Privacy Act; Implementation, 39186-39188 [2013-15596]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 78, Number 126 (Monday, July 1, 2013)]
[Rules and Regulations]
[Pages 39186-39188]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2013-15596]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 5b

[Docket No. NIH-2011-0001]


Privacy Act; Implementation

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS or 
Department), through the National Institutes of Health (NIH), is 
exempting a system of records from certain requirements of the Privacy 
Act to protect the integrity of NIH research misconduct proceedings and 
to protect the identity of confidential sources in such proceedings.

DATES: Effective Date: This rule is effective July 31, 2013.

FOR FURTHER INFORMATION CONTACT: Jerry Moore, NIH Regulations Officer, 
Office of Management Assessment, Division of Management Support, 6011 
Executive Boulevard, Suite 601, MSC 7669, Rockville, MD 20852-7669; 
telephone 301-496-4607; fax 301-402-0169; email jm40z@nih.gov.

SUPPLEMENTARY INFORMATION: HHS/NIH is exempting a system of records, 
09-25-0223, ``NIH Records Related to Research Misconduct Proceedings, 
HHS/NIH,'' under subsections (k)(2) and (k)(5) of the Privacy Act (5 
U.S.C. 552a) from notification, access, accounting, and amendment 
provisions of the Privacy Act.
    This system of records is part of NIH's implementation of its 
responsibilities under the Public Health Service (PHS) Policies on 
Research Misconduct, 42 CFR Part 93, and applies to alleged or actual 
research misconduct involving research in the NIH Intramural Research 
Program (IRP): (1) Carried out in NIH facilities by any person; (2) 
funded by the NIH IRP in any location; or (3) undertaken by an NIH 
employee or trainee as part of his or her official NIH duties or NIH 
training activities, regardless of location. Subject to NIH IRP policy, 
a person who, at the time of the alleged or actual research misconduct, 
was employed by, was an agent of, or was affiliated by contract, 
agreement, or other arrangement with NIH is covered by the system.
    The term ``research misconduct'' is defined at 42 CFR 93.103 to 
mean ``fabrication, falsification, or plagiarism in proposing, 
performing, or reviewing research, or in reporting research results.'' 
The general policy of the PHS Policies on Research Misconduct is that 
``[r]esearch misconduct involving PHS support is contrary to the 
interests of the PHS and the Federal government and to the health and 
safety of the public, to the integrity of research, and to the 
conservation of public funds'' 42 CFR 93.100(a).
    Under the Privacy Act, individuals have a right of access to 
information pertaining to them that is contained in a system of 
records. At the same time, the Privacy Act permits certain types of 
systems to be exempt from some of the Privacy Act requirements. For 
example, section (k)(2) of the Privacy Act allows Agency heads to 
exempt from certain Privacy Act provisions a system of records 
containing investigatory material compiled for law enforcement 
purposes. This exemption's effect on the record access provision is 
qualified in that if the maintenance of the material results in the 
denial of any right, privilege, or benefit that the individual would 
otherwise be entitled to by federal law, the individual must be granted 
access to the material except to the extent that the access would 
reveal the identity of a source who furnished information to the 
government under an express promise that the identity of the source 
would be held in confidence. In addition, section (k)(5) of the Privacy 
Act permits an Agency to exempt investigatory material from certain 
Privacy Act provisions where such material is compiled solely for the 
purpose of determining suitability, eligibility, or qualifications for 
federal civilian employment, military service, federal contracts, or 
access to classified information. This exemption is also limited as it 
will be applied only to the extent that the disclosure of such material 
would reveal the identity of a source who furnished information to the 
government under an express promise of confidentiality.
    The NIH may take administrative action in response to a research 
misconduct proceeding and, where there is a reasonable indication that 
a civil or criminal fraud may have taken place, will refer the matter 
to the appropriate investigative body. As such, the NIH's records 
related to research misconduct proceedings are compiled for law 
enforcement purposes, and the subsection (k)(2) exemption is applicable 
to this system of records. Moreover, where records related to research 
misconduct proceedings are compiled solely for the purpose of making 
determinations as to the suitability for appointment as special 
government employees or eligibility for federal contracts from PHS 
agencies, the subsection (k)(5) exemption is applicable.

[[Page 39187]]

    On August 28, 2012, HHS/NIH published a System of Records Notice 
(SORN) for this system (77 FR 52043). On the same date, HHS/NIH also 
published a proposed rule (77 FR 51954) and, anticipating no 
significant adverse comment, a direct final rule (77 FR 51933) to 
exempt this system of records under subsections (k)(2) and (k)(5) of 
the Privacy Act from the notification, access, accounting, and 
amendment provisions of the Privacy Act. The comment period was open 
through November 13, 2012. The Agency received two comments during the 
rulemaking comment period. One comment, which questioned the privacy 
interest of scientists who receive grant money and are accused of 
misconduct, appears to have misunderstood the scope and applicability 
of the exceptions. The system of records in question pertains to 
research misconduct proceedings involving the NIH IRP. Thus, NIH grant 
funding to extramural scientists is unlikely to be involved. Moreover, 
the exception would not interfere with the public disclosure of 
findings of research misconduct by HHS' Office of Research Integrity 
(ORI) on behalf of the agency, including findings that may involve NIH 
IRP scientists or trainees found to have committed research misconduct. 
The other comment expressed a general concern about a loss of privacy 
and appeared to seek a reconsideration of the agency's approach, which 
was construed as sufficiently adverse to merit withdrawal of the direct 
final rule on January 10, 2013. HHS/NIH now publishes this final rule 
under the standard notice and comment rulemaking process.
    After considering the comments, HHS/NIH believes the exemptions at 
issue are necessary to fulfill the Agency's responsibilities for 
addressing research misconduct. The exemptions are essential for NIH to 
protect the confidentiality of sources who provide information relevant 
to a research misconduct proceeding and to guard against the premature 
disclosure of research misconduct records that might obstruct or 
compromise proceedings. The exemptions will thereby enable the NIH to 
maintain the integrity and effectiveness of research misconduct 
proceedings.
    Failure to adopt the exemptions would jeopardize the integrity and 
effectiveness of the NIH's research misconduct proceedings. The NIH's 
new system of records is modeled after the system of records maintained 
by the ORI, entitled ``HHS Records Related to Research Misconduct 
Proceedings, HHS/OS/ORI'' System No. 09-37-0021 (59 FR 36717, July 19, 
1994; revised most recently at 74 FR 44847, August 31, 2009). The ORI 
has exempted these records under subsections (k)(2) and (k)(5) of the 
Privacy Act from the notification, access, accounting, and amendment 
provisions of the Privacy Act to ensure that these records will not be 
disclosed inappropriately (59 FR 36717, July 19, 1994). Likewise, HHS/
NIH believes that exempting the new NIH system from the same Privacy 
Act provisions is essential to ensure that material in the NIH's files 
related to research misconduct proceedings is not disclosed 
inappropriately.
    Subject to its obligations under the PHS Policies on Research 
Misconduct, 42 CFR Part 93, and other applicable law, HHS/NIH is 
therefore exempting this system under subsections (k)(2) and (k)(5) of 
the Privacy Act from the notification, access, and amendment provisions 
of the Act (subsections (c)(3), (d)(1) to (d)(4), (e)(4)(G) and 
(e)(4)(H), and (f)). The specific rationales for applying each of the 
exemptions are as follows:
     Subsection (c)(3). An exemption from the requirement to 
provide an accounting of disclosures is needed during the pendency of a 
research misconduct proceeding. Release of an accounting of disclosures 
to an individual who is the subject of a pending research misconduct 
assessment, inquiry, or investigation could prematurely reveal the 
nature and scope of the assessment, inquiry, or investigation and could 
result in the altering or destruction of evidence, improper influencing 
of witnesses, and other evasive actions that could impede or compromise 
the proceeding.
     Subsection (d)(1). An exemption from the access 
requirement is needed both during and after a research misconduct 
proceeding to avoid revealing the identity of any source who was 
expressly promised confidentiality. Only material that would reveal a 
confidential source will be exempt from access. Protecting the identity 
of a source is necessary when the source is unwilling to report 
possible research misconduct because of fear of retaliation (e.g., from 
an employer or coworkers).
     Subsections (d)(2) through (d)(4). An exemption from the 
amendment provisions is necessary while one or more related research 
misconduct proceedings is pending. Allowing amendment of investigative 
records in a pending proceeding could interfere with that proceeding. 
Even after that proceeding is concluded, an amendment could interfere 
with other pending or prospective research misconduct proceedings or 
could significantly delay inquiries or investigations in an attempt to 
resolve questions of accuracy, relevance, timeliness, and completeness.
     Subsection (e)(4)(G) and (e)(4)(H). An exemption from the 
Privacy Act notification provisions is necessary during the pendency of 
a research misconduct proceeding because notifying an individual who is 
the subject of an assessment, inquiry, or investigation of the fact of 
such proceedings could prematurely reveal the nature and scope of the 
proceedings and result in the altering or destruction of evidence, 
improper influencing of witnesses, and other evasive actions that could 
impede or compromise the proceeding. This exemption does not alter 
NIH's obligations to provide notice to the respondent in a research 
misconduct proceeding as described in the PHS Policies on Research 
Misconduct, 42 CFR Part 93.
     Subsection (f). An exemption from the requirement to 
establish procedures for notification, access to records, amendment of 
records, or appeals of denials of access to records is appropriate 
because the procedures would serve no purpose in light of the other 
exemptions, to the extent that those exemptions apply.
    To avoid the unnecessary application of the exemptions, the NIH 
will give case-by-case consideration to requests for notification, 
access, and amendment submitted to the NIH Agency Intramural Research 
Integrity Officer (System Manager) or NIH Privacy Act Officer. Except 
for information that would reveal the identity of a source who was 
expressly promised confidentiality, the access exemption will not 
prohibit HHS/NIH from granting respondents' access requests consistent 
with the PHS Policies on Research Misconduct, 42 CFR part 93, including 
in those cases in which a finding of research misconduct has become 
final and an administrative action has been imposed. The request 
submission process is described in the SORN previously published for 
this system (77 FR 52043) and available online at https://www.gpo.gov/fdsys/pkg/FR-2012-08-28/pdf/2012-20884.pdf.

Analysis of Impacts

    HHS/NIH has examined the impacts of the final rule under Executive 
Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 
U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 
104-4). Executive Orders 12866 and 13563 direct Agencies to assess all 
costs and benefits of available regulatory alternatives and, when 
regulation is necessary, to select regulatory

[[Page 39188]]

approaches that maximize net benefits (including potential economic, 
environmental, public health and safety, and other advantages; 
distributive impacts; and equity). The Agency believes that this final 
rule is not a significant regulatory action under Executive Order 
12866.
    The Regulatory Flexibility Act requires Agencies to analyze 
regulatory options that would minimize any significant impact of a rule 
on small entities. Because the final rule imposes no duties or 
obligations on small entities, the Agency certifies that the final rule 
will not have a significant economic impact on a substantial number of 
small entities.
    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that Agencies prepare a written statement, which includes an assessment 
of anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation) in any one year.'' The current threshold after adjustment 
for inflation is $136 million, using the most current (2010) Implicit 
Price Deflator for the Gross Domestic Product. HHS/NIH does not expect 
this final rule to result in any 1-year expenditure that would meet or 
exceed this amount.

List of Subjects in 45 CFR Part 5b

    Privacy.

    For the reasons set out in the preamble, the Department of Health 
and Human Services is amending 45 CFR part 5b Subtitle A to read as 
follows:

PART 5b--PRIVACY ACT REGULATIONS

0
1. The authority citation for 45 CFR part 5b continues to read as 
follows:

    Authority: 5 U.S.C. 301, 5 U.S.C. 552a.


0
2. Section 5b.11 is amended by adding paragraph (b)(2)(vii)(D) to read 
as follows:


Sec.  5b.11  Exempt systems.

* * * * *
    (b) * * *
    (2) * * *
    (vii) * * *
    (D) NIH Records Related to Research Misconduct Proceedings, HHS/
NIH, 09-25-0223.
* * * * *

    Dated: June 14, 2013.
Kathleen Sebelius,
Secretary of Health and Human Services.
[FR Doc. 2013-15596 Filed 6-28-13; 8:45 am]
BILLING CODE 4140-01-P