Privacy Act of 1974; Department of Homeland Security U.S. Immigration and Customs Enforcement-013 Alien Medical Records System of Records, 57688-57692 [E9-26910]

Agencies

• Office of the Secretary
• DEPARTMENT OF HOMELAND SECURITY

[Federal Register Volume 74, Number 215 (Monday, November 9, 2009)]
[Notices]
[Pages 57688-57692]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E9-26910]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Office of the Secretary

[Docket No. DHS-2009-0126]


Privacy Act of 1974; Department of Homeland Security U.S. 
Immigration and Customs Enforcement--013 Alien Medical Records System 
of Records

AGENCY: Privacy Office, DHS.

ACTION: Notice of Privacy Act system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974 the Department of 
Homeland Security proposes to establish a new Department of Homeland 
Security U.S. Immigration and Customs Enforcement system of records 
notice titled, Department of Homeland Security U.S. Immigration and 
Customs Enforcement--013 Alien Medical Records System of Records. This 
system maintains records that document the medical screening, 
examination, and treatment of aliens arrested and detained by U.S. 
Immigration and Customs Enforcement for violations of the Immigration 
and Nationality Act. The records contain the medical information for 
aliens detained in facilities owned and operated by U.S. Immigration 
and Customs Enforcement or its contractors, or in facilities where 
medical care is provided by Department of Health and Human Services 
Public Health Service Commissioned Corps Officers. The system also 
supports the collection and maintenance of medical information about 
these individuals and its dissemination in the case of infectious 
diseases, especially in the event of a public health emergency, such as 
an epidemic or pandemic. The information described in this notice was 
previously covered by a Department of Health and Human Services 
Patients Medical Record system of records. This newly established 
system will be included in the Department of Homeland Security's 
inventory of record systems.

DATES: Submit comments on or before December 9, 2009. This new system 
will be effective December 9, 2009.

ADDRESSES: You may submit comments, identified by docket number DHS-
2009-0126 by one of the following methods:
     Federal e-Rulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
     Fax: 703-483-2999.
     Mail: Mary Ellen Callahan, Chief Privacy Officer, Privacy 
Office, Department of Homeland Security, Washington, DC 20528.
     Instructions: All submissions received must include the 
agency name and docket number for this rulemaking. All comments 
received will be posted without change to https://www.regulations.gov, 
including any personal information provided.
     Docket: For access to the docket to read background 
documents or comments received go to https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: For general questions please contact: 
Lyn Rahilly (202-732-3300), Privacy Officer, U.S. Immigration and 
Customs Enforcement. For privacy issues please contact: Mary Ellen 
Callahan (703-235-0780), Chief Privacy Officer, Privacy Office, U.S. 
Department of Homeland Security, Washington, DC 20528.

SUPPLEMENTARY INFORMATION:

I. Background

    The Alien Medical Records system of records is maintained by the 
Department of Homeland Security (DHS) U.S. Immigration and Customs 
Enforcement (ICE) Division of Immigration Health Services (DIHS), a 
division within the Office of Detention and Removal Operations (DRO). 
As noted above, the information described in this notice was previously 
covered by the Department of Health and Human Services (HHS) 9-15-0002 
Patients Medical Record System Public Health Service Hospitals HHS/
HRSA/BPHC System of Records (August 3, 2009, 74 FR 38456). This system 
of records maintains medical, mental health, and dental records that 
document the medical screening, examination, and treatment of aliens 
whom ICE arrests and detains for violations of the Immigration and 
Nationality Act (INA). The records contain the medical information for 
aliens detained in facilities owned and operated by ICE or its 
contractors, or in other facilities for ICE detainees where medical 
care is provided by ICE DIHS. It also maintains information about 
prisoners of the U.S. Marshals Service (USMS) who are housed in a 
detention facility operated by or on behalf of ICE pursuant to an 
agreement between the USMS and ICE. The system of records also supports 
the dissemination of medical information about these individuals in the 
case of infectious diseases especially in the event of a public health 
emergency, such as an epidemic or pandemic.
    Before October 1, 2007, DHS and HHS maintained annual interagency 
agreements through which ICE DIHS, a component of HHS's Health 
Resources and Services Administration (HRSA), provided health care for 
ICE detainees. Medical records created by HRSA in providing those 
services were covered under a HHS Privacy Act system of records notice 
titled HHS 9-15-0002 Patients Medical Record System Public Health 
Service Hospitals HHS/HRSA/BPHC System of Records (August 3, 2009, 74 
FR 38456). On August 23, 2007, a new agreement between DHS and HHS was 
signed to facilitate the transfer of the Federal detainee health care 
program responsibilities from HHS to DHS and detailed Public Health 
Service Commissioned Corps Officers to DHS on an open-ended basis to 
provide medical care for ICE detainees. HRSA has disbanded its DIHS, 
and ICE has

[[Page 57689]]

created a component within its DRO known as DIHS. ICE's DIHS now 
provides health services to ICE detainees through the detailed Public 
Health Service Commissioned Corps Officers from HHS and through other 
contracted medical professionals. With the transfer of this function, 
ICE now owns the medical records created by DIHS personnel and 
contracted medical professionals. This transfer of record ownership 
requires that ICE publish this system of records notice under the 
Privacy Act describing for the public the medical records it owns and 
maintains.
    The medical services provided to ICE detainees include medical, 
mental health, and dental care. If a detainee needs care that the 
medical staff in the detention facility cannot provide, such as meeting 
with a specialist or receiving a medical procedure in a hospital or in 
an in-patient or out-patient facility, the medical staff makes 
arrangements to procure the consultation, treatment, or procedure. For 
each category of individuals described in this notice, ICE maintains 
medical records that document the person's health, including symptoms, 
diseases and conditions, treatments received, and medications 
prescribed. This information is typically shared with other health care 
providers to ensure continuity of care. For individuals with infectious 
diseases of public health significance, this information may be shared 
with public health officials in order to prevent exposure to or 
transmission of the disease.
    Consistent with DHS's information sharing mission, information 
stored in the DHS/ICE-013 Alien Medical Records System of Records may 
be shared with other DHS components, as well as appropriate Federal, 
State, local, tribal, foreign, or international government agencies. 
This sharing will only take place after DHS determines that the 
receiving component or agency has a need to know the information to 
carry out the purposes of this system of records, including the medical 
treatment and removal of detainees from the United States.
    It is important to note that DHS/ICE/DIHS is not subject to the 
provisions of the Health Insurance Portability and Accountability Act 
of 1996 (HIPAA) regulation, ``Standards for Privacy of Individually 
Identifiable Health Information'' (Privacy Rule), 45 CFR Parts 160 and 
164. DHS/ICE/DIHS does not meet the statutory definition of a covered 
plan under HIPAA, 42 U.S.C. 1320d(5), and is specifically carved out of 
the application of HIPAA as a ``government funded program whose 
principal activity is the direct provision of healthcare to persons.'' 
45 CFR 160.103 (definition of a health plan). Because DHS/ICE/DIHS is 
not a covered entity, the restrictions proscribed by the HIPAA Privacy 
Rule are not applicable.

II. Privacy Act

    The Privacy Act embodies fair information principles in a statutory 
framework governing the means by which the United States Government 
collects, maintains, uses, and disseminates individuals' records. The 
Privacy Act applies to information that is maintained in a ``system of 
records.'' A ``system of records'' is a group of any records under the 
control of an agency for which information is retrieved by the name of 
an individual or by some identifying number, symbol, or other 
identifying particular assigned to the individual. In the Privacy Act, 
an individual is defined to encompass United States citizens and lawful 
permanent residents. As a matter of policy, DHS extends administrative 
Privacy Act protections to all individuals where systems of records 
maintain information on U.S. citizens, lawful permanent residents, and 
visitors. Individuals may request access to their own records that are 
maintained in a system of records in the possession or under the 
control of DHS by complying with DHS Privacy Act regulations, 6 CFR 
Part 5.
    The Privacy Act requires each agency to publish in the Federal 
Register a description denoting the type and character of each system 
of records that the agency maintains, and the routine uses that are 
contained in each system in order to make agency recordkeeping 
practices transparent, to notify individuals regarding the uses to 
which their records are put, and to assist individuals to more easily 
find such files within the agency. Below is the description of the DHS/
ICE-013 Alien Medical Records System of Records.
    In accordance with 5 U.S.C. 552a(r), DHS has provided a report of 
this system of records to the Office of Management and Budget and to 
Congress.
SYSTEM OF RECORDS

DHS/ICE--013

System name:
    Immigration and Customs Enforcement Alien Medical Records System

Security classification:
    Unclassified and for official use only.

System location:
    Records are maintained at detention facilities operated by and on 
behalf of ICE, at certain Intergovernmental Service Agreement (IGSA) 
facilities operated by and on behalf of State and local governments 
with whom ICE has an agreement, at ICE Headquarters in Washington, DC, 
and at ICE field offices. (Note: IGSA facilities are city, county, or 
State-owned facilities where ICE contracts for detention, staging, and/
or holding services, or leases bed space.)

Categories of individuals covered by the system:
    The categories of individuals covered by this system are primarily 
aliens arrested by ICE for administrative violations of the Immigration 
and Nationality Act (INA). These aliens have been booked into a 
detention facility owned and operated by ICE or ICE contractors, or 
into a facility where medical care is provided by ICE DIHS. ICE also 
maintains information about prisoners in the custody of the USMS who 
are being detained in facilities operated by or on behalf of ICE 
pursuant to an agreement between the USMS and ICE. Hereafter, the term 
``in ICE custody'' will be used to refer to both aliens arrested by ICE 
and USMS prisoners being housed in a detention facility operated by or 
on behalf of ICE.

Categories of records in the system:
    Categories of records in this system include:
     Individual's name and aliases;
     Date of birth;
     Alien Registration Number (A-Number);
     Federal Bureau of Prisons Number (if applicable);
     Phone numbers;
     Email addresses;
     Addresses;
     Country of Origin;
     Nationality;
     Gender;
     Languages spoken;
     Medical history (self and family to establish medical 
history);
     Current medical conditions;
     Symptoms reported, including dates;
     Medical examination records and medical notes;
     Diagnostic data, such as tests ordered and test results;
     Problem list which lists all the diagnoses and medical 
symptoms or problems for an individual as determined by a medical 
practitioner or reported by the person;
     Refusal forms;
     Informed consent forms;
     Treatment records and medical treatment plans;
     Mental health records and mental health treatment plans;

[[Page 57690]]

     Prescription drug records;
     Over-the-counter drug records;
     Records concerning the diagnosis and treatment of diseases 
or conditions that present a public health threat, including 
information about exposure of other individuals and reports to public 
health authorities;
     Dental history and records, including x-rays, treatment, 
and procedure records;
     Correspondence related to an individual's medical or 
dental care;
     Physician or other medical/dental provider's name and 
credentials such as medical doctor, registered nurse, and Doctor of 
Dental Science;
     Legal documents, such as death certificate, do-not-
resuscitate order, or advance directive (e.g., living will);
     Device identifiers, such as hearing aids and pacemakers;
     Information about special needs and accommodations for an 
individual with disabilities, such as requiring a cane, wheelchair, 
special shoes, or needing to sleep on a bottom bunk; and
     Off-site care records (emergency room, hospitalizations, 
specialized care, records of previous medical care or testing)

Authority for maintenance of the system:
    Public L. 110-329, 122 Stat. 3574, 3658 (2008); 5 U.S.C. 301; 44 
U.S.C. 3101; 8 U.S.C. 1103, Sec.  1222 and 1231; 42 U.S.C. 249. Note: 
The Health Insurance Portability and Accountability Act (HIPAA), Public 
Law 104-191, as amended, does not apply to the health information 
maintained in this system of records.

Purpose(s):
    The purpose of this system is to document and facilitate the 
providing of medical, dental, and mental health care to individuals in 
ICE custody in facilities owned and operated by ICE or its contractors, 
or in other facilities where medical care is provided by HHS Public 
Health Service Commissioned Corps Officers. The system also supports 
the collection, maintenance, and sharing of medical information for 
these individuals in the interest of public health especially in the 
event of a public health emergency, such as an epidemic or pandemic.

Routine uses of records maintained in the system, including categories 
of users and the purposes of such uses:
    In addition to those disclosures generally permitted under 5 U.S.C. 
552a (b) of the Privacy Act, all or a portion of the records or 
information contained in this system may be disclosed outside DHS as a 
routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:
    A. To the Department of Justice (including United States Attorney 
Offices) or other Federal agency conducting litigation or in 
proceedings before any court, adjudicative or administrative body, when 
it is necessary to the litigation and one of the following is a party 
to the litigation or has an interest in such litigation:
    1. DHS or any component thereof;
    2. Any employee of DHS, or HHS employee detailed to DHS, in his/her 
official capacity;
    3. Any employee of DHS, or HHS employee detailed to DHS, in his/her 
individual capacity where DOJ or DHS has agreed to represent the 
employee; or
    4. The United States or any agency thereof, is a party to the 
litigation or has an interest in such litigation, and DHS determines 
that the records are both relevant and necessary to the litigation and 
the use of such records is compatible with the purpose for which DHS 
collected the records.
    B. To a congressional office from the record of an individual in 
response to an inquiry from that congressional office made at the 
request of the individual to whom the record pertains.
    C. To the National Archives and Records Administration or other 
Federal government agencies pursuant to records management inspections 
being conducted under the authority of 44 U.S.C. 2904 and 2906.
    D. To an agency, organization, or individual for the purpose of 
performing audit or oversight operations as authorized by law, but only 
such information as is necessary and relevant to such audit or 
oversight function.
    E. To appropriate agencies, entities, and persons when:
    1. DHS suspects or has confirmed that the security or 
confidentiality of information in the system of records has been 
compromised;
    2. The Department has determined that as a result of the suspected 
or confirmed compromise there is a risk of harm to economic or property 
interests, identity theft or fraud, or harm to the security or 
integrity of this system or other systems or programs (whether 
maintained by DHS or another agency or entity) or harm to the 
individual that relies upon the compromised information; and
    3. The disclosure made to such agencies, entities, and persons is 
reasonably necessary to assist in connection with DHS's efforts to 
respond to the suspected or confirmed compromise and prevent, minimize, 
or remedy such harm.
    F. To contractors and their agents, grantees, experts, consultants, 
and others performing or working on a contract, service, grant, 
cooperative agreement, or other assignment for DHS, when necessary to 
accomplish an agency function related to this system of records. 
Individuals provided information under this routine use are subject to 
the same Privacy Act requirements and limitations on disclosure as are 
applicable to DHS officers and employees.
    G. To an appropriate Federal, State, tribal, local, international, 
or foreign law enforcement agency or other appropriate authority 
charged with investigating or prosecuting a violation or enforcing or 
implementing a law, rule, regulation, or order, where a record, either 
on its face or in conjunction with other information, indicates a 
violation or potential violation of law, which includes criminal, 
civil, or regulatory violations and such disclosure is proper and 
consistent with the official duties of the person making the 
disclosure.
    H. To hospitals, physicians, medical laboratories and testing 
facilities, and other medical service providers, for the purpose of 
diagnosing and treating medical conditions or arranging the care of 
individuals in ICE custody and of individuals released or about to be 
released from ICE custody including, but not limited to, released under 
an order of supervision, on their own recognizance, on bond, on parole, 
or in an alternative to detention program.
    I. To an actual or potential party or his or her attorney for the 
purpose of negotiation or discussion on such matters as settlement of 
the case or matter, or informal discovery proceedings.
    J. To foreign governments for the purpose of coordinating and 
conducting the removal or return of aliens from the United States to 
other nations when disclosure of information about the alien's health 
is necessary or advisable to safeguard the public health, to facilitate 
transportation of the alien, to obtain travel documents for the alien, 
to ensure continuity of medical care for the alien, or is otherwise 
required by international agreement or law.
    K. To immediate family members and attorneys or other agents acting 
on behalf of an alien to assist those individuals in determining the 
current medical condition of an alien in ICE custody provided they can 
present adequate verification of a familial or agency relationship with 
the alien.
    L. To appropriate Federal, State, local, tribal, or foreign 
governmental agencies or multilateral governmental organizations for 
the purpose of protecting the vital interests of a data subject or 
other persons, including to assist such agencies or organizations in

[[Page 57691]]

preventing exposure to or transmission of a communicable or 
quarantinable disease or to combat other significant public health 
threats.
    M. To hospitals, physicians, and other healthcare providers for the 
purpose of protecting the health and safety of individuals who may have 
been exposed to a contagion or biohazard, and to assist such persons or 
organizations in preventing exposure to or transmission of a 
communicable or quarantinable disease or to combat other significant 
public health threats.
    N. To the U.S. Marshals Service (USMS) concerning USMS prisoners 
that are or will be held in detention facilities operated by or on 
behalf of ICE, and to Federal, State, or local law enforcement or 
correctional agencies concerning an individual in ICE custody that is 
to be transferred to such agency's custody, in order to coordinate the 
transportation, custody, and care of these individuals.
    O. To third parties to facilitate placement or release of an alien 
(e.g., at a group home, homeless shelter, etc.) who has been or is 
about to be released from ICE custody, but only such information that 
is relevant and necessary to arrange housing or continuing medical care 
for the alien.
    P. To appropriate State, local, or tribal agency or other 
appropriate authority for the purpose of providing information about an 
alien who has been or is about to be released from ICE custody who, due 
to a condition such as mental illness, may pose a health or safety risk 
to himself/herself or to the community. ICE will only disclose health 
information about the individual that is relevant to the health or 
safety risk they may pose and/or the means to mitigate that risk (e.g., 
the alien's need to remain on certain medication for a serious mental 
health condition).
    Q. To appropriate State, local, or tribal agency or other 
appropriate authority for the purpose of reporting vital statistics 
(e.g., births, deaths).
    R. To the U.S. Bureau of Prisons and other government agencies for 
the purpose of providing medical information about an alien when 
custody of the alien is being transferred from ICE to the other agency. 
This will include the transfer of information about unaccompanied minor 
children to the U.S. Department of Health and Human Services.
    S. To individuals for the purpose of determining if they have had 
contact in a custodial setting with a person known or suspected to have 
a communicable or quarantinable disease and to identify and protect the 
health and safety of others who may have been exposed.
    T. To a public or professional licensing organization when such 
information indicates, either by itself or in combination with other 
information, a violation or potential violation of professional 
standards, or reflects on the moral, educational, or professional 
qualifications of an individual who is licensed or is seeking to become 
licensed.
    U. To the news media and the public, with the approval of the Chief 
Privacy Officer in consultation with counsel, when there exists a 
legitimate public interest in the disclosure of the information or when 
disclosure is necessary to preserve confidence in the integrity of DHS 
or is necessary to demonstrate the accountability of DHS's officers, 
employees, or individuals covered by the system, except to the extent 
it is determined that release of the specific information in the 
context of a particular case would constitute an unwarranted invasion 
of personal privacy.

Disclosure to consumer reporting agencies:
    None.

Policies and practices for storing, retrieving, accessing, retaining, 
and disposing of records in the system:
Storage:
    Records in this system are stored electronically and/or on paper in 
secure facilities behind a locked door. Electronic records are stored 
on magnetic disc, tape, digital media, and CD-ROM.

Retrievability:
    Records may be retrieved by name, Alien Registration Number (A-
Number), or Bureau of Prisons Number.

Safeguards:
    Records in this system are safeguarded in accordance with 
applicable rules and policies, including all applicable DHS automated 
systems security and access policies. Strict controls have been imposed 
to minimize the risk of compromising the information that is being 
stored. Access to the computer systems containing the records in this 
system is limited to those individuals who have a need to know the 
information for the performance of their official duties and who have 
appropriate clearances or permissions.

Retention and disposal:
    ICE is in the process of working with its Records Office to draft a 
proposed record retention schedule for the various records associated 
with the records described in this notice. ICE anticipates that:
    (1) Medical records will be retained for ten (10) years after an 
individual has been released from ICE custody and then shall be 
destroyed;
    (2) annual data on detainees who have died in ICE custody that has 
been transferred to the Bureau of Justice Statistics (BJS) and annual 
reports regarding other infectious diseases will be retained for ten 
(10) years and then destroyed;
    (3) various statistical reports will be retained permanently by 
NARA; and
    (4) monthly and annual statistical reports including those 
regarding workload operations will be destroyed when no longer needed 
for business purposes.

System Manager and address:
    Director, Division of Immigration Health Services, Detainee Health 
Care Unit, Detention and Removal Operations, U.S. Immigration and 
Customs Enforcement, 1220 L Street, NW., Suite 500, Washington, DC 
20005.

Notification procedure:
    Individuals seeking notification of and access to any record 
contained in this system of records, or seeking to contest its content, 
may submit a request in writing to the U.S. Immigration and Customs 
Enforcement FOIA Officer, whose contact information can be found at 
https://www.dhs.gov/foia under ``contacts.'' If an individual believes 
more than one component maintains Privacy Act records concerning him or 
her, the individual may submit the request to the Chief Privacy Officer 
and Chief Freedom of Information Act Officer, Department of Homeland 
Security, 245 Murray Drive, SW., Building 410, STOP-0655, Washington, 
DC 20528.
    When seeking records about yourself from this system of records or 
any other Departmental system of records your request must conform with 
the Privacy Act regulations set forth in 6 CFR Part 5. You must first 
verify your identity, meaning that you must provide your full name, 
current address, and date and place of birth. You must sign your 
request, and your signature must either be notarized or submitted under 
28 U.S.C. 1746, a law that permits statements to be made under penalty 
of perjury as a substitute for notarization. While no specific form is 
required, you may obtain forms for this purpose from the Chief Privacy 
Officer and Chief Freedom of Information Act Officer, https://www.dhs.gov or 1-866-431-0486. In addition you should provide the 
following:

[[Page 57692]]

     An explanation of why you believe the Department would 
have information on you;
     Identify which component(s) of the Department you believe 
may have the information about you;
     Specify when you believe the records would have been 
created;
     Provide any other information that will help the FOIA 
staff determine which DHS component agency may have responsive records; 
and
     If your request is seeking records pertaining to another 
living individual, you must include a statement from that individual 
certifying his/her agreement for you to access his/her records.
    Without this bulleted information, the component(s) may not be able 
to conduct an effective search, and your request may be denied due to 
lack of specificity or lack of compliance with applicable regulations.

Record access procedures:
    See ``Notification procedure'' above. In addition, individuals in 
ICE-owned facilities or in contract detention facilities operated on 
behalf of ICE may request access to their records by making a request 
to the facility's health care unit. Specifically, individuals should 
submit a Form G-639, Freedom of Information/Privacy Act Request form, 
to any staff member.
    ICE also detains individuals in Intergovernmental Service Agreement 
(IGSA) facilities. These facilities are city, county, or State-owned 
and operated facilities where ICE contracts for detention services or 
leases bed space. There is no set procedure for how individuals in the 
IGSA facilities request access to their records. Each facility has its 
own process. Persons seeking such information should contact the chief 
administrative officer of such facility for guidance.

Contesting record procedures:
    See ``Notification procedure'' above.

Record source categories:
    Information may be obtained from the individual, immediate family 
members, physicians, nurses, dentists, medical laboratories and testing 
facilities, hospitals, other medical and dental care providers, other 
law enforcement or custodial agencies, and public health agencies.

Exemptions claimed for the system:
    None.

    Dated: November 2, 2009.
Mary Ellen Callahan,
Chief Privacy Officer, Department of Homeland Security.
[FR Doc. E9-26910 Filed 11-6-09; 8:45 am]
BILLING CODE 9111-28-P