Privacy Act; Implementation, 14183-14185 [2018-06676]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 83, Number 64 (Tuesday, April 3, 2018)]
[Rules and Regulations]
[Pages 14183-14185]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-06676]



[[Page 14183]]

=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 5b

[Docket Number NIH-2016-0001]
RIN 0925-AA63


Privacy Act; Implementation

AGENCY: National Institutes of Health (NIH), Department of Health and 
Human Services (HHS).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS or 
Department), through the National Institutes of Health (NIH), is 
issuing this final rule to make effective the exemptions that HHS/NIH 
proposed for a subset of records covered in a new Privacy Act system of 
records, System No. 09-25-0225, NIH Electronic Research Administration 
(eRA) Records (NIH eRA Records). The new system covers records used in 
managing NIH research and development applications and awards 
throughout the award lifecycle. The listed exemptions are necessary to 
maintain the integrity of the NIH extramural peer review and award 
processes, and will enable the agency to prevent, when appropriate, 
individual record subjects from having access to, and other rights 
under the Privacy Act with respect to, confidential source-identifying 
material in the records.

DATES: This final rule is effective April 3, 2018.

FOR FURTHER INFORMATION CONTACT: Celeste Dade-Vinson, NIH Privacy Act 
Officer, Office of Management Assessment, National Institutes of 
Health, 6011 Executive Boulevard, Suite 601, MSC 7669, Rockville, 
Maryland 20852, telephone 301-496-4606, fax 301-402-0169, email 
[email protected].

SUPPLEMENTARY INFORMATION: In accordance with the Privacy Act of 1974 
(Privacy Act), the exemptions were described in a Notice of Proposed 
Rulemaking (NPRM) published for public notice and comment on December 
8, 2016 (81 FR 88637). The new system of records was described in a 
System of Records Notice (SORN) published for public notice and comment 
the same day (81 FR 88690). Only certain confidential source-
identifying information was proposed to be exempted, from the 
accounting of disclosures, access and amendment, and notification 
provisions in subsections (c)(3) and (d)(1) through (4) of the Privacy 
Act, based on subsection (k)(5) of the Act. One comment was received on 
the NPRM and no comments were received on the SORN. No changes to the 
proposed exemptions or to the SORN were made as a result of comment 
received. The NIH research and development award programs provide funds 
through contracts, cooperative agreements, and grants to support 
biomedical and behavioral research and development projects and 
centers, training, career development, small business, and loan 
repayment and other research programs. The NIH is responsible to 
Congress and the U.S. taxpayers for carrying out its research and 
development award programs in a manner that facilitates research cost-
effectively and in compliance with applicable statutes, rules and 
regulations, including 42 U.S.C. 217a, 281, 282, 41 U.S.C. 423 and 45 
CFR part 75. The NIH uses an award process that relies on checks and 
balances, separation of responsibilities, and a two-level peer review 
system to ensure that funding applications submitted to the NIH are 
evaluated in a manner that is fair, equitable, timely, and free of 
bias. The two-level peer review system is authorized by 42 U.S.C. 216, 
42 U.S.C. 282(b)(6), 42 U.S.C. 284(c)(3), and 42 U.S.C. 289a and 
governed by regulations at 42 CFR part 52h, ``Scientific Peer Review of 
Research Grant Applications and Research and Development Contract 
Projects.'' The two-level system separates the scientific assessment of 
proposed projects from policy decisions about scientific areas to be 
supported and the level of resources to be allocated, which permits a 
more objective and complete evaluation than would result from a single 
level of review. The two-level review system is designed to provide NIH 
officials with the best available advice about scientific and technical 
merit as well as program priorities and policy considerations. The 
initial or first level review involves panels of experts established 
according to scientific disciplines, generally referred to as 
Scientific Review Groups (SRGs), whose primary function is to evaluate 
the scientific merit of grant applications. The second level of review 
of grant applications is performed by National Advisory Boards or 
Councils composed of both scientific and lay representatives. The 
recommendations made by these Boards or Councils are based not only on 
considerations of scientific merit as judged by the SRG but also on the 
relevance of a proposed project to the programs and priorities of the 
NIH. Referees are those individuals who supply reference or other 
letters of recommendations for a grant or cooperative agreement 
applicant.
    Confidential referee and peer reviewer identifying material is 
contained in records such as reference or recommendation letters, 
reviewer critiques, preliminary or final individual overall impact/
priority score records, and/or assignment of peer reviewers to an 
application and other evaluative materials and data, which referees and 
peer reviewers provide to the NIH Office of Extramural Research (OER) 
under express promises that they will not be identified as the sources 
of the information, and which NIH/OER compiles solely for the purpose 
of determining applicants' suitability, eligibility, or qualifications 
for federal contracts, grants, or cooperative agreements. To the extent 
that records in System No. 09-25-0225 are retrieved by personal 
identifiers for individuals other than the referees and reviewers (for 
example, individual applicants), the exemptions for the new system will 
enable the agency to prevent, when appropriate, those individual record 
subjects from having access to, and other rights under the Privacy Act 
with respect to, confidential source-identifying material in the 
records.
    Under the Privacy Act (5 U.S.C. 552a), individuals have a right of 
access to records about them in federal agency systems of records, and 
other rights with respect to those records (such as notification, 
amendment, and an accounting of disclosures), but the Act permits 
certain types of systems of records (identified in section 552a (j) and 
(k)) to be exempted from certain requirements of the Act. Subsection 
(k)(5) permits the head of an agency to promulgate rules to exempt from 
the requirements in subsections (c)(3) and (d)(1) through (4) of the 
Act investigatory material compiled solely for the purpose of 
determining suitability, eligibility, or qualifications for Federal 
contracts, to the extent that the disclosure of such material would 
reveal the identity of a source who furnished information to the 
Government under an express promise that the identity of the source 
would be held in confidence.
    On December 8, 2016, HHS/NIH published a System of Records Notice 
(SORN) describing the new system (81 FR 88690). On the same date, HHS/
NIH also published a Notice of Proposed Rulemaking (NPRM) (81 FR 88637) 
proposing to exempt a subset of records in the system of records under 
subsection (k)(5) of the Privacy Act from requirements pertaining to 
providing an

[[Page 14184]]

accounting of disclosures, access and amendment, and notification (5 
U.S.C. 552a(c)(3) and (d)). The comment period for the SORN and NPRM 
was open through February 6, 2017. The Agency received one comment and 
recommendation on the NPRM during the rulemaking comment period. The 
comment applauded HHS/NIH's efforts to exempt information contained 
within the system of records as specified in this section of the 
notice. The commenter recommended that the Agency reassess information 
contained within the system of records on a recurrent basis to ensure 
that relevant records are appropriately treated as exempt from the 
Privacy Act provisions in question. After considering the comment and 
recommendation, HHS/NIH believes the exemptions are necessary to 
maintain the integrity of the NIH extramural peer review and award 
processes. Protecting referee and peer reviewer identities as the 
sources of the information they provide protects them from harassment, 
intimidation, and other attempts to improperly influence award 
outcomes, and ensures that they are not reluctant to provide sensitive 
information or frank assessments to the government under an express 
promise that their identities as sources would be held in confidence. 
Case law has held that exemptions promulgated under subsection (k)(5) 
may protect source-identifying material even where the identity of the 
source is known.
    The specific rationales that support the exemptions, as to each 
affected Privacy Act provision, are as follows:
     Subsection (c)(3). An exemption from the requirement to 
provide an accounting of disclosures to record subjects is needed to 
protect the identity of any referee or peer reviewer source who is 
expressly promised confidentiality. Release of an accounting of 
disclosures to an individual who is related to the application under 
assessment or evaluation could identify particular referees and peer 
reviewers as sources of recommendations or evaluative input received, 
or to be received, on the application. Inappropriately revealing their 
identities in association with the nature and scope of their 
assessments or evaluations and could lead them to alter or destroy 
their assessments or evaluations or subject them to harassment, 
intimidation, or other improper influences, which would impede or 
compromise the fairness and objectivity of the grant or contract review 
process.
     Subsection (d)(1). An exemption from the access 
requirement is needed both during and after a grant or contract review 
proceeding, to avoid inappropriately revealing the identity of any 
referee or peer reviewer source who was expressly promised 
confidentiality. Protecting confidential referee and peer reviewer 
identifying material from inappropriate access by record subjects is 
necessary for the integrity of the peer review process to ensure such 
sources provide candid assessments or evaluations to the government 
without fear that their identities as linked to a specific work product 
will be inappropriately revealed. Allowing an individual applicant or 
other individual who is the subject of an assessment or evaluation to 
access material that would inappropriately reveal a confidential 
referee or peer reviewer source could interfere with or compromise the 
objectivity and fairness of grant and contract review proceedings, 
constitute an unwarranted invasion of the personal privacy of the 
source and violate the express promise of confidentiality made to the 
source.
     Subsections (d)(2) through (d)(4). An exemption from the 
amendment provisions is necessary while one or more related grant and/
or contract review proceedings are pending, but only if and to the 
extent that disclosure of information in the amendment request process 
would inappropriately reveal the identity of any referee or peer 
reviewer source who was expressly promised confidentiality. This 
exemption will be limited to allowing the agency, when processing an 
amendment or correction request by an individual applicant or other 
individual who is the subject of an evaluation or assessment in a 
pending proceeding, to avoid disclosing the existence of the record and 
its contents, if doing so would inappropriately reveal the identity of 
any referee or peer reviewer source who was expressly promised 
confidentiality. Inappropriately revealing the identity of a 
confidential referee or peer reviewer source to an individual applicant 
or other individual who is the subject of an evaluation or assessment 
in a pending proceeding could interfere with that proceeding, would 
constitute an unwarranted invasion of the personal privacy of a source, 
or would violate the express promise of confidentiality made to the 
source.
    Accordingly, pursuant to 5 U.S.C. 552a(k)(5), the agency is now 
exempting the following source-identifying material in system of 
records 09-25-0225 NIH eRA Records from the accounting, access, 
amendment and notification provisions of the Privacy Act (paragraphs 
(c)(3) and (d)(1) through (4)), based on the specific rationales 
indicated above:

    Material that would inappropriately reveal the identities of 
referees who provide letters of recommendation and peer reviewers 
who provide written evaluative input and recommendations to NIH 
about particular funding applications under an express promise by 
the government that their identities in association with the written 
work products they authored and provided to the government will be 
kept confidential; this includes only material that would reveal a 
particular referee or peer reviewer as the author of a specific work 
product (e.g., reference or recommendation letters, reviewer 
critiques, preliminary or final individual overall impact/priority 
scores, and/or assignment of peer reviewers to an application and 
other evaluative materials and data compiled by NIH/OER); it 
includes not only an author's name but any content that could enable 
the author to be identified from context.

    Notwithstanding the exemptions, consideration will be given to any 
requests for notification, access, and amendment that are addressed to 
the System Manager, as provided in the SORN for system of records 09-
25-0225, and to accounting of disclosure requests.
    The Federal Register notice containing the SORN proposed for new 
system of records 09-25-0225 (81 FR 88690, published December 8, 2016) 
provides for that SORN to be effective upon publication of this final 
rule. No changes were made to the SORN as a result of public comments 
and, therefore, the SORN, as published at 81 FR 88690, is now 
effective.

Analysis of Impacts

I. Review Under Executive Orders 12866, 13563, and 13771

    The agency has reviewed this rule under Executive Orders 12866 and 
13563, which direct agencies to assess costs and benefits of available 
regulatory alternatives and, if regulation is necessary, to maximize 
the net benefits. The agency believes that this rule is not a 
significant regulatory action under Executive Order 12866, and 
therefore does not constitute an Executive Order 13771 regulatory 
action, because it will not (1) have an annual effect on the economy of 
$100 million or more or adversely affect in a material way the economy, 
a sector of the economy, productivity, competition, jobs, the 
environment, public health or safety, or state, local or tribal 
governments or communities; (2) create a serious inconsistency or 
otherwise interfere with an action taken or planned by another agency; 
(3) materially alter the budgetary impact of entitlements, grants, user 
fees or loan programs, or the

[[Page 14185]]

rights and obligations of recipients thereof; or (4) raise novel legal 
or policy issues arising out of legal mandates, the President's 
priorities, or the principles set forth in Executive Order 12866. This 
rule renders certain Privacy Act requirements inapplicable to certain 
agency records (in this case, certain confidential source-identifying 
records in NIH research and development award records) in accordance 
with criteria established in subsection (k)(5) of the Privacy Act (5 
U.S.C. 552a(k)(5)), based on a showing that agency compliance with 
those Privacy Act requirements with respect to those records would harm 
the effectiveness or integrity of the agency function or process for 
which the records are maintained (in this case, NIH research and 
development award processes).

II. Review Under the Regulatory Flexibility Act (5 U.S.C. 601-612)

    The Regulatory Flexibility Act requires agencies to analyze 
regulatory options that would minimize any significant regulatory 
impacts of a rule on small entities. Because the rule imposes no duties 
or obligations on small entities, we have determined, and the Director 
certifies, that the rule will not have a significant economic impact on 
a substantial number of small entities.

III. Review Under the Unfunded Mandates Reform Act of 1995 (Section 
202, Pub. L. 104-4)

    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that agencies prepare a written statement, which includes an assessment 
of anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation) in any one year.'' The current threshold after adjustment 
for inflation is $144 million, using the most current (2015) Implicit 
Price Deflator for the Gross Domestic Product. The agency does not 
expect that this final rule would result in any 1-year expenditure by 
State, local, and tribal governments that would meet or exceed this 
amount.

IV. Review Under the Paperwork Reduction Act of 1995 (44 U.S.C. 35-1 et 
seq.)

    This rule does not contain any information collection requirements 
subject to the Paperwork Reduction Act.

V. Review Under Executive Order 13132, Federalism

    This rule will not have any direct effects on the States, on the 
relationship between the National Government and the States, or on the 
distribution of power and responsibilities among the various levels of 
government. Therefore, the requirements of Executive Order 13132 are 
inapplicable.

List of Subjects in 45 CFR Part 5b

    Privacy.

    For the reasons set out in the preamble, the Department amends part 
5b of title 45 of the Code of Federal Regulations as follows:

PART 5b--PRIVACY ACT REGULATIONS

0
1. The authority citation for part 5b continues to read as follows:

    Authority: 5 U.S.C. 301, 5 U.S.C. 552a.


0
2. Amend Sec.  5b.11 by:
0
a. Removing ``and,'' from the end of paragraph (b)(2)(iv)(A);
0
b. Removing the period at the end of paragraph (b)(2)(iv)(B) and adding 
``; and'' in its place; and
0
c. Adding paragraph (b)(2)(iv)(C).
    The addition reads as follows:


Sec.  5b.11   Exempt systems.

* * * * *
    (b) * * *
    (2) * * *
    (iv) * * *
    (C) NIH Electronic Research Administration (eRA) Records, HHS/NIH/
OD/OER, 09-25-0225.
* * * * *

    Dated: February 5, 2018.
Francis S. Collins,
Director, National Institutes of Health.
    Approved: March 28, 2018.
Alex M. Azar II,
Secretary, Department of Health and Human Services.
[FR Doc. 2018-06676 Filed 4-2-18; 8:45 am]
 BILLING CODE 4140-01-P