Privacy Act of 1974; System of Records, 49540-49544 [2019-20423]
Download as PDF
49540
Federal Register / Vol. 84, No. 183 / Friday, September 20, 2019 / Notices
khammond on DSKJM1Z7X2PROD with NOTICES
procedures for the HR office; (3) guides
the identification, review, and
implementation of HR information
technology that enables workforce
empowerment and supports HR in
achieving its ability to execute a variety
of duties efficiently and effectively; (4)
manages an accountability program that
includes preparation and responses to
audits and reviews; (5) manages the
incentive and honor awards programs;
(6) manages the HR helpdesk by
providing timely, reliable, and accurate
HR-related information to customers
and other stakeholders; (7) manages the
executive resources functions to include
recruitment, staffing, and performance
management; and (8) works on HR
projects and initiatives.
Division of Workforce Development
(RB64)
(1) Establishes long-term workforce
skills and capacity building strategies;
(2) plans, directs, manages, and
evaluates HRSA-wide learning
programs, technical, career growth and
leadership development programs; (3)
develops, designs, implements, and
evaluates a comprehensive strategic
workforce leadership development and
career management program for all
occupational series throughout HRSA;
(4) provides technical assistance and
recommendations in creating highperformance in organizations, career
management, and employee learning
and development; (5) maximizes
economies of scale through systematic
planning and evaluation of agency-wide
learning and leadership development
initiatives; (6) identifies and assesses
relevant scanning/benchmarking on
workforce and career development
processes, services and products; (7)
establishes policies governing major
learning initiatives and new learning
activities, and works collaboratively
with other components of HRSA in
planning, developing, implementing,
and evaluating policies related to
professional development initiatives; (8)
plans, directs, and manages HRSA-wide
skills-building and service programs for
fellows and interns; (9) conducts
agency-wide workforce analysis studies
and surveys; (10) develops
comprehensive workforce capacitybuilding strategies that meet the
requirements of the Office of Personnel
Management and HHS, programmatic
needs of HRSA, and the governance and
management needs of HRSA leadership;
and (11) evaluates workforce capacitybuilding strategies to ensure that HRSA
is able to retain a cadre of talented and
ready public health professionals,
reduce risks associated with turnover in
mission critical positions and create a
VerDate Sep<11>2014
17:13 Sep 19, 2019
Jkt 247001
match between future needs and the
aspirations of individuals.
Section RB–30, Delegations of Authority
All delegations of authority and redelegations of authority made to
officials and employees of affected
organizational components will
continue in them or their successors
pending further redelegation, if allowed,
provided they are consistent with this
reorganization.
This reorganization is effective upon
date of signature.
(Authority: 44 U.S.C. 3101)
Dated: September 13, 2019.
Thomas J. Engels,
Acting Administrator.
[FR Doc. 2019–20407 Filed 9–19–19; 8:45 am]
BILLING CODE 4165–15–P
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Privacy Act of 1974; System of
Records
National Institutes of Health
(NIH), Department of Health and Human
Services (HHS).
ACTION: Notice of a Modified System of
Records.
AGENCY:
In accordance with the
requirements of the Privacy Act of 1974,
as amended, the Department of Health
and Human Services is modifying a
system of records maintained by the
National Institutes of Health (NIH), 09–
25–0225 ‘‘NIH Electronic Research
Administration (eRA) Records, HHS/
NIH/OD/OER,’’ to include a new routine
use allowing NIH to disclose
information to applicant organizations
for the purpose of communicating with
the applicants about matters related to
agency award programs.
DATES: In accordance with 5 U.S.C.
552a(e)(4) and (11), this notice is
applicable September 20, 2019, subject
to a 30-day period in which to comment
on the new routine use, described
below. Please submit any comments by
October 21, 2019.
ADDRESSES: The public should submit
written comments on this notice, by
mail or email, to Celeste Dade-Vinson,
NIH Privacy Act Officer, Office of
Management Assessment, National
Institutes of Health, 6011 Executive
Blvd., Suite 601, MSC 7669, Rockville,
MD 20852, or celeste.dade-vinson@
nih.gov. Comments will be available for
public viewing at the same location. To
review comments in person, please
contact Celeste Dade-Vinson at
SUMMARY:
PO 00000
Frm 00035
Fmt 4703
Sfmt 4703
celeste.dade-vinson@nih.gov or 301–
402–6201.
FOR FURTHER INFORMATION CONTACT:
General questions may be submitted to
Celeste Dade-Vinson, NIH Privacy Act
Officer, Office of Management
Assessment (OMA), Office of the
Director (OD), National Institutes of
Health (NIH), 6011 Executive Blvd.,
Suite 601, MSC 7669, Rockville, MD
20852, or telephone (301) 402–6201.
SUPPLEMENTARY INFORMATION:
I. Background on the NIH Electronic
Research Administration (eRA)
Records System
The system of records modified in
this Notice, ‘‘NIH Electronic Research
Administration (eRA) Records, HHS/
NIH/OD/OER’’ (hereinafter referred to as
the ‘‘NIH eRA Records’’ system), covers
records used throughout the research
and development award lifecycle,
including pre-award stages of
application submission, scientific peer
review, award processing, post-award
monitoring, and close-out. Many of the
records in the system contain
information about more than one
individual or type of individual (e.g.,
applicants, awardees, faculty members
of applicant and awardee entities,
application reviewers). By design, any
of the records can be (and in practice
are) retrieved using the name or other
personal identifier of any of the
individuals whose information is
contained in the records, to the extent
required to help ensure that award
proceedings are carried out by the NIH
in accordance with all applicable
federal statutes and regulations.
The eRA information technology (IT)
system associated with this system of
records is an HHS-designated Center of
Excellence, and is used as a shared
service provider by other federal
agencies to manage their award records.
Records pertaining to awards of other
agencies in the eRA IT system are not
covered under SORN 09–25–0225, but
would be covered under SORN(s) those
agencies publish, if their records require
a SORN.
II. Explanation of Changes
To facilitate award management and
NIH communications with applicant
organizations via authorized
organization representative(s), applicant
program director(s)/principal
investigator(s), and other senior officials
at applicant organizations, NIH is
modifying this system of records by
adding a new routine use, numbered as
routine use 5, to clarify that information
may be shared with applicant
organizations and persons. The new
E:\FR\FM\20SEN1.SGM
20SEN1
khammond on DSKJM1Z7X2PROD with NOTICES
Federal Register / Vol. 84, No. 183 / Friday, September 20, 2019 / Notices
routine use is compatible with the
purposes for which PII is collected in
the affected system of records. One
express purpose of the system is ‘‘[t]o
communicate matters to agency award
programs with (1) applicant
organizations, including associated
systems or system providers . . .’’ The
new routine use would further that
purpose and is consistent with the
expectations of individuals named in
grant applications.
The breach response-related routine
use which was previously numbered as
routine use 5, and which was revised
February 14, 2018 (see 83 FR 6591), is
now numbered as routine use 10; and a
second breach response-related routine
use which was added in that same
notice on February 14, 2018 is now
numbered as routine use 11.
Unnecessary wording (‘‘provided,
however, that in each case, it has been
determined that the disclosure is
compatible with the purpose for which
the records were collected’’) has been
removed from routine use 2. The
wording is redundant because a routine
use is defined in the Privacy Act at 5
U.S.C. 552a(a)(7) as a disclosure for a
purpose which is compatible with the
purpose for which the record was
collected.
In the ‘‘Purposes’’ section, a note has
been added to the last purpose
description, to clarify that records in
this system of records would be used to
‘‘document’’ inventions, patents, and
utilization data to protect the
government’s right to patents made with
NIH support, but that other systems of
records would cover the records used to
‘‘manage’’ invention and patent-related
functions.
The ‘‘Exemptions’’ section now omits
wording indicating when the
exemptions will become effective,
because the exemptions were rendered
effective by publication of a Final Rule
on April 3, 2018 (see 83 FR 14183). The
‘‘Record Access Procedures,’’
‘‘Contesting Record Procedures,’’ and
‘‘Notification Procedures’’ sections,
which stated that certain material ‘‘will
be’’ exempt from access, amendment,
and notification requirements now state
that certain material ‘‘is’’ exempt from
those requirements.
In addition to these changes, the
modified SORN includes formatting
changes to comply with OMB Circular
A–108.
VerDate Sep<11>2014
17:13 Sep 19, 2019
Jkt 247001
Dated: September 17, 2019.
Alfred C. Johnson,
Deputy Director for Management, NIH.
SYSTEM NAME AND NUMBER:
Electronic Research Administration
(eRA) Records, HHS/NIH/OD/OER, 09–
25–0225.
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
The address of the agency component
responsible for this system of records is
as shown in the System Manager(s)
section below.
SYSTEM MANAGER(S):
Director, Office of Extramural
Research (OER), Office of the Director
(OD), National Institutes of Health
(NIH), Building 1, Room 144, 1 Center
Drive, Bethesda, MD 20892, oer@
od.nih.gov.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
42 U.S.C. secs. 217a, 241, 242, 248,
281, 282, 284, 284a, 285, 285b, 285c,
285d, 285e, 285f, 285g, 285h, 285i, 285j,
285k, 285l, 285m, 285n, 285o, 285p,
285q, 285r, 285s, 285t, 286, 287, 287b,
287c–21, 287d, 288, 35 U.S.C. 200–212,
48 CFR Subpart 15.3 and 37 CFR 401.1–
16.
PURPOSE(S) OF THE SYSTEM:
The records about individuals
covered by this system of records are
used within the agency for these
purposes:
1. To support NIH award programs
and related process, including (1)
application preparation, receipt,
referral, and assignment; (2) initial peer
and council reviews; (3) award
processing, funding, monitoring, and
close-out; and (4) data querying,
reporting, tracking, compliance,
evaluation, audit, and communications.
2. To track individual trainees who
receive support from NIH through grants
such as fellowship or career awards or
who are supported through institutional
training grant awards. Included are
individuals in training for research and
development supported in an
investigator’s laboratory which has an
NIH-funded award (e.g., R01); these
trainees are defined as ‘‘closely
associated trainees.’’
3. To communicate matters related to
agency award programs with (1)
applicant organizations, including
associated systems or system providers;
(2) applicant persons such as the
authorized institutional representatives,
principal investigator(s) or trainees; (3)
peer reviewers; or (4) other entities such
as Congress; federal departments or
PO 00000
Frm 00036
Fmt 4703
Sfmt 4703
49541
agencies, non-federal agencies or
entities, or the general public.
4. To monitor the operation of review
and award processes to detect and deal
appropriately with any instances of real
or apparent inequities.
5. To provide mandated and other
requested reports to Congress and in
compliance with statutory, regulatory,
and policy requirements.
6. To maintain communication with
former fellows and trainees who have
incurred a payback obligation through
the National Research Service Award
Program and other federal research
training programs.
7. To maintain official administrative
files of agency-funded research
programs.
8. To manage research portfolios.
9. To document inventions, patents,
and utilization data to protect the
government’s right to patents made with
NIH support. Note that records used to
manage invention and patent-related
functions are covered under a separate
system of records.
CATEGORIES OF INDIVIDUALS COVERED BY THE
SYSTEM:
The records contained within this
system pertain to the following
categories of individuals:
1. Applicants for or Awardees of
biomedical and behavioral research and
development, training, career
development, or loan repayment grant
awards; cooperative agreement awards;
and research and development contract
awards;
2. Individuals who are named in
applications, or awards; or individuals
named on NIH intramural projects; e.g.,
program directors, key personnel,
trainees, collaborators, consultants;
3. Peer Reviewers who review and
provide evaluative input to the
government about particular
applications, in records such as
reviewer critiques, preliminary or final
individual overall impact/priority
scores, and/or assignment of peer
reviewers to an application;
4. Referees who, in association with a
particular trainee application, supply a
reference or letter of recommendation
for an applicant;
5. Individual awardees and subawardees who are required to report
inventions, patents, and utilization of
subject invention(s) associated with NIH
awards; and
6. Academic medical faculty, medical
students and resident physicians (e.g.,
faculty of Association of American
Medical Colleges of member
institutions).
E:\FR\FM\20SEN1.SGM
20SEN1
49542
Federal Register / Vol. 84, No. 183 / Friday, September 20, 2019 / Notices
khammond on DSKJM1Z7X2PROD with NOTICES
CATEGORIES OF RECORDS IN THE SYSTEM:
This system includes a variety of preaward and award management records
that contain information needed to
process applications and manage grant
awards across the award lifecycle.
Listed below are the categories of
individuals mentioned above, matched
with pre-award and award management
records collected about them.
1. Applicants for or Awardees of
awards—pre-award and award
management (awardees) information;
2. Individuals named in applications,
or awards—pre-award and award
management (awardees) information;
3. Referees—pre-award information;
4. Peer Reviewers—pre-award
information;
5. Individuals required to report
inventions, etc.—award management
information; and,
6. Academic medical faculty, medical
students and resident physicians—
award management information.
Pre-award information includes the
(1) application and related materials,
and (2) documents related to the
composition and function of chartered
advisory committees (i.e., rosters). A
record may consist of name, institution
address, professional degree,
demographic information, education
and employment records and identifiers
used by eRA Commons (i.e., user name
and an IMPAC II system-assigned,
unique personal identification number).
Award management information
consists of materials submitted in
support of an award such as (1)
recommendation letters; (2) peer review
related information such as application
scores, reviewer critiques, summary
statements and express promises of
confidentiality of any information
concerning applications, scores, or
critiques; (3) financial information such
as obligated award amounts and
awardee financial reports; (4) financial
conflict of interest records; (5)
inventions, utilization data, patent
applications, and patents; (6)
publications or other scholarly products
reported as associated with awards; (7)
reports related to management of
awards; and (8) records and reports
related to data querying, reporting,
tracking, compliance, evaluation, audit,
and communications activities. For the
academic medical faculty category,
records are used to support special
studies, including research and policy
evaluations and to complete biomedical
workforce statistical reports and include
(1) faculty name, (2) employing
institution and institutional address; (3)
degree and year obtained; (4)
demographic information; (5) field of
study; (6) appointment information; and
VerDate Sep<11>2014
17:13 Sep 19, 2019
Jkt 247001
(7) employment history. For the purpose
of peer review, the eRA system contains
limited information on loan repayment
applications (which are managed
through a different System of Records,
NIH SORN 09–25–0165, Division of
Loan Repayment Records) and research
and development contract award
information for purposes of complying
with statutory requirements related to
research and development awards at
NIH such as reporting on the inclusion
of minorities, women, and children in
clinical research; obtaining approval for
foreign grant components from the
Department of State; and to satisfy
research conditions, and disease
categorization reporting requirements.
RECORD SOURCE CATEGORIES:
Information in records retrieved by a
particular individual’s identifier will be
obtained directly from that individual or
from other individuals and entities
named in, contacted about, or involved
in processing the records, including
applicant institutions; NIH and
customer agency acquisition personnel;
educational, trainee and awardee
institutions; and third parties that
provide references or recommendations
concerning the subject individual.
ROUTINE USES OF RECORDS MAINTAINED IN THE
SYSTEM, INCLUDING CATEGORIES OF USERS AND
THE PURPOSES OF SUCH USES:
Records about an individual may be
disclosed from this system of records to
the following parties outside HHS,
without the individual’s prior written
consent, for the following purposes:
1. To a congressional office from the
record of an individual in response to a
written inquiry from the congressional
office made at the written request of the
individual.
2. To the Department of Justice (DOJ)
or to a court or other adjudicative body
when:
—HHS or any component thereof or
participating agencies; or
—any employee of HHS or participating
agencies in the employee’s official
capacity; or
—any employee of HHS in the
employee’s individual capacity where
the DOJ, HHS, or the participating
agency has agreed to represent the
employee; or
—The United States,
is a party to litigation or has a direct and
substantial interest in the proceedings
and the disclosure of such records is
deemed by the agency to be relevant and
necessary to the proceedings.
3. When a record on its face, or in
combination with other records,
indicates a violation or potential
violation of law, whether civil, criminal
PO 00000
Frm 00037
Fmt 4703
Sfmt 4703
or regulatory in nature, and whether
arising by general statute or particular
program statute, or by regulation, rule,
or order issued pursuant thereto,
disclosure may be made to the
appropriate public authority, whether
federal, foreign, state, local, tribal, or
otherwise responsible for enforcing,
investigating, or prosecuting the
violation or charged with enforcing or
implementing the statute, rule,
regulation, or order issued pursuant
thereto, if the information disclosed is
relevant to the enforcement, regulatory,
investigative, or prosecutorial
responsibility of the receiving entity.
4. To appropriate federal agencies and
HHS contractors, grantees, consultants,
or volunteers who have been engaged by
HHS to assist in the accomplishment of
an HHS function relating to the
purposes of this system of records and
that need to have access to the records
in order to assist HHS in performing the
activity. Any contractor will be required
to comply with the Privacy Act of 1974,
as amended.
5. To applicant organizations, via
authorized organization
representative(s), applicant program
director(s)/principal investigator(s), and
other senior officials at applicant
organizations (including but not limited
to deans, presidents, vice presidents,
research integrity officers, and
compliance officials), to communicate
matters related to agency award
programs. Only matters that are relevant
to a particular applicant organization
would be communicated to that
organization.
6. To a party for a research purpose
when NIH: (A) Has determined that the
use or disclosure does not violate legal
or policy limitations under which the
record was provided, collected, or
obtained; (B) has determined that the
research purpose (1) cannot be
reasonably accomplished unless the
record is provided in individually
identifiable form, and (2) warrants the
risk to the privacy of the individual; (C)
has required the recipient to (1)
establish reasonable administrative,
technical, and physical safeguards to
prevent unauthorized use or disclosure
of the record, (2) remove or destroy the
information that identifies the
individual at the earliest time at which
removal or destruction can be
accomplished consistent with the
purpose of the research project, unless
the recipient has presented adequate
justification of the research, and (3)
makes no further use or disclosure of
the record except when required by law,
and reports results of the research in deidentified or aggregate form; and (D) has
secured a written statement attesting to
E:\FR\FM\20SEN1.SGM
20SEN1
khammond on DSKJM1Z7X2PROD with NOTICES
Federal Register / Vol. 84, No. 183 / Friday, September 20, 2019 / Notices
the recipient’s understanding of and
willingness to abide by these provisions
(i.e., signed data access agreement for
system data) in which the data may
relate to reports of the composition of
biomedical and/or research and
development workforce; authors of
publications attributable to federallyfunded awards; information made
available through third-party systems as
permitted by applicants or awardees for
agency awards; information related to
agency research integrity investigations;
or award payment information reported
to federal databases.
7. A record from this system may be
disclosed to a federal, foreign, state,
local, tribal or other public authority of
the fact that this system of records
contains information relevant to the
hiring or retention of an employee, the
issuance or retention of a security
clearance, the letting of a contract, or
the issuance or retention of a license,
grant or other benefit. The other agency
or licensing organization may then make
a request supported by the written
consent of the individual for further
information if it so chooses. HHS will
not make an initial disclosure unless the
information has been determined to be
sufficiently reliable to support a referral
to another office within the agency or to
another federal agency for criminal,
civil, administrative, personnel, or
regulatory action.
8. To qualified experts not within the
definition of agency employees as
prescribed in agency regulations or
policies to obtain their opinions on
applications for grants, CRADAs,
inventions, or other awards as a part of
the peer review process.
9. To the National Archives and
Records Administration (NARA),
General Services Administration (GSA),
or other federal government agencies
pursuant to records management
inspections conducted under the
authority of 44 U.S.C. secs. 2904 and
2906.
10. To appropriate agencies, entities,
and persons when (1) HHS suspects or
has confirmed that there has been a
breach of the system of records; (2) HHS
has determined that as a result of the
suspected or confirmed breach there is
a risk of harm to individuals, HHS
(including its information systems,
programs, and operations), the federal
government, or national security; and
(3) the disclosure made to such
agencies, entities, and persons is
reasonably necessary to assist in
connection with HHS’s efforts to
respond to the suspected or confirmed
breach or to prevent, minimize, or
remedy such harm
VerDate Sep<11>2014
17:13 Sep 19, 2019
Jkt 247001
11. To another federal agency or
federal entity, when HHS determines
that information from this system of
records is reasonably necessary to assist
the recipient agency or entity in (1)
responding to a suspected or confirmed
breach or (2) preventing, minimizing, or
remedying the risk of harm to
individuals, the recipient agency or
entity (including its information
systems, programs, and operations), the
federal government, or national security,
resulting from a suspected or confirmed
breach.
NIH may also disclose information
about an individual, without the
individuals’ prior written consent, from
this system of records to parties outside
HHS for any of the purposes authorized
directly in the Privacy Act at 5 U.S.C.
552a(b)(2) and (b)(4)–(11).
POLICIES AND PRACTICES FOR STORAGE OF
RECORDS:
Records are stored in various
electronic media and paper form, and
maintained under secure conditions in
areas with limited and/or controlled
access. Only authorized users whose
official duties require the use of this
information will have regular access to
the records in this system. In
accordance with established NIH, HHS
and other federal security requirements,
policies, and controls, records may also
be located, maintained and accessed
from secure servers wherever feasible or
located on approved portable/mobile
devices designed to hold any kind of
digital data including, but not limited to
laptops, tablets, PDAs, USB drives,
media cards, portable hard drives,
smartphones, optical storage (CDs and
DVDs), and/or other mobile storage
devices. Records are stored on portable/
mobile storage devices only for valid
business purposes and with prior
approval.
POLICIES AND PRACTICES FOR RETRIEVAL OF
RECORDS:
Records are retrieved by the name or
other personal identifier (e.g., Commons
user ID) of a subject individual.
POLICIES AND PRACTICES FOR RETENTION AND
DISPOSAL OF RECORDS:
Records are retained and disposed of
in accordance with the NIH Records
Control Schedule contained in NIH
Manual Chapter 1743, ‘‘Keeping and
Destroying Records,’’ which provides
these disposition periods:
• Item E–0001 (DAA–0443–2013–
0004–0001)—Official case files of
construction, renovation, endowment
and similar grants.
Disposition: Temporary. Cut off
annually following completion of final
grant-related activity that represents
PO 00000
Frm 00038
Fmt 4703
Sfmt 4703
49543
closing of the case file (e.g., project
period ended). Destroy 20 years after
cut-off;
• Item E–0002 (DAA–0443–2013–
0004–0002)—Official case files of
funded grants, unfunded grants, and
award applications, appeals and
litigation records.
Disposition: Temporary. Cut off
annually following completion of final
grant-related activity that represents
closing of the case file (e.g., end of
project period, completed final peer
review, litigation or appeal proceeding
concluded). Destroy 10 years after cutoff;
• Item E–0003 (DAA–0443–2013–
0004–0003)—Animal welfare assurance
files.
Disposition: Temporary. Cut off
annually following closing of the case
file. Destroy 4 years after cut-off; and,
• Item E–0004 (DAA–0443–2013–
0004–0004)—Extramural program and
grants management oversight records.
Disposition: Temporary. Cut off
annually. Destroy 3 years after cut-off.
Refer to the NIH Manual Chapter for
specific retention and disposition
instructions: https://www1.od.nih.gov/
oma/manualchapters/management/
1743.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL
SAFEGUARDS:
Measures to prevent unauthorized
disclosures are implemented as
appropriate for each location or form of
storage and for the types of records
maintained. Safeguards conform to the
HHS Information Security and Privacy
Program, https://www.hhs.gov/ocio/
securityprivacy/. Site(s)
implement personnel and procedural
safeguards such as the following:
Administrative Safeguards:
Controls to ensure proper protection
of information and information
technology systems include, but are not
limited to, the completion of a Security
Assessment and Authorization (SA&A)
package and a Privacy Impact
Assessment (PIA) and mandatory
completion of annual NIH Information
Security and Privacy Awareness
training or comparable specific in-kind
training offered by participating
agencies that has been reviewed and
accepted by the NIH eRA Information
Systems Security Officer (ISSO). The
SA&A package consists of a Security
Categorization, e-Authentication Risk
Assessment, System Security Plan,
evidence of Security Control Testing,
Plan of Action and Milestones,
Contingency Plan, and evidence of
Contingency Plan Testing. When the
design, development, or operation of a
system of records on individuals is
E:\FR\FM\20SEN1.SGM
20SEN1
49544
Federal Register / Vol. 84, No. 183 / Friday, September 20, 2019 / Notices
required to accomplish an agency
function, the applicable Privacy Act
Federal Acquisition Regulation (FAR)
clauses are inserted in solicitations and
contracts.
Technical Safeguards:
Controls executed by the computer
system are employed to minimize the
possibility of unauthorized access, use,
or dissemination of the data in the
system. They include, but are not
limited to, user identification, password
protection, firewalls, virtual private
network, encryption, intrusion detection
system, common access cards, smart
cards and public key infrastructure.
Physical Safeguards:
Controls to secure the data and
protect paper and electronic records,
buildings, and related infrastructure
against threats associated with their
physical environment include, but are
not limited to, the use of the HHS
Employee ID and/or badge number and
NIH key cards, security guards, cipher
locks, and closed-circuit TV. Paper
records are secured under conditions
that require at least two locks to access,
such as in locked file cabinets that are
contained in locked offices or facilities.
Electronic media are kept on secure
servers or computer systems.
RECORD ACCESS PROCEDURES:
Certain material is exempt from
access; however, consideration will be
given to all access requests addressed to
the System Manager. To request access
to a record about you, write to the
System Manager identified above, and
provide the information described
under ‘‘Notification Procedure’’.
Individuals may also request an
accounting of disclosures that have been
made of their records, if any.
khammond on DSKJM1Z7X2PROD with NOTICES
CONTESTING RECORD PROCEDURES:
Certain material is exempt from
amendment; however, consideration
will be given to all amendment requests
addressed to the System Manager. To
contest information in a record about
you, write to the System Manager
identified above, reasonably identify the
record and specify the information
being contested, state the corrective
action sought and the reason(s) for
requesting the correction, and provide
supporting information. The right to
contest records is limited to information
that is factually inaccurate, incomplete,
irrelevant, or untimely (obsolete).
NOTIFICATION PROCEDURES:
Certain material is exempt from
notification; however, consideration
will be given to all notification requests
addressed to the System Manager. Any
individual who wants to know whether
VerDate Sep<11>2014
17:13 Sep 19, 2019
Jkt 247001
this system of records contains a record
about him or her must make a written
request to the System Manager
identified above. The requester should
provide either a notarization of the
request or a written certification that the
requester is who he or she claims to be
and understands that the knowing and
willful request of a record pertaining to
an individual under false pretenses is a
criminal offense under the Privacy Act,
subject to a five thousand dollar fine.
The request should include the
requester’s full name and address, and
should also include the following
information, if known: The approximate
date(s) the information was collected,
the type(s) of information collected, and
the office(s) or official(s) responsible for
the collection of information.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
Pursuant to 5 U.S.C. 552a(k)(5), the
following subset of records in this
system of records qualifies as
investigatory material compiled solely
for the purpose of determining
suitability, eligibility, or qualifications
for federal contracts, and is exempt from
the Privacy Act requirements pertaining
to providing an accounting of
disclosures, access and amendment,
notification, and agency procedures and
rules (5 U.S.C. 552a (c)(3), and (d)(1)–
(4)):
Material that would inappropriately
reveal the identities of referees who
provide letters of recommendation and
peer reviewers who provide written
evaluative input and recommendations
to NIH about particular funding
applications under an express promise
by the government that their identities
in association with the written work
products they authored and provided to
the government will be kept
confidential; this includes only material
that would reveal a particular referee or
peer reviewer as the author of a specific
work product (e.g., reference or
recommendation letters, reviewer
critiques, preliminary or final
individual overall impact/priority
scores, and/or assignment of peer
reviewers to an application and other
evaluative materials and data compiled
by NIH/OER); it includes not only an
author’s name but any content that
could enable the author to be identified
from context.
To the extent that records in System
No. 09–25–0225 are retrieved by
personal identifiers for individuals
other than referees and peer reviewers
(for example, individual funding
applicants, and other individuals who
are the subject of assessment or
evaluation), the exemptions enable the
agency to prevent, when appropriate,
PO 00000
Frm 00039
Fmt 4703
Sfmt 4703
those individual record subjects from
having access to, and other rights under
the Privacy Act with respect to, the
above-described confidential sourceidentifying material in the records.
HISTORY:
81 FR 88690 (Dec. 8, 2016), 83 FR
6591 (Feb.14, 2018).
[FR Doc. 2019–20423 Filed 9–19–19; 8:45 am]
BILLING CODE 4150–28–P
DEPARTMENT OF HEALTH OF HUMAN
SERVICES
Request for Information—Revisions to
the PHS Guideline for Reducing
Human Immunodeficiency Virus (HIV),
Hepatitis B Virus (HBV), and Hepatitis
C Virus (HCV) Through Organ
Transplantation; Extension of
Comment Period
Office of the Assistant
Secretary for Health, Office of the
Secretary, Department of Health and
Human Services.
ACTION: Notice; extension of comment
period.
AGENCY:
The Office of the Assistant
Secretary for Health published a
document in the Federal Register of
August 27, 2019, requesting public
comment related to revisions to the PHS
Guideline for Reducing Human
Immunodeficiency Virus (HIV),
Hepatitis B Virus (HBV), and Hepatitis
C Virus (HCV) Through Organ
Transplantation. Due to numerous
requests of an extension to the public
comment period, this document is
announcing an extension.
DATES: To be assured consideration,
comments must be received at the
address provided below no later than
5:00 p.m. ET on October 10, 2019.
FOR FURTHER INFORMATION CONTACT: Mr.
James Berger, (202) 795–7608;
ACBTSA@hhs.gov.
SUMMARY:
Dated: September 17, 2019.
James J. Berger,
Senior Advisor for Blood and Tissue Policy,
Office of the Assistant Secretary for Health.
[FR Doc. 2019–20419 Filed 9–19–19; 8:45 am]
BILLING CODE 4150–28–P
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
National Institutes of Health
National Institute on Aging; Amended
Notice of Meeting
Notice is hereby given of a change in
the meeting of the Clinical Aging
E:\FR\FM\20SEN1.SGM
20SEN1
Agencies
[Federal Register Volume 84, Number 183 (Friday, September 20, 2019)]
[Notices]
[Pages 49540-49544]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-20423]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Privacy Act of 1974; System of Records
AGENCY: National Institutes of Health (NIH), Department of Health and
Human Services (HHS).
ACTION: Notice of a Modified System of Records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the requirements of the Privacy Act of
1974, as amended, the Department of Health and Human Services is
modifying a system of records maintained by the National Institutes of
Health (NIH), 09-25-0225 ``NIH Electronic Research Administration (eRA)
Records, HHS/NIH/OD/OER,'' to include a new routine use allowing NIH to
disclose information to applicant organizations for the purpose of
communicating with the applicants about matters related to agency award
programs.
DATES: In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is
applicable September 20, 2019, subject to a 30-day period in which to
comment on the new routine use, described below. Please submit any
comments by October 21, 2019.
ADDRESSES: The public should submit written comments on this notice, by
mail or email, to Celeste Dade-Vinson, NIH Privacy Act Officer, Office
of Management Assessment, National Institutes of Health, 6011 Executive
Blvd., Suite 601, MSC 7669, Rockville, MD 20852, or [email protected]. Comments will be available for public viewing at the
same location. To review comments in person, please contact Celeste
Dade-Vinson at [email protected] or 301-402-6201.
FOR FURTHER INFORMATION CONTACT: General questions may be submitted to
Celeste Dade-Vinson, NIH Privacy Act Officer, Office of Management
Assessment (OMA), Office of the Director (OD), National Institutes of
Health (NIH), 6011 Executive Blvd., Suite 601, MSC 7669, Rockville, MD
20852, or telephone (301) 402-6201.
SUPPLEMENTARY INFORMATION:
I. Background on the NIH Electronic Research Administration (eRA)
Records System
The system of records modified in this Notice, ``NIH Electronic
Research Administration (eRA) Records, HHS/NIH/OD/OER'' (hereinafter
referred to as the ``NIH eRA Records'' system), covers records used
throughout the research and development award lifecycle, including pre-
award stages of application submission, scientific peer review, award
processing, post-award monitoring, and close-out. Many of the records
in the system contain information about more than one individual or
type of individual (e.g., applicants, awardees, faculty members of
applicant and awardee entities, application reviewers). By design, any
of the records can be (and in practice are) retrieved using the name or
other personal identifier of any of the individuals whose information
is contained in the records, to the extent required to help ensure that
award proceedings are carried out by the NIH in accordance with all
applicable federal statutes and regulations.
The eRA information technology (IT) system associated with this
system of records is an HHS-designated Center of Excellence, and is
used as a shared service provider by other federal agencies to manage
their award records. Records pertaining to awards of other agencies in
the eRA IT system are not covered under SORN 09-25-0225, but would be
covered under SORN(s) those agencies publish, if their records require
a SORN.
II. Explanation of Changes
To facilitate award management and NIH communications with
applicant organizations via authorized organization representative(s),
applicant program director(s)/principal investigator(s), and other
senior officials at applicant organizations, NIH is modifying this
system of records by adding a new routine use, numbered as routine use
5, to clarify that information may be shared with applicant
organizations and persons. The new
[[Page 49541]]
routine use is compatible with the purposes for which PII is collected
in the affected system of records. One express purpose of the system is
``[t]o communicate matters to agency award programs with (1) applicant
organizations, including associated systems or system providers . . .''
The new routine use would further that purpose and is consistent with
the expectations of individuals named in grant applications.
The breach response-related routine use which was previously
numbered as routine use 5, and which was revised February 14, 2018 (see
83 FR 6591), is now numbered as routine use 10; and a second breach
response-related routine use which was added in that same notice on
February 14, 2018 is now numbered as routine use 11.
Unnecessary wording (``provided, however, that in each case, it has
been determined that the disclosure is compatible with the purpose for
which the records were collected'') has been removed from routine use
2. The wording is redundant because a routine use is defined in the
Privacy Act at 5 U.S.C. 552a(a)(7) as a disclosure for a purpose which
is compatible with the purpose for which the record was collected.
In the ``Purposes'' section, a note has been added to the last
purpose description, to clarify that records in this system of records
would be used to ``document'' inventions, patents, and utilization data
to protect the government's right to patents made with NIH support, but
that other systems of records would cover the records used to
``manage'' invention and patent-related functions.
The ``Exemptions'' section now omits wording indicating when the
exemptions will become effective, because the exemptions were rendered
effective by publication of a Final Rule on April 3, 2018 (see 83 FR
14183). The ``Record Access Procedures,'' ``Contesting Record
Procedures,'' and ``Notification Procedures'' sections, which stated
that certain material ``will be'' exempt from access, amendment, and
notification requirements now state that certain material ``is'' exempt
from those requirements.
In addition to these changes, the modified SORN includes formatting
changes to comply with OMB Circular A-108.
Dated: September 17, 2019.
Alfred C. Johnson,
Deputy Director for Management, NIH.
SYSTEM NAME AND NUMBER:
Electronic Research Administration (eRA) Records, HHS/NIH/OD/OER,
09-25-0225.
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
The address of the agency component responsible for this system of
records is as shown in the System Manager(s) section below.
SYSTEM MANAGER(S):
Director, Office of Extramural Research (OER), Office of the
Director (OD), National Institutes of Health (NIH), Building 1, Room
144, 1 Center Drive, Bethesda, MD 20892, [email protected].
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
42 U.S.C. secs. 217a, 241, 242, 248, 281, 282, 284, 284a, 285,
285b, 285c, 285d, 285e, 285f, 285g, 285h, 285i, 285j, 285k, 285l, 285m,
285n, 285o, 285p, 285q, 285r, 285s, 285t, 286, 287, 287b, 287c-21,
287d, 288, 35 U.S.C. 200-212, 48 CFR Subpart 15.3 and 37 CFR 401.1-16.
PURPOSE(S) OF THE SYSTEM:
The records about individuals covered by this system of records are
used within the agency for these purposes:
1. To support NIH award programs and related process, including (1)
application preparation, receipt, referral, and assignment; (2) initial
peer and council reviews; (3) award processing, funding, monitoring,
and close-out; and (4) data querying, reporting, tracking, compliance,
evaluation, audit, and communications.
2. To track individual trainees who receive support from NIH
through grants such as fellowship or career awards or who are supported
through institutional training grant awards. Included are individuals
in training for research and development supported in an investigator's
laboratory which has an NIH-funded award (e.g., R01); these trainees
are defined as ``closely associated trainees.''
3. To communicate matters related to agency award programs with (1)
applicant organizations, including associated systems or system
providers; (2) applicant persons such as the authorized institutional
representatives, principal investigator(s) or trainees; (3) peer
reviewers; or (4) other entities such as Congress; federal departments
or agencies, non-federal agencies or entities, or the general public.
4. To monitor the operation of review and award processes to detect
and deal appropriately with any instances of real or apparent
inequities.
5. To provide mandated and other requested reports to Congress and
in compliance with statutory, regulatory, and policy requirements.
6. To maintain communication with former fellows and trainees who
have incurred a payback obligation through the National Research
Service Award Program and other federal research training programs.
7. To maintain official administrative files of agency-funded
research programs.
8. To manage research portfolios.
9. To document inventions, patents, and utilization data to protect
the government's right to patents made with NIH support. Note that
records used to manage invention and patent-related functions are
covered under a separate system of records.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
The records contained within this system pertain to the following
categories of individuals:
1. Applicants for or Awardees of biomedical and behavioral research
and development, training, career development, or loan repayment grant
awards; cooperative agreement awards; and research and development
contract awards;
2. Individuals who are named in applications, or awards; or
individuals named on NIH intramural projects; e.g., program directors,
key personnel, trainees, collaborators, consultants;
3. Peer Reviewers who review and provide evaluative input to the
government about particular applications, in records such as reviewer
critiques, preliminary or final individual overall impact/priority
scores, and/or assignment of peer reviewers to an application;
4. Referees who, in association with a particular trainee
application, supply a reference or letter of recommendation for an
applicant;
5. Individual awardees and sub-awardees who are required to report
inventions, patents, and utilization of subject invention(s) associated
with NIH awards; and
6. Academic medical faculty, medical students and resident
physicians (e.g., faculty of Association of American Medical Colleges
of member institutions).
[[Page 49542]]
CATEGORIES OF RECORDS IN THE SYSTEM:
This system includes a variety of pre-award and award management
records that contain information needed to process applications and
manage grant awards across the award lifecycle. Listed below are the
categories of individuals mentioned above, matched with pre-award and
award management records collected about them.
1. Applicants for or Awardees of awards--pre-award and award
management (awardees) information;
2. Individuals named in applications, or awards--pre-award and
award management (awardees) information;
3. Referees--pre-award information;
4. Peer Reviewers--pre-award information;
5. Individuals required to report inventions, etc.--award
management information; and,
6. Academic medical faculty, medical students and resident
physicians--award management information.
Pre-award information includes the (1) application and related
materials, and (2) documents related to the composition and function of
chartered advisory committees (i.e., rosters). A record may consist of
name, institution address, professional degree, demographic
information, education and employment records and identifiers used by
eRA Commons (i.e., user name and an IMPAC II system-assigned, unique
personal identification number).
Award management information consists of materials submitted in
support of an award such as (1) recommendation letters; (2) peer review
related information such as application scores, reviewer critiques,
summary statements and express promises of confidentiality of any
information concerning applications, scores, or critiques; (3)
financial information such as obligated award amounts and awardee
financial reports; (4) financial conflict of interest records; (5)
inventions, utilization data, patent applications, and patents; (6)
publications or other scholarly products reported as associated with
awards; (7) reports related to management of awards; and (8) records
and reports related to data querying, reporting, tracking, compliance,
evaluation, audit, and communications activities. For the academic
medical faculty category, records are used to support special studies,
including research and policy evaluations and to complete biomedical
workforce statistical reports and include (1) faculty name, (2)
employing institution and institutional address; (3) degree and year
obtained; (4) demographic information; (5) field of study; (6)
appointment information; and (7) employment history. For the purpose of
peer review, the eRA system contains limited information on loan
repayment applications (which are managed through a different System of
Records, NIH SORN 09-25-0165, Division of Loan Repayment Records) and
research and development contract award information for purposes of
complying with statutory requirements related to research and
development awards at NIH such as reporting on the inclusion of
minorities, women, and children in clinical research; obtaining
approval for foreign grant components from the Department of State; and
to satisfy research conditions, and disease categorization reporting
requirements.
RECORD SOURCE CATEGORIES:
Information in records retrieved by a particular individual's
identifier will be obtained directly from that individual or from other
individuals and entities named in, contacted about, or involved in
processing the records, including applicant institutions; NIH and
customer agency acquisition personnel; educational, trainee and awardee
institutions; and third parties that provide references or
recommendations concerning the subject individual.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
Records about an individual may be disclosed from this system of
records to the following parties outside HHS, without the individual's
prior written consent, for the following purposes:
1. To a congressional office from the record of an individual in
response to a written inquiry from the congressional office made at the
written request of the individual.
2. To the Department of Justice (DOJ) or to a court or other
adjudicative body when:
--HHS or any component thereof or participating agencies; or
--any employee of HHS or participating agencies in the employee's
official capacity; or
--any employee of HHS in the employee's individual capacity where the
DOJ, HHS, or the participating agency has agreed to represent the
employee; or
--The United States,
is a party to litigation or has a direct and substantial interest in
the proceedings and the disclosure of such records is deemed by the
agency to be relevant and necessary to the proceedings.
3. When a record on its face, or in combination with other records,
indicates a violation or potential violation of law, whether civil,
criminal or regulatory in nature, and whether arising by general
statute or particular program statute, or by regulation, rule, or order
issued pursuant thereto, disclosure may be made to the appropriate
public authority, whether federal, foreign, state, local, tribal, or
otherwise responsible for enforcing, investigating, or prosecuting the
violation or charged with enforcing or implementing the statute, rule,
regulation, or order issued pursuant thereto, if the information
disclosed is relevant to the enforcement, regulatory, investigative, or
prosecutorial responsibility of the receiving entity.
4. To appropriate federal agencies and HHS contractors, grantees,
consultants, or volunteers who have been engaged by HHS to assist in
the accomplishment of an HHS function relating to the purposes of this
system of records and that need to have access to the records in order
to assist HHS in performing the activity. Any contractor will be
required to comply with the Privacy Act of 1974, as amended.
5. To applicant organizations, via authorized organization
representative(s), applicant program director(s)/principal
investigator(s), and other senior officials at applicant organizations
(including but not limited to deans, presidents, vice presidents,
research integrity officers, and compliance officials), to communicate
matters related to agency award programs. Only matters that are
relevant to a particular applicant organization would be communicated
to that organization.
6. To a party for a research purpose when NIH: (A) Has determined
that the use or disclosure does not violate legal or policy limitations
under which the record was provided, collected, or obtained; (B) has
determined that the research purpose (1) cannot be reasonably
accomplished unless the record is provided in individually identifiable
form, and (2) warrants the risk to the privacy of the individual; (C)
has required the recipient to (1) establish reasonable administrative,
technical, and physical safeguards to prevent unauthorized use or
disclosure of the record, (2) remove or destroy the information that
identifies the individual at the earliest time at which removal or
destruction can be accomplished consistent with the purpose of the
research project, unless the recipient has presented adequate
justification of the research, and (3) makes no further use or
disclosure of the record except when required by law, and reports
results of the research in de-identified or aggregate form; and (D) has
secured a written statement attesting to
[[Page 49543]]
the recipient's understanding of and willingness to abide by these
provisions (i.e., signed data access agreement for system data) in
which the data may relate to reports of the composition of biomedical
and/or research and development workforce; authors of publications
attributable to federally-funded awards; information made available
through third-party systems as permitted by applicants or awardees for
agency awards; information related to agency research integrity
investigations; or award payment information reported to federal
databases.
7. A record from this system may be disclosed to a federal,
foreign, state, local, tribal or other public authority of the fact
that this system of records contains information relevant to the hiring
or retention of an employee, the issuance or retention of a security
clearance, the letting of a contract, or the issuance or retention of a
license, grant or other benefit. The other agency or licensing
organization may then make a request supported by the written consent
of the individual for further information if it so chooses. HHS will
not make an initial disclosure unless the information has been
determined to be sufficiently reliable to support a referral to another
office within the agency or to another federal agency for criminal,
civil, administrative, personnel, or regulatory action.
8. To qualified experts not within the definition of agency
employees as prescribed in agency regulations or policies to obtain
their opinions on applications for grants, CRADAs, inventions, or other
awards as a part of the peer review process.
9. To the National Archives and Records Administration (NARA),
General Services Administration (GSA), or other federal government
agencies pursuant to records management inspections conducted under the
authority of 44 U.S.C. secs. 2904 and 2906.
10. To appropriate agencies, entities, and persons when (1) HHS
suspects or has confirmed that there has been a breach of the system of
records; (2) HHS has determined that as a result of the suspected or
confirmed breach there is a risk of harm to individuals, HHS (including
its information systems, programs, and operations), the federal
government, or national security; and (3) the disclosure made to such
agencies, entities, and persons is reasonably necessary to assist in
connection with HHS's efforts to respond to the suspected or confirmed
breach or to prevent, minimize, or remedy such harm
11. To another federal agency or federal entity, when HHS
determines that information from this system of records is reasonably
necessary to assist the recipient agency or entity in (1) responding to
a suspected or confirmed breach or (2) preventing, minimizing, or
remedying the risk of harm to individuals, the recipient agency or
entity (including its information systems, programs, and operations),
the federal government, or national security, resulting from a
suspected or confirmed breach.
NIH may also disclose information about an individual, without the
individuals' prior written consent, from this system of records to
parties outside HHS for any of the purposes authorized directly in the
Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(11).
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records are stored in various electronic media and paper form, and
maintained under secure conditions in areas with limited and/or
controlled access. Only authorized users whose official duties require
the use of this information will have regular access to the records in
this system. In accordance with established NIH, HHS and other federal
security requirements, policies, and controls, records may also be
located, maintained and accessed from secure servers wherever feasible
or located on approved portable/mobile devices designed to hold any
kind of digital data including, but not limited to laptops, tablets,
PDAs, USB drives, media cards, portable hard drives, smartphones,
optical storage (CDs and DVDs), and/or other mobile storage devices.
Records are stored on portable/mobile storage devices only for valid
business purposes and with prior approval.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrieved by the name or other personal identifier
(e.g., Commons user ID) of a subject individual.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records are retained and disposed of in accordance with the NIH
Records Control Schedule contained in NIH Manual Chapter 1743,
``Keeping and Destroying Records,'' which provides these disposition
periods:
Item E-0001 (DAA-0443-2013-0004-0001)--Official case files
of construction, renovation, endowment and similar grants.
Disposition: Temporary. Cut off annually following completion of
final grant-related activity that represents closing of the case file
(e.g., project period ended). Destroy 20 years after cut-off;
Item E-0002 (DAA-0443-2013-0004-0002)--Official case files
of funded grants, unfunded grants, and award applications, appeals and
litigation records.
Disposition: Temporary. Cut off annually following completion of
final grant-related activity that represents closing of the case file
(e.g., end of project period, completed final peer review, litigation
or appeal proceeding concluded). Destroy 10 years after cut-off;
Item E-0003 (DAA-0443-2013-0004-0003)--Animal welfare
assurance files.
Disposition: Temporary. Cut off annually following closing of the
case file. Destroy 4 years after cut-off; and,
Item E-0004 (DAA-0443-2013-0004-0004)--Extramural program
and grants management oversight records.
Disposition: Temporary. Cut off annually. Destroy 3 years after
cut-off.
Refer to the NIH Manual Chapter for specific retention and
disposition instructions: https://www1.od.nih.gov/oma/manualchapters/management/1743.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Measures to prevent unauthorized disclosures are implemented as
appropriate for each location or form of storage and for the types of
records maintained. Safeguards conform to the HHS Information Security
and Privacy Program, https://www.hhs.gov/ocio/securityprivacy/. Site(s) implement personnel and procedural safeguards such
as the following:
Administrative Safeguards:
Controls to ensure proper protection of information and information
technology systems include, but are not limited to, the completion of a
Security Assessment and Authorization (SA&A) package and a Privacy
Impact Assessment (PIA) and mandatory completion of annual NIH
Information Security and Privacy Awareness training or comparable
specific in-kind training offered by participating agencies that has
been reviewed and accepted by the NIH eRA Information Systems Security
Officer (ISSO). The SA&A package consists of a Security Categorization,
e-Authentication Risk Assessment, System Security Plan, evidence of
Security Control Testing, Plan of Action and Milestones, Contingency
Plan, and evidence of Contingency Plan Testing. When the design,
development, or operation of a system of records on individuals is
[[Page 49544]]
required to accomplish an agency function, the applicable Privacy Act
Federal Acquisition Regulation (FAR) clauses are inserted in
solicitations and contracts.
Technical Safeguards:
Controls executed by the computer system are employed to minimize
the possibility of unauthorized access, use, or dissemination of the
data in the system. They include, but are not limited to, user
identification, password protection, firewalls, virtual private
network, encryption, intrusion detection system, common access cards,
smart cards and public key infrastructure.
Physical Safeguards:
Controls to secure the data and protect paper and electronic
records, buildings, and related infrastructure against threats
associated with their physical environment include, but are not limited
to, the use of the HHS Employee ID and/or badge number and NIH key
cards, security guards, cipher locks, and closed-circuit TV. Paper
records are secured under conditions that require at least two locks to
access, such as in locked file cabinets that are contained in locked
offices or facilities. Electronic media are kept on secure servers or
computer systems.
RECORD ACCESS PROCEDURES:
Certain material is exempt from access; however, consideration will
be given to all access requests addressed to the System Manager. To
request access to a record about you, write to the System Manager
identified above, and provide the information described under
``Notification Procedure''. Individuals may also request an accounting
of disclosures that have been made of their records, if any.
CONTESTING RECORD PROCEDURES:
Certain material is exempt from amendment; however, consideration
will be given to all amendment requests addressed to the System
Manager. To contest information in a record about you, write to the
System Manager identified above, reasonably identify the record and
specify the information being contested, state the corrective action
sought and the reason(s) for requesting the correction, and provide
supporting information. The right to contest records is limited to
information that is factually inaccurate, incomplete, irrelevant, or
untimely (obsolete).
NOTIFICATION PROCEDURES:
Certain material is exempt from notification; however,
consideration will be given to all notification requests addressed to
the System Manager. Any individual who wants to know whether this
system of records contains a record about him or her must make a
written request to the System Manager identified above. The requester
should provide either a notarization of the request or a written
certification that the requester is who he or she claims to be and
understands that the knowing and willful request of a record pertaining
to an individual under false pretenses is a criminal offense under the
Privacy Act, subject to a five thousand dollar fine. The request should
include the requester's full name and address, and should also include
the following information, if known: The approximate date(s) the
information was collected, the type(s) of information collected, and
the office(s) or official(s) responsible for the collection of
information.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
Pursuant to 5 U.S.C. 552a(k)(5), the following subset of records in
this system of records qualifies as investigatory material compiled
solely for the purpose of determining suitability, eligibility, or
qualifications for federal contracts, and is exempt from the Privacy
Act requirements pertaining to providing an accounting of disclosures,
access and amendment, notification, and agency procedures and rules (5
U.S.C. 552a (c)(3), and (d)(1)-(4)):
Material that would inappropriately reveal the identities of
referees who provide letters of recommendation and peer reviewers who
provide written evaluative input and recommendations to NIH about
particular funding applications under an express promise by the
government that their identities in association with the written work
products they authored and provided to the government will be kept
confidential; this includes only material that would reveal a
particular referee or peer reviewer as the author of a specific work
product (e.g., reference or recommendation letters, reviewer critiques,
preliminary or final individual overall impact/priority scores, and/or
assignment of peer reviewers to an application and other evaluative
materials and data compiled by NIH/OER); it includes not only an
author's name but any content that could enable the author to be
identified from context.
To the extent that records in System No. 09-25-0225 are retrieved
by personal identifiers for individuals other than referees and peer
reviewers (for example, individual funding applicants, and other
individuals who are the subject of assessment or evaluation), the
exemptions enable the agency to prevent, when appropriate, those
individual record subjects from having access to, and other rights
under the Privacy Act with respect to, the above-described confidential
source-identifying material in the records.
HISTORY:
81 FR 88690 (Dec. 8, 2016), 83 FR 6591 (Feb.14, 2018).
[FR Doc. 2019-20423 Filed 9-19-19; 8:45 am]
BILLING CODE 4150-28-P