Privacy Act of 1974; New System of Records, 35993-35997 [E7-12682]
Download as PDF
Federal Register / Vol. 72, No. 126 / Monday, July 2, 2007 / Notices
Federal Communications Commission
Marlene H. Dortch,
Secretary.
[FR Doc. 07–3234 Filed 6–28–07; 2:56 pm]
BILLING CODE 6712–01–P
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Centers for Disease Control and
Prevention
Privacy Act of 1974; New System of
Records
Department of Health and
Human Services (HHS), Centers for
Disease Control and Prevention (CDC).
ACTION: Notice of a New System of
Records.
jlentini on PROD1PC65 with NOTICES
AGENCY:
SUMMARY: In accordance with the
requirements of the Privacy Act, the
Centers for Disease Control and
Prevention (CDC) is proposing to
establish a new system of records (SOR),
09–20–0170, ‘‘National Select Agent
Registry (NSAR)/Select Agent Transfer
and Entity Registration Information
System (SATERIS), HHS/CDC/
COTPER.’’ The purpose of the system is
to limit access to those biological agents
and toxins listed in 42 CFR Part 73, 9
CFR Part 121, and 7 CFR Part 331, to
those individuals who have a legitimate
need to handle or use such agents or
toxins, and who are not identified as
restricted persons by the U.S. Attorney
General. NSAR is a single web-based
information management system shared
by CDC and the U.S. Department of
Agriculture (USDA)/Animal and Plant
Health Inspection Service (APHIS) that
tracks the possession, use and transfer
of select agents and toxins that could
pose a severe threat to public health and
safety, to the health and safety of
animals, and to the safety of plants or
animal and plant products. We have
provided background information about
the new system in the SUPPLEMENTARY
INFORMATION section below.
DATES: Effective Date: CDC filed a new
SOR report with the Chair of the House
Committee on Government Reform and
Oversight, the Chair of the Senate
Committee on Homeland Security &
Governmental Affairs, and the
Administrator, Office of Information
and Regulatory Affairs, Office of
Management and Budget (OMB) on June
25, 2007. CDC invites interested parties
to submit comments on the proposed
routine uses. To ensure that all parties
have adequate time in which to
comment, the new system will be
effective 30 days from the publication of
this notice, or 40 days from the date it
VerDate Aug<31>2005
22:57 Jun 29, 2007
Jkt 211001
was submitted to OMB and the
Congress, whichever is later, unless
CDC receives comments that persuade
us to defer implementation.
ADDRESSES: Comments should be
addressed to the CDC Privacy Act
Officer at the address listed below.
Comments received will be available for
review at this location by appointment
during regular business hours from 8
a.m. to 4:30 p.m., Monday through
Friday in the CDC Roybal Facility,
Building 21, Room 8125, Atlanta,
Georgia.
FOR FURTHER INFORMATION CONTACT:
Betsey S. Dunaway, Privacy Act Officer,
Office of the Chief Science Officer,
Centers for Disease Control and
Prevention, 1600 Clifton Road, NE.,
Building 21, Room 8125, Mailstop D–74,
Atlanta, Georgia 30333, (404) 639–4642.
SUPPLEMENTARY INFORMATION: CDC
proposes to establish a new system of
records within its Coordinating Office
for Terrorism Preparedness and
Emergency Response (COTPER): 09–20–
0170, ‘‘National Select Agent Registry
(NSAR)/ Select Agent Transfer and
Entity Registration Information System
(SATERIS), HHS/CDC/COTPER.’’ An
important component of the nation’s
overall terrorism deterrence policy, the
Division of Select Agents and Toxins
(DSAT) in the Coordinating Office for
Terrorism Preparedness and Emergency
Response (COTPER) within the CDC
regulates the possession, use, and
transfer of biological agents and toxins
(select agents) that could pose a severe
threat to public health and safety. A
select agent is defined as a virus,
bacteria, fungus or toxin that could pose
a severe threat to public health and
safety, to animal or plant health; or
animal or plant products.
I. Description of the Proposed System of
Records
A. Statutory and Regulatory Basis for
SOR. The Public Health Security and
Bioterrorism Preparedness and
Response Act of 2002 requires entities
to register with the U.S. Department of
Health and Human Services (HHS) if
they possess, use, or transfer select
agents that could pose a severe threat to
public health and safety. The
Agricultural Bioterrorism Protection Act
of 2002 requires that facilities handling
select agents that could pose a severe
threat to animal or plant health; or
animal or plant products register with
the USDA. Within HHS, the DSAT is
responsible for registering entities and
personnel who either possess or are
applying for approval to possess, use or
transfer select agents that could pose a
severe threat to public health and safety.
PO 00000
Frm 00027
Fmt 4703
Sfmt 4703
35993
Within the USDA, APHIS has a similar
responsibility for registering entities and
personnel handling agents that pose a
severe threat to animal or plant health;
or animal or plant products.
The Acts require safeguards and
security measures that will adequately
protect these agents. This includes
controlling access and screening of
entities and personnel through security
risk assessments conducted by the U.S.
Attorney General. The Acts also require
the establishment of a national database
of registered entities. While some
entities register for select agents
regulated only by HHS, others for select
agents regulated only by USDA, there
are a number of entities registering for
select agents that can pose a severe
threat to public health and safety, to
animal health, or to animal products
(‘‘overlap’’ select agents). Since DSAT
and APHIS coordinate regulatory
activities for those overlap select agents
that would be regulated by both
agencies, the Acts require that a single
national database be established. This
new Privacy Act system of records
notice (SORN) describes the records and
processes that enable DSAT to fulfill
HHS’ requirements; APHIS will be
publishing a similar SORN to address
how USDA will fulfill theirs.
B. Collection and Maintenance of Data
in the System
CDC will only collect the minimum
amount of personal data necessary to
achieve the purpose of this system,
which is to limit access to the select
agents listed in 42 CFR Part 73, 9 CFR
Part 121, and 7 CFR Part 331, to those
individuals who have a legitimate need
to handle or use such agents, and who
are not identified as a restricted person
by the U.S. Attorney General. The data
elements required are: name, address,
date of birth, job title, and the name of
the institution that would be housing
the select agent(s).
Entities handling select agents must
appoint a Responsible Official within
their organization who certifies that the
entity meets federal requirements for
handling select agents such as having
security measures in place to protect the
select agents they possess from theft,
loss and unauthorized access, and safety
measures to prevent the release of
agents. DSAT’s SOR includes personal
information on those individuals who
have access or who have applied to have
access to select agents, and the list of
select agents to which they have access
or would have access.
E:\FR\FM\02JYN1.SGM
02JYN1
35994
Federal Register / Vol. 72, No. 126 / Monday, July 2, 2007 / Notices
II. Agency Policies, Procedures, and
Restrictions on the Routine Use
jlentini on PROD1PC65 with NOTICES
The Privacy Act permits us to disclose
information without an individual’s
consent if the information is to be used
for a purpose that is compatible with the
purpose(s) for which the information
was collected. Any such compatible
disclosure of data is known as a
‘‘routine use.’’ The government will
only release select agent information
that can be associated with an
individual as provided for under
‘‘Section III. Proposed Routine Use
Disclosures of Data in the System.’’ We
will only collect the minimum personal
data necessary to achieve the purpose of
this system.
CDC has the following policies and
procedures concerning disclosures of
information that will be maintained in
the system. Disclosure of information
from the SOR will be approved only to
the extent necessary to accomplish the
purpose of the disclosure and only after
CDC:
A. Determines that the use or
disclosure is consistent with the reason
that the data are being collected, e.g., to
limit access to select agents to those
individuals who have a legitimate need
to handle or use select agents and who
are not identified as a restricted person
by the U.S. Attorney General.
B. DETERMINES THAT:
1. The purpose for which the
disclosure is to be made can only be
accomplished if the record is provided
in individually identifiable form;
2. The purpose for which the
disclosure is to be made is of sufficient
importance to warrant the effect and/or
risk on the privacy of the individual that
additional exposure of the record might
bring; and
3. There is a strong probability that
the proposed use of the data would in
fact accomplish the stated purpose(s).
C. Requires the information recipient
to:
1. Establish administrative, technical,
and physical safeguards to prevent
unauthorized use of disclosure of the
record;
2. Remove or destroy at the earliest
time all identifiable information; and
3. Agree to not use or disclose the
information for any purpose other than
the stated purpose under which the
information was disclosed.
D. Determines that the data are valid
and reliable.
III. Proposed Routine Use Disclosures
of Data in the System
The Privacy Act permits us to disclose
information without an individual’s
consent if the information is to be used
VerDate Aug<31>2005
22:57 Jun 29, 2007
Jkt 211001
for a purpose that is compatible with the
purpose(s) for which the information
was collected. Any such compatible
disclosure of data is known as a
‘‘routine use.’’ The proposed routine
uses in this system meet the
compatibility requirement of the Privacy
Act. We are proposing to establish the
following routine use disclosures of
information maintained in the system:
A. Records may be disclosed to
contractors to handle program work
overflow duties, performing many of the
same functions as DSAT employees.
Contractors are required to maintain
Privacy Act safeguards with respect to
such records. These functions include
conducting regulatory oversight of
individuals and entities that possess,
use, or transfer select agents, including
the review of registration applications,
conducting inspections of registered
facilities or facilities requesting
registration, and maintaining this
information pertaining to individuals
and entities that possess, use, and/or
transfer select agents. DSAT contracts
out certain functions when doing so
would contribute to efficient and
effective operations of the agency. DSAT
must be able to give a contractor the
information necessary for the contractor
to fulfill its duties. Safeguards are
provided in the contract prohibiting the
contractor from using or disclosing the
information for any purpose other than
that described in the Statement of Work
and requires the contractor to return or
destroy all information at the contract’s
completion.
B. Records may be disclosed to health
departments and other public health or
cooperating medical authorities to deal
more effectively with outbreaks and
conditions of public health significance.
When outbreaks or other conditions of
public health significance that might
have been caused by exposure to select
agents (either accidental or otherwise)
occur, CDC’s sharing of information on
those individuals and organizations
registered to possess select agents could
prove beneficial to the health
department’s investigation.
C. Personal information from this
system may be disclosed as a routine
use to assist the recipient Federal
agency in making a determination
concerning an individual’s
trustworthiness to access select agents;
to any Federal or State agency where the
purpose in making the disclosure is to
prevent access to select agents for use in
domestic or international terrorism or
for any criminal purpose; or to any
Federal or State agency to protect the
public health and safety with regard to
the possession, use, or transfer of select
agents.
PO 00000
Frm 00028
Fmt 4703
Sfmt 4703
Based on the provisions of the Acts,
the Attorney General has the authority
and responsibility to conduct electronic
database checks (i.e., the security risk
assessments) on the Responsible
Official, alternate Responsible Official,
owners of non-governmental entities,
and individuals requesting access to
select agents. The Federal Bureau of
Investigation, Criminal Justice
Information Services Division (CJIS),
has been delegated authority for
conducting these security risk
assessments. Therefore, the information
must be shared with the CJIS for them
to conduct a security risk assessment to
ensure that individuals requesting
access to select agents are not identified
as a restricted person based on criteria
established in the U.S.A. Patriot Act.
This is compatible with the overall
purpose of the system—that only
trustworthy individuals are granted
access.
Other Federal or State agencies may
require the information DSAT possesses
on individuals with access to select
agents and the institutions at which
those agents are housed to aid in their
investigations of domestic or
international terrorism or for any other
criminal purpose. The purpose of the
system is to be certain that only
individuals who have a legitimate need
to handle or use such select agents have
access to them; this routine use is
compatible in that this disclosure is
done to prevent access to select agents
for terrorism or other criminal purposes.
State emergency planners may need this
identifiable information to fulfill their
responsibilities.
The overall purpose of this SOR is to
protect the public health and safety.
Federal and State agency emergency
responders may require DSAT’s
identifiable information if select agents
are accidentally released or otherwise
used inappropriately with the ultimate
goal of protecting the public’s health
and safety. Records may also be shared
with the Department of Transportation
to ensure that the transfer of select
agents is done safely and in compliance
with their regulations—a use in line
with CDC’s purpose of safely
transferring select agents for which it
has responsibility.
D. Disclosure may be made to a
congressional office from the record of
an individual in response to a verified
inquiry from the congressional office
made at the written request of that
individual. When a constituent requests
a congressional office to facilitate
obtaining information from this CDC
system, it is compatible to provide such
information, since this is in line with
the overall purpose of the Privacy Act
E:\FR\FM\02JYN1.SGM
02JYN1
Federal Register / Vol. 72, No. 126 / Monday, July 2, 2007 / Notices
jlentini on PROD1PC65 with NOTICES
which is to provide access to the subject
individual of the records the
government has on him or her.
E. In the event of litigation where the
defendant is: (a) The Department, any
component of the Department, or any
employee of the Department in his or
her official capacity; (b) the United
States where the Department determines
that the claim, if successful, is likely to
directly affect the operations of the
Department or any of its components; or
(c) any Department employee in his or
her individual capacity where the
Justice Department has agreed to
represent such employee, disclosure
may be made to the Department of
Justice to enable that Department to
present an effective defense, provided
that such disclosure is compatible with
the purpose for which the records were
collected.
Whenever CDC is involved in
litigation dealing with the DSAT, and
CDC policies or operations could be
affected by the outcome of the litigation,
CDC must be able to disclose
identifiable information to the
Department of Justice so that an
effective defense could be presented.
IV. Safeguards
The CDC/DSAT has safeguards in
place for authorized users and monitors
such users to ensure against
unauthorized use. Personnel with access
to the system have been trained in
Privacy Act and information security
requirements. Employees maintaining
records are instructed not to release data
until the intended recipient agrees to
implement appropriate management,
operational and technical safeguards
sufficient to protect the confidentiality,
integrity and availability of the
information and information systems
and to prevent unauthorized access.
This system will conform to all
applicable Federal laws and regulations
and Federal and HHS policies and
standards as they relate to information
security and data privacy. These laws
and regulations may apply but are not
limited to: the Privacy Act of 1974; the
Federal Information Security
Management Act of 2002; the Computer
Fraud and Abuse Act of 1986; the EGovernment Act of 2002; the ClingerCohen Act of 1996; the Medicare
Modernization Act of 2003, and the
corresponding implementing
regulations. OMB Circular A–130,
Management of Federal Resources,
Appendix III, Security of Federal
Automated Information Resources also
applies. Federal, HHS and CDC policies
and standards include but are not
limited to: all pertinent National
Institute of Standards and Technology
VerDate Aug<31>2005
22:57 Jun 29, 2007
Jkt 211001
publications and the HHS Information
Systems Program Handbook.
V. Effects of the Proposed System of
Records on Individual Rights
CDC proposes to establish this system
in accordance with the principles and
requirements of the Privacy Act and will
collect, use, and disseminate
information only as prescribed therein.
Data in this system will be subject to the
authorized releases in accordance with
the routine uses identified in this
system of records.
CDC will take precautionary measures
to minimize the risks of unauthorized
access to the records and the potential
harm to individual privacy or other
personal or property rights of
individuals whose data are maintained
in the system. CDC will collect only that
information necessary to perform the
system’s purpose. In addition, CDC will
make disclosures from the system only
with consent of the subject individual,
or his/her legal representative, or in
accordance with an applicable
exception provision of the Privacy Act.
CDC, therefore, does not anticipate an
unfavorable effect on individual privacy
as a result of information relating to
individuals.
Dated: June 22, 2007.
James D. Seligman,
Chief Information Officer, Office of the
Director, Centers for Disease Control and
Prevention.
Privacy Act System
NO. 09–20–0170
SYSTEM NAME:
National Select Agent Registry
(NSAR)/Select Agent Transfer and
Entity Registration Information System
(SATERIS), HHS/CDC/COTPER.
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
Division of Select Agents and Toxins
(DSAT), Coordinating Office for
Terrorism Preparedness and Emergency
Response (COTPER), Bldg. 20, Centers
for Disease Control and Prevention
(CDC), 1600 Clifton Road, NE., Atlanta,
GA 30333 and Federal Records Center,
4712 Southpark Blvd., Ellenwood, GA
30294.
CATEGORIES OF INDIVIDUALS COVERED BY THE
SYSTEM:
The Responsible Official, alternate
Responsible Official, owners of nongovernmental entities, and individuals
requesting access to select agents under
the provisions of Part 73, of Title 42 of
the Code of Federal Regulations (42 CFR
PO 00000
Frm 00029
Fmt 4703
Sfmt 4703
35995
part 73), Part 121 of Title 9 of the Code
of Federal Regulations (9 CFR Part 121),
and Part 331 of Title 7 of the Code of
Federal Regulations (7 CFR part 331).
CATEGORIES OF RECORDS IN THE SYSTEM:
The DSAT maintains records which
include the names of the Responsible
Official, alternate Responsible Official,
owners of non-governmental entities,
and individuals who have access, or
who have applied to have access to
select agents (defined as a virus,
bacteria, fungus or toxin that could pose
a severe threat to public health and
safety, to animal or plant health; or
animal or plant products), and the list
of select agents to which they have
access. The Responsible Official,
alternate Responsible Official, owners of
non-governmental entities, and
individuals requesting access to select
agents are required to provide their
name, address, date of birth, and job
title and the name of the institution that
would be housing the select agent(s).
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Public Health Security and
Bioterrorism Preparedness and
Response Act of 2002 and The
Agricultural Bioterrorism Protection Act
of 2002 (Pub. L. 107–188).
PURPOSE(S):
Records maintained in the National
Select Agent Registry (NSAR)—a joint
DSAT and U.S. Department of
Agriculture/Animal and Plant Health
Inspection Service (APHIS) information
management system—are accessed by
DSAT through the Select Agent Transfer
and Entity Registration Information
System (SATERIS) which is an user
interface for data entry, data query, and
routine reporting activities. The purpose
of this system of records is to limit
access to those select agents listed in 42
CFR Part 73, 9 CFR Part 121, and 7 CFR
Part 331 to those individuals who have
a legitimate need to handle or use such
select agents, and who are not identified
as a restricted person by the U.S.
Attorney General. The NSAR is also
used to track the possession, use, and
transfer of select agents and is a single
Web-based system shared by DSAT and
APHIS.
DSAT conducts regulatory oversight
of individuals and entities that possess,
use, or transfer select agents. This
includes the review of registration
applications, conducting inspections of
registered facilities or facilities
requesting registration, processing
requests to import select agents,
processing all reports and requests
received from individuals or entities
regarding a select agent, and
E:\FR\FM\02JYN1.SGM
02JYN1
35996
Federal Register / Vol. 72, No. 126 / Monday, July 2, 2007 / Notices
maintaining this information pertaining
to individuals and entities that possess,
use, and/or transfer select agents.
ROUTINE USES OF RECORDS MAINTAINED IN THE
SYSTEM, INCLUDING CATEGORIES OF USERS AND
THE PURPOSES OF SUCH USES
1. Records may be disclosed to
contractors to handle program work
overflow duties, performing many of the
same functions (listed in the Purpose
section above) as DSAT employees.
Contractors are required to maintain
Privacy Act safeguards with respect to
such records.
2. Records may be disclosed to health
departments and other public health or
cooperating medical authorities to deal
more effectively with outbreaks and
conditions of public health significance.
3. Personal information from this
system may be disclosed as a routine
use to assist the recipient Federal
agency in making a determination
concerning an individual’s
trustworthiness to access select agents;
to any Federal or State agency where the
purpose in making the disclosure is to
prevent access to select agents for use in
domestic or international terrorism or
for any criminal purpose; or to any
Federal or State agency to protect the
public health and safety with regard to
the possession, use, or transfer of select
agents.
4. Disclosure may be made to a
congressional office from the record of
an individual in response to a verified
inquiry from the congressional office
made at the written request of that
individual.
5. In the event of litigation where the
defendant is: (a) The Department, any
component of the Department, or any
employee of the Department in his or
her official capacity; (b) the United
States where the Department determines
that the claim, if successful, is likely to
directly affect the operations of the
Department or any of its components; or
(c) any Department employee in his or
her individual capacity where the
Justice Department has agreed to
represent such employee, disclosure
may be made to the Department of
Justice to enable that Department to
present an effective defense, provided
that such disclosure is compatible with
the purpose for which the records were
collected.
jlentini on PROD1PC65 with NOTICES
POLICIES AND PRACTICES FOR STORING,
RETRIEVING, ACCESSING, RETAINING, AND
DISPOSING OF RECORDS IN THE SYSTEM
STORAGE:
File folders, computer tapes and
disks, CD–ROMs.
RETRIEVABILITY:
By name or DOJ identifier number.
VerDate Aug<31>2005
22:57 Jun 29, 2007
Jkt 211001
SAFEGUARDS:
The following special safeguards are
provided to protect the records from
inadvertent disclosure:
1. Authorized Users: A database
security package is implemented on
CDC computers to control unauthorized
access to the system. Attempts to gain
access by unauthorized individuals are
automatically recorded and reviewed on
a regular basis. Individuals who have
routine access to these records are
limited to Select Agent Program staff
(DSAT FTEs and contractors) who have
responsibility for conducting regulatory
oversight of individuals and entities that
possess, use, or transfer select agents.
2. Physical Safeguards: Paper records
are maintained in locked cabinets in
locked rooms in a restricted access
location that is controlled by a cardkey
system, and security guard service
provides personnel screening of visitors.
Electronic data files are password
protected and stored in a restricted
access location. The computer room is
protected by an automatic sprinkler
system, numerous automatic sensors
(e.g., water, heat, smoke, etc.) are
installed, and a proper mix of portable
fire extinguishers is located throughout
the computer room. The system is
backed up on a nightly basis with copies
of the files stored off site in a secure
location. Computer workstations,
lockable personal computers, and
automated records are located in
secured areas.
3. Procedural Safeguards: Protection
for computerized records includes
programmed verification of valid user
identification code and password prior
to logging on to the system; mandatory
password changes, limited log-ins, virus
protection, and user rights/file attribute
restrictions. Password protection
imposes user name and password log-in
requirements to prevent unauthorized
access. Each user name is assigned
limited access rights to files and
directories at varying levels to control
file sharing. There are routine daily
backup procedures and secure off-site
storage is available for backup files.
Knowledge of individual tape
passwords is required to access tapes,
and access to the system is limited to
users obtaining prior supervisory
approval. To avoid inadvertent data
disclosure, a special additional
procedure is performed to ensure that
all Privacy Act data are removed from
computer tapes and/or other magnetic
media. When possible, a backup copy of
data is stored at an offsite location and
a log kept of all changes to each file and
all persons reviewing the file.
Additional safeguards may also be built
into the program by the system analyst
PO 00000
Frm 00030
Fmt 4703
Sfmt 4703
as warranted by the sensitivity of the
data set.
The DSAT and contractor employees
who maintain records are instructed in
specific procedures to protect the
security of records, and are to check
with the system manager prior to
making disclosure of data. When
individually identified data are being
used in a room, admittance at either
CDC or contractor sites is restricted to
specifically authorized personnel.
Appropriate Privacy Act provisions
are included in contracts and the CDC
Project Director, contract officers, and
project officers oversee compliance with
these requirements. Upon completion of
the contract, all data will be either
returned to CDC or destroyed, as
specified by the contract.
The USDA/APHIS maintains similarly
stringent safeguards that are discussed
within that agency’s Select Agent
system of records notice.
4. Implementation Guidelines: The
safeguards outlined above are in
accordance with the HHS Information
Security Program Policy and FIPS Pub
200, ‘‘Minimum Security Requirements
for Federal Information and Information
Systems.’’ Data maintained on CDC’s
Mainframe and the COTPER LAN are in
compliance with OMB Circular A–130,
Appendix III. Security is provided for
information collection, processing,
transmission, storage, and
dissemination in general support
systems and major applications.
RETENTION AND DISPOSAL:
The DSAT records and associated
information are retained and
dispositioned in accordance with DSAT
records retention schedule, N1–442–06–
1, pending approval by the National
Archives and Records Administration.
The DSAT records will be retained for
10 years in compliance with the records
retention schedule requirements or until
such time as no longer needed for
litigation or other records purposes.
Records will be transferred to a Federal
Records Center for storage when no
longer in active use. Final disposition of
records stored offsite at the Federal
Records Center will be accomplished by
a controlled process requesting final
disposition approval from the record
owner prior to any destruction to ensure
records are not needed for litigation or
other records purposes. Hard copy
records and Sensitive But Unclassified
(SBU) information designated for local
disposition will be placed in a locked
container or designated secure storage
area while awaiting destruction. All
SBU data will be destroyed in a manner
that precludes its reconstruction, such
as shredding. Electronic information
E:\FR\FM\02JYN1.SGM
02JYN1
Federal Register / Vol. 72, No. 126 / Monday, July 2, 2007 / Notices
will be deleted or overwritten using
overwriting software that wipes the
entire physical disk and not just the
virtual disk. Overwriting is required for
the destruction of all electronic SBU
information.
SYSTEM MANAGER(S) AND ADDRESS:
Director, Division of Select Agents
and Toxins, Coordinating Office for
Terrorism Preparedness and Emergency
Response, Bldg. 20, Rm. 4100, MS A46,
Centers for Disease Control and
Prevention, 1600 Clifton Road, NE.,
Atlanta, GA 30333.
NOTIFICATION PROCEDURE:
An individual may learn if a record
exists about himself or herself by
contacting the system manager at the
above address. Requesters in person
must provide driver’s license or other
positive identification. Individuals who
do not appear in person must submit a
notarized request on institutional
letterhead to verify their identity. The
knowing and willful request for or
acquisition of a record pertaining to an
individual under false pretenses is a
criminal offense under the Privacy Act
subject to a $5,000 fine and/or
imprisonment.
RECORD ACCESS PROCEDURES:
Same as notification procedures.
Requestors should also reasonably
specify the record contents being
sought. An accounting of disclosures
that have been made of the record, if
any, may also be requested.
CONTESTING RECORD PROCEDURES:
Contact the system manager at the
address specified above, reasonably
identify the record and specify the
information being contested, the
corrective action sought, and the
reasons for requesting the correction,
along with supporting information to
show how the record is inaccurate,
incomplete, untimely, or irrelevant.
RECORD SOURCE CATEGORIES:
Applicants registering for possession,
use, and transfer of select agents and the
U.S. Attorney General.
[FR Doc. E7–12682 Filed 6–29–07; 8:45 am]
jlentini on PROD1PC65 with NOTICES
BILLING CODE 4163–18–P
VerDate Aug<31>2005
22:57 Jun 29, 2007
Jkt 211001
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Centers for Medicare & Medicaid
Services
Privacy Act of 1974; Report of a New
System of Records
Department of Health and
Human Services (HHS), Center for
Medicare & Medicaid Services (CMS).
ACTION: Notice of a New System of
Records (SOR).
AGENCY:
SUMMARY: In accordance with the
requirements of the Privacy Act of 1974,
we are proposing to establish a new
system titled, ‘‘Medicare Master Death
Records File (MMDRF), System No. 09–
70–0597.’’ Under the provisions of
Sections 1106 (42 U.S.C. 1306 and
205(r) (42 U.S.C. 405(r) of the Social
Security Act (the Act), the Social
Security Administration (SSA) will
provide to CMS the SSA Death Master
File including unrestricted State death
data. CMS will use this death data to: (1)
Ensure that no future payments are
made to any physician or individually
enrolled practitioner and other
individuals for whom CMS has a record
of death, and (2) investigate and initiate
an appropriate response where a
deceased physician’s billing number has
been found to have been used as the
basis for a request for payment for
services allegedly rendered after the
physician’s date of death. Upon
independent verification of the facts
with respect to specific individuals, the
results will be used to update CMS
databases and may also be used to
support payment recovery operations
and or the work of law enforcement. We
have provided additional background
information about the new system in the
‘‘Supplementary Information’’ section
below.
The primary purpose of this system is
to collect and maintain Social Security
Administration death records for
physicians, non-physician practitioners
and individuals associated with
organizational providers and suppliers
to ensure payments are not made for
services rendered after confirmed date
of death and to prevent and/or detect
any fraud, waste and abuse. Information
retrieved from this system may be
disclosed to: (1) Support regulatory,
reimbursement, and policy functions
performed within the agency or by a
contractor, consultant, CMS grantee; (2)
assist another Federal or State agency
with information to contribute to the
accuracy of CMS’s proper payment of
Medicare benefits, enable such agency
to administer a Federal health benefits
PO 00000
Frm 00031
Fmt 4703
Sfmt 4703
35997
program, or to enable such agency to
fulfill a requirement of Federal statute
or regulation that implements a health
benefits program funded in whole or in
part with Federal funds; (3) support
litigation involving the agency; and (4)
combat fraud, waste, and abuse in
certain Federally-funded health benefits
programs.
EFFECTIVE DATES: CMS filed a new
system report with the Chair of the
House Committee on Oversight and
Government Reform, the Chair of the
Senate Committee on Homeland
Security and Governmental Affairs, and
the Administrator, Office of Information
and Regulatory Affairs, Office of
Management and Budget (OMB) on June
25, 2007. To ensure that all parties have
adequate time in which to comment, the
new SOR, including routine uses, will
become effective 40 days from the
publication of the notice, or from the
date it was submitted to OMB and the
Congress, whichever is later, unless
CMS receives comments that require
alterations to this notice. Although the
Privacy Act requires only that CMS
provide an opportunity for interested
persons to comment on the proposed
routine uses, CMS invites comments on
all portions of this notice.
ADDRESSES: The public should address
comments to: CMS Privacy Officer,
Division of Privacy Compliance,
Enterprise Architecture and Strategy
Group, Office of Information Services,
CMS, Room N2–04–27, 7500 Security
Boulevard, Baltimore, Maryland 21244–
1850. Comments received will be
available for review at this location, by
appointment, during regular business
hours, Monday through Friday from 9
a.m.—3 p.m., Eastern Time zone.
FOR FURTHER INFORMATION CONTACT:
Allen Gillespie, Technical Advisor,
Division of Provider/Supplier
Enrollment, Program Integrity Group,
Office of Financial Management, Mail
Stop C3–24–01, Centers for Medicare &
Medicaid Services, 7500 Security
Boulevard, Baltimore, MD 21244–1849.
He can be reached by telephone at 410–
786–5996, or via e-mail at
allen.gillespie@cms.hhs.gov.
SUPPLEMENTARY INFORMATION: CMS staff
will develop a program to compare data
on the monthly MMDRF with
individuals in the Provider Enrollment
Chain Ownership System (PECOS). A
report of potential matches from the
MMDRF and PECOS will be distributed
monthly to the Parts A and B MACs and
affiliated contractors. CMS will issue
manual instructions with procedures
contractors should follow to determine
if the individual name on the monthly
report is a match to the individual in the
E:\FR\FM\02JYN1.SGM
02JYN1
Agencies
[Federal Register Volume 72, Number 126 (Monday, July 2, 2007)]
[Notices]
[Pages 35993-35997]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E7-12682]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Disease Control and Prevention
Privacy Act of 1974; New System of Records
AGENCY: Department of Health and Human Services (HHS), Centers for
Disease Control and Prevention (CDC).
ACTION: Notice of a New System of Records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the requirements of the Privacy Act, the
Centers for Disease Control and Prevention (CDC) is proposing to
establish a new system of records (SOR), 09-20-0170, ``National Select
Agent Registry (NSAR)/Select Agent Transfer and Entity Registration
Information System (SATERIS), HHS/CDC/COTPER.'' The purpose of the
system is to limit access to those biological agents and toxins listed
in 42 CFR Part 73, 9 CFR Part 121, and 7 CFR Part 331, to those
individuals who have a legitimate need to handle or use such agents or
toxins, and who are not identified as restricted persons by the U.S.
Attorney General. NSAR is a single web-based information management
system shared by CDC and the U.S. Department of Agriculture (USDA)/
Animal and Plant Health Inspection Service (APHIS) that tracks the
possession, use and transfer of select agents and toxins that could
pose a severe threat to public health and safety, to the health and
safety of animals, and to the safety of plants or animal and plant
products. We have provided background information about the new system
in the SUPPLEMENTARY INFORMATION section below.
DATES: Effective Date: CDC filed a new SOR report with the Chair of the
House Committee on Government Reform and Oversight, the Chair of the
Senate Committee on Homeland Security & Governmental Affairs, and the
Administrator, Office of Information and Regulatory Affairs, Office of
Management and Budget (OMB) on June 25, 2007. CDC invites interested
parties to submit comments on the proposed routine uses. To ensure that
all parties have adequate time in which to comment, the new system will
be effective 30 days from the publication of this notice, or 40 days
from the date it was submitted to OMB and the Congress, whichever is
later, unless CDC receives comments that persuade us to defer
implementation.
ADDRESSES: Comments should be addressed to the CDC Privacy Act Officer
at the address listed below. Comments received will be available for
review at this location by appointment during regular business hours
from 8 a.m. to 4:30 p.m., Monday through Friday in the CDC Roybal
Facility, Building 21, Room 8125, Atlanta, Georgia.
FOR FURTHER INFORMATION CONTACT: Betsey S. Dunaway, Privacy Act
Officer, Office of the Chief Science Officer, Centers for Disease
Control and Prevention, 1600 Clifton Road, NE., Building 21, Room 8125,
Mailstop D-74, Atlanta, Georgia 30333, (404) 639-4642.
SUPPLEMENTARY INFORMATION: CDC proposes to establish a new system of
records within its Coordinating Office for Terrorism Preparedness and
Emergency Response (COTPER): 09-20-0170, ``National Select Agent
Registry (NSAR)/ Select Agent Transfer and Entity Registration
Information System (SATERIS), HHS/CDC/COTPER.'' An important component
of the nation's overall terrorism deterrence policy, the Division of
Select Agents and Toxins (DSAT) in the Coordinating Office for
Terrorism Preparedness and Emergency Response (COTPER) within the CDC
regulates the possession, use, and transfer of biological agents and
toxins (select agents) that could pose a severe threat to public health
and safety. A select agent is defined as a virus, bacteria, fungus or
toxin that could pose a severe threat to public health and safety, to
animal or plant health; or animal or plant products.
I. Description of the Proposed System of Records
A. Statutory and Regulatory Basis for SOR. The Public Health
Security and Bioterrorism Preparedness and Response Act of 2002
requires entities to register with the U.S. Department of Health and
Human Services (HHS) if they possess, use, or transfer select agents
that could pose a severe threat to public health and safety. The
Agricultural Bioterrorism Protection Act of 2002 requires that
facilities handling select agents that could pose a severe threat to
animal or plant health; or animal or plant products register with the
USDA. Within HHS, the DSAT is responsible for registering entities and
personnel who either possess or are applying for approval to possess,
use or transfer select agents that could pose a severe threat to public
health and safety. Within the USDA, APHIS has a similar responsibility
for registering entities and personnel handling agents that pose a
severe threat to animal or plant health; or animal or plant products.
The Acts require safeguards and security measures that will
adequately protect these agents. This includes controlling access and
screening of entities and personnel through security risk assessments
conducted by the U.S. Attorney General. The Acts also require the
establishment of a national database of registered entities. While some
entities register for select agents regulated only by HHS, others for
select agents regulated only by USDA, there are a number of entities
registering for select agents that can pose a severe threat to public
health and safety, to animal health, or to animal products (``overlap''
select agents). Since DSAT and APHIS coordinate regulatory activities
for those overlap select agents that would be regulated by both
agencies, the Acts require that a single national database be
established. This new Privacy Act system of records notice (SORN)
describes the records and processes that enable DSAT to fulfill HHS'
requirements; APHIS will be publishing a similar SORN to address how
USDA will fulfill theirs.
B. Collection and Maintenance of Data in the System
CDC will only collect the minimum amount of personal data necessary
to achieve the purpose of this system, which is to limit access to the
select agents listed in 42 CFR Part 73, 9 CFR Part 121, and 7 CFR Part
331, to those individuals who have a legitimate need to handle or use
such agents, and who are not identified as a restricted person by the
U.S. Attorney General. The data elements required are: name, address,
date of birth, job title, and the name of the institution that would be
housing the select agent(s).
Entities handling select agents must appoint a Responsible Official
within their organization who certifies that the entity meets federal
requirements for handling select agents such as having security
measures in place to protect the select agents they possess from theft,
loss and unauthorized access, and safety measures to prevent the
release of agents. DSAT's SOR includes personal information on those
individuals who have access or who have applied to have access to
select agents, and the list of select agents to which they have access
or would have access.
[[Page 35994]]
II. Agency Policies, Procedures, and Restrictions on the Routine Use
The Privacy Act permits us to disclose information without an
individual's consent if the information is to be used for a purpose
that is compatible with the purpose(s) for which the information was
collected. Any such compatible disclosure of data is known as a
``routine use.'' The government will only release select agent
information that can be associated with an individual as provided for
under ``Section III. Proposed Routine Use Disclosures of Data in the
System.'' We will only collect the minimum personal data necessary to
achieve the purpose of this system.
CDC has the following policies and procedures concerning
disclosures of information that will be maintained in the system.
Disclosure of information from the SOR will be approved only to the
extent necessary to accomplish the purpose of the disclosure and only
after CDC:
A. Determines that the use or disclosure is consistent with the
reason that the data are being collected, e.g., to limit access to
select agents to those individuals who have a legitimate need to handle
or use select agents and who are not identified as a restricted person
by the U.S. Attorney General.
B. DETERMINES THAT:
1. The purpose for which the disclosure is to be made can only be
accomplished if the record is provided in individually identifiable
form;
2. The purpose for which the disclosure is to be made is of
sufficient importance to warrant the effect and/or risk on the privacy
of the individual that additional exposure of the record might bring;
and
3. There is a strong probability that the proposed use of the data
would in fact accomplish the stated purpose(s).
C. Requires the information recipient to:
1. Establish administrative, technical, and physical safeguards to
prevent unauthorized use of disclosure of the record;
2. Remove or destroy at the earliest time all identifiable
information; and
3. Agree to not use or disclose the information for any purpose
other than the stated purpose under which the information was
disclosed.
D. Determines that the data are valid and reliable.
III. Proposed Routine Use Disclosures of Data in the System
The Privacy Act permits us to disclose information without an
individual's consent if the information is to be used for a purpose
that is compatible with the purpose(s) for which the information was
collected. Any such compatible disclosure of data is known as a
``routine use.'' The proposed routine uses in this system meet the
compatibility requirement of the Privacy Act. We are proposing to
establish the following routine use disclosures of information
maintained in the system:
A. Records may be disclosed to contractors to handle program work
overflow duties, performing many of the same functions as DSAT
employees. Contractors are required to maintain Privacy Act safeguards
with respect to such records. These functions include conducting
regulatory oversight of individuals and entities that possess, use, or
transfer select agents, including the review of registration
applications, conducting inspections of registered facilities or
facilities requesting registration, and maintaining this information
pertaining to individuals and entities that possess, use, and/or
transfer select agents. DSAT contracts out certain functions when doing
so would contribute to efficient and effective operations of the
agency. DSAT must be able to give a contractor the information
necessary for the contractor to fulfill its duties. Safeguards are
provided in the contract prohibiting the contractor from using or
disclosing the information for any purpose other than that described in
the Statement of Work and requires the contractor to return or destroy
all information at the contract's completion.
B. Records may be disclosed to health departments and other public
health or cooperating medical authorities to deal more effectively with
outbreaks and conditions of public health significance. When outbreaks
or other conditions of public health significance that might have been
caused by exposure to select agents (either accidental or otherwise)
occur, CDC's sharing of information on those individuals and
organizations registered to possess select agents could prove
beneficial to the health department's investigation.
C. Personal information from this system may be disclosed as a
routine use to assist the recipient Federal agency in making a
determination concerning an individual's trustworthiness to access
select agents; to any Federal or State agency where the purpose in
making the disclosure is to prevent access to select agents for use in
domestic or international terrorism or for any criminal purpose; or to
any Federal or State agency to protect the public health and safety
with regard to the possession, use, or transfer of select agents.
Based on the provisions of the Acts, the Attorney General has the
authority and responsibility to conduct electronic database checks
(i.e., the security risk assessments) on the Responsible Official,
alternate Responsible Official, owners of non-governmental entities,
and individuals requesting access to select agents. The Federal Bureau
of Investigation, Criminal Justice Information Services Division
(CJIS), has been delegated authority for conducting these security risk
assessments. Therefore, the information must be shared with the CJIS
for them to conduct a security risk assessment to ensure that
individuals requesting access to select agents are not identified as a
restricted person based on criteria established in the U.S.A. Patriot
Act. This is compatible with the overall purpose of the system--that
only trustworthy individuals are granted access.
Other Federal or State agencies may require the information DSAT
possesses on individuals with access to select agents and the
institutions at which those agents are housed to aid in their
investigations of domestic or international terrorism or for any other
criminal purpose. The purpose of the system is to be certain that only
individuals who have a legitimate need to handle or use such select
agents have access to them; this routine use is compatible in that this
disclosure is done to prevent access to select agents for terrorism or
other criminal purposes. State emergency planners may need this
identifiable information to fulfill their responsibilities.
The overall purpose of this SOR is to protect the public health and
safety. Federal and State agency emergency responders may require
DSAT's identifiable information if select agents are accidentally
released or otherwise used inappropriately with the ultimate goal of
protecting the public's health and safety. Records may also be shared
with the Department of Transportation to ensure that the transfer of
select agents is done safely and in compliance with their regulations--
a use in line with CDC's purpose of safely transferring select agents
for which it has responsibility.
D. Disclosure may be made to a congressional office from the record
of an individual in response to a verified inquiry from the
congressional office made at the written request of that individual.
When a constituent requests a congressional office to facilitate
obtaining information from this CDC system, it is compatible to provide
such information, since this is in line with the overall purpose of the
Privacy Act
[[Page 35995]]
which is to provide access to the subject individual of the records the
government has on him or her.
E. In the event of litigation where the defendant is: (a) The
Department, any component of the Department, or any employee of the
Department in his or her official capacity; (b) the United States where
the Department determines that the claim, if successful, is likely to
directly affect the operations of the Department or any of its
components; or (c) any Department employee in his or her individual
capacity where the Justice Department has agreed to represent such
employee, disclosure may be made to the Department of Justice to enable
that Department to present an effective defense, provided that such
disclosure is compatible with the purpose for which the records were
collected.
Whenever CDC is involved in litigation dealing with the DSAT, and
CDC policies or operations could be affected by the outcome of the
litigation, CDC must be able to disclose identifiable information to
the Department of Justice so that an effective defense could be
presented.
IV. Safeguards
The CDC/DSAT has safeguards in place for authorized users and
monitors such users to ensure against unauthorized use. Personnel with
access to the system have been trained in Privacy Act and information
security requirements. Employees maintaining records are instructed not
to release data until the intended recipient agrees to implement
appropriate management, operational and technical safeguards sufficient
to protect the confidentiality, integrity and availability of the
information and information systems and to prevent unauthorized access.
This system will conform to all applicable Federal laws and
regulations and Federal and HHS policies and standards as they relate
to information security and data privacy. These laws and regulations
may apply but are not limited to: the Privacy Act of 1974; the Federal
Information Security Management Act of 2002; the Computer Fraud and
Abuse Act of 1986; the E-Government Act of 2002; the Clinger-Cohen Act
of 1996; the Medicare Modernization Act of 2003, and the corresponding
implementing regulations. OMB Circular A-130, Management of Federal
Resources, Appendix III, Security of Federal Automated Information
Resources also applies. Federal, HHS and CDC policies and standards
include but are not limited to: all pertinent National Institute of
Standards and Technology publications and the HHS Information Systems
Program Handbook.
V. Effects of the Proposed System of Records on Individual Rights
CDC proposes to establish this system in accordance with the
principles and requirements of the Privacy Act and will collect, use,
and disseminate information only as prescribed therein. Data in this
system will be subject to the authorized releases in accordance with
the routine uses identified in this system of records.
CDC will take precautionary measures to minimize the risks of
unauthorized access to the records and the potential harm to individual
privacy or other personal or property rights of individuals whose data
are maintained in the system. CDC will collect only that information
necessary to perform the system's purpose. In addition, CDC will make
disclosures from the system only with consent of the subject
individual, or his/her legal representative, or in accordance with an
applicable exception provision of the Privacy Act. CDC, therefore, does
not anticipate an unfavorable effect on individual privacy as a result
of information relating to individuals.
Dated: June 22, 2007.
James D. Seligman,
Chief Information Officer, Office of the Director, Centers for Disease
Control and Prevention.
Privacy Act System
NO. 09-20-0170
System Name:
National Select Agent Registry (NSAR)/Select Agent Transfer and
Entity Registration Information System (SATERIS), HHS/CDC/COTPER.
Security Classification:
Unclassified.
System Location:
Division of Select Agents and Toxins (DSAT), Coordinating Office
for Terrorism Preparedness and Emergency Response (COTPER), Bldg. 20,
Centers for Disease Control and Prevention (CDC), 1600 Clifton Road,
NE., Atlanta, GA 30333 and Federal Records Center, 4712 Southpark
Blvd., Ellenwood, GA 30294.
Categories of Individuals Covered By the System:
The Responsible Official, alternate Responsible Official, owners of
non-governmental entities, and individuals requesting access to select
agents under the provisions of Part 73, of Title 42 of the Code of
Federal Regulations (42 CFR part 73), Part 121 of Title 9 of the Code
of Federal Regulations (9 CFR Part 121), and Part 331 of Title 7 of the
Code of Federal Regulations (7 CFR part 331).
Categories of Records in the System:
The DSAT maintains records which include the names of the
Responsible Official, alternate Responsible Official, owners of non-
governmental entities, and individuals who have access, or who have
applied to have access to select agents (defined as a virus, bacteria,
fungus or toxin that could pose a severe threat to public health and
safety, to animal or plant health; or animal or plant products), and
the list of select agents to which they have access. The Responsible
Official, alternate Responsible Official, owners of non-governmental
entities, and individuals requesting access to select agents are
required to provide their name, address, date of birth, and job title
and the name of the institution that would be housing the select
agent(s).
Authority For Maintenance of the System:
Public Health Security and Bioterrorism Preparedness and Response
Act of 2002 and The Agricultural Bioterrorism Protection Act of 2002
(Pub. L. 107-188).
Purpose(s):
Records maintained in the National Select Agent Registry (NSAR)--a
joint DSAT and U.S. Department of Agriculture/Animal and Plant Health
Inspection Service (APHIS) information management system--are accessed
by DSAT through the Select Agent Transfer and Entity Registration
Information System (SATERIS) which is an user interface for data entry,
data query, and routine reporting activities. The purpose of this
system of records is to limit access to those select agents listed in
42 CFR Part 73, 9 CFR Part 121, and 7 CFR Part 331 to those individuals
who have a legitimate need to handle or use such select agents, and who
are not identified as a restricted person by the U.S. Attorney General.
The NSAR is also used to track the possession, use, and transfer of
select agents and is a single Web-based system shared by DSAT and
APHIS.
DSAT conducts regulatory oversight of individuals and entities that
possess, use, or transfer select agents. This includes the review of
registration applications, conducting inspections of registered
facilities or facilities requesting registration, processing requests
to import select agents, processing all reports and requests received
from individuals or entities regarding a select agent, and
[[Page 35996]]
maintaining this information pertaining to individuals and entities
that possess, use, and/or transfer select agents.
Routine Uses of Records Maintained In the System, Including Categories
of Users and the Purposes of Such Uses
1. Records may be disclosed to contractors to handle program work
overflow duties, performing many of the same functions (listed in the
Purpose section above) as DSAT employees. Contractors are required to
maintain Privacy Act safeguards with respect to such records.
2. Records may be disclosed to health departments and other public
health or cooperating medical authorities to deal more effectively with
outbreaks and conditions of public health significance.
3. Personal information from this system may be disclosed as a
routine use to assist the recipient Federal agency in making a
determination concerning an individual's trustworthiness to access
select agents; to any Federal or State agency where the purpose in
making the disclosure is to prevent access to select agents for use in
domestic or international terrorism or for any criminal purpose; or to
any Federal or State agency to protect the public health and safety
with regard to the possession, use, or transfer of select agents.
4. Disclosure may be made to a congressional office from the record
of an individual in response to a verified inquiry from the
congressional office made at the written request of that individual.
5. In the event of litigation where the defendant is: (a) The
Department, any component of the Department, or any employee of the
Department in his or her official capacity; (b) the United States where
the Department determines that the claim, if successful, is likely to
directly affect the operations of the Department or any of its
components; or (c) any Department employee in his or her individual
capacity where the Justice Department has agreed to represent such
employee, disclosure may be made to the Department of Justice to enable
that Department to present an effective defense, provided that such
disclosure is compatible with the purpose for which the records were
collected.
Policies and Practices For Storing, Retrieving, Accessing, Retaining,
and Disposing of Records In the System
Storage:
File folders, computer tapes and disks, CD-ROMs.
Retrievability:
By name or DOJ identifier number.
Safeguards:
The following special safeguards are provided to protect the
records from inadvertent disclosure:
1. Authorized Users: A database security package is implemented on
CDC computers to control unauthorized access to the system. Attempts to
gain access by unauthorized individuals are automatically recorded and
reviewed on a regular basis. Individuals who have routine access to
these records are limited to Select Agent Program staff (DSAT FTEs and
contractors) who have responsibility for conducting regulatory
oversight of individuals and entities that possess, use, or transfer
select agents.
2. Physical Safeguards: Paper records are maintained in locked
cabinets in locked rooms in a restricted access location that is
controlled by a cardkey system, and security guard service provides
personnel screening of visitors. Electronic data files are password
protected and stored in a restricted access location. The computer room
is protected by an automatic sprinkler system, numerous automatic
sensors (e.g., water, heat, smoke, etc.) are installed, and a proper
mix of portable fire extinguishers is located throughout the computer
room. The system is backed up on a nightly basis with copies of the
files stored off site in a secure location. Computer workstations,
lockable personal computers, and automated records are located in
secured areas.
3. Procedural Safeguards: Protection for computerized records
includes programmed verification of valid user identification code and
password prior to logging on to the system; mandatory password changes,
limited log-ins, virus protection, and user rights/file attribute
restrictions. Password protection imposes user name and password log-in
requirements to prevent unauthorized access. Each user name is assigned
limited access rights to files and directories at varying levels to
control file sharing. There are routine daily backup procedures and
secure off-site storage is available for backup files.
Knowledge of individual tape passwords is required to access tapes,
and access to the system is limited to users obtaining prior
supervisory approval. To avoid inadvertent data disclosure, a special
additional procedure is performed to ensure that all Privacy Act data
are removed from computer tapes and/or other magnetic media. When
possible, a backup copy of data is stored at an offsite location and a
log kept of all changes to each file and all persons reviewing the
file. Additional safeguards may also be built into the program by the
system analyst as warranted by the sensitivity of the data set.
The DSAT and contractor employees who maintain records are
instructed in specific procedures to protect the security of records,
and are to check with the system manager prior to making disclosure of
data. When individually identified data are being used in a room,
admittance at either CDC or contractor sites is restricted to
specifically authorized personnel.
Appropriate Privacy Act provisions are included in contracts and
the CDC Project Director, contract officers, and project officers
oversee compliance with these requirements. Upon completion of the
contract, all data will be either returned to CDC or destroyed, as
specified by the contract.
The USDA/APHIS maintains similarly stringent safeguards that are
discussed within that agency's Select Agent system of records notice.
4. Implementation Guidelines: The safeguards outlined above are in
accordance with the HHS Information Security Program Policy and FIPS
Pub 200, ``Minimum Security Requirements for Federal Information and
Information Systems.'' Data maintained on CDC's Mainframe and the
COTPER LAN are in compliance with OMB Circular A-130, Appendix III.
Security is provided for information collection, processing,
transmission, storage, and dissemination in general support systems and
major applications.
Retention and Disposal:
The DSAT records and associated information are retained and
dispositioned in accordance with DSAT records retention schedule, N1-
442-06-1, pending approval by the National Archives and Records
Administration. The DSAT records will be retained for 10 years in
compliance with the records retention schedule requirements or until
such time as no longer needed for litigation or other records purposes.
Records will be transferred to a Federal Records Center for storage
when no longer in active use. Final disposition of records stored
offsite at the Federal Records Center will be accomplished by a
controlled process requesting final disposition approval from the
record owner prior to any destruction to ensure records are not needed
for litigation or other records purposes. Hard copy records and
Sensitive But Unclassified (SBU) information designated for local
disposition will be placed in a locked container or designated secure
storage area while awaiting destruction. All SBU data will be destroyed
in a manner that precludes its reconstruction, such as shredding.
Electronic information
[[Page 35997]]
will be deleted or overwritten using overwriting software that wipes
the entire physical disk and not just the virtual disk. Overwriting is
required for the destruction of all electronic SBU information.
System manager(s) and Address:
Director, Division of Select Agents and Toxins, Coordinating Office
for Terrorism Preparedness and Emergency Response, Bldg. 20, Rm. 4100,
MS A46, Centers for Disease Control and Prevention, 1600 Clifton Road,
NE., Atlanta, GA 30333.
Notification Procedure:
An individual may learn if a record exists about himself or herself
by contacting the system manager at the above address. Requesters in
person must provide driver's license or other positive identification.
Individuals who do not appear in person must submit a notarized request
on institutional letterhead to verify their identity. The knowing and
willful request for or acquisition of a record pertaining to an
individual under false pretenses is a criminal offense under the
Privacy Act subject to a $5,000 fine and/or imprisonment.
Record Access Procedures:
Same as notification procedures. Requestors should also reasonably
specify the record contents being sought. An accounting of disclosures
that have been made of the record, if any, may also be requested.
Contesting Record Procedures:
Contact the system manager at the address specified above,
reasonably identify the record and specify the information being
contested, the corrective action sought, and the reasons for requesting
the correction, along with supporting information to show how the
record is inaccurate, incomplete, untimely, or irrelevant.
Record Source Categories:
Applicants registering for possession, use, and transfer of select
agents and the U.S. Attorney General.
[FR Doc. E7-12682 Filed 6-29-07; 8:45 am]
BILLING CODE 4163-18-P