Privacy Act; Implementation, 51933-51935 [2012-20886]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 77, Number 167 (Tuesday, August 28, 2012)]
[Rules and Regulations]
[Pages 51933-51935]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2012-20886]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 5b

[Docket Number NIH-2011-0001]


Privacy Act; Implementation

AGENCY: Department of Health and Human Services.

ACTION: Direct Final rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS or 
Department), through the National Institutes of Health (NIH), is 
implementing a new system of records, 09-25-0223, ``NIH Records Related 
to Research Misconduct Proceedings, HHS/NIH.'' HHS is exempting this 
system of records from certain provisions of the Privacy Act to protect 
the integrity of NIH research misconduct proceedings and to protect the 
identity of confidential sources in such proceedings. HHS is issuing a 
direct final rule for this action because the agency expects that there 
will be no significant adverse comment on this rule. Elsewhere in this 
issue of the Federal Register, HHS is publishing a companion proposed 
rule under the agency's usual procedure for notice-and-comment 
rulemaking to provide a procedural framework to finalize the rule in 
the event the agency receives any significant comments and withdraws 
this direct final rule. The companion proposed rule and this direct 
final rule are substantively identical.

DATES: This rule is effective January 10, 2013. Submit either 
electronic or written comments by November 13, 2012. If HHS/NIH 
receives no significant adverse comments within the specified comment 
period, the agency will publish a document confirming the effective 
date of the final rule in the Federal Register within 30 days after the 
comment period on this direct final rule ends. If timely significant 
adverse comments are received, the agency will publish a document in 
the Federal Register withdrawing this direct final rule before its 
effective date.

ADDRESSES: You may submit comments, identified by [Docket No(s).], by 
any of the following methods:

Electronic Submissions

    Submit electronic comments in the following way:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.

Written Submissions

    Submit written submissions in the following ways:
     Fax: 301-402-0169.
     Mail: Jerry Moore, NIH Regulations Officer, Office of 
Management Assessment, National Institutes of Health, 6011 Executive 
Boulevard, Suite 601, MSC 7669, Rockville, MD 20852-7669.
    To ensure more timely processing of comments, HHS/NIH is no longer 
accepting comments submitted to the agency by email. HHS/NIH encourages 
you to continue to submit electronic comments by using the Federal 
eRulemaking Portal, as described previously, in the ADDRESSES portion 
of this document under Electronic Submissions.
    Instructions: All submissions received must include the agency name 
and Docket No. for this rulemaking. All comments received may be posted 
without change to https://www.regulations.gov, including any personal 
information provided.
    Docket: For access to the docket to read background documents or 
comments received, go to https://www.regulations.gov and follow the 
instructions provided for conducting a search, using the docket 
number(s) found in brackets in the heading of this document.

FOR FURTHER INFORMATION CONTACT: Jerry Moore, NIH Regulations Officer, 
Office of Management Assessment, National Institutes of Health, 6011 
Executive Boulevard, Suite 601, MSC 7669, Rockville, MD 20852-7669, 
telephone 301-496-4607, fax 301-402-0169, email jm40z@nih.gov.

SUPPLEMENTARY INFORMATION: NIH is implementing a new system of records 
called, ``NIH Records Related to Research Misconduct Proceedings'' (09-
25-0223). This system of records is part of NIH's implementation of its 
responsibilities under the Public Health Service (PHS) Policies on 
Research Misconduct, 42 CFR part 93. The system notice applies to 
alleged or actual research misconduct involving research: (1) Carried 
out in NIH facilities by any person; (2) funded by the NIH Intramural 
Research Program (IRP) in any location; or (3) undertaken by an NIH 
employee or trainee as part of his or her official NIH duties or NIH 
training activities, regardless of location. A person who, at the time 
of the alleged or actual research misconduct, was employed by, was an 
agent of, or was affiliated by contract, agreement, or other 
arrangement with NIH, is covered by the system if, for example, he or 
she is involved in: (1) NIH- or PHS-supported biomedical or behavioral 
research; (2) NIH- or PHS-supported biomedical or behavioral research 
training programs; (3) NIH- or PHS-supported activities that are 
related to biomedical or behavioral research or research training, such 
as the operation of tissue and data banks and the dissemination of 
research information; (4) plagiarism of research records produced in 
the course of NIH- or PHS-supported research, research training or 
activities related to that research or research training; or (5) an 
application or proposal for NIH or PHS support for biomedical or 
behavioral research, research training or activities related to that 
research or research training, such as the operation of tissue and data 
banks and the dissemination of research information (regardless of 
whether it is approved or funded).
    The term ``research misconduct'' is defined at 42 CFR 93.103 to 
mean ``fabrication, falsification, or plagiarism in proposing, 
performing, or reviewing research, or in reporting research results.'' 
The general policy of the PHS Policies on Research Misconduct is that 
``Research misconduct involving PHS support is contrary to the 
interests of the PHS and the Federal government and to

[[Page 51934]]

the health and safety of the public, to the integrity of research, and 
to the conservation of public funds.'' 42 CFR 93.100(a). The PHS 
Policies on Research Misconduct provide for a number of HHS 
administrative actions that can be taken in response to a research 
misconduct proceeding, such as an adverse personnel action against a 
federal employee, the suspension of a contract, or debarment. 42 CFR 
93.407. In addition, pursuant to 42 CFR 93.318 and 93.401, NIH shall at 
any time during a research misconduct proceeding notify the HHS Office 
of Research Integrity (ORI) immediately to ensure that NIH's Office of 
Management Assessment, HHS' Office of Inspector General, the Department 
of Justice, or other appropriate law enforcement agencies are notified 
and consulted, if there is a reasonable indication of possible 
violations of civil or criminal law that may involve such offices.
    NIH's system of records is modeled after the system of records 
maintained by ORI, entitled ``HHS Records Related to Research 
Misconduct Proceedings, HHS/OS/ORI'' System No. 09-37-0021 (59 FR 
36717, July 19, 1994; revised most recently at 74 FR 44847, Aug. 31, 
2009).
    NIH's records related to research misconduct proceedings are 
located in the Office of Intramural Research in NIH's Office of the 
Director. NIH is updating its organization and operation of these 
records, to be exempt from Privacy Act requirements, as provided in 
this direct final rule and in a new ``System of Records Notice'' which 
NIH is publishing in the Federal Register for public comment 
contemporaneously with or soon after publication of this direct final 
rule.
    Under the Privacy Act (5 U.S.C. 552a), individuals have a right of 
access to information pertaining to them which is contained in a system 
of records. At the same time, the Act permits certain types of systems 
to be exempt from some of the Privacy Act requirements, including the 
access requirement. For example, section 552a(k)(2) allows agency heads 
to exempt from certain Privacy Act provisions a system of records 
containing investigatory material compiled for law enforcement 
purposes. This exemption's effect on the access requirement is 
qualified in that if the maintenance of the material results in the 
denial of any right, privilege, or benefit that the individual would be 
otherwise entitled to by Federal law, the individual must be granted 
access to the material unless the access would reveal the identity of a 
source who furnished information to the Government under an express 
promise of confidentiality. In addition, section 552a(k)(5) permits an 
agency to exempt investigatory material from certain Privacy Act 
provisions where such material is compiled solely for the purpose of 
determining suitability, eligibility, or qualifications for Federal 
civilian employment, military service, Federal contracts, or access to 
classified information, but only to the extent that the disclosure of 
such material would reveal the identity of a source who furnished 
information to the Government under an express promise that the 
identity of the source would be held in confidence.
    As stated above, NIH may take administrative action in response to 
a research misconduct proceeding and, where a civil or criminal fraud 
may have taken place, NIH may refer the matter to the appropriate 
investigative body. As such, NIH's records related to research 
misconduct proceedings are compiled for law enforcement purposes, and 
the subsection (k)(2) exemption is applicable to this system of record. 
Moreover, where records related to research misconduct proceedings are 
compiled solely for the purpose of making determinations as to the 
suitability for appointment as special government employees or 
eligibility for Federal contracts from PHS agencies, the subsection 
(k)(5) exemption is applicable.
    Exempting the system from Privacy Act provisions pertaining to 
providing an accounting of disclosures, access and amendment, 
notification, and procedures and rules is necessary to maintain the 
integrity of the research misconduct proceedings and to ensure that the 
NIH's efforts to obtain accurate and objective information will not be 
hindered.
    Accordingly, HHS/NIH is exempting this system under subsections 
(k)(2) and (k)(5) of the Privacy Act from the accounting, access, and 
amendment, notification and procedures and rules provisions of the 
Privacy Act (paragraphs (c)(3), (d)(1)-(4), (e)(4)(G) and (H), and (f)) 
for the reasons stated below. However, consideration will be given to 
requests for notification, access, and amendment that are addressed to 
the System Manager. The specific rationale for exempting the system 
from each of these provisions is as follows:
     Subsection (c)(3). An exemption from the requirement to 
provide an accounting of disclosures is needed during the pendency of a 
research misconduct proceeding. Release of an accounting of disclosures 
to an individual who is the subject of a pending research misconduct 
assessment, inquiry or investigation could prematurely reveal the 
nature and scope of the assessment, inquiry or investigation and could 
result in the altering or destruction of evidence, improper influencing 
of witnesses, and other evasive actions that could impede or compromise 
the proceeding.
     Subsection (d)(1). An exemption from the access 
requirement is needed both during and after a research misconduct 
proceeding, to avoid revealing the identity of any source who was 
expressly promised confidentiality. Only material that would reveal a 
confidential source will be exempt from access. Protecting the identity 
of a source is necessary when the source is unwilling to come forward 
and report possible research misconduct because of fear of retaliation 
(e.g., from an employee or co-worker).
     Subsections (d)(2) through (d)(4). An exemption from the 
amendment provisions is necessary while one or more related research 
misconduct proceedings are pending. Allowing amendment of investigative 
records in a pending proceeding could interfere with that proceeding; 
even after that proceeding is concluded, an amendment could interfere 
with other pending or prospective research misconduct proceedings, or 
could significantly delay inquiries or investigations in an attempt to 
resolve questions of accuracy, relevance, timeliness, and completeness.
     Subsections (e)(4)(G) and (H). An exemption from the 
notification provisions is necessary during the pendency of a research 
misconduct proceeding, because notifying an individual who is the 
subject of an assessment, inquiry, or investigation of the fact of such 
proceedings could prematurely reveal the nature and scope of the 
proceedings in a manner that could result in the altering or 
destruction of evidence, improper influencing of witnesses, and other 
evasive actions that could impede or compromise the proceeding.
     Subsection (f). An exemption from this requirement to 
establish procedures for notification, access to records, amendment of 
records, or appeals of denials of access to records, is necessary 
because the procedures would serve no purpose in light of the other 
exemptions, to the extent that those exemptions apply.
    As stated above, NIH's system of records is modeled after the 
system of records maintained by HHS' Office of Research Integrity 
(ORI). ORI has exempted these records under subsections (k)(2) and 
(k)(5) of the Privacy Act from the notification, accounting, access, 
and amendment provisions of the Privacy Act, to ensure

[[Page 51935]]

that these investigative files will not be disclosed inappropriately 
[59 FR 36717 (July 19, 1994)]. Likewise, NIH believes that exempting 
the new system, ``NIH Records Related to Research Misconduct 
Proceedings, HHS/NIH,'' from the Privacy Act provisions is essential to 
ensure that material in NIH's files related to research misconduct 
proceedings is not disclosed inappropriately. Except for information 
that would reveal the identity of a source who was expressly promised 
confidentiality, the access exemption will not prohibit HHS/NIH from 
granting respondents' access requests consistent with the PHS Policies 
on Research Misconduct (42 CFR Part 93), including in those cases in 
which a finding of research misconduct has become final and an 
administrative action has been imposed.

Analysis of Impacts

    HHS/NIH has examined the impacts of the final rule under Executive 
Order 12866 and the Regulatory Flexibility Act (5 U.S.C. 601-612), and 
the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4). Executive 
Order 12866 directs agencies to assess all costs and benefits of 
available regulatory alternatives and, when regulation is necessary, to 
select regulatory approaches that maximize net benefits (including 
potential economic, environmental, public health and safety, and other 
advantages; distributive impacts; and equity). The agency believes that 
this final rule is not a significant regulatory action under the 
Executive Order.
    The Regulatory Flexibility Act requires agencies to analyze 
regulatory options that would minimize any significant impact of a rule 
on small entities. Because the final rule imposes no duties or 
obligations on small entities, the agency certifies that the final rule 
will not have a significant economic impact on a substantial number of 
small entities.
    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that agencies prepare a written statement, which includes an assessment 
of anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation) in any one year.'' The current threshold after adjustment 
for inflation is $136 million, using the most current (2010) Implicit 
Price Deflator for the Gross Domestic Product. NIH does not expect this 
final rule to result in any 1-year expenditure that would meet or 
exceed this amount.

List of Subjects in 45 CFR Part 5b

    Privacy.

    For the reasons set out in the preamble, the Department's Privacy 
Act Regulations, Part 5b of 45 CFR Subtitle A, are amended as follows:

PART 5b--PRIVACY ACT REGULATIONS

0
1. The authority citation for Part 5b continues to read as follows:

    Authority:  5 U.S.C. 301, 5 U.S.C. 552a


0
2. In Sec.  5b.11, add paragraph (b)(2)(vii)(D) to read as follows:


Sec.  5b.11  Exempt systems.

* * * * *
    (b) * * *
    (2) * * *
    (vii) * * *
    (D) NIH Records Related to Research Misconduct Proceedings, HHS/
NIH, 09-25-0223.
* * * * *

    Dated: July 20, 2012.
Kathleen Sebelius,
Secretary, Department of Health and Human Services.
[FR Doc. 2012-20886 Filed 8-27-12; 8:45 am]
BILLING CODE 4140-01-P