Privacy Act of 1974; New System of Records, 46228-46231 [07-4019]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Health Resources and Services Administration

[Federal Register Volume 72, Number 159 (Friday, August 17, 2007)]
[Notices]
[Pages 46228-46231]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 07-4019]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Health Resources and Services Administration


Privacy Act of 1974; New System of Records

AGENCY: Health Resources and Services Administration (HRSA), HHS.

[[Page 46229]]


ACTION: Notification of New System of Records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act, the 
Health Resources and Services Administration (HRSA) is publishing 
notice of a proposal to establish a new system of records. The Stem 
Cell Therapeutic and Research Act of 2005 (the Act) authorizes the C.W. 
Bill Young Cell Transplantation Program (the Program) and provides for 
the collection, maintenance, and distribution of human blood stem cells 
for the treatment of patients and for research. The Program consists of 
four interrelated components each operated under a separate contract. 
The four components are: The Bone Marrow Coordinating Center; the Cord 
Blood Coordinating Center; the Office of Patient Advocacy/Single Point 
of Access; and the Stem Cell Therapeutic Outcomes Database. The 
contracts for operation of the Bone Marrow Coordinating Center, Cord 
Blood Coordinating Center, and Office of Patient Advocacy/Single Point 
of Access were awarded to the National Marrow Donor Program in 
September, 2006. A single contract for the Stem Cell Therapeutic 
Outcomes Database was awarded to the Center for International Blood and 
Marrow Transplant Research (CIBMTR) at the Medical College of Wisconsin 
in September, 2006 as well.
    As identified by the Act, the Program is charged with: Operating a 
system for identifying, matching, and facilitating the distribution of 
bone marrow that is suitably matched to candidate patients; operating a 
system for identifying, matching, and facilitating the distribution of 
donated umbilical cord blood units that are suitably matched to 
candidate patients; providing a means by which transplant physicians, 
other healthcare professionals, and patients can electronically search 
for and access all available adult marrow donors available through the 
Program; recruiting potential adult volunteer marrow donors; 
coordinating with other Federal programs to maintain and expand medical 
contingency response capabilities; carrying out informational and 
educational activities; providing patient advocacy services; providing 
case management services for potential donors; and collecting, 
analyzing, and publishing blood stem cell transplantation related data 
in a standardized electronic format. This system of records is required 
to comply with the implementation directives of the Act, Public Law 
109-129. The records will be used for the C.W. Bill Young Cell 
Transplantation Program's planning, implementation, evaluation, 
monitoring, and document storage purposes.

DATES: HRSA invites interested parties to submit comments on the 
proposed New System of Records on or before September 26, 2007. As of 
the date of the publication of this Notice, HRSA has sent a Report of 
New System of Records to Congress and to the Office of Management and 
Budget (OMB). The New System of Records will be effective 40 days from 
the date submitted to OMB unless HRSA receives comments that would 
result in contrary determination.

ADDRESSES: Please address comments to Health Resources and Services 
Administration Privacy Act Coordinator, Donn Taylor, 5600 Fishers Lane, 
Room 14A-20, Rockville, Maryland 20857; telephone (301) 443-0204. This 
is not a toll-free number. Comments received will be available for 
inspection at this same address from 9 a.m. to 3 p.m., Monday through 
Friday.

FOR FURTHER INFORMATION CONTACT: James F. Burdick, M.D., Director, 
Division of Transplantation, HSB, HRSA, 5600 Fishers Lane, Room 12C-06, 
Rockville, Maryland 20857; telephone (301) 443-7577; fax (301) 594-
6095; or e-mail: jburdick@hrsa.gov. This is not a toll-free number.

SUPPLEMENTARY INFORMATION: The Health Resources and Services 
Administration proposes to establish a new system of records: ``C.W. 
Bill Young Cell Transplantation Program''. The Stem Cell Therapeutic 
and Research Act of 2005 establishes the C.W. Bill Young Cell 
Transplantation Program which maintains information related to patients 
in need of a blood stem cell transplant and potential adult volunteer 
blood stem cell donors who have agreed to be listed on the registry 
maintained by the Program. Additionally, the Program maintains 
information related to the outcomes of patients who have undergone 
blood stem cell transplantation.

    Dated: August 7, 2007.
Elizabeth M. Duke,
Administrator.
09-15-0068

System Name:
    The ``C.W. Bill Young Cell Transplantation Program,'' which is 
comprised of the Office of Patient Advocacy/Single Point of Access, the 
Bone Marrow Coordinating Center, the Cord Blood Coordinating Center, 
and the Stem Cell Therapeutic Outcomes Database.

Security Classification:
    None.

System Location:
    Data collected by the C.W. Bill Young Cell Transplantation Program 
(the Program) are maintained by the National Marrow Donor Program 
(NMDP) and the Medical College of Wisconsin, contractors for the 
Program. The Division of Transplantation within the Health Resources 
and Service Administration oversees the Program and the contracts with 
the NMDP and Medical College of Wisconsin.
    Records associated with the C.W. Bill Young Cell Transplantation 
Program are located at the National Marrow Donor Program, 3001 Broadway 
Street, NE., Suite 500, Minneapolis, MN 55413.
    Additional records associated with the Stem Cell Therapeutic 
Outcomes Database component of the Program are located at the Medical 
College of Wisconsin's Center for International Blood and Marrow 
Transplant Research (CIBMTR), 8701 Watertown Plank Road, Milwaukee, WI 
53226.

Categories of Individuals Covered by the System:
    1. Volunteers whose bone marrow, peripheral blood or cord blood 
donations are to be used for hematopoietic reconstitution or other 
therapeutic applications on behalf of patients in need.
    2. Patients searching for an unrelated donor or who are served by 
the C.W. Bill Young Cell Transplantation Program.
    3. Recipients of allogeneic blood stem cell transplantation.

Categories of Records in the System:
    Records consist of documents (printed and electronic) containing 
all information necessary to manage and facilitate patient searches and 
to track detailed post-transplant clinical status, including but not 
limited to documentation and correspondence concerning patients in need 
of (or recipients of) blood stem cell transplants and volunteers listed 
on the Program's registry as potential blood stem cell donors. These 
documents include all information necessary to manage and facilitate 
patient searches, and to track detailed post-transplant clinical 
status. Information maintained in the system may include, but is not 
limited to: Name, Social Security number (voluntary), identifiers 
assigned by the contractors, transplant center and provider number, 
State and zip code of residence, citizenship, race/ethnicity, gender, 
date and time of transplantation or donation, name of transplant center

[[Page 46230]]

(or other identifier), histocompatibility status, patient condition 
before and after transplantation, immunosuppressive medication, cause 
of death (if appropriate), health care coverage, and employment.

Authority for maintenance of the System:
    Public Law 109-129 establishes the C.W. Bill Young Cell 
Transplantation Program, authorizing the Department to establish by 
contract a system for identifying, matching and facilitating bone 
marrow and cord blood transplants, including recruitment, patient 
advocacy and maintenance of a stem cell therapeutic outcomes database.

Purpose(s):
    The purpose of the system is to support the Program's mission to 
facilitate and increase access to blood stem cell transplantation. 
Additionally, the collection of accurate information will be used to 
advise the Secretary of the Department of Health and Human Services and 
the Advisory Council on Blood Stem Cell Transplantation on matters 
related to the Program and for ongoing monitoring of the Program by the 
Health Resources and Services Administration.

Routine Uses of Records Maintained in the System, Including Categories 
of Users and the Purposes of Such Uses:
    Any disclosure of records or information contained therein related 
to the Program will be made with the intent of providing and 
disseminating accurate and timely information required by patients, 
physicians, donors and the Program to facilitate and increase access to 
blood stem cell transplantation.
    1. Departmental contractors who have been engaged by the Department 
to assist in accomplishment of a departmental function related to the 
purposes for this system of records and who need to have access to the 
records in order to assist the Department.
    2. HRSA, acting through its contractors, may disclose information 
regarding blood stem cell donors, blood stem cell transplant 
candidates, and blood stem cell transplant recipients to transplant 
centers and NMDP participating organizations provided that such 
disclosure is compatible with the purpose for which the records were 
collected including: matching donor blood stem cells with recipients, 
monitoring compliance of member organizations with contractor 
requirements, reviewing and reporting periodically to the public on the 
status of blood stem cell donation and transplantation in the United 
States. This information may consist of donor or patient identification 
information, and pertinent medical information.
    3. Disclosures of certain information may be made to personnel 
involved in the care and management of volunteer blood stem cell 
donors. Disclosures of certain information may be made to patients or 
their designated representatives for purposes of facilitating searches 
for blood stem cell donors or products and/or facilitation of unrelated 
donor transplants.
    4. Disclosures may be made by and between the contractors for the 
Office of Patient Advocacy/Single Point of Access, the Bone Marrow 
Coordinating Center, the Cord Blood Coordinating Center, the Stem Cell 
Therapeutic Outcomes Database, and NMDP participating centers for 
purposes of carrying out the statutory charge of the C.W. Bill Young 
Cell Transplantation Program.
    5. In the event of litigation where the defendant is (a) The 
Department, any component of the Department, or any employee of the 
Department in his or her official capacity; (b) the United States where 
the Department determines that the claim, if successful, is likely to 
affect directly the operation of the Department or any of its 
components; or (c) any Department employee in his or her individual 
capacity where the Department of Justice has agreed to represent such 
employee, for example, in defending a claim against the Public Health 
Service in connection with such individual, disclosure may be made to 
the Department of Justice to enable the Department to present an 
effective defense.
    6. Disclosure may be made to a congressional office from the record 
of an individual in response to a verified inquiry from the 
congressional office made at the written request of that individual.
    7. Disclosure may be made for research purposes, when the 
Department, independently or through its contractor(s): (a) Has 
determined that the use or disclosure does not violate legal or policy 
limitations under which the record was provided, collected, or 
obtained; (b) has determined that a bona fide research/analysis purpose 
exists; (c) has required the recipient to: (1) Establish strict 
limitations concerning the receipt and use of patient-identified data; 
(2) establish reasonable administrative, technical, and physical 
safeguards to protect the confidentiality of the data and to prevent 
the unauthorized use or disclosure of the record; (3) remove, destroy, 
or return the information that identifies the individual at the 
earliest time at which removal or destruction can be accomplished 
consistent with the purpose of the research project, unless the 
recipient has presented adequate justification of a research or health 
nature for retaining such information; and (4) make no further use of 
disclosure of the record except as authorized by HRSA or its 
contractor(s) or when required by law; (d) has determined that other 
applicable safeguards or protocols will be followed; and (e) has 
secured a written statement attesting to the recipient's understanding 
of, and willingness to abide by these provisions.

Policies and Practices For Storing, Retrieving, Accessing, Retaining, 
and Disposing of Records in the System:
Storage:
    Records are maintained in file folders and in computer data files.

Retrievability:
    Retrieval of donor or patient records will be limited to authorized 
users for search or transplant management purposes. Patient records are 
retrieved using a unique ID number assigned to patients once registered 
in the system by the transplant center managing their care or through 
the use of other identifying information. Donor records may be 
retrieved by a unique ID assigned by the system or through the use of 
other identifying information.

Safeguards:
    1. Authorized Users: Access is limited to authorized contract 
personnel responsible for administering the program. Authorized 
personnel include the program managers/program specialists who have 
responsibilities for implementing the program and the HRSA Information 
Systems Security Officer. The contractor(s) shall maintain current 
lists of authorized users.
    2. Assign Responsibility for Security: Responsibility is assigned 
to a management official knowledgeable of the nature of the information 
and processes supported by the C.W. Bill Young Cell Transplantation 
Program and in the management, personnel, operational, and technical 
controls used to protect it.
    3. Perform Risk Assessment: A risk assessment was conducted in 
conjunction with the development of the system. The system design 
ensures vulnerabilities, risks, and other security concerns are 
identified and addressed in the system design and throughout the life 
cycle of the project. This is consistent with the HHS Automated

[[Page 46231]]

Information Systems Security Program Handbook.
    4. Certification and Accreditation: The Program's electronic data 
systems are certified under the auspices of HRSA's Office of 
Information Technology Certification and Accreditation system.
    5. Physical Safeguards: All computer equipment and files and hard 
copy files are stored in areas where fire and life safety codes are 
strictly enforced. All automated and non-automated documents are 
protected on a 24-hour basis. Perimeter security includes intrusion 
alarms, key/passcard/combination controls, and receptionist controlled 
area. Most hard copy files are maintained in a file room used solely 
for this purpose with access limited by combination lock to authorized 
users identified above. Computer files are password protected and are 
accessible only by use of computers which are password protected.
    6. Procedural Safeguards: A password is required to access computer 
files. All users of personal information in connection with the 
performance of their jobs protect information from public view and from 
unauthorized personnel entering an unsupervised area. All authorized 
users sign a nondisclosure statement. All passwords, keys and/or 
combinations are changed when a person leaves or no longer has 
authorized duties. Access to records is limited to those authorized 
personnel trained in accordance with the Privacy Act and ADP security 
procedures. The transmission of records is protected using secure 
protocols. Individuals with access to the system have User IDs and 
passwords and must be granted access to the system. External access to 
the data requires two-factor authentication. The contractor(s) shall 
maintain current lists of authorized users. The safeguards described 
above were established in accordance with NIST 800-53 and OMB Circular 
A-130 Appendix III.

Retention and Disposal:
    Patient and donor records will be retained indefinitely.

System Manager and Address:
    Director, Blood Stem Cell Transplantation Program, HRSA, Parklawn 
Building, Room 12C-06, 5600 Fishers Lane, Rockville, MD 20857.

Notification Procedure:
    Requests must be made to the System Manager.
    Requests by mail: Requests for information and/or access to records 
received by mail must contain information providing the identity of the 
writer, and a reasonable description of the record desired, and whom it 
concerns. Written requests must contain the name and address of the 
requester, his/her date of birth and his/her signature. Requests must 
be notarized to verify the identity of the requester, or the requester 
must certify that (s)he is the individual who (s)he claims to be and 
that (s)he understands that to knowingly and willfully request or 
acquire a record pertaining to another individual under false pretenses 
is a criminal offense under the Privacy Act subject to a $5,000 fine 
(45 CFR 5b.5(b)(2)(ii)).
    Requests in person or by telephone, electronic mail or facsimile 
cannot be honored.

Requests in Person:
    No requests in person at the system location will be honored.

Requests By Telephone:
    Since positive identification of the caller cannot be established, 
telephone requests are not honored.

Record Access Procedures:
    Record access procedures are the same as notification procedures. 
Requesters should also provide a reasonable description of the contents 
of the record being sought. A parent or guardian who requests 
notification of, or access to, a minor's/incompetent person's record 
shall designate a family physician or other health professional (other 
than a family member) to whom the record, if any, will be sent. The 
parent or guardian must verify relationship to the minor/incompetent 
person as well as his/her own identity. Records will be mailed only to 
the requester's address that is on file, unless a different address is 
demonstrated by official documentation.

Contesting Record Procedures:
    To contest a record in the system, contact the official at the 
address specified above and reasonably identify the record, specify the 
information being contested, and state the corrective action sought and 
the reason(s) for requesting the correction, along with supporting 
documentation to show how the record is inaccurate, incomplete, 
untimely, or irrelevant.

Record Source Categories:
    Sources of records include, but are not limited to, patients, 
donors, and/or their representatives under the C.W. Bill Young Cell 
Transplantation Program and any other sources of information or 
documentation submitted by any other person or entity for inclusion in 
a request for the purpose of facilitating blood stem cell 
transplantation (e.g., transplant center healthcare professionals).

Systems Exempted From Certain Provisions of the Act:
    None.

[FR Doc. 07-4019 Filed 8-16-07; 8:45 am]
BILLING CODE 4165-15-M