Privacy Act of 1974; System of Records Notice, 21344-21347 [2019-09926]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 84, Number 93 (Tuesday, May 14, 2019)]
[Notices]
[Pages 21344-21347]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-09926]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES


Privacy Act of 1974; System of Records Notice

AGENCY: Office of the Secretary of Health and Human Services (OS), 
Department of Health and Human Services (HHS).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, as amended, HHS is revising a department-wide system of records, 
System No. 09-90-1601 titled Outside Experts Recruited for Non-FACA 
Activities, to add records about outside consultants used by HHS' 
Administration for Children and Families, Office of Trafficking in 
Persons (ACF/OTIP).

DATES: The modified system of records is effective June 13, 2019, with 
the exception of the new and revised routine uses. The new and revised 
routine uses will be effective 30 days after publication of this 
notice, unless comments are received that warrant a revision to this 
notice. Comments should be submitted within 30 days of publication, but 
may be made at any time.

ADDRESSES: The public should submit written comments by mail or email 
to Beth Kramer, HHS Privacy Act Officer, FOIA/PA Division, Hubert H. 
Humphrey Bldg., Ste. 729H, 200 Independence Ave. SW, Washington, DC 
20201, or [email protected].

FOR FURTHER INFORMATION CONTACT: General questions about the modified 
system of records may be submitted by mail or email to Beth Kramer, HHS 
Privacy Act Officer, FOIA/PA Division, Hubert H. Humphrey Bldg., Ste. 
729H, 200 Independence Ave. SW, Washington, DC 20201, or 
[email protected].

SUPPLEMENTARY INFORMATION:

I. Explanation of Modifications Made to System No. 09-90-1601

    This department-wide system of records covers records about 
individuals outside the HHS workforce who serve or are considered for 
service on mission-related committees and other activities (such as 
peer review programs) which require specific expertise or experience 
but are not subject to the Federal Advisory Committee Act (FACA), 5 
U.S.C. App., et seq. The system of records has been modified to add the 
following records maintained by the Administration for Children and 
Families' Office on Trafficking in Persons (ACF/OTIP):
     Consultants on Office on Trafficking in Persons (OTIP) 
projects. ACF/OTIP contractors arrange for outside consultants to be 
used in OTIP programs (in addition to peer review programs) when 
technical assistance is needed in conferences, meetings, and evaluation 
projects that involve a specialized area of research, review, or 
advice.
    The ACF/OTIP consultant records are similar in type and function to 
the other records currently covered by System No. 09-90-1601; i.e.,:
     Curricula Vitae of Consultants to the National Center for 
Health Statistics (NCHS) within the Centers for Disease Control and 
Prevention (CDC/NCHS) (formerly covered under SORN 09-20-0168). This 
program maintains records about individuals with special expertise, 
training, and professional experience who may be enlisted to assist 
CDC/NCHS as consultants. The records are used by CDC/NCHS to select 
individuals to participate in

[[Page 21345]]

assignments such as: Planning and conducting surveys, studies, 
statistical reporting programs, and statistical analyses of data; 
providing training and technical assistance; and planning and 
conducting conferences.
     The Food and Drug Administration (FDA) Patient 
Representative Program. This program enlists individuals with patient 
advocacy experience to serve as patient representatives on both FACA 
committees and non-FACA assignments. For example, patient 
representatives may provide input that is used in making decisions to 
approve devices or drugs, or may contribute to discussions at 
presentations and conferences. Records about patient representatives 
are retrieved by the representatives' names, and are covered under 
either SORN No. 09-90-0059 or SORN No. 09-90-1601, depending on whether 
the records pertain to service on a FACA committee or service on a non-
FACA assignment.
     Peer Review Programs at the Administration for Children 
and Families (ACF), Health Resources and Services Administration 
(HRSA), and Substance Abuse and Mental Health Services Administration 
(SAMHSA) that recruit and use outside individuals to serve on peer 
review committees formed to review applications for grants and 
cooperative agreements. These programs exist in several HHS components, 
but only ACF, HRSA, and SAMHSA sometimes use a personal identifier 
(i.e., name) to retrieve administrative records about the outside 
individuals they recruit and use. Other components (including the 
Office of the Assistant Secretary for Health (OASH), Centers for 
Medicare & Medicaid Services (CMS), and National Institutes of Health 
(NIH)) use only non-personal identifiers (e.g., expertise type, or 
funding opportunity announcement number) for retrieval.
     Consultants on Other SAMHSA Projects. SAMHSA contractors 
arrange for outside consultants to be used in other SAMHSA programs 
(besides peer review programs) when technical assistance is needed in 
conferences, meetings, and evaluation projects that involve a 
specialized area of research, review, or advice.
    The System of Records Notice (SORN) for System No. 09-90-1601 has 
been reformatted to comply with OMB Circular A-108, issued December 23, 
2016, and has been revised as follows to cover ACF/OTIP consultant 
records:
     The System Manager(s) section and Records Location section 
have been updated to identify the component responsible for ACF/OTIP 
consultant records.
     The Authority section now includes the legal authorities 
applicable to ACF/OTIP consultant records.
     The Categories of Individuals section has been revised to 
add ``human trafficking'' to the list of examples of outside experts' 
areas of expertise or experience.
     In the Categories of Records section, ``[d]ates and 
descriptions of current assignments'' has been added to the list of 
data elements that may be contained in the records.
     Routine use 7 has been revised to remove the following 
unnecessary wording: ``and that, therefore, the use of such records by 
the DOJ, court or other tribunal is deemed by HHS to be compatible with 
the purpose for which the agency collected the records.'' The wording 
is unnecessary because a routine use is defined in subsection (a)(7) of 
the Privacy Act as a disclosure of a record for a use that is 
compatible with the purpose for which the record was collected.
    Because some of these revisions are significant, a report on the 
modified system of records was sent to Congress and OMB in accordance 
with 5 U.S.C. 552a(r).

    Dated: May 8, 2019.
Michael S. Marquis,
Director, FOIA/Privacy Act Division, Assistant Secretary for Public 
Affairs.
    Dated: May 8, 2019.
Anita E. Alford,
Chief Information Security Officer and OpDiv Senior Officer for 
Privacy, Office of the Chief Information Officer, Administration for 
Children and Families.
SYSTEM NAME AND NUMBER
    Outside Experts Recruited for Non-FACA Activities, 09-90-1601.

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    The address of each agency component responsible for the system of 
records is provided in the System Manager(s) section. Records locations 
include:
    [ssquf] CDC program offices that recruit consultants to assist in 
statistical projects and reporting programs conducted or sponsored by 
NCHS, in Atlanta, GA and Hyattsville, MD;
    [ssquf] FDA's committee management office in Silver Spring, MD;
    [ssquf] Program offices at ACF in Washington, DC, at HRSA in 
Rockville, MD, and at SAMHSA in Rockville, MD, that recruit individuals 
to serve as peer reviewers; and
    [ssquf] Locations of SAMHSA contractors that arrange use of 
consultants on SAMHSA projects, and locations of ACF/OTIP contractors 
that arrange use of consultants on OTIP projects.

SYSTEM MANAGER(S):
    For CDC/NCHS Consultant Records: Centers for Disease Control and 
Prevention (CDC), Director, National Center for Health Statistics, 
OPHSS, Prince George's Metro IV Bldg., Rm. 7209, MS P08, 3311 Toledo 
Rd., Hyattsville, MD 20782, (301) 458-4000.
    For FDA Patient Representative Records: Food and Drug 
Administration (FDA), Advisory Committee Oversight & Management Staff, 
10903 New Hampshire Ave., Bldg. WO32, Rm. 5129, Silver Spring, MD 
20993-002, (301) 443-0572.
    For ACF Peer Reviewer Records: Administration for Children and 
Families (ACF), Privacy Act Contact, Office of the Chief Information 
Officer, 330 C St. SW, Washington, DC 20201, [email protected], 
(202) 401-4628.
    For HRSA Peer Reviewer Records: Health Resources and Services 
Administration (HRSA), Chief, Policy, Analysis & Training Branch, 
Division of Independent Review, Office of Federal Assistance 
Management, 5600 Fishers Ln., Rockville, MD 20857, (301) 443-4767.
    For SAMHSA Peer Reviewer Records: Substance Abuse and Mental Health 
Services Administration (SAMHSA), Director, Division of Grant Review, 
5600 Fishers Ln., Rockville, MD 20852, (240) 276-1199.
    For Other Consultant Records, Maintained by SAMHSA Contractors: 
Substance Abuse and Mental Health Services Administration (SAMHSA), 
Director, Division of Contracts Management, Office of Program Services, 
5600 Fishers Ln., Rockville, MD 20852, (240) 276-1500.
    For Other Consultant Records, Maintained by ACF/OTIP Contractors: 
Office on Trafficking in Persons (OTIP), Deputy Director, Mary E. 
Switzer Building, 330 C St. SW, Washington, DC 20201, (202) 401-9372.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    For CDC/NCHS Consultant Records: 42 U.S.C. 242b(b)(3).
    For FDA Patient Representative Records: 21 U.S.C. 360bbb-8c, 371 et 
seq., 379d-1(b)(1)(A).
    For ACF Peer Reviewer Records: 42 U.S.C. 799(f), 806(e).
    For HRSA Peer Reviewer Records: 42 U.S.C. 799(f), 806(e).
    For SAMHSA Peer Reviewer and Other Consultant Records: 42 U.S.C. 
241, 249(c), 290aa et seq., 290aa-5, 290bb et seq., 290bb-21 et seq., 
290bb-

[[Page 21346]]

31 et seq., 5121 et seq., 10801 et seq.; 8 U.S.C. 1522 note; Executive 
Order 12341.
    For OTIP Consultant Records: 22 U.S.C. 7104(b), 7105(b)(1)(G), 
(c)(4), and (f); 42 U.S.C. 1314b.
    See also: 5 U.S.C. 3109.

PURPOSE(S):
    The records are used within the agency on a need-to-know basis for 
the purpose of staffing committees and other assignments and managing 
administrative matters pertaining to individuals serving on committees 
and other assignments, including to:
     Prepare reports and lists of past, present, and 
recommended members, vacancies, acceptances, and separations;
     Send recruitment notices to individual prospective 
candidates, and send informational notices to selectees;
     Identify qualified candidates and document the selections; 
and
     Manage and coordinate the selected individuals' 
participation in assignment activities (including sharing information 
within the agency to coordinate aspects such as badging, parking, 
travel, training, and payment of any stipend or honorarium).

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Records in this system pertain to individuals outside the HHS 
workforce who serve or are considered for service on HHS mission-
related committees or other assignments that require specific outside 
expertise or experience (for example, medical, scientific, 
manufacturing, or human trafficking expertise, or patient advocacy 
experience), but that are not subject to the Federal Advisory Committee 
Act (FACA), 5 U.S.C. App., et seq.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The records consist of recruitment and other administrative 
records, including:
     An application and resume or curricula vitae, describing 
the individual's qualifications;
     Nomination/recommendation records, or other records used 
in evaluating an individual's qualifications and any potential 
conflicts of interest and selecting an individual for a specific 
assignment; and
     Records used to plan and arrange the individual's 
participation in the assigned activities, including scheduling records 
and records used to coordinate parking, badging, and payment of any 
stipend or honorarium.
    The records may contain these data elements:
     The individual's name and other identifying information 
(e.g., sex, place and date of birth);
     Contact information (e.g., home and business addresses, 
telephone numbers, email addresses);
     Occupation, job titles, employers, employment status and 
history, and whether currently employed by the federal government;
     Work and organizational affiliations, memberships, 
credentials, and licenses;
     Degrees held, and general educational and/or experience 
background;
     Racial classification or ethnic background;
     Areas of specialization, expertise, or experience, and 
special qualifications (e.g., language or technical skills, ability to 
drive to an assignment);
     Dates and descriptions of past assignments or past 
experience;
     Dates and descriptions of current assignments;
     Sources and references, and any information provided by 
sources/references; and
     Information about availability and any special needs.
    Any special needs, medical condition, or similar information 
contained in an individual's records is maintained and used in 
accordance with relevant provisions of the Rehabilitation Act of 1973, 
as amended, 29 U.S.C. 791 et seq., and implementing regulations at 29 
CFR parts 1614 and 1630, and the Genetic Information Nondiscrimination 
Act of 2008 at 42 U.S.C. 2000ff et seq.

RECORD SOURCE CATEGORIES:
    Most information is obtained directly from the individual record 
subject. Information pertaining to references and recommendations is 
obtained from other private individuals, educational institutions, 
current and former employers, HHS program personnel, biographical 
reference books, private organizations, members of Congress, and other 
government sources.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    HHS may make the following disclosures of information about an 
individual record subject from this system of records to parties 
outside the agency without the individual's prior, written consent:
    1. Disclosures may be made to federal agencies and Department 
contractors that have been engaged by HHS to assist in accomplishment 
of an HHS function relating to the purposes of this system of records 
and that have a need to have access to the records in order to assist 
HHS in performing the activity. Any contractor will be required to 
comply with the requirements of the Privacy Act.
    2. Records may be disclosed to parties such as educational 
institutions, current and former employers, and qualified experts, when 
necessary to check or obtain an opinion about a candidate's 
qualifications.
    3. Records about consultants and patient advocates may be disclosed 
to parties organizing or hosting assignment activities, such as grantee 
institutions and federal, foreign, state, tribal, local, and other 
government agencies and public authorities (e.g., U.S. Embassies and 
Ministries of Health), when necessary to apprise them of an 
individual's qualifications for the assignment or coordinate the 
individual's participation in the activities.
    4. Records may be disclosed to supervisors and administrative 
assistants at the individual's place of employment, for administrative 
purposes such as coordinating the individual's participation in the 
activities.
    5. Records may be disclosed to external parties that audit 
committee or assignment activities.
    6. Relevant information will be included in any required reports to 
the President, the Office of Management and Budget (OMB), and the 
General Services Administration (GSA) about committees and other 
assignments that are mission-related.
    7. Information may be disclosed to the U.S. Department of Justice 
(DOJ) or to a court or other tribunal, when:
    a. The agency or any component thereof, or
    b. Any employee of the agency in his or her official capacity, or
    c. Any employee of the agency in his or her individual capacity 
where DOJ has agreed to represent the employee, or
    d. The United States Government, is a party to litigation or has an 
interest in such litigation and, by careful review, HHS determines that 
the records are both relevant and necessary to the litigation.
    8. Records may be disclosed to student volunteers and other 
individuals performing functions for the Department but technically not 
having the status of agency employees, if they need access to the 
records in order to perform their assigned agency functions.
    9. Disclosures may be made to the National Archives and Records 
Administration (NARA) and/or the General Services Administration (GSA) 
for the purpose of records management

[[Page 21347]]

inspections conducted under 44 U.S.C. 2904 and 2906.
    10. Information may be disclosed to a Member of Congress or a 
Congressional staff member in response to a written inquiry of the 
Congressional office made at the written request of the constituent 
about whom the record is maintained. The Congressional office does not 
have any greater authority to obtain records than the individual would 
have if requesting the records directly.
    11. Records may be disclosed to the U.S. Department of Homeland 
Security (DHS) if captured in an intrusion detection system used by HHS 
and DHS pursuant to a DHS cybersecurity program that monitors internet 
traffic to and from federal government computer networks to prevent a 
variety of types of cybersecurity incidents.
    12. Records may be disclosed to appropriate agencies, entities, and 
persons when (1) HHS suspects or has confirmed that there has been a 
breach of the system of records, (2) HHS has determined that as a 
result of the suspected or confirmed breach there is a risk of harm to 
individuals, HHS (including its information systems, programs, and 
operations), the federal government, or national security, and (3) the 
disclosure made to such agencies, entities, and persons is reasonably 
necessary to assist in connection with HHS's efforts to respond to the 
suspected or confirmed breach or to prevent, minimize, or remedy such 
harm.
    13. Records may be disclosed to another federal agency or federal 
entity, when HHS determines that information from this system of 
records is reasonably necessary to assist the recipient agency or 
entity in (1) responding to a suspected or confirmed breach or (2) 
preventing, minimizing, or remedying the risk of harm to individuals, 
the recipient agency or entity (including its information systems, 
programs, and operations), the federal government, or national 
security, resulting from a suspected or confirmed breach.
    The disclosures authorized by publication of the above routine uses 
pursuant to 5 U.S.C. 552a(b)(3) are in addition to other disclosures 
authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(4)-(11).

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records are stored in hard-copy files and electronic media.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records are retrieved by the individual's name.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records pertaining to recruitment and use of outside peer reviewers 
are destroyed three years after final action; they are retained longer 
if required for business use (see General Records Schedule (GRS) 1.2, 
Item 010, Grant and Cooperative Agreement Program Management Records). 
Records pertaining to recruitment and use of other outside individuals 
(e.g., experts, patient advocates, and members of mission-related non-
FACA committees) are currently unscheduled. Unscheduled records must be 
retained indefinitely pending the agency's submission, and NARA's 
approval, of a disposition schedule. HHS anticipates proposing to NARA, 
as an appropriate retention period for these records, ``three years 
after final action, or longer if required for business use'' (similar 
to the period provided in GRS 1.2, Item 010) or ``when no longer needed 
for administrative purposes'' (similar to the periods applicable to 
similar records not retrieved by personal identifier which are not 
covered under this SORN; i.e.: N1-442-93-1, Item 37 for the Agency for 
Toxic Substances and Disease Registry's Curriculum Vitae Files, and 
NC1-235-82-1, Item 100-3 for the Office of the Secretary's Advisory 
Committee Candidate Resume Files).

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    Safeguards conform to the HHS Information Security and Privacy 
Program, https://www.hhs.gov/ocio/securityprivacy/. 
Information is safeguarded in accordance with applicable laws, rules 
and policies, including the HHS Information Technology Security Program 
Handbook, all pertinent National Institutes of Standards and Technology 
(NIST) publications, and OMB Circular A-130, Managing Information As a 
Strategic Resource. Records are protected from unauthorized access 
through appropriate administrative, physical, and technical safeguards. 
These safeguards include protecting the facilities where records are 
stored or accessed with security guards, badges and cameras, securing 
hard-copy records in locked file cabinets, file rooms or offices during 
off-duty hours, limiting access to electronic databases to authorized 
users based on roles and two-factor authentication (user ID and 
password), using a secured operating system protected by encryption, 
firewalls, and intrusion detection systems, requiring encryption for 
records stored on removable media, and training personnel in Privacy 
Act and information security requirements. Records that are eligible 
for destruction are disposed of using destruction methods prescribed by 
NIST SP 800-88.

RECORD ACCESS PROCEDURES:
    An individual seeking access to records about him or her in this 
system should submit a written request to the relevant System Manager 
indicated in the ``System Manager(s)'' section above. The requester 
must verify his or her identity by providing either a notarization of 
the request or a written certification that the requester is who he or 
she claims to be and understands that the knowing and willful request 
for acquisition of a record pertaining to an individual under false 
pretenses is a criminal offense under the Privacy Act, subject to a 
five thousand dollar fine.

CONTESTING RECORD PROCEDURES:
    An individual seeking to amend a record about him or her in this 
system should contact the relevant System Manager indicated in the 
``Section Manager(s)'' section, verify his or her identity in the 
manner indicated in the ``Record Access Procedures'' section, and 
reasonably identify the record, specify the information contested, 
state the corrective action sought, and provide the reasons for the 
amendment, with any supporting documentation.

NOTIFICATION PROCEDURES:
    An individual who wishes to know if this system contains records 
about him or her should contact the relevant System Manager indicated 
in the ``Section Manager(s)'' section and verify his or her identity in 
the manner indicated in the ``Record Access Procedures'' section.

EXEMPTIONS CLAIMED FOR THE SYSTEM:
    None.

HISTORY:
    81 FR 83246 (Nov. 21, 2016), 83 FR 6591 (Feb. 14, 2018).
[FR Doc. 2019-09926 Filed 5-13-19; 8:45 am]
 BILLING CODE 4184-01-P