.

Leonardo Helicopters has issued Alert Service Bulletin (ASB) No. 139-533, dated August 30, 2018; ASB No. 169-099, dated August 30, 2018; and ASB No. 189-195, dated August 30, 2018. This service information describes procedures for removal of affected SMA inflation systems and installation of serviceable SMA inflation systems (including correcting the SMA inflation system by performing a reset procedure). These documents are distinct since they apply to different helicopter models.

This service information is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

The FAA estimates that this AD affects 138 helicopters of U.S. registry. The FAA estimates the following costs to comply with this AD:

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. Subtitle VII: Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

This AD will not have federalism implications under Executive Order 13132. This AD will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify that this AD:

(1) Is not a “significant regulatory action” under Executive Order 12866,

(2) Will not affect intrastate aviation in Alaska, and

(3) Will not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA amends 14 CFR part 39 as follows:

The EASA, which is the Technical Agent for the Member States of the European Union, has issued EASA AD 2020-0071, dated March 25, 2020 (“EASA AD 2020-0071”) (also referred to as the Mandatory Continuing Airworthiness Information, or “the MCAI”), to correct an unsafe condition for certain Airbus SAS Model A350-941 airplanes.

This AD was prompted by reports of improperly locked diagonal struts located in a certain section of the fuselage; the teeth of the lock washers were incorrectly engaged, which could lead to a loss of tightening torque of an affected strut. The FAA is issuing this AD to address this condition, which could affect the structural integrity of the surrounding parts, possibly resulting in failure of the horizontal tail plane attachments or rear cone joints, and consequent reduction or loss of control of the airplane. See the MCAI for additional background information.

EASA AD 2020-0071 describes procedures for inspecting the diagonal strut for correct installation and for correct locking of the lock washers, and corrective actions if necessary. The corrective actions include a general visual inspection of the affected strut for damage, repair of damaged struts, and re-installation of affected struts with no damage.

This material is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

This product has been approved by the aviation authority of another country, and is approved for operation in the United States. Pursuant to our bilateral agreement with the State of Design Authority, the FAA has been notified of the unsafe condition described in the MCAI referenced above. The FAA is issuing this AD because the FAA evaluated all pertinent information and determined the unsafe condition exists and is likely to exist or develop on other products of the same type design.

This AD requires accomplishing the actions specified in EASA AD 2020-0071 described previously, as incorporated by reference, except for any differences identified as exceptions in the regulatory text of this AD.

In the FAA's ongoing efforts to improve the efficiency of the AD process, the FAA initially worked with Airbus and EASA to develop a process to use certain EASA ADs as the primary source of information for compliance with requirements for corresponding FAA ADs. The FAA has since coordinated with other manufacturers and civil aviation authorities (CAAs) to use this process. As a result, EASA AD 2020-0071 is incorporated by reference in this final rule. This AD, therefore, requires compliance with EASA AD 2020-0071 in its entirety, through that incorporation, except for any differences identified as exceptions in the regulatory text of this AD. Using common terms that are the same as the heading of a particular section in the EASA AD does not mean that operators need comply only with that section. For example, where the AD requirement refers to “all required actions and compliance times,” compliance with this AD requirement is not limited to the section titled “Required Action(s) and Compliance Time(s)” in the EASA AD. Service information specified in EASA AD 2020-0071 that is required for compliance with EASA AD 2020-0071 is available on the internet at https://www.regulations.gov by searching for and locating Docket No. FAA-2020-0588.

Since there are currently no domestic operators of these products, notice and opportunity for public comment before issuing this AD are unnecessary. In addition, for the reasons stated above, the FAA finds that good cause exists for making this amendment effective in less than 30 days.

This AD is a final rule that involves requirements affecting flight safety, and the FAA did not precede it by notice and opportunity for public comment. The FAA invites you to send any written relevant data, views, or arguments about this AD. Send your comments to an address listed under the ADDRESSES section. Include “Docket No. FAA-2020-0588; Product Identifier 2020-NM-048-AD” at the beginning of your comments. The most helpful comments reference a specific portion of the proposal, explain the reason for any recommended change, and include supporting data. The FAA will consider all comments received by the closing date and may amend this AD based on those comments.

Except for Confidential Business Information (CBI) as described in the following paragraph, and other information as described in 14 CFR 11.35, the FAA will post all comments the FAA receives, without change, to https://www.regulations.gov, including any personal information you provide. The FAA will also post a report summarizing each substantive verbal contact the FAA receives about this AD.

CBI is commercial or financial information that is both customarily and actually treated as private by its owner. Under the Freedom of Information Act (FOIA) (5 U.S.C. 552), CBI is exempt from public disclosure. If your comments responsive to this final rule, request for comments, contain commercial or financial information that is customarily treated as private, that you actually treat as private, and that is relevant or responsive to this final rule, request for comments, it is important that you clearly designate the submitted comments as CBI. Please mark each page of your submission containing CBI as “PROPIN.” The FAA will treat such marked submissions as confidential under the FOIA, and they will not be placed in the public docket of this final rule, request for comments. Submissions containing CBI should be sent to the person identified in the FOR FURTHER INFORMATION CONTACT section. Any commentary that the FAA receives which is not specifically designated as CBI will be placed in the public docket for this rulemaking.

The requirements of the RFA do not apply when an agency finds good cause pursuant to 5 U.S.C. 553 to adopt a rule without prior notice and comment. Because the FAA has determined that it has good cause to adopt this rule without notice and comment, RFA analysis is not required.

Currently, there are no affected U.S.-registered airplanes. If an affected airplane is imported and placed on the U.S. Register in the future, the FAA provides the following cost estimates to comply with this AD:

The FAA estimates that it would take about 1 work-hour per product to comply with the reporting requirement in this AD. The average labor rate is $85 per hour. Based on these figures, the FAA estimates the cost of reporting the inspection results on U.S. operators to be $85 per product.

A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a current valid OMB control number. The control number for the collection of information required by this AD is 2120-0056. The paperwork cost associated with this AD has been detailed in the Costs of Compliance section of this document and includes time for reviewing instructions, as well as completing and reviewing the collection of information. Therefore, all reporting associated with this AD is mandatory. Comments concerning the accuracy of this burden and suggestions for reducing the burden should be directed to Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524.

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. Subtitle VII: Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

The FAA determined that this AD will not have federalism implications under Executive Order 13132. This AD will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify that this AD:

(1) Is not a “significant regulatory action” under Executive Order 12866, and

(2) Will not affect intrastate aviation in Alaska.

Accordingly, under the authority delegated to me by the Administrator, the FAA amends 14 CFR part 39 as follows:

The FAA issued a notice of proposed rulemaking (NPRM) to amend 14 CFR part 39 by adding an AD that would apply to Bell Model 204B, 205A, 205A-1, 205B, 212, 214B, 214B-1, 412, 412CF, and 412EP helicopters with a comfort clip part number (P/N) D7LZ-6560286-A, D7LZ-6560286-B, or 504636-401 installed. The NPRM published in the Federal Register on April 6, 2020 (85 FR, 19113). The NPRM was prompted by a series of service bulletins issued by Bell reporting an issue with comfort clip P/Ns D7LZ-6560286-A, D7LZ-6560286-B, and 504636-401, which are installed on seat belt assemblies. A design review by Leonardo S.p.A. Helicopter (formerly Agusta S.p.A., Finmeccanica S.p.A.) indicates the use of the affected comfort clips could jeopardize, in cases of impact or deceleration, the correct functionality of the seat belt or the seat belt inertia reel. The NPRM proposed to require removing comfort clips P/Ns D7LZ-6560286-A, D7LZ-6560286-B, and 504636-401from service and inspecting each harness for a rip or an abrasion. The FAA is issuing this AD to address the unsafe condition on these products.

The FAA gave the public the opportunity to participate in developing this AD, but the FAA did not receive any comments on the NPRM.

The FAA has reviewed the relevant information and determined that an unsafe condition exists and is likely to exist or develop on other helicopters of these same type designs and that air safety and the public interest require adopting the AD requirements as proposed.

The FAA reviewed Bell Alert Service Bulletin (ASB) 204B-15-70 for Model 204B helicopters, Bell ASB 205-15-113 for Model 205A and 205A-1 helicopters, Bell ASB 205B-15-66 for Model 205B helicopters, Bell ASB 212-15-156 for Model 212 helicopters, Bell ASB 412-15-170 for Model 412 and 412EP helicopters, and Bell ASB 412CF-15-60 for Model 412CF helicopters, all dated January 20, 2016. The FAA also reviewed Bell ASB 214-15-76, dated January 11, 2016, for Model 214B and 214B-1 helicopters. This service information specifies removing the comfort clips from all crew and passenger seat belt assemblies.

The service information specifies a compliance time of within 100 flight hours or no later than February 21, 2016, and does not specify inspecting each harness for a rip and an abrasion. This AD requires a compliance time of within 50 hours TIS and requires inspecting each harness for a rip and an abrasion. The FAA determined that including an inspection for harness damage is necessary to correct the unsafe condition.

The FAA estimates that this AD affects 210 helicopters of U.S. registry. The FAA estimates that operators may incur the following costs in order to comply with this AD. Labor costs are estimated at $85 per work-hour.

Removing a comfort clip takes about 0.5 work-hour, for an estimated cost of $43 per comfort clip.

Inspecting a harness takes about 0.25 work-hour, for an estimated cost of $21 per harness.

If required, replacing a harness takes about 1 work-hour and parts cost about $1,050 for an estimated replacement cost of $1,135 per harness.

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. Subtitle VII: Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on helicopters identified in this rulemaking action.

This AD will not have federalism implications under Executive Order 13132. This AD will not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify that this AD:

1. Is not a “significant regulatory action” under Executive Order 12866,

2. Will not affect intrastate aviation in Alaska, and

3. Will not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA amends 14 CFR part 39 as follows:

The final rule also amends § 1913.10 to clarify that a written MAO does not constitute an administrative subpoena, eliminates outdated requirements for the removal of direct personal identifiers when OSHA personnel review medical information away from a worksite, and establishes new procedures for the access and safeguarding of personally identifiable employee medical information in electronic form. The revisions to § 1913.10 in the final rule will increase employee privacy and enhance OSHA's ability to safeguard personally identifiable medical information.

In order to carry out its statutory obligations, OSHA often reviews employee medical records. For example, OSHA may need to review employee medical records during a compliance inspection to determine whether an employer is in compliance with OSHA standards and regulations, or to verify that an employer has taken steps to correct existing violations. Access to employee medical records may also be necessary during inspections to determine the effectiveness of voluntary employer safety and health programs. OSHA also reviews medical records when gathering information during agency rulemaking to develop or revise occupational safety and health standards.

Several OSHA standards and regulations mandate medical records access, including 29 CFR 1910.1020, Access to Employee Exposure and Medical Records, which sets forth procedures by which exposure and medical records can be accessed by employees, their designated representatives, and OSHA. This regulation, which applies to employers with employees exposed to toxic substances and harmful physical agents, provides OSHA representatives with prompt access to employee exposure and medical records and to analysis thereof using exposure or medical records. See 29 CFR 1910.1020(e)(3). In addition, several of OSHA's substance-specific standards include provisions for OSHA access to employee medical records. ( e.g., 29 CFR 1910.25(n)(4) (Lead), and 29 CFR 1910.1028(k) (Benzene)).

In many instances, OSHA must examine and copy employee medical information in personally identifiable form. Personally identifiable employee medical information as defined by 29 CFR 1913.10(b)(2) means employee medical information accompanied by either direct identifiers (name, address, social security number, payroll number) or by information which could reasonably be used in particular circumstances indirectly to identify specific employees ( e.g., date of birth, race, sex, date of initial employment, job title). An employee medical record may include individual health histories as well as medical opinions and evaluations generated during diagnosis, physical examinations, or medical treatment by a health care professional.

Because of the substantial personal privacy interests involved, OSHA authority to access personally identifiable employee medical information is exercised only after the agency has made a careful determination of the need for the information, and only when appropriate safeguards are in place to prevent unauthorized access. Once this information is accessed, OSHA examination and use is limited to only that information needed to accomplish a relevant statutory purpose. Also, personally identifiable employee medical information is retained by OSHA only for so long as needed to accomplish the purpose for access, is kept secured while being used, and is not disclosed to other agencies or members of the public except in narrowly defined circumstances. In addition, the examination and use of personally identifiable employee medical information is limited to only OSHA personnel with a need to review such information.

This rule is not an Executive Order (E.O.) 13771 regulatory action because this rule is not significant under E.O. 12866. Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq. ), the Office of Information and Regulatory Affairs designated this rule not a ‘major rule’, as defined by 5 U.S.C. 804(2).

On May 25, 1980, OSHA issued a final rule entitled Rules of Agency Practice and Procedure Concerning OSHA Access to Employee Medical Records (45 FR 35284). The final rule was developed and published in concert with the promulgation of 29 CFR 1910.1020, Access to Employee Exposure and Medical Records (45 FR 35212). During the rulemaking, there was universal agreement that if OSHA obtained access to employee medical records, the access should be accompanied by stringent internal agency procedures to preclude abuse of personally identifiable medical information. Provided these procedures were established, many participants in the rulemaking endorsed OSHA access to employee medical records without the consent of the employee for occupational safety and health purposes (see 45 FR 35218).

Except as provided in 29 CFR 1913.10(b)(3) through (6), the rules of agency practice and procedure apply to all requests by OSHA personnel to obtain access to records to examine and copy personally identifiable employee medical information, whether or not access is mandated by 29 CFR 1910.1020. Among other things, the regulation at 29 CFR 1913.10 establishes certain responsibilities for specific OSHA officials when the agency accesses personally identifiable employee medical information. The regulation also includes provisions addressing the internal use of employee medical records by agency personnel, as well as requirements for inter-agency transfer and public disclosure of such records. The regulation includes security procedures for the use and storage of employee medical records while in the agency's possession. Finally, the regulation sets forth internal agency requirements for the retention and destruction of records.

A key provision set forth in § 1913.10 is that, with few exceptions, each request by an OSHA representative to examine or copy personally identifiable employee medical information must be made pursuant to a written access order. The written access order is an authorization for specific OSHA personnel to examine or copy personally identifiable employee medical information contained in records held by an employer or other record holder. The rules of agency practice and procedure in § 1913.10 make clear that each written access order must state the statutory purpose for which access is sought, a general description of the type of employee medical information that will be examined and why there is a need to examine personally identifiable information, whether the medical information will be examined on-site, what type of information will be copied and removed off-site, and the anticipated time during which OSHA expects to retain the employee medical information in personally identifiable form.

In order to enhance employee privacy, and clarify certain provisions, OSHA has determined that it is necessary to revise its regulation at § 1913.10. For example, OSHA's previous regulation at § 1913.10 used the term “written access order.” However, this final rule revises the regulatory text to include the more commonly used term “medical access order” or “MAO.”

The final rule also amends the regulation at 29 CFR 1913.10 to transfer certain responsibilities from the Assistant Secretary to the OSHA Medical Records Officer (MRO). Specifically, the MRO will now be responsible for the overall administration and implementation of the procedures contained in § 1913.10. These new responsibilities include making determinations regarding (1) OSHA access to personally identifiable employee medical information pursuant to a MAO, and (2) inter-agency transfer and public disclosure of personally identifiable employee medical information. The final rule also transfers responsibility from the Assistant Secretary to the MRO for issuing written directives that authorize OSHA compliance personnel to review certain information without obtaining a MAO.

The final rule clarifies that a MAO does not constitute an administrative subpoena, and eliminates requirements for the removal of direct personal identifiers when OSHA personnel review medical information away from a workplace. The deletion of requirements for the removal of direct personal identifiers will be offset by new provisions designed to strengthen employee privacy. Finally, the final rule establishes new internal OSHA requirements, based on existing agency policy, for the access and safeguarding of personally identifiable employee medical information maintained in electronic form.

The procedures set forth in § 1913.10 are internal agency procedures and do not affect employer compliance with OSHA requirements. Employers and employees will benefit from the revisions to § 1913.10 in several ways. First, since the process for determining whether there is a need for OSHA to review employee medical information will be more efficient, employers will know sooner if such a review is authorized at their worksite. Second, the elimination of the outdated requirement to remove direct personal identifiers before taking medical information off-site for review will reduce the amount of an employer's time and physical space needed by OSHA personnel when they visit a specific workplace. Third, the revisions will benefit employees because the procedures in § 1913.10 to protect the security and privacy of employee medical records will be strengthened, especially with regard to medical information in electronic form. Fourth, the elimination of the requirement to remove direct personal identifiers before taking medical information off-site will enhance employee privacy because the removal process always carries with it the possibility that medical information will be misidentified or mislabeled, which could result in unauthorized staff mistakenly reviewing that information. Finally, deletion of the time-consuming de-identification procedures will mean that authorized OSHA personnel can conduct follow-up consultations with employees about their health more quickly.

The notice and comment rulemaking procedures of 5 U.S.C. 553 of the Administrative Procedure Act (APA) do not apply to “interpretive rules, general statements of policy, or rules of agency organization, procedure, or practice.” 5 U.S.C. 553(b)(A). The provisions in 29 CFR 1913.10 are rules of agency procedure and practice within the meaning of section 553(b)(A) of the APA. Therefore, publication in the Federal Register of a notice of proposed rulemaking and request for comments is not required. Furthermore, because this rule is procedural rather than substantive, the normal requirement of 5 U.S.C. 553(d) that a rule not be effective until at least 30 days after publication in the Federal Register is inapplicable. OSHA also finds good cause to provide an immediate effective date for this rule, because it imposes no obligations on parties outside the federal government and therefore no advance notice is required to enable employers or other private parties to come into compliance.

The Occupational Safety and Health Act of 1970, 29 U.S.C. 651 et seq. (OSH Act) authorizes the Secretary to issue two types of occupational safety and health rules: Standards and regulations. Standards, which are authorized by section 6 of the Act, specify remedial measures to be taken to prevent and control employee exposure to identified occupational safety and health hazards, while regulations are the means to effectuate other statutory purposes, including the maintaining of records. For example, the OSHA requirements at 29 CFR 1910.95 are a “standard” because they include remedial measures to address the specific and already identified hazard of employee exposure to occupational noise. In contrast, a “regulation” is a purely administrative effort designed to uncover violations of the Act and discover unknown dangers. The procedural regulations in 29 CFR 1913.10 are necessary to enable the use of employee medical records by OSHA consistent with the employee's right of privacy.

In section 2(b) of the OSH Act, Congress declared the overriding purpose of the Act is “to assure so far as possible every working man and woman in the Nation safe and healthful working conditions.” (29 U.S.C. 651.) Congress also explicitly declared that this must be accomplished, among other ways, “by providing an effective enforcement program . . .” (29 U.S.C. 651(b)(10)). For the Secretary of Labor to conduct an effective enforcement program, he or she must determine whether occupational safety and health hazards exist in the workplace. To that end, the OSH Act authorizes the Secretary to enter and inspect workplaces and to conduct reasonable investigations into working conditions.

Section 8(a) of the OSH Act authorizes OSHA to enter, inspect, and investigate places of employment, and section 8(b) permits OSHA to subpoena both witnesses and evidence when conducting inspections and investigations. (29 U.S.C. 657(a) and (b)). As noted above, in some instances, it may be necessary for OSHA to examine personally identifiable employee medical information. Section 8 of the OSH Act recognizes OSHA's right of access to medical records, and records access is mandated by OSHA standards and regulations, including 29 CFR 1910.1020(e)(3) (access to employee exposure and medical records). OSHA relies on administrative subpoenas to compel production of medical records by employers and other record holders.

OSHA is issuing the final rule pursuant to authority expressly granted in section 8 of the OSH Act. Section 8(c)(1) requires each employer to “make, keep, preserve, and make available to the Secretary [of Labor] or the Secretary of Health and Human Services, such records regarding his activities relating to this Act as the Secretary, in cooperation with the Secretary of Health and Human Services, may prescribe by regulation as necessary or appropriate for the enforcement of this Act or for developing information regarding the causes and prevention of occupational accidents and illnesses” (29 U.S.C. 657(c)(1)). Employee medical records are included within the type of records addressed by this provision.

Section 8(g)(1) of the OSH Act provides that the Secretary and Secretary of Health and Human Services are authorized to compile, analyze, and publish, either in summary or detailed from, all records or information obtained under this section (29 U.S.C. 657(g)(1)). Section 8(g)(2) is the general rulemaking authority of the OSH Act and provides that the Secretary and the Secretary of Health and Human Services shall prescribe such rules and regulations as he may deem necessary to carry out their responsibilities under this Act, including rules and regulations dealing with the inspection of an employer's establishment.

OSHA's regulation at 29 CFR 1913.10(b), Scope and application, defines the circumstances under which the procedural regulations in § 1913.10 will apply. Except as provided in paragraphs (b)(3) through (6), the policies and procedures in § 1913.10 apply to all requests by OSHA personnel to access personally identifiable employee medical information.

In general, 29 CFR 1913.10 requires OSHA personnel to obtain a MAO (previously “written access order,” but referred to in this section as “MAO” as it is in the final rule) when accessing personally identifiable employee medical information. However, under certain circumstances, the regulation states that OSHA access may be accomplished without obtaining a MAO. For example, § 1913.10(d)(4)(i) provides that a MAO is not needed when an employee gives specific written consent for OSHA to access their medical records. Also, § 1913.10(b)(3) through (5) include several categories of records that are not subject to § 1913.10 and therefore may be accessed without obtaining a MAO. These categories of records include medical information that is not in personally identifiable form, injury and illness records required by 29 CFR part 1904, death certificates, employee exposure records, and medical information obtained in the course of litigation. In addition, previous § 1913.10(b)(6) provided that the policies and procedures in § 1913.10 do not apply when a written directive by the Assistant Secretary authorizes appropriately qualified personnel to conduct limited review of specific medical information mandated by an OSHA standard or of specific biological monitoring test results. This final rule amends § 1913.10(b)(6) to state that the MRO is now responsible for issuing these written authorization directives.

OSHA Directive CPL 02-02-072, Rules of agency practice and procedure concerning OSHA access to employee medical records, August 22, 2007, includes authorization for review of three categories of information based on the provisions in § 1913.10(b)(6). The directive authorizes OSHA compliance personnel to review (1) medical opinions mandated by OSHA standards, (2) information required by a medical surveillance program, and (3) certain information used to verify compliance with the injury and illness recordkeeping requirements in 29 CFR part 1904. OSHA personnel do not need a MAO when they access the information at a workplace pursuant to a written directive under § 1913.10(b)(6). Instead, OSHA personnel follow the procedures set forth in the written directive. The 2007 directive includes provisions on how OSHA personnel may access the specific types of information and how the information should be protected once in the agency's possession.

OSHA believes the MRO is in the best position to make determinations regarding written authorization under § 1913.10(b)(6). Section 1913.10(c)(2) already provides that the MRO must have experience or training in the evaluation, use, and privacy protection of medical records, and, as discussed below in this preamble, paragraph (c) of § 1913.10 has been amended to provide that the MRO is now responsible for the overall administration of the policies and procedures in § 1913.10. Also, as part of the final rule, paragraph (c) now states that the MRO is specifically responsible for making determinations regarding the approval of MAOs, inter-agency transfer, and public disclosure of identifiable employee medical records. Given all the new MRO responsibilities set forth in paragraph (c), as well as the existing duties in the other paragraphs of the regulation, it is appropriate to also make the MRO responsible for written authorization under paragraph (b)(6). Accordingly, final § 1913.10(b)(6) states that the provisions of 29 CFR 1913.10 do not apply where a written directive by the MRO authorizes appropriately qualified personnel to conduct limited review of specific medical information mandated by an occupational safety and health standard or of specific biological monitoring test results. OSHA will also amend Directive CPL 02-02-072 to reflect the new regulatory text in paragraph (b)(6).

OSHA's regulation at 29 CFR 1913.10(c) establishes certain responsibilities for OSHA personnel when the agency accesses personally identifiable employee medical information. Paragraph (c) is largely a summary of duties established by other paragraphs in § 1913.10 and sets forth specific responsibilities for the Assistant Secretary, MRO, and Principal OSHA Investigator. The final rule amends several provisions in paragraph (c) to emphasize the responsibilities of the MRO.

Under the previous regulation, paragraph (c)(1) provided that the OSHA Assistant Secretary was responsible for the overall administration and implementation of the policies and procedures in § 1913.10. This responsibility included making determinations regarding (1) OSHA access to personally identifiable employee medical information and (2) interagency transfer or public disclosure of personally identifiable employee medical information. Also under the previous regulation, § 1913.10(d)(1) provided that each request by an OSHA representative to access information through a written access order must be approved by the Assistant Secretary upon the recommendation of the MRO.

Section 1913.10(c)(2) of the previous regulation provided that the Assistant Secretary was responsible for designating an OSHA official with experience or training in the evaluation, use, and privacy protection of medical records to be the MRO. The MRO, who reported directly to the Assistant Secretary on matters related to § 1913.10, was responsible for making recommendations to the Assistant Secretary on whether to approve or deny written access orders, and served as the central reviewer of the sufficiency and justification of these documents. The MRO was also responsible for responding to employee, collective bargaining agent, and employer objections to written access orders. In addition, § 1913.10(c)(2) of the previous regulation stated that the MRO was responsible for controlling the use of direct personal identifiers; controlling internal agency use and security of personally identifiable employee medical information; assuring that the results of agency analysis of personally identifiable employee medical information are, where appropriate, communicated to employees; preparing an annual report for the Assistant Secretary on OSHA's experience with respect to § 1913.10; and assuring that adequate notice is given of intended inter-agency transfers or public disclosures of personally identifiable employee medical information.

The other OSHA official with important responsibilities when the agency accesses employee medical information is the Principal OSHA Investigator. Section 1913.10(c)(3) provides that the Principal OSHA Investigator is the OSHA employee designated on the MAO who is primarily responsible for ensuring that OSHA examination and use of employee medical information is in accordance with the provisions of the MAO and § 1913.10. In most instances, the Principal OSHA Investigator named on a MAO is an employee from an OSHA Regional or Area Office and determines how and when employee medical information will be accessed during an OSHA inspection or investigation. In practice, the Principal OSHA Investigator is responsible for ensuring that the provisions of the MAO and § 1913.10 are followed by OSHA personnel when medical information is accessed at a specific workplace. As provided in § 1913.10(c)(3), the Principal OSHA Investigator must be professionally trained in medicine, public health, or similar fields (epidemiology, toxicology, industrial hygiene, biostatistics, environmental health) when access is made pursuant to a MAO. The provisions in § 1913.10(c)(3) concerning the Principal OSHA Investigator are unchanged by the final rule.

The final rule retains the Assistant Secretary's responsibility to designate an OSHA official as MRO. However, this responsibility is now set forth in § 1913.10(c)(1). Like the previous regulation, § 1913.10(c)(1) of the final rule states that the Assistant Secretary shall designate an OSHA official with experience or training in the evaluation, use, and privacy protection of medical records to be the OSHA Medical Records Officer. The final rule also states that the Assistant Secretary may change the designation of the MRO at will.

The final rule includes several changes to paragraph (c)(2), OSHA Medical Records Officer. Some of these changes transfer specific responsibilities from the Assistant Secretary to the MRO while other responsibilities assigned to the MRO in § 1913.10(c)(2) are carried over from the previous regulation.

The final rule amends paragraph (c)(2) to provide that the MRO is now responsible for the overall administration and implementation of the procedures contained in § 1913.10. OSHA believes there are two central principles that form the basis of the procedural requirements in § 1913.10: (1) There should be a thorough review of all efforts to examine or copy personally identifiable employee medical information before the information is obtained and (2) personally identifiable information must be carefully protected once obtained. OSHA also believes the MRO is in the best position to ensure that the central principles of § 1913.10 are carried out by the agency.

As already noted, paragraph (c)(1) of the final rule, like the previous regulation, provides that the MRO must have experience and training in the evaluation, use, and privacy protection of medical records. Historically, a physician from OSHA's Office of Occupational Medicine and Nursing (OOMN) has been designated as MRO, and, in most cases, the person designated has been the Director of OOMN. As a result, the MRO has had an extensive background in both medicine and administration.

Additionally, under the previous regulation, the MRO was already responsible for ensuring the sufficiency and justification of MAOs and making recommendations to the Assistant Secretary on whether to approve or deny such documents. The MRO also has several duties set forth throughout the other paragraphs in § 1913.10 and therefore has a good understanding of the day-to-day implementation of the regulation.

Under the final rule, the MRO will now be responsible for making determinations regarding whether to approve or deny MAOs, any inter-agency transfer, and public disclosures of personally identifiable employee medical information, as well as whether to issue written directives authorizing OSHA personnel to conduct limited review of certain medical information without an MAO. Accordingly, the extensive medical and administrative experience, the responsibilities under the previous regulation, and the new responsibilities assigned by this final rule make the MRO the logical OSHA official to have responsibility for the overall administration and implementation of the procedures in § 1913.10.

While the final rule limits the role of the Assistant Secretary in the day-to-day implementation of § 1913.10, the Assistant Secretary still maintains an important oversight responsibility. As in the previous regulation, the Assistant Secretary retains the responsibility for naming an OSHA official as MRO, with the ability to replace the MRO at will, and the MRO must still report to the Assistant Secretary on matters related to § 1913.10. In practice, the MRO will continue to consult with the Assistant Secretary on MAO approval, inter-agency transfers, and public disclosures of personally identifiable employee medical information. In addition, paragraph (l) requires the MRO to prepare an annual report for the Assistant Secretary on matters related to the approval and purpose of MAOs, objections to MAOs, and inter-agency transfers and public disclosures during the previous year. The responsibility to designate an OSHA official as MRO, continued consultation, and receiving reports from the MRO will keep the Assistant Secretary informed about OSHA's overall implementation of § 1913.10. Accordingly, like the previous regulation, the final rule at paragraph (c)(2) provides that the MRO is responsible for reporting directly to the Assistant Secretary on matters concerning § 1913.10.

Under the final rule, the MRO is also now responsible for making determinations concerning (1) access to personally identifiable employee medical information and (2) interagency transfer or public disclosure of personally identifiable employee medical information. These two responsibilities had been assigned to the Assistant Secretary in previous § 1913.10(c)(1).

Section 1913.10(c)(2)(i) of the final rule states that the MRO is responsible for making determinations concerning OSHA access to personally identifiable employee medical information under § 1913.10(d). Paragraph (d) addresses OSHA access to personally identifiable employee medical information by MAO.

With the exception of two circumstances described at the end of paragraph (d), each request by OSHA to examine or copy personally identifiable employee medical information is made pursuant to an MAO. Paragraph (d)(2) sets criteria the agency must follow when it seeks access to identifiable medical information, and paragraph (d)(3) sets forth the content to be included in the MAO. In order to be valid, an MAO must be approved by the MRO using the criteria in paragraph (d)(2). First, the MRO must consider whether the information to be examined or copied is relevant to a statutory purpose and whether there is a need to gain access to the information. The MRO has the responsibility, on a case-by-case basis, to ensure that access is sought only where there is a genuine need to do so. OSHA believes that a finding of relevance and need by the MRO is a significant safeguard against excessive use of the agency's authority to access personally identifiable employee medical information.

Paragraph (d)(2) next states that consideration must be given to whether the personally identifiable employee medical information subject to the MAO is limited to only that information needed to accomplish the purpose for access. This provision is aimed at preventing OSHA access to extraneous medical information unrelated to the purpose for access. Lastly, paragraph (d)(2) states that the MRO must determine that the personnel authorized to review the medical information are limited to those who have a need for access and have appropriate professional qualifications. The limiting of personnel that can review and analyze information to only those who have a need for access and who have appropriate professional qualifications is important for maintaining the confidentiality of employee medical records.

OSHA believes the MRO is in the best position to evaluate the criteria in paragraph (d) and make determinations on whether to approve or deny MAOs. Typically, the MRO has extensive subject-matter clinical experience and expertise in occupational medicine. This allows the MRO to evaluate whether, and to what extent, employee medical information needs to be accessed by OSHA. Accordingly, paragraph (d)(2) has been amended to state that, before approving an MAO, the MRO must determine that the documents meet the criteria in that paragraph.

For similar reasons, the MRO is also now responsible for making determinations concerning inter-agency transfer and public disclosure of personally identifiable employee medical information. Section 1913.10(m) describes the circumstances under which personally identifiable employee medical information can be transferred to another agency or disclosed to the public. The requirements in paragraph (m) remain unchanged from the previous regulation. However, the provisions in paragraph (m), as well as paragraph (c)(2), are amended by the final rule to provide that the MRO, not the Assistant Secretary, is now responsible for making determinations regarding inter-agency transfer and public disclosure of personally identifiable employee medical information. The individual provisions in paragraph (m) are amended to cross reference with the new MRO responsibility established in § 1913.10(c)(2)(vii).

The following discussion of the individual provisions in paragraph (m) clarifies the MRO's new responsibility for making determinations concerning inter-agency transfer and public disclosure set forth in § 1913.10(c)(2). The previous regulation at § 1913.10(m)(1) stated that personally identifiable employee medical information shall not be transferred to another agency or office outside of OSHA (other than the Office of the Solicitor of Labor) or disclosed to the public (other than to the affected employee or the original recordholder) except when required by law or when approved by the Assistant Secretary. The final rule amends paragraph (c)(2)(vii) to make clear that the MRO is now responsible for making these determinations. The final rule also amends paragraph (m) to provide that the MRO must follow specific criteria when making determinations concerning inter-agency transfer and public disclosure of personally identifiable employee medical information.

OSHA's longstanding position is that inter-agency transfer and public disclosure of personally identifiable employee medical information should be carefully considered, and paragraph (m) addresses these issues. Inter-agency transfer and public disclosure of personally identifiable employee medical information are not categorically prohibited by the regulation for two reasons. OSHA believes (1) it cannot legally make such a commitment and (2) situations arise where transfer or disclosure is appropriate. Under certain circumstances, as a matter of law, OSHA is compelled to transfer information to another agency or disclose it to a non-governmental individual. For example, OSHA might be required to provide the information in response to a lawful subpoena. In other circumstances, disclosure may also be appropriate. For example, in order to resolve a public health problem, OSHA may need to transfer employee medical information to another federal or state agency. In such situations, the transfer of employee medical information may be critical in identifying an emerging health issue, compiling data on worker fatalities from specific exposure, or evaluating the effectiveness of workplace controls designed to prevent occupational illness at manufacturing facilities.

OSHA notes that inter-agency transfer and public disclosure of personally identifiable employee medical information is not a common occurrence. In the last five years, the agency has made only three inter-agency transfers of personally identifiable employee medical information to another federal or state agency. OSHA also notes that inter-agency transfer and public disclosure of employee medical information not in personally identifiable form is not subject to provisions in § 1913.10.

Paragraph (m) of § 1913.10 includes strict limitations on inter-agency sharing and public disclosure of employee medical information. Except when required by law, all inter-agency transfer or public disclosure of personally identifiable employee medical information must be approved by the MRO in accordance with the criteria in paragraph (m).

Paragraph (m)(2) states that, except as provided for in paragraph (m)(3), the MRO shall not approve a request for an inter-agency transfer, which has not been consented to by the affected employee, unless the request is by a public health agency. Under this provision, transfer of medical information is permitted only to a public health agency for a substantial public health purpose. The regulation goes on to state that the MRO can approve the transfer only if the public health agency (1) needs the information for substantial public health purposes, (2) will not use the information to make individual determinations concerning affected employees which could be to their detriment, (3) has regulations or written established procedures providing protection for personally identifiable medical information substantially equivalent to § 1913.10, and (4) satisfies an exemption to the Privacy Act to the extent the Privacy Act applies to the requested information.

Because OSHA collects medical information only for a public health purpose, OSHA believes it is appropriate to restrict all subsequent discretionary transfers to those agencies with an equivalent public health purpose. The MRO must review each request for a transfer on a case-by-case basis by taking into account each of the listed criteria in paragraph (m)(2). Most importantly, in order to protect individual privacy, the MRO must be satisfied that the recipient agency's privacy protections are equivalent to OSHA's.

Paragraph (m)(3) contains two exceptions to the requirements of paragraph (m)(2). First, upon the approval of the MRO, personally identifiable employee medical information can be shared with the National Institute for Occupational Safety and Health (NIOSH). Like OSHA, NIOSH is a public health agency and its research activities complement OSHA's regulatory responsibilities. OSHA's ability to analyze employee medical records is often improved by gaining NIOSH assistance, and medical information collected by OSHA may have major research value for NIOSH. Also, because of its frequent use of medical information, and sensitivity to individual privacy, NIOSH has procedures in place that provide for the protection of personally identifiable medical information that are substantially equivalent to § 1913.10. As a result, employee medical information may be transferred to NIOSH if approved by the MRO without further inquiry into the sufficiency of its programs for protecting medical records.

Paragraph (m)(3) also permits, upon the approval of the MRO, the inter-agency transfer of personally identifiable employee medical information to the U.S. Department of Justice when necessary with respect to a specific action under the OSH Act. For example, the Justice Department prosecutes criminal violations under the OSH Act, as well as civil penalty collection actions. The Justice Department also represents OSHA in Freedom of Information Act (FOIA) lawsuits. Personally identifiable employee medical information may be relevant in these legal actions, and OSHA must be able to share information in these circumstances.

Paragraphs (m)(4) and (5) address public disclosure of personally identifiable employee medical information which has not been consented to by the affected employee. Paragraph (m)(4) provides that the MRO shall not approve a request for public disclosure of employee medical information containing personal identifiers unless there are compelling circumstances affecting the health or safety of an individual. Also, paragraph (m)(5) states that the MRO shall not approve a request for public disclosure of employee medical information which contains information which could reasonably be used indirectly to identify specific employees when the disclosure would constitute a clearly unwarranted invasion of personal privacy. Finally, paragraph (m)(6) retains the provision from the previous regulation that, except as to inter-agency transfer to NIOSH or the Department of Justice, the MRO shall ensure that advance notice is provided to any collective bargaining agent representing affected employees and to the employer on each occasion OSHA intends to transfer personally identifiable employee medical information to another agency or disclose it to a member of the public other than to an affected employee. When feasible, the MRO must take reasonable steps to assure that advance notice is provided to affected employees when the employees' medical information to be transferred or disclosed contains direct personal identifiers.

Finally, the final rule at § 1913.10(c)(2) retains several provisions from the previous regulation. Specifically, paragraph (c)(2)(iii) continues to provide that the MRO is responsible for responding to MAO objections, and paragraph (c)(2)(iv) continues to provide that the MRO is responsible for overseeing the internal use and security of personally identifiable employee medical information. Two other MRO responsibilities in paragraph (c)(2) have been retained from the previous regulation but have been renumbered under the final rule. Paragraph (c)(2)(v), formerly paragraph (c)(2)(vi), continues to provide that the MRO is responsible for assuring that the results of agency analyses of personally identifiable medical information are, where appropriate, communicated to employees. Paragraph (c)(2)(vi), formerly paragraph (c)(2)(vii), retains the provision that the MRO is responsible for preparing an annual report of OSHA's experience under § 1913.10.

OSHA's previous regulation at § 1913.10(d)(1) stated that, except as provided in paragraph (d)(4), each request by an OSHA representative to examine or copy personally identifiable employee medical information contained in a record held by an employer or other record holder shall be made pursuant to a written access order which has been approved by the Assistant Secretary upon the recommendation of the OSHA Medical Records Officer. Paragraph (d)(1) went on to state that, if deemed appropriate, a written access order may constitute, or be accompanied by, an administrative subpoena.

As explained above, the MRO is now responsible for the approval or denial of MAOs, and paragraph (d)(1) has been revised to reflect this change. The final rule also amends paragraph (d)(1) to make clear that a MAO does not constitute an administrative subpoena.

An administrative subpoena is a written order issued by OSHA to require an employer, or any other person, to produce listed records, documents, testimony and/or other supporting evidence relevant to an inspection or investigation under the OSH Act. If the person served with a subpoena refuses to honor (or only partially honors) the order, the subpoena is subject to judicial review and enforcement by a U.S. District Court. OSHA Regional Administrators have authority to issue administrative subpoenas and are also authorized to delegate to Area Directors the authority to issue routine administrative subpoenas. OSHA's policies and procedures for issuing an administrative subpoena are set forth in OSHA Instruction ADM 01-00-002, August 19, 1991.

In contrast, a MAO is an authorization for specified OSHA personnel to examine or copy personally identifiable employee medical information contained in a record held by an employer or some other record holder. Since an MAO relates to internal OSHA procedures, it cannot be used to compel the production of records, nor be enforced in a U.S. District Court. Historically, OSHA has not treated an MAO as equivalent to an administrative subpoena. OSHA's longstanding practice has been to rely on an administrative subpoena to compel production of medical records by employers. See OSHA's August 22, 2007, Instruction CPL 02-02-072, Rules of agency practice and procedure concerning OSHA access to employee medical records. MAOs set forth internal OSHA procedure for assuring appropriate confidentiality of medical records is observed by OSHA personnel. As a result, except when reasonably certain that the employer will grant access to employee medical information, OSHA personnel present an administrative subpoena to the employer concurrently with an MAO.

The final rule amends § 1913.10(d)(1) to state that except as provided in paragraph (d)(4), each request by an OSHA representative to examine or copy personally identifiable employee medical information contained in a record held by an employer or other recordholder shall be made pursuant to a written medical access order which has been approved by the OSHA Medical Records Officer. A medical access order does not constitute an administrative subpoena.

OSHA's previous regulation at § 1913.10(g) provided that all direct personal identifiers ( e.g., name, address, Social Security Number, payroll number) must be removed by OSHA personnel whenever employee medical information obtained pursuant to a written access order is taken off-site, unless otherwise directed by the MRO. The regulation also required the Principal OSHA Investigator to code the medical information and the list of direct personal identifiers with a unique identifying number for each employee and then hand deliver or mail the list of identifiers to the MRO. The MRO thereafter controlled the use and distribution of the list of coded identifiers to those with a need to know its contents. In addition, the numerical coded medical information was to be used and kept secured as though still in a directly identifiable form.

Paragraph (g) was originally promulgated by OSHA when the rules of agency practice and procedure were issued in 1980. At that time, electronic medical records did not exist, and the employee records that did exist were maintained almost entirely in paper form. Since 1980, the number of medical records maintained by employers and other record holders has substantially increased, and the majority of these records are now maintained in electronic form.

The final rule revises § 1913.10 by deleting the outdated procedures set forth in paragraph (g). OSHA is eliminating this internal requirement for several reasons. First, existing access and safeguarding requirements in § 1913.10 already address privacy concerns when OSHA takes medical information away from a workplace for off-site review. Specifically, paragraph (h) of § 1913.10 provides that only authorized personnel may examine or copy personally identifiable employee medical information. As explained below, OSHA experience is that this process can result in coding and re-coding errors in individual employee medical records. Likewise, it provides that, unless an exception applies, OSHA personnel and contractors are authorized to use information only for the purpose for which it was obtained. In addition, paragraph (h)(5) states that, whenever practicable, the examination of personally identifiable employee medical information shall be conducted on-site with a minimum of medical information taken off-site in a personally identifiable form.

Additionally, paragraph (i) of § 1913.10 includes security procedures for handling personally identifiable employee medical information. For example, paragraph (i)(1) provides that files containing personally identifiable employee medical information shall be segregated from other agency files and, when not in active use, must be kept in a locked cabinet or vault. In practice, the locking requirement extends to when medical information is transported from the workplace, as OSHA personnel place records in a locked trunk during transport by automobile.

Second, paragraph (n) of this final rule establishes new requirements for the access and safeguarding of personally identifiable employee medical information in electronic form. As discussed more extensively below, paragraph (n) of the final rule provides that the Principal OSHA Investigator is responsible for preventing any careless, accidental, or unintentional disclosure of, modification to, or destruction of electronic medical records. Paragraph (n)(3) of the final rule provides that the transfer and/or duplication of medical records in electronic form must be kept to the minimum necessary to accomplish the purpose for which it was obtained. Also, paragraph (n)(4) states that electronic files containing personally identifiable employee medical information shall be downloaded only to a computer hard drive or laptop that is secured ( e.g., password protected). Paragraph (n)(4) now includes the Government standards that address secure access to Government systems and the data they contain: Federal Information Processing Standards (FIPS) 201-2, “Personal Identity Verification (PIV) of Federal Employees and Contractors”; and HSPD-12, “Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors (HSPD-12).”

In addition, paragraph (n)(5) provides that electronic files containing personally identifiable employee medical information must be encrypted before transferred to authorized individuals. OSHA believes the safeguards for electronic medical records established by this final rule, which are based on existing OSHA practices and policy, enhance privacy protection and reduces the need to remove direct personal identifiers when OSHA personnel take personally identifiable employee medical information off-site.

OSHA's experience is that de-identification increases the risk of mislabeling or misidentifying employee medical records and places a burden on agency resources by requiring additional OSHA staff time to accurately conduct de-identification and copying of employee medical records. In some cases, depending on the number of employees at a specific facility, OSHA employees may spend several hours finding and removing each direct personal identifier within each affected employee's medical record. The deletion of paragraph (g) will reduce the amount of time and physical space needed by OSHA personnel at a worksite.

Finally, the deletion of de-identification procedures in paragraph (g) will simplify follow-up communication from authorized OSHA personnel with individual employees after evaluation of their medical information. For example, by not having to complete a potentially extensive de-identification process, critical medical information about an employee will be reviewed by an OSHA physician sooner, and this will allow the physician to conduct follow-up consultation with the employee in a timely manner. Also, because personally-identifiable information will remain in the medical records taken from a workplace for off-site review, it will make it easier for the OSHA physician to identify employees, compare associated records, and contact individual employees.

For all of the above reasons, OSHA has concluded that the removal of direct personal identifier requirements in paragraph (g) should be deleted.

In many cases, employers and other record holders maintain personally identifiable employee medical information in electronic form. OSHA's regulation at 29 CFR 1910.1020 provides that a “record” includes any item, collection, or grouping of information regardless of the form or process by which it is maintained ( e.g., paper, document, microfilm, X-ray film, or automated data processing). Medical records may also be maintained on media such as magnetic tape, computer disks, USB storage devices ( e.g., thumb drives), and online computer storage. Historically, OSHA personnel have followed the requirements in 29 CFR 1913.10 when accessing personally identifiable employee medical information maintained in electronic form. However, the regulation did not include provisions that specifically addressed electronic medical records. The final rule establishes new internal policies and procedures in paragraph (n) to § 1913.10 that specifically address OSHA access, use, and safeguarding of personally identifiable employee medical information maintained in electronic form.

Since the rules of agency practice and procedure were first issued in 1980, medical professionals have increasingly relied on the use and storage of medical records in electronic form. These records tend to improve the quality of health care and have several practical advantages over paper records. For example, electronic medical records can be accessed by health care professionals at any time from any given location. Legible records can also lead to more accurate diagnosis, treatment, and drug prescription. Electronic medical records are cost-effective because they take up less storage space and can be stored indefinitely. However, because they are in electronic form, these records also present unique challenges to security, privacy, and data integrity.

OSHA believes the best way to protect the security and confidentiality of personally identifiable employee medical information in electronic form is to prevent unauthorized access to such information. Several effective administrative, technological, and physical measures can be taken to protect electronic medical information from unauthorized access, use, disclosure, disruption, modification, or destruction. These methods include establishing specific security roles and responsibilities for OSHA officials, technology safeguards such as encryption or firewalls to protect against electronic breaches, ID/password protection for devices and information systems, and the use of anti-virus and intrusion detection software. The establishment of new internal OSHA policies and procedures in paragraph (n) of this final rule will effectively protect the security, privacy, and data integrity of employee medical information in electronic form.

Section 1913.10(n)(1) of the final rule provides that, in general, when accessing and/or copying personally identifiable employee medical information in electronic form, OSHA personnel shall follow the requirements set forth in 29 CFR 1913.10. As noted above, OSHA personnel have historically followed the rules of agency practice and procedure in § 1913.10 when accessing employee medical information in electronic form, and many of the provisions in § 1913.10 are applicable regardless of the format used to maintain information. As a result, unless specifically addressed in paragraph (n), OSHA personnel should continue to follow the rules of agency practice and procedure in paragraphs (a) through (m) when accessing and safeguarding electronic employee medical information.

Section (n)(2) of the final rule includes responsibilities for the Principal OSHA Investigator when OSHA personnel access personally identifiable employee medical information in electronic form. Specifically, paragraph (n)(2) states that when personally identifiable employee medical information in electronic form is taken off-site, the Principal OSHA Investigator is primarily responsible for ensuring that such information is properly used and kept secured. This provision is based on the requirement in paragraph (h)(1) of § 1913.10, which provides that the Principal OSHA Investigator is responsible for ensuring that medical information is used and kept secured in accordance with § 1913.10. Other specific responsibilities assigned to the Principal OSHA Investigator in paragraph (n)(2) include preventing any accidental or unintentional disclosure of, modification to, or destruction of personally identifiable employee medical information in electronic form (paragraph (n)(2)(i)); controlling the flow of data into, through, and from agency computer operations (paragraph (n)(2)(ii)); and ensuring that distribution and review of medical information in electronic form is limited to only those OSHA personnel and contractors with a need for access (paragraph (n)(2)(iii)). The requirement in paragraph (n)(2)(iii) is derived from § 1913.10(d)(2)(iii), which provides that, before approving a MAO, the MRO must determine that personnel authorized to review and analyze personally identifiable employee medical information are limited to those who have a need for access and have appropriate qualifications.

As discussed above, the Principal OSHA Investigator is the OSHA employee in the field with primary responsibility for ensuring that the examination and use of employee medical information is in accordance with § 1913.10. As such, the Principal OSHA Investigator is responsible for ensuring that the provisions in paragraph (n) are followed by OSHA personnel when electronic medical information is accessed from a specific workplace. For example, this would include ensuring that access to personally identifiable employee medical records in electronic form is limited to only authorized personnel with a need to review the information, ensuring that employee medical information is only downloaded to a secured device ( e.g., password protected), and verifying that medical information is deleted or destroyed when no longer needed by the agency.

Section 1913.10(n)(3) of the final rule provides that the transfer and/or duplication of medical information in electronic form shall be kept to the minimum necessary to accomplish the purpose for which it was obtained. This provision is similar to paragraph (i)(3) of § 1913.10, which states that the photocopying or other duplication of personally identifiable employee medical information shall be kept to the minimum necessary to accomplish the purpose for which the information was obtained.

In some cases, personally identifiable employee medical information in electronic form needs to be transferred or duplicated to facilitate internal OSHA review. For example, in order to conduct a proper workplace inspection or investigation, it may be necessary for OSHA personnel to transfer employee medical records to another OSHA employee with expertise on a specific occupational health hazard. Paragraph (n)(3) of the final rule permits the transfer and duplication of electronic medical information but only to authorized individuals with a need to review the information. Transfer and duplication are also limited to the minimum necessary to accomplish the purpose for which it was obtained. An example of this limitation might include the review of a medical record to determine whether an employee has sustained a work-related injury or illness. In such cases, review of a medical record would extend only to information about the employee's injury or illness. In this example, the transfer and/or duplication of electronic medical information unrelated to the injury or illness would not be permitted.

Additionally, OSHA believes the likelihood that medical information in electronic form will be lost, altered, or destroyed increases during transfer or duplication. The duplication of electronic medical information can also raise concern about data integrity. For example, the copying or deleting of employee medical information from one document to another raises concern about the accuracy of the information. Accordingly, personally identifiable electronic medical information should be transferred only to authorized individuals with a need to know the information and should be duplicated only to facilitate authorized internal agency review.

Consistent with existing OSHA policy, § 1913.10(n)(4) of the final rule states that electronic files containing personally identifiable employee medical information shall be downloaded only to a computer hard drive or laptop that is in accordance with Federal Information Processing Standard (FIPS) 201-2, “Personal Identity Verification (PIV) of Federal Employees and Contractors,” and “Homeland Security Presidential Directive 12: Policy for Common Identification Standard for Federal Employees and Contractors (HSPD-12).” The use of secured technology when downloading medical records will help to ensure that information is (1) accessed only by authorized individuals with a need-to-know and (2) not modified or deleted.

In accordance with current OSHA and Federal Government policy, the use of password protection is easy to implement, cost-effective, and a reliable method for securing electronic information. By downloading employee medical information to a secured hard drive or laptop, OSHA personnel will be able to ensure that only individuals that know the password can open a document and read its content. This practice also provides a level of protection that goes with the document no matter where it is stored or sent. Finally, because tampering with a secured device takes time and effort, providing this level of protection acts as a deterrent to accessing document content by unauthorized individuals.

Additionally, it is important for OSHA personnel to follow proper security practices when using password protected devices containing personally identifiable employee medical information. Authorized individuals must not share their ID with others, should log-off when leaving a terminal, and use their own ID to access employee medical records. Also, authorized individuals should not keep written facsimiles of passwords or access codes. Other security measures, such as the use of firewalls, anti-virus software, and intrusion detection software should also be used to protect data integrity. Again, the Principal OSHA Investigator is responsible for ensuring that proper security measures are in place in the field to protect the confidentiality of personally identifiable employee medical records in electronic form.

Moreover, it is critically important that mobile devices be encrypted or use password protection when used to download, transfer, or store electronic medical information. Mobile devices are for individual use, and are not designed for centralized IT management. These devices can easily be manipulated, damaged, or stolen. By encryption, OSHA means the process of changing plain text into cypher text for the purpose of security. The use of encryption results in the encoding of information in such a way so that only authorized individuals can access the information.

Section 1913.10(n)(5) of the final rule states that electronic files containing personally identifiable employee medical information shall not be transferred to authorized personnel through email attachment unless appropriately encrypted. The transfer of employee medical information by email attachment increases the risk that such information will be sent to an unauthorized individual. The transfer of personally identifiable employee medical information in electronic form must be made through secured means. See § 1913.10(n)(4), discussed above (“Electronic files containing personally identifiable employee medical information shall only be downloaded to a computer hard drive or laptop that is secured.”). Appropriate methods for the transfer of personally identifiable employee medical information in electronic form may include the use of password protected or encrypted files on a secured agency website designed for confidential information, the mailing of encrypted computer disks or USB drives, the emailing of password protected medical records (Adobe secured), and the printing and hand delivery of paper records.

Paragraph (n)(6) provides that when an employer or other record holder(s) provides access to employee medical information through a properly encrypted email attachment, the attachment shall be downloaded to a secured hard drive or laptop. After the attachment is downloaded, the email shall be permanently deleted.

In some cases, employers and other record holders provide OSHA with access to employee medical information through an encrypted email attachment. As noted above, the use of email attachments to transfer medical records makes it more likely that the information will be sent to unauthorized individuals. Paragraph (n)(6) ensures that medical information received in an encrypted email attachment is downloaded to a secured device.

After downloading the attachment from the employer or other record holder, the email must be permanently deleted to prevent transfer to unauthorized individuals. By permanently deleted, OSHA means that the email should be deleted so that it cannot be retrieved. Some email programs automatically delete trashed emails after a certain amount of time. Other programs retain emails until the user runs out of space. However, the intent of this provision is that, once the attachment is downloaded, OSHA personnel should immediately and permanently delete the incoming email. Most email programs have a “delete forever” function that allows the user to select emails in the trash folder for permanent deletion.

Section 1913.10(n)(7) of the final rule states that personally identifiable employee medical information in electronic form shall be secured when not in use. This provision is based on paragraph (i)(1) of § 1913.10, which states that agency files containing personally identifiable employee medical information shall be segregated from other agency files, and when not in active use, files containing this information shall be kept secured in a locked cabinet or vault. Paragraph (n)(7) is intended to prevent unauthorized access or modification to employee medical information in electronic form. In addition to all of the procedures in paragraph (n) addressing the use of electronic information by OSHA personnel, when not in use, such information must be stored in a secured manner. For example, when not in use, personally identifiable employee medical information should be stored on a password protected hard drive or laptop. Another example might be the storing of information on a password protected agency website designed to store confidential information. Also, if employee medical records are kept on computer disk or other electronic storage media, when not in use, the disk or media should be stored under lock and key. Paragraph (n)(7)(i) of the final rule also emphasizes the importance of proper storage by specifically stating that medical information in electronic form shall only be maintained or stored where facilities and conditions are designed to prevent unauthorized access.

Paragraph (n)(7)(ii) provides that personally identifiable employee medical information in electronic form shall be maintained only for so long as needed to accomplish the purpose for access. This provision is derived from paragraph (j)(1) of § 1913.10, which provides that consistent with OSHA records disposition programs, personally identifiable employee medical information shall be destroyed or returned to the original record holder when no longer needed for the purposes for which they were obtained. In OSHA's view, maintaining medical records only for so long as needed helps to ensure that such information will not be accessed by unauthorized individuals.

In some cases, after its initial use by the agency, personally identifiable employee medical information may not be used again until sometime in the future. For example, medical information used as the basis for an OSHA citation may be used during the hearing stage of an enforcement case before the Occupational Safety and Health Review Commission. The medical information may not be used while the case is on appeal, but there may be a need for the information if the case is remanded for further judicial proceedings. Similarly, an investigation of an apparently new health hazard may produce uncertain results. Before completely closing out this investigation, it may be appropriate to await the outcome of an ongoing research study or parallel investigation elsewhere in the country. In these cases, § 1913.10(j) provides that the medical information should be transferred to the MRO. Also, under § 1913.10(l)(2), the MRO must conduct an annual review of all centrally-held information to determine which information is no longer needed for the purposes for which it was obtained. These requirements apply equally to personally identifiable employee medical information stored in electronic form.

Paragraph (n)(7)(iii) of the final rules states that when no longer needed, the Principal OSHA Investigator shall ensure that all personally identifiable employee medical information on electric files has been deleted, destroyed, or returned to the original record holder. The requirement in paragraph (n)(7)(iii) is intended to ensure that the Principal OSHA Investigator is responsible for OSHA access and use of electronic medical information from beginning to end. When no longer needed, the Principal OSHA Investigator must make sure that authorized OSHA personnel follow proper procedures for the deletion, destruction and disposal of personally identifiable employee medical information. In practice, the Principal OSHA Investigator must ensure that media containing employee medical information is sanitized or destroyed before disposal or release for reuse in accordance with approved methods. In addition, if electronic medical records are returned to the original record holder, the Principal OSHA Investigator must ensure that all data is returned, and no data remains in the possession of OSHA personnel.

Paragraph (n)(7)(iv) states that the disposal of personally identifiable employee medical information maintained in electronic form shall be accomplished in such a manner as to make the data unattainable by unauthorized personnel. When no longer needed, electronic media must be handled and sanitized appropriately to prevent unauthorized disclosure or modification of personally identifiable employee medical information.

OSHA personnel use several types of electronic media to access, use, and maintain personally identifiable employee medical information, including hard drives, laptops, USB storage drives ( e.g., thumb drives), CDs, DVDs, and digital storage cards such as camera cards. In order to meet the requirement in paragraph (n)(7)(iv), and depending on the type of electronic media used, OSHA personnel may need to re-use, recycle, or destroy the electronic media containing medical information. Also, when employee medical information in electronic form is no longer needed, it is important to ensure that deleted data is not easily recoverable. Residual data may allow unauthorized individuals to reconstruct data and thereby gain access to personally identifiable employee medical information. Sanitization is one method that can be used to ensure that deleted data cannot be reconstructed.

Sanitization is the general process of removing data from storage media, such that there is reasonable assurance that the data may not be easily retrieved and reconstructed. There are different types of sanitization for each type of media, including cleaning, purging, and destroying. Cleaning is the removal of data from devices in such a way that there is assurance that the data cannot be reconstructed using normal system functions or software file/data recovery utilities. For example, cleaning may include using software or hardware products to overwhelm media with non-sensitive data. Purging is generally done before releasing media beyond control, such as before discarding old media, and includes degaussing or exposing media to a strong magnetic field in order to disrupt recorded magnetic domains. Destruction of media is the ultimate form of sanitization.

In some cases, OSHA personnel maintain employee medical information on media that may not be able to be reused such as computer disks and camera cards. In these situations, when no longer needed, electronic media containing personally identifiable employee medical information should be disposed of using approved secure data destruction. Several methods exist to dispose of electronic media containing medical information. For example, computer disks can be rendered unusable by shredding, incinerating, or pulverizing. Many OSHA Regional and Area Offices already have equipment that can shred or burn disks. Other offices contract with private companies to perform this task in a secure manner. As a reminder, in order to address security and privacy concerns, disposal operations should be conducted in accordance with approved DOL or OSHA methods. In addition, OSHA is responsible for the management of records pursuant to the Federal Records Act of 1950, as amended (44 U.S.C. Chapters 21, 29, 31, 33). The retention and destruction of Federal records must be conducted in accordance with the procedures described in the Federal Records Act.

Finally, in the future, OSHA personnel will be using media types not specifically mentioned in this preamble. The processes mentioned in this document should guide media sanitization and disposal decisions regardless of the type of media in use. In the future, OSHA will issue guidance to agency staff as new technology is developed.

The 28 states and U.S. territories with their own OSHA-approved occupational safety and health plans are encouraged, but not required, to adopt these rules of agency practice and procedure concerning employee medical record access that Federal OSHA is promulgating to 29 CFR 1913.10 in this final rule. The states and U.S. territories with OSHA-approved occupational safety and health plans covering private employees and state and local government employees are Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, and Wyoming. In addition, six states and U.S. territories have OSHA-approved state Plans that apply to state and local government employees only: Connecticut, Illinois, Maine, New Jersey, New York, and the Virgin Islands.

This final rule describes a Federal program change for which State Plan adoption is not required. However, State Plans are required to have standards, and an enforcement program, that are “at least as effective in providing safe and healthful employment” as those of Federal OSHA. In order to be “at least as effective” as Federal OSHA, a State Plan must appropriately utilize its authority for access to medical records, and must have effective procedures to assure that the privacy of those records is protected in a manner consistent with applicable state and federal privacy laws. Therefore, although adoption of this rule is not required, State Plans must have procedures covering this issue that are at least as effective as those of Federal OSHA and are encouraged to adopt requirements comparable to those in 29 CFR 1913.10.

Within 60 days of the effective date of this final rule, a State Plan must submit a notice of intent indicating whether they already have a similar policy in place, intend to adopt new policies and procedures, or do not intend to adopt this final rule. If a State Plan does not adopt at first, but at some later point decides to adopt this final rule or an at least as effective version of this final rule, the State Plan must notify OSHA of this change in intent. Within 60 days of adoption, the State Plan must provide an electronic copy of the regulation or policy, or a link to where their policy is posted on the State Plan's website. The State Plan must also provide the date of adoption and identify differences, if any, between their policy and this final rule. OSHA will provide summary information on the State Plan responses to this instruction on its website at: www.osha.gov/dcsp/osp/index.html.

The notice and comment procedures of section 553 of the APA do not apply “to interpretative rules, general statements of policy, or rules of agency organization, procedure, or practice.” 5 U.S.C. 553(b)(A). Rules that are exempt from APA notice and comment requirements are also exempt from the Regulatory Flexibility Act (RFA). See SBA Office of Advocacy, A Guide for Government Agencies: How to Comply with the Regulatory Flexibility Act (August 2017); also found at http://www.sba.gov/sites/default/files/rfaguide5F05125F0.pdf. This is a rule of agency procedure, practice, and interpretation within the meaning of that section; and therefore, is exempt from both the notice and comment rulemaking procedures of the APA and the requirements of the RFA.

In accordance with the requirements of the National Environmental Policy Act (NEPA) (42 U.S.C. 4231 et seq. ), Council on Environmental Quality NEPA regulations (40 CFR parts 1500 through 1518), and the Department of Labor NEPA regulations (29 CFR part 11), OSHA has determined that this final rule will not have a significant impact on the external environment.

OSHA reviewed this final rule in accordance with the most recent Executive order on federalism (Executive Order 13132, 64 FR 43255, August 10, 1999). This Executive order requires Federal agencies, to the extent possible, to refrain from limiting state policy options, consult with states prior to taking any action that would restrict state policy options, and take such actions only when clear constitutional authority exists and the problem is national in scope.

This rule does not have “federalism implications.” The rule does not have “substantial direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government” and therefore is not subject to Executive Order 13132 (Federalism).

The Department has concluded that this rule is not a “significant regulatory action” within the meaning of Executive Order 12866, reaffirmed by Executive Order 13563, because it is not likely to (1) have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or state, local, or Tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) materially alter the budgetary impact of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) raise novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles set forth in Executive Order 12866. Therefore, no economic impact analysis under section 6(a)(3)(C) of Executive Order 12866 has been prepared. For the same reason, and because no notice of proposed rulemaking was published, no statement is required under section 202 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1532. In any event, this rulemaking is procedural and interpretive in nature and is thus not expected to have a significant economic impact.

OSHA reviewed this rule in accordance with Executive Order 13175 (65 FR 67249, November 6, 2000) and determined that it does not have “tribal implications” as defined in that order. The rule does not have substantial direct effects on one or more Indian tribes, on the relationship between the Federal Government and Indian tribes, or on the distribution of power and responsibilities between the Federal Government and Indian tribes.

The Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq. ) and OMB regulations (5 CFR part 1320) require agencies to obtain approval from OMB before conducting any collection of information. The PRA defines a “collection of information” as “the obtaining, causing to be obtained, soliciting, or requiring the disclosure to third parties or the public of facts or opinions by or for an agency regardless of form or format” (44 U.S.C. 3502(3)(A)). The PRA does not apply to this final rule because it amends existing internal agency procedures and does not impose any new recordkeeping or information collection requirements that require OMB approval.

This document was prepared under the direction of Loren Sweatt, Principal Deputy Assistant Secretary for Occupational Safety and Health. It is issued under Section 8 of the Occupational Safety and Health Act (29 U.S.C. 657), 5 U.S.C. 553, 5 U.S.C. 552a(e), 5 U.S.C. 301, and Secretary of Labor's Order No. 5-2012 (77 FR 3912).

Part 1913 of title 29 of the Code of Federal Regulations is hereby amended as follows:

The Commission submitted revised information collection requirements for review and approval by OMB, as required by the Paperwork Reduction Act (PRA) of 1995, on May 20, 2020, which were approved by OMB on July 9, 2020. The information collection requirements are contained in the Commission's Uniendo a Puerto Rico Fund and Connect USVI Fund Order, FCC 19-95 published at 84 FR 59937, November 7, 2019. The OMB Control Number is 3060-1274. If you have any comments on the burden estimates listed in the following, or how the Commission can improve the collections and reduce any burdens caused thereby, please contact Nicole Ongele, Federal Communications Commission, Room 1-A620, 445 12th Street SW, Washington, DC 20554. Please include the OMB Control Number, 3060-1274, in your correspondence. The Commission will also accept your comments via email at PRA@fcc.gov.

To request materials in accessible formats for people with disabilities (Braille, large print, electronic files, audio format), send an email to fcc504@fcc.gov or call the Consumer and Governmental Affairs Bureau at (202) 418-0530 (voice), (202) 418-0432 (TTY).

As required by the Paperwork Reduction Act of 1995 (44 U.S.C. 3507), the Commission is notifying the public that it received OMB approval on July 9, 2020, for the information collection requirements contained in 47 CFR 54.1505, 54.1508 and 54.1515 published at 84 FR 59937, November 7, 2019. Under 5 CFR part 1320, an agency may not conduct or sponsor a collection of information unless it displays a current, valid OMB Control Number.

No person shall be subject to any penalty for failing to comply with a collection of information subject to the Paperwork Reduction Act that does not display a current, valid OMB Control Number. The OMB Control Number is 3060-1274.

The foregoing notice is required by the Paperwork Reduction Act of 1995, Public Law 104-13, October 1, 1995, and 44 U.S.C. 3507.

The total annual reporting burdens and costs for the respondents are as follows:

OMB Control Number: 3060-1274.

OMB Approval Date: July 9, 2020.

OMB Expiration Date: July 31, 2023.

Title: Application for the Uniendo a Puerto Rico Fund and the Connect USVI Fund Stage 2 Fixed Support.

Form Number: FCC Form 5634.

Type of Review: New information collection.

Respondents: Business or other for-profit.

Number of Respondents and Responses: 20 unique respondents; 30 responses.

Estimated Time per Response: 2-80 hours.

Frequency of Response: One-time and annual reporting requirements.

Obligation to Respond: Required to obtain or retain benefits. Statutory authority for this information collection is contained in 47 U.S.C. 151-154, 214, and 254.

Total Annual Burden: 1,620 hours.

Total Annual Cost: No Cost.

Privacy Act Impact Assessment: No impact(s).

Nature and Extent of Confidentiality: Although some information collected in FCC Form 5634 will be made available for routine public inspection, the Commission will withhold certain information collected in FCC Form 5634 from routine public inspection. Specifically, the Commission will treat certain financial and technical information submitted in FCC Form 5634 as confidential. However, if a request for public inspection for this technical or financial information is made under 47 CFR 0.461, and the applicant has any objections to disclosure, the applicant will be notified and will be required to justify continued confidential treatment. To the extent that an applicant seeks to have other information collected in FCC Form 5634 or during the post-selection review process withheld from public inspection, the applicant may request confidential treatment pursuant to 47 CFR 0.459.

Needs and Uses: In the Uniendo a Puerto Rico Fund and Connect USVI Fund Order, the Commission comprehensively reformed the high-cost program within the universal service fund to focus support on networks capable of providing advanced, hardened voice and broadband services in Puerto Rico and the U.S. Virgin Islands (collectively, the Territories). Uniendo a Puerto Rico Fund and the Connect USVI Fund, WC Dockets Nos. 18-143 et al., Report and Order and Order on Reconsideration, 34 FCC Rcd 9109 ( PR-USVI Order ). As part of the PR-USVI Order, the Commission adopted a single-round competitive proposal process to award Stage 2 support for fixed telecommunications networks in the Territories (Stage 2 Competition).

For the Stage 2 Competition, service providers will compete to receive high-cost support of up to $504.7 million in Puerto Rico and $186.5 million in the U.S. Virgin Islands over 10 years to offer fixed voice and broadband services to all locations in the Territories in accordance with the framework adopted in the PR-USVI Order. The information collection requirements reported under this new collection are the result of the competitive proposal process adopted by the PR-USVI Order to award support to winning applicants. The Commission adopted various rules regarding the eligibility of service providers and the term of support. In addition, the Commission adopted rules to govern the competitive proposal process, which includes information to be submitted by parties as part of their competitive proposals and information that must be submitted by winning bidders seeking to become authorized to receive Stage 2 fixed support. The Commission concluded, based on its experience with awarding high-cost support and consistent with the record, that this single-stage competitive proposal process balances the need to collect information essential to awarding support and authorizing Stage 2 fixed support with administrative efficiency.

The Commission estimates that approximately 20 parties will apply and approximately 10 will be selected as winning applicants. This information collection addresses the burdens associated with these requirements.

This action approves the management measures in Framework Adjustment 59 to the Northeast Multispecies Fishery Management Plan (FMP). The measures implemented in this final rule:

• Set fishing year 2020 shared U.S./Canada quotas for Georges Bank (GB) yellowtail flounder and Eastern GB cod and haddock;

• Set 2020-2022 specifications, including catch limits, for 15 groundfish stocks;

• Adjust 2020 allocations for four groundfish stocks: Gulf of Maine (GOM) winter flounder, Southern New England/Mid-Atlantic (SNE/MA) winter flounder, redfish, and ocean pout;

• Address commercial/recreational allocation issues raised by new Marine Recreational Information Program (MRIP) data; and

• Revise the GB cod Incidental Catch total allowable catch (TAC) to remove the allocation to the Closed Area I Hook Gear Haddock Special Access Program (SAP).

This action also implements regulatory corrections that are not part of Framework 59, but that are implemented under our section 305(d) authority in the Magnuson-Stevens Act to make changes necessary to carry out the FMP. We are implementing these corrections in conjunction with the Framework 59 measures for expediency purposes. We describe these corrections in Section 4, Regulatory Corrections under Secretarial Authority.

As described in the proposed rule (85 FR 32347; May 29, 2020), Eastern GB cod, Eastern GB haddock, and GB yellowtail flounder are jointly managed with Canada under the U.S./Canada Resource Sharing Understanding. This action adopts shared U.S./Canada quotas for these stocks for fishing year 2020 based on 2019 assessments and the recommendations of the Transboundary Management Guidance Committee (TMGC). The 2020 shared U.S./Canada quotas, and each country's allocation, are listed in Table 1. Detailed summaries of the assessments can be found at: https://www.fisheries.noaa.gov/new-england-mid-atlantic/international-affairs/population-dynamics-international-collaboration.

The regulations implementing the U.S./Canada Resource Sharing Understanding require deducting any overages of the U.S. quota for Eastern GB cod, Eastern GB haddock, or GB yellowtail flounder from the U.S. quota in the following fishing year. Based on preliminary data through July 9, 2020, the U.S. fishery did not exceed its 2019 fishing year quota for any of the shared stocks. However, if final catch accounting for the 2019 fishing year indicates that the U.S. fishery exceeded its quota for any of the shared stocks, we will reduce the respective U.S. quotas for the 2020 fishing year in an adjustment action, as soon as possible in the 2020 fishing year. If any fishery that is allocated a portion of the U.S. quota exceeds its allocation and causes an overage of the overall U.S. quota, the overage reduction would be applied only to that fishery's allocation in the following fishing year. This ensures that catch by one component of the overall fishery does not negatively affect another component of the overall fishery.

This rule adopts new catch limits for 14 groundfish stocks for the 2020-2022 fishing years based on stock assessments completed in 2019, and fishing year 2020-2021 specifications for GB yellowtail flounder. Framework 57 (83 FR 18985; May 1, 2018) previously set 2020 quotas for the five groundfish stocks not assessed in 2019 (GOM winter flounder, SNE/MA winter flounder, redfish, ocean pout, and Atlantic wolffish), based on assessments conducted in 2017. This action includes minor adjustments for four of these stocks (excluding Atlantic wolffish) for fishing year 2020. The catch limits implemented in this action, including overfishing limits (OFL), acceptable biological catches (ABC), and annual catch limits (ACL), are listed in Tables 2 through 10. A summary of how these catch limits were developed, including the distribution to the various fishery components, was provided in the proposed rule and in Appendix II (Calculation of Northeast Multispecies Annual Catch Limits, FY 2020-FY 2022) to the Framework 59 Environmental Assessment (EA) (see ADDRESSES for information on how to get this document), and is not repeated here. The sector and common pool sub-ACLs implemented in this action are based on fishing year 2020 potential sector contributions (PSC) and final fishing year 2020 sector rosters.

Amendment 16 to the FMP (75 FR 18262; April 9, 2010) established the method for determining the original commercial and recreational allocations of GOM cod and haddock based on the ratio of reported landings (for commercial and recreational) and discards (commercial only) for the time period 2001-2006 using data from the Groundfish Assessment Review Meeting III (GARM III). The 2019 stock assessments used updated data to assess groundfish stocks including GOM cod and haddock. The proposed rule included an explanation of the data changes incorporated into the 2019 stock assessments and is not repeated here.

Framework 59, applying the same method approved in Amendment 16 but with the revised data for the same time period of 2001-2006, approves a revised recreational allocation of 37.5 percent for GOM cod and 33.9 percent for GOM haddock. The remaining portion of the ABC (62.5 percent for GOM cod, 66.1 percent for GOM haddock) is allocated to the commercial fisheries, which include the Federal commercial groundfish fishery, state commercial fishery, and other Federal fisheries. Table 11 shows the original and revised split in allocations as a percentage for the commercial and recreational fisheries for GOM cod and haddock.

Framework 59 removes the portion of the Incidental Catch Total Allowable Catch (TAC) for GB cod that is allocated to the Closed Area I Hook Gear Haddock SAP. The allocation of the GB cod Incidental Catch TAC remains for the Regular B Days-at-Sea Program and the Eastern U.S./Canada Haddock SAP (Table 8).

NMFS manages the groundfish fishery in the BSAI according to the Fishery Management Plan for Groundfish of the Bering Sea and Aleutian Islands Management Area (FMP) prepared by the North Pacific Fishery Management Council under authority of the Magnuson-Stevens Fishery Conservation and Management Act. Regulations governing fishing by U.S. vessels in accordance with the FMP appear at subpart H of 50 CFR part 600 and 50 CFR part 679.

The 2020 “other rockfish” TAC in the Aleutian Islands subarea of the BSAI is 388 metric tons (mt) as established by the final 2020 and 2021 harvest specifications for groundfish in the BSAI (85 FR 13553, March 9, 2020). In accordance with § 679.20(d)(2), the Administrator, Alaska Region, NMFS (Regional Administrator), has determined that the 2020 “other rockfish” TAC in the Aleutian Islands subarea of the BSAI has been reached. Therefore, NMFS is requiring that “other rockfish” in the Aleutian Islands subarea of the BSAI be treated in the same manner as a prohibited species, as described under § 679.21(a), for the remainder of the year, except “other rockfish” species in the Aleutian Islands subarea caught by catcher vessels using hook-and-line, pot, or jig gear as described in § 679.20(j).

NMFS issues this action pursuant to section 305(d) of the Magnuson-Stevens Act. This action is required by 50 CFR part 679, which was issued pursuant to section 304(b), and is exempt from review under Executive Order 12866.

Pursuant to 5 U.S.C. 553(b)(B), there is good cause to waive prior notice and an opportunity for public comment on this action, as notice and comment would be impracticable and contrary to the public interest, as it would prevent NMFS from responding to the most recent fisheries data in a timely fashion and would delay the prohibited retention of “other rockfish” in the Aleutian Islands subarea of the BSAI. NMFS was unable to publish a notice providing time for public comment because the most recent, relevant data only became available as of July 23, 2020.