Office for Civil Rights; Privacy Act of 1974, Amended System of Records, 18841-18846 [2010-8412]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 75, Number 70 (Tuesday, April 13, 2010)]
[Notices]
[Pages 18841-18846]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2010-8412]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES


Office for Civil Rights; Privacy Act of 1974, Amended System of 
Records

AGENCY: Office for Civil Rights (OCR), Department of Health and Human 
Services (HHS or the Department).

ACTION: Notice of modified or altered System of Records (SOR).

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act, we are proposing to modify 
or alter an existing SOR, ``Program Information Management System 
(PIMS),'' System No. 09-90-0052, published at 67 FR 57011, September 6, 
2002. First, we propose to add a new authority, the Health Information 
Technology for Economic and Clinical Health (HITECH) Act, part of the 
American Recovery and Reinvestment Act of 2009 (Pub. L. 111-5), to 
those under which OCR collects information. Second, we propose to add 
three new purposes of the PIMS system. Third, we propose to add six new 
routine uses to the PIMS system. Fourth, we propose to expand the 
categories of information stored in the PIMS system to include 
information that covered entities under the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA) and their business 
associates report to the Secretary with respect to a breach of 
protected health information. See Effective Dates section for comment 
period.

DATES: Effective Dates: OCR filed a system report with the Chair of the 
House Committee on Government Reform and Oversight, the Chair of the 
Senate Committee on Homeland Security and Governmental Affairs, and the 
Administrator, Office of Information and Regulatory Affairs, Office of 
Management and Budget (OMB) on March 30, 2010. Comments on this SOR may 
be submitted within 40 days from the publication of the notice, or from 
the date it was submitted to OMB and the Congress, whichever is later. 
The SOR, including routine uses, will become effective at the end of 
the 40-day period, unless OCR receives comments that require 
alterations to this notice.

ADDRESSES: You may submit comments by any of the following methods 
(please do not submit duplicate comments):
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments. Attachments should be 
in Microsoft Word, WordPerfect, or Excel; however, we prefer Microsoft 
Word.
     Regular, Express, or Overnight Mail: U.S. Department of 
Health and Human Services, Office for Civil Rights, Attention: PIMS 
System of Records, Hubert H. Humphrey Building, Room 509F, 200 
Independence Avenue, SW., Washington, DC 20201. Please submit one 
original and two copies.
     Hand Delivery or Courier: Office for Civil Rights, 
Attention: PIMS System of Records, Hubert H. Humphrey Building, Room 
509F, 200 Independence Avenue, SW., Washington, DC 20201. Please submit 
one original and two copies. (Because access to the interior of the 
Hubert H. Humphrey Building is not readily available to persons without 
Federal government identification, commenters are encouraged to leave 
their comments in the mail drop slots located in the main lobby of the 
building.)
    Inspection of Public Comments: All comments received before the 
close of the comment period will be available for public inspection, 
including any personally identifiable or confidential business 
information that is included in a comment. We will post all comments 
received before the close of the comment period at https://www.regulations.gov. Because

[[Page 18842]]

comments will be made public, they should not include any sensitive 
personal information, such as a person's social security number; date 
of birth; driver's license number, state identification number or 
foreign country equivalent; passport number; financial account number; 
or credit or debit card number. Comments also should not include any 
sensitive health information, such as medical records or other 
individually identifiable health information.

FOR FURTHER INFORMATION CONTACT: For further information contact: PIMS 
Project Manager, Management Operations Division, Office for Civil 
Rights, 200 Independence Ave., SW., Room 509F, Washington, DC 20201. 
Telephone number: (202) 619-2888.

SUPPLEMENTARY INFORMATION: The system of records (i.e., PIMS) described 
in the OCR's Privacy Act notice, 67 FR 57011 (Sept. 6, 2002), is used 
by OCR staff and consists of an electronic repository of information 
and documents, and supplementary paper document files. PIMS effectively 
combined and replaced OCR's two previous systems of records, (CIMS and 
the Complaint File and Log), into a single, integrated system with 
enhanced electronic storage, retrieval, and tracking capacities that 
allows OCR to manage more effectively the information that it collects. 
PIMS was modified to add a new authority, the Patient Safety and 
Quality Improvement Act of 2005, and altered to add two new routine 
uses in OCR's Privacy Act notice at 72 FR 8734 (Feb. 27, 2007).
    The Privacy Act permits OCR to disclose information or records 
pertaining to an individual without that individual's consent if the 
information is to be used for a purpose that is compatible with the 
purpose(s) for which the information was collected, 5 U.S.C. 
552a(b)(3). Any such disclosure is known as a ``routine use.'' The PIMS 
system conforms to applicable law and policy governing the privacy and 
security of Federal automated information systems. These include but 
are not limited to: The Privacy Act of 1974, Federal Information 
Security Management Act of 2002, Computer Security Act of 1987, the 
Paperwork Reduction Act of 1995, the Clinger-Cohen Act of 1996, and OMB 
Circular A-130, Appendix, III, ``Security of Federal Automated 
Information Resources.''
    OCR has prepared a system security plan as required by OMB Circular 
A-130, Appendix III. This plan conforms fully to guidance issued by the 
National Institute for Standards and Technology (NIST) in NIST Special 
Publication 800-18, ``Guide for Developing Security Plans for 
Information Technology Systems.'' The plan includes performance of a 
risk assessment that addresses the confidentiality and integrity of the 
data. Only authorized users have access to the information in the 
system.
    Specific access is structured around need and is determined by the 
person's role in the organization. Access is managed through the use of 
electronic access control lists, which regulate the ability to read, 
change, and delete information in the system. Each OCR user has read 
access to designated information in the system, with the ability to 
modify only their own submissions or those of others within their 
region or group. Data identified as confidential is so designated and 
only specified individuals are granted access. The system maintains an 
audit trail of all actions against the data base. All electronic data 
is stored on servers maintained in locked facilities with computerized 
access control allowing access to only those support personnel with a 
demonstrated need for access. A database is kept of all individuals 
granted security card access to the room, and all visitors are escorted 
while in the room. The server facility has appropriate environmental 
security controls, including measures to mitigate damage to automated 
information system resources caused by fire, electricity, water, and 
inadequate climate controls. Access control to servers, individual 
computers and databases includes a required user log-on with a 
password, inactivity lockout to systems based on a specified period of 
time, legal notices and security warnings at log-on, and remote access 
security that allows user access for remote users (e.g., while on 
government travel) under the same terms and conditions as for users 
within the office. System administrators have appropriate security 
clearance. Printed materials are filed in secure cabinets in secure 
Federal buildings with access based on need as described above for the 
automated component of the PIMS system.
    Section 13402(e)(3) of the HITECH Act requires HIPAA covered 
entities to provide notice to the Secretary of the Department of Health 
and Human Services (HHS or the Department) of a breach of unsecured 
protected health information. Notice to the Secretary is required 
immediately if a breach affects 500 or more individuals and annually 
for breaches affecting fewer than 500 individuals. Section 13402(e)(4) 
of the HITECH Act requires the Secretary to make available to the 
public on the HHS Web site a list that identifies each covered entity 
involved in a breach affecting more than 500 individuals. To implement 
these HITECH provisions, HHS published an interim final rule on August 
24, 2009 (74 FR 42740). Section 164.408(a) of the regulations published 
in the interim final rule requires covered entities to notify the 
Secretary of breaches of unsecured protected health information. 
Section 164.408(b) requires breaches that affect 500 or more 
individuals to be reported to the Secretary contemporaneously with 
notice to the individual--that is, without unreasonable delay and in no 
case later than 60 calendar days after a covered entity discovers a 
breach (subject to a law enforcement delay as provided in section 
164.412). Section 164.408(c) sets out the annual reporting for breaches 
affecting fewer than 500 individuals. Covered entities are required to 
report these breaches in the manner specified on the HHS Web site. A 
breach report form that has been approved by OMB for collection of this 
information can be found at https://transparency.cit.nih.gov/breach/index.cfm. A breach report must be filed through this Web site.
    Accordingly, this notice modifies PIMS by adding a new authority 
for maintenance of the system, identifies three new purposes of the 
PIMS system, adds new routine uses of the PIMS system, and expands the 
categories of information stored in the PIMS system. In addition to the 
new routine uses proposed because of breach notification requirements 
under the HITECH Act, one proposed new routine use regards responding 
to breaches of personally identifiable information within the 
Department, consistent with Office of Management and Budget (OMB) 
Memorandum 07-16, Safeguarding Against and Responding to the Breach of 
Personally Identifiable Information, dated May 22, 2007. Another 
proposed new routine use regards disclosing relevant personally 
identifiable information including the identity of covered entities and 
business associates to obtain information relevant and necessary to 
investigate violations and potential violations, as well as to conduct 
compliance reviews, of the Federal laws and regulations OCR has legal 
authority to enforce. The last new proposed routine use regards 
allowing OCR to disclose relevant information to the public to inform 
the public of the results of investigations and compliance reviews of 
the Federal laws and regulations that OCR has legal authority to 
enforce, after OCR determines that

[[Page 18843]]

the disclosure would not constitute an unwarranted invasion of personal 
privacy. OCR expects these modifications will not result in any 
unwarranted invasion of personal privacy.
    OCR proposes to add the following authority for maintenance of the 
PIMS system: section 13402 of the HITECH Act, part of the American 
Recovery and Reinvestment Act of 2009 (Pub. L. 111-5).
    OCR proposes to add the following three new purposes of the PIMS 
system: (1) To collect, maintain, and post on the HHS Web site a list 
of covered entities that experience breaches of unsecured protected 
health information affecting more than 500 individuals using 
information reported to the Secretary by covered entities (or a 
business associate on behalf of a covered entity) as required by 
section 13402(e) of the HITECH Act; (2) to develop an annual report to 
Congress, as required by section 13402(i) of the HITECH Act, regarding 
breach notification using information reported to the Secretary by 
covered entities (or a business associate on behalf of a covered 
entity) under section 13402(e) of the HITECH Act; and (3) to provide 
technical assistance, training, and guidance materials regarding 
breaches of protected health information.
    OCR proposes to establish the following six new routine use 
disclosures of information for PIMS. Each routine use is compatible 
with a stated purpose of the system.
    I. The first new routine use allows OCR to post on its Web site, as 
required by section 13402(e)(4) of the HITECH Act, information reported 
by a covered entity (or a business associate on behalf of a covered 
entity) to the Secretary pursuant to section 13402(e)(3) of the HITECH 
Act that identifies covered entities that experience breaches of 
unsecured protected health information affecting more than 500 
individuals.
    II. The second new routine use allows OCR to disclose information 
regarding breaches of unsecured protected health information in an 
annual report to Congress, as required by section 13402(i) of the 
HITECH Act, regarding the number and nature of the breaches reported to 
the Secretary and actions taken in response to such breaches.
    III. The third new routine use allows OCR to disclose information 
regarding breaches of unsecured protected health information to the 
public and to appropriate Federal agencies and Department contractors 
to provide technical assistance, training, and guidance materials, 
after OCR determines that the disclosure would not constitute an 
unwarranted invasion of personal privacy.
    IV. The fourth new routine use allows OCR to disclose information 
to appropriate Federal agencies and Department contractors that have a 
need to know the information for the purpose of assisting the 
Department's efforts to respond to a suspected or confirmed breach of 
security or confidentiality of information maintained in this system of 
records, and the information disclosed is relevant and necessary for 
that assistance.
    V. The fifth new routine use allows OCR to disclose information to 
third party contacts, including public and private organizations, to 
investigate violations and potential violations, as well as to conduct 
compliance reviews, of the Federal laws and regulations that OCR has 
legal authority to enforce.
    VI. The sixth new routine use allows OCR to disclose relevant 
information to the public to inform the public of the results of 
investigations and compliance reviews of the Federal laws and 
regulations that OCR has legal authority to enforce, after OCR 
determines that the disclosure would not constitute an unwarranted 
invasion of personal privacy.
    OCR proposes to add the following category of information included 
in the PIMS system: Information that HIPAA covered entities (or a 
business associate on behalf of a covered entity) (defined in 45 CFR 
160.103) are required to provide to HHS to fulfill their breach 
notification requirements to the Secretary pursuant to section 13402(e) 
of the HITECH Act. This information includes the name, address, and 
contact information of the covered entity or business associate, as 
well as the contact name of the individual at the covered entity or 
business associate that reported the breach of protected health 
information.
    OCR will continue to collect only information that is necessary to 
perform the PIMS functions. We only disclose the minimum personal data 
necessary to achieve the purpose of PIMS. Disclosure of information 
from the system will be approved only to the extent necessary to 
accomplish the purpose of the disclosure. Further, OCR continues to 
take precautionary measures to minimize the risks of unauthorized 
access to the records and the potential harm to individual privacy or 
other individual rights. In addition, OCR makes disclosures from the 
PIMS system only with consent of the subject individual, or his/her 
legal representative, or in accordance with an applicable exception 
provision of the Privacy Act. OCR, therefore, believes that no 
unfavorable effect on individual privacy will result from the 
modifications and alterations to PIMS proposed herein.
    The following notice is written in the present, rather than the 
future tense, to avoid the unnecessary expenditure of public funds to 
republish the notice after the system has become effective.

    Dated: March 30, 2010.
Georgina C. Verdugo,
Director, Office for Civil Rights.
09-90-0052

SYSTEM NAME:
    ``Program Information Management System'' (PIMS) (09-90-0052) HHS/
OS/OCR.

SECURITY CLASSIFICATION:
    None.

SYSTEM LOCATION:
    The automated portion of the system is maintained at OCR 
Headquarters. Paper files are maintained in headquarters and regional 
offices as noted in Appendix I.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Covered individuals include persons who file complaints alleging 
discrimination or violation of their rights or other violations under 
the statutes identified below (Authority for Maintenance) and covered 
entities (e.g., health care providers) that are individuals and not 
organizations or institutions, investigated by OCR as a result of 
complaints filed or through reviews conducted by OCR. Covered 
individuals also include persons who submit correspondence to OCR 
related to other compliance activities (e.g., outreach and public 
education), and other correspondence unrelated to a complaint or review 
and requiring responses by OCR. Covered individuals also include 
covered entities and business associates (that are individuals and not 
organizations or institutions), as defined in 45 CFR 160.103, who 
report breaches of protected health information by submitting a breach 
report through the HHS Web site. In addition, OCR employees that use 
the system to record the status of their work are covered by the 
system.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The system encompasses a variety of records having to do with 
complaints, reviews, correspondence, and reports of breaches of 
protected health information. For example, the system includes records 
containing individual names, Social Security numbers (SSN), tax 
identification numbers (TIN),

[[Page 18844]]

addresses, dates of birth, provider names and addresses, physicians' 
names, prescriber identification numbers, assigned provider numbers 
(facility, referring/servicing physician), and/or other identification 
numbers of HIPAA covered entities.
    The complaint files and log include complaint allegations, 
information gathered during the complaint investigation, findings and 
results of the investigation, and correspondence relating to the 
investigation, as well as status information for all complaints. This 
component of PIMS is exempt from the notification, access, correction 
and amendment provisions of the Privacy Act (see below: Systems 
Exempted From Certain Provisions of the Act). Equivalent types of 
information are maintained for reviews and correspondence activities--
namely, information gathered, findings, results, correspondence and 
status.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Authority for the collection, maintenance, and disclosures from 
this system is given under Title VI of the 1964 Civil Rights Act; 
Sections 533, 542, 794, 855, 1947 and 1908 of the Public Health Service 
Act; Sections 504 and 508 of the Rehabilitation Act of 1973; Title II 
of the Americans with Disabilities Act of 1990; the Age Discrimination 
Act of 1975; the Equal Employment Opportunity Provisions of the Public 
Telecommunications Financing Act of 1978; Title VI and Title XVI of the 
Public Health Service Act (the ``community services obligation'' of 
facilities funded under the Act); Title IX of the 1972 Education 
Amendments; Section 407 of the Drug Abuse Office and Treatment Act; 
Section 321 of the Comprehensive Alcohol Abuse and Alcoholism 
Prevention, Treatment, and Rehabilitation Act of 1970; Section 508 of 
the Social Security Act; the Family Violence Prevention and Services 
Act; Low-Income Home Energy Assistance Act of 1981; Section 1808 of the 
Small Business Job Protection Act of 1996; the Health Insurance 
Portability and Accountability Act of 1996; the Patient Safety and 
Quality Improvement Act of 2005 (Patient Safety Act); and section 13402 
of the Health Information Technology for Economic and Clinical Health 
(HITECH) Act.

PURPOSE(S) OF THE SYSTEM:
    PIMS is used by OCR staff and consists of an electronic repository 
of information and documents, and supplementary paper document files. 
PIMS effectively combines and replaces OCR's two previous systems of 
records, the ``Case Information Management System (CIMS), HHS/OS/OCR, 
09-90-0050,'' and the ``Complaint File and Log, HHS/OS/OCR 09-00-
0051,'' into a single, integrated system with enhanced electronic 
storage, retrieval and tracking capacities that allows OCR to manage 
more effectively the information it collects.
    The system is designed to allow OCR to integrate all of OCR's 
various business processes, including all its compliance activities, to 
allow for real time access and results reporting and other varied 
information management needs. PIMS provides: (1) A single, central, 
electronic repository of all significant OCR documents and information, 
including investigative files, correspondence, administrative records, 
policy and procedure manuals and other documents and information 
developed or maintained by OCR; (2) easy, robust capability to search 
all the information in OCR's repository; (3) better quality control at 
the front end with simplified data entry and stronger data validation; 
(4) tools to help staff work on and manage their casework, and (5) 
supplementary paper document files. The system has the capacity to 
generate reports concerning the status of all current and closed 
complaints, reviews, and correspondence; track outreach, training, and 
other activities; and to locate and retrieve information, and report 
results, in order to manage more efficiently OCR's work. In addition, 
PIMS allows for the tracking of work assignments to employees to 
facilitate workload balancing, timely response to complaints and 
completion of reviews, and outreach and public education initiatives 
focused on organizations and individuals.
    PIMS also is used by OCR: (1) To collect, maintain, and post on the 
HHS Web site a list of covered entities that experience breaches of 
unsecured protected health information affecting more than 500 
individuals using information reported to the Secretary by covered 
entities (or a business associate on behalf of a covered entity) as 
required by section 13402(e) of the HITECH Act; (2) to develop an 
annual report to Congress, as required by section 13402(i) of the 
HITECH Act, regarding breach notification using information reported to 
the Secretary by covered entities (or a business associate on behalf of 
a covered entity) pursuant to section 13402(e) of the HITECH Act; and 
(3) to provide technical assistance, training, and guidance regarding 
breaches of protected health information.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OR USERS AND THE PURPOSES OF SUCH USES:
    The Privacy Act allows us to disclose information without an 
individual's consent if the information is to be used for a purpose 
that is compatible with the purpose(s) for which the information was 
collected. Any such compatible use of data is known as a ``routine 
use.'' The routine uses in this system meet the compatibility 
requirement of the Privacy Act. The following are the routine use 
disclosures of information maintained in the PIMS system:
    I. The first routine use for this system, permitting disclosure to 
a congressional office, allows subject individuals to obtain assistance 
from their representatives in Congress, should they so desire. Such 
disclosure would be made only pursuant to the request of the 
individual.
    II. The second routine use allows disclosure to the Department of 
Justice or a court in the event of litigation.
    III. The third routine use allows referral to the appropriate 
agency, in the event that a System of Records maintained by this agency 
to carry out its functions indicates a violation or potential violation 
of law.
    IV. The fourth routine use allows disclosure of records to 
contractors for the purpose of processing or refining records in the 
system.
    V. The fifth routine use allows records to be disclosed to student 
volunteers, individuals working under a personal services contract, and 
other individuals performing functions for the Department but 
technically not having the status of agency employees, if they need 
access to the records in order to perform their assigned agency 
functions.
    VI. The sixth routine use allows referrals of Age Discrimination 
Act complaints to the Federal Mediation and Conciliation Service (FMCS) 
for purposes of mediation.
    VII. The seventh routine use allows OCR to post on its Web site, as 
required by section 13402(e)(4) of the HITECH Act, information reported 
by a covered entity (or a business associate on behalf of a covered 
entity) to the Secretary pursuant to section 13402(e)(3) of the HITECH 
Act that identifies covered entities that experience breaches of 
unsecured protected health information affecting more than 500 
individuals.
    VIII. The eighth routine use allows OCR to disclose information 
regarding breaches of unsecured protected health information in an 
annual report to Congress, as required by section 13402(i) of the 
HITECH Act, regarding the number and nature of the breaches

[[Page 18845]]

reported to the Secretary and actions taken in response to such 
breaches.
    IX. The ninth routine use allows OCR to disclose information 
regarding breaches of unsecured protected health information to the 
public and to appropriate Federal agencies and Department contractors 
to provide technical assistance, training, and guidance materials, 
after OCR determines that the disclosure would not constitute an 
unwarranted invasion of personal privacy.
    X. The tenth routine use allows OCR to disclose information to 
appropriate Federal agencies and Department contractors that have a 
need to know the information for the purpose of assisting the 
Department's efforts to respond to a suspected or confirmed breach of 
security or confidentiality of information maintained in this system of 
records, and the information disclosed is relevant and necessary for 
that assistance.
    XI. The eleventh routine use allows OCR to disclose information to 
third party contacts, including public and private organizations, to 
investigate violations and potential violations, as well as to conduct 
compliance reviews, of the Federal laws and regulations that OCR has 
legal authority to enforce.
    XII. The twelfth routine use allows OCR to disclose relevant 
information to the public to inform the public of the results of 
investigations and compliance reviews of the Federal laws and 
regulations that OCR has legal authority to enforce, after OCR 
determines that the disclosure would not constitute an unwarranted 
invasion of personal privacy.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Automated records are maintained on magnetic disc and tape back-up. 
Paper records are kept in file folders.

RETRIEVABILITY:
    Records are indexed by transaction number, but may be retrieved by 
name, street address, and other complainant, covered entity, or 
business associate characteristic (such as type of entity, city, state, 
and type of service provided).

SAFEGUARDS:
    The PIMS system conforms to applicable law and policy governing the 
privacy and security of Federal automated information systems. These 
include but are not limited to: the Privacy Act of 1974, Federal 
Information Security Management Act of 2002, Computer Security Act of 
1987, the Paperwork Reduction Act of 1995, the Clinger-Cohen Act of 
1996, and OMB Circular A-130, Appendix, III, ``Security of Federal 
Automated Information Resources.'' OCR has prepared a system security 
plan as required by OMB Circular A-130, Appendix III. This plan 
conforms fully to guidance issued by the National Institute for 
Standards and Technology (NIST) in NIST Special Publication 800-18, 
``Guide for Developing Security Plans for Information Technology 
Systems.'' The plan includes conduct of a risk assessment that 
addresses the confidentiality and integrity of the data. Only 
authorized users have access to the information in the system. 
Categories of users include: OCR investigators, regional and 
headquarters managers, team leaders, OCR budget and Government 
Performance and Results Act planning staff, program and policy staff, 
and data analysts. Specific access is structured around need and is 
determined by the person's role in the organization. Access is managed 
through the use of electronic access control lists, which regulate the 
ability to read, change, and delete information in the system. Each OCR 
user has read access to designated information in the system, with the 
ability to modify only their own submissions or those of others within 
their region or group. Data identified as confidential is so designated 
and only specified individuals are granted access. The system maintains 
an audit trail of all actions against the data base.
    All electronic data is stored on servers maintained in locked 
facilities with computerized access control allowing access to only 
those support personnel with a demonstrated need for access. A database 
is kept of all individuals granted security card access to the room, 
and all visitors are escorted while in the room. The server facility 
has appropriate environmental security controls, including measures to 
mitigate damage to automated information system resources caused by 
fire, electricity, water, and inadequate climate controls.
    Access control to servers, individual computers, and databases 
includes a required user log-on with a password, inactivity lockout to 
systems based on a specified period of time, legal notices and security 
warnings at log-on, and remote access security that allows user access 
for remote users (e.g., while on government travel) under the same 
terms and conditions as for users within the office. System 
administrators have appropriate security clearance. Printed materials 
are filed in secure cabinets in secure Federal buildings with access 
based on need as described above for the automated component of the 
PIMS system.

RETENTION AND DISPOSAL:
    Documents related to breaches are retained at OCR for two years 
from the date the breach is reported and then are archived at the 
National Archives and Records Administration for 15 years. 
Correspondence is retained for one year following the end of the fiscal 
year in which processed.

SYSTEM MANAGER AND ADDRESS:
    PIMS Project Manager, Management Operations Division, Office for 
Civil Rights, 200 Independence Ave., SW., Room 509F, Washington, DC 
20201.

NOTIFICATION PROCEDURE:
    Contact System Manager (above). Include name and address of 
complainant, and name of the recipient against which the allegation was 
filed. The Department is exempting all investigative records from this 
provision (see below: Records Exempted).

RECORD ACCESS PROCEDURE:
    Same as notification procedures. Requesters also should reasonably 
specify the record contents being sought. Requests should be made to 
the system manager (above). The Department is exempting all 
investigative records from this provision. (See below: Records 
Exempted).

CONTESTING RECORD PROCEDURE:
    Contact the official(s) at the address specified under System 
Manager, and reasonably identify the record and specify the information 
to be contested and corrective action sought with supporting 
justification. (These procedures are in accordance with Department 
Regulations (45 CFR 5b.7) The Department is exempting all investigative 
records from this provision (see below: Records Exempted).

RECORD SOURCE CATEGORIES:
    Information is provided by complainants, covered entities, and 
business associates.

SYSTEM RECORDS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:
    OCR investigative records maintained in PIMS, either as paper 
records or electronic documents, are records compiled for law 
enforcement purposes and are exempt under subsection (k)(2) from the 
notification, access, correction, and amendment provisions of the 
Privacy Act.

[[Page 18846]]

APPENDIX NUMBER 1--SYSTEM LOCATIONS:
    This system is located at HHS offices in the following cities:
    Headquarters, PIMS Project Manager, Management Operations Division, 
Office for Civil Rights, 200 Independence Ave., SW., Room 509F, 
Washington, DC 20201.
    Region I, Regional Manager, OCR/HHS, J.F. Kennedy Federal 
Building--Room 1875 Boston, MA 02203.
    Region II, Regional Manager, OCR/HHS, 26 Federal Plaza--Suite 3312, 
New York, NY 10278.
    Region III, Regional Manager, OCR/HHS, 150 S. Independence Mall 
West, Suite 372, Public Ledger Building, Philadelphia, PA 19106-9111.
    Region IV, Regional Manager, OCR/HHS, Atlanta Federal Center, Suite 
3B70, 61 Forsyth Street, SW., Atlanta, GA 30303-8909.
    Region V, Regional Manager, OCR/HHS, 233 N. Michigan Ave, Suite 
240, Chicago, IL 60601.
    Region VI, Regional Manager, OCR/HHS, 1301 Young Street, Suite 
1169, Dallas, TX 75202.
    Region VII, Regional Manager, OCR/HHS, 601 E. 12th Street--Room 
248, Kansas City, MO 64106.
    Region VIII, Regional Manager, OCR/HHS, Federal Office Building, 
1961 Stout Street--Room 1426 FOB, Denver, CO 80294-3538.
    Region IX, Regional Manager, OCR/HHS, 90 7th Street, Suite 4-100, 
San Francisco, CA 94103.
    Region X, Regional Manager, OCR/HHS, 2201 Sixth Avenue-- M/S: RX-
11, Seattle, WA 98121-2290.

[FR Doc. 2010-8412 Filed 4-12-10; 8:45 am]
BILLING CODE 4153-01-P