Privacy Act of 1974; System of Records, 71097-71099 [2021-27041]

Agencies

• National Aeronautics and Space Administration

[Federal Register Volume 86, Number 237 (Tuesday, December 14, 2021)]
[Notices]
[Pages 71097-71099]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-27041]


-----------------------------------------------------------------------

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

[NOTICE: (21-084)]


Privacy Act of 1974; System of Records

AGENCY: National Aeronautics and Space Administration (NASA).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: Pursuant to the provisions of the Privacy Act of 1974, the 
National Aeronautics and Space Administration is issuing public notice 
of its proposal to alter a previously noticed system of records NASA 
Health Information Management System/NASA 10HIMS. This adds a retention 
schedule and revises NASA standard routine uses, as set forth below 
under the caption SUPPLEMENTARY INFORMATION.

DATES: Submit comments within 30 calendar days from the date of this 
publication. The changes will take effect at the end of that period, if 
no adverse comments are received.

ADDRESSES: Patti F. Stockman, Privacy Act Officer, Office of the Chief 
Information Officer, National Aeronautics and Space Administration 
Headquarters, Washington, DC 20546-0001, (202) 358-4787, [email protected].

FOR FURTHER INFORMATION CONTACT: NASA Privacy Act Officer, Patti F. 
Stockman, (202) 358-4787, [email protected].

SUPPLEMENTARY INFORMATION: This notice adds a retention schedule that 
covers individual health records under Policies and Practices for 
Retention and Disposal of Records. It also revises Standard Routine Use 
5 to clarify conditions under which NASA will release records to a 
legal body for a proceeding involving NASA.

Cheryl Parker,
Federal Register Liaison Officer.

SYSTEM NAME AND NUMBER:
    Health Information Management System, NASA 10HIMS.

SECURITY CLASSIFICATION:
    None.

SYSTEM LOCATION:
    Records of Medical Clinics/Units and Environmental Health Offices 
are maintained at:
    Mary W. Jackson NASA Headquarters, National Aeronautics and Space 
Administration (NASA), Washington, DC 20546-0001;
    Ames Research Center (NASA), Moffett Field, CA 94035-1000;
    Armstrong Flight Research Center (NASA), PO Box 273, Edwards, CA 
93523-0273;
    John H. Glenn Research Center at Lewis Field (NASA), 21000 
Brookpark Road, Cleveland, OH 44135-3191;
    Goddard Space Flight Center (NASA), Greenbelt, MD 20771-0001;
    Lyndon B. Johnson Space Center (NASA), Houston, TX 77058-3696;
    John F. Kennedy Space Center (NASA), Kennedy Space Center, FL 
32899-0001;
    Langley Research Center, (NASA), Hampton, VA 23681-2199;
    George C. Marshall Space Flight Center (NASA), Marshall Space 
Flight Center, AL 35812-0001;
    John C. Stennis Space Center (NASA), Stennis Space Center, MS 
39529-6000;
    Michoud Assembly Facility (NASA), PO Box 29300, New Orleans, LA 
70189; and
    Wallops Flight Facility (NASA), Wallops Island, VA 23337.
    Electronic records are also hosted at:
    CORITY Chicago Data Center, 341 Haynes Drive, in Wood Dale, 
Illinois 60191;
    Salesforce Government Cloud in Ashburn, Virginia; and
    Salesforce Disaster Recovery Center in Elk Grove Village, Illinois.

SYSTEM AND SUBSYSTEM MANAGER(S):
    Chief Health and Medical Officer at NASA Headquarters (see System 
Location above for address).
    Subsystem Managers:
    Director Health and Medical Systems, Occupational Health at NASA 
Headquarters (see System Location above for address);
    Chief, Space Medicine Division at NASA Johnson Space Center (see 
System Location above for address);
    Occupational Health Contracting Officer Representatives at NASA 
Ames Research Center, (see System Location above for address);
    NASA Armstrong Flight Research Center (see System Location above 
for address);
    NASA Goddard Space Flight Center (see System Location above for 
address);
    NASA Kennedy Space Center (see System Location above for address);
    NASA Langley Research Center (see System Location above for 
address);
    NASA Glenn Research Center (see System Location above for address);
    NASA Marshall Space Flight Center (see System Location above for 
address);
    NASA Jet Propulsion Laboratory (see System Location above for 
address);
    NASA Stennis Space Center (see System Location above for address);
    Michoud Assembly Facility (NASA) (see System Location above for 
address); and

[[Page 71098]]

    Wallops Flight Facility (NASA) (see System Location above for 
address).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    5 U.S.C. 7901--Health service programs;
    51 U.S.C. 20113 (a)--Powers of the Administration in performance of 
functions to make and promulgate rules and regulations;
    44 U.S.C. 3101--Records management by agency heads; general duties;
    42 CFR part 2--Confidentiality of substance use disorder patient 
records.

PURPOSE(S) OF THE SYSTEM:
    In order to ensure a healthy environment and workforce, information 
in this system of records is maintained on anyone receiving (1) exams 
for general wellness, (2) occupational clearances or determination of 
fitness for duty, (3) behavioral health assistance, (4) workplace 
surveillance for potential human exposure within NASA to communicable 
diseases and hazards such as noise and chemical exposure, repetitive 
motion, and (5) first aid or medical care for onsite illness or 
injuries through a NASA clinic outreach.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    This system contains information on (1) NASA employees and 
applicants; (2) employees from other agencies and military detailees 
working at NASA; (3) active or retired astronauts and active astronaut 
family members; (4) other space flight personnel on temporary or 
extended duty at NASA; (5) contractor personnel; (6) Space Flight 
Participants and those engaged in commercial use of NASA facilities, 
(7) civil service and contractor family members; and (8) visitors to 
NASA Centers who use clinics or ambulance services for emergency or 
first-aid treatment.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Records in this system contain demographic data and private health 
information:
    (1) Wellness records including but not limited to exams provided 
for continuing healthcare, documentation of immunizations and other 
outreach records.
    (2) Fitness for duty and/or exposure exams/surveillance including 
but not limited to ergonomics, hazardous materials, radiation, noise, 
communicable diseases and other applicable longitudinal surveillance.
    (3) Qualification records including the use of offsite or onsite 
exams to determine suitability for duties.
    (4) Behavioral health and employee assistance records.
    (5) Records of first aid, contingency response, or emergency care, 
including ambulance transportation.

RECORD SOURCE CATEGORIES:
    The information in this system of records is obtained from 
individuals themselves, physicians, and previous medical records of 
individuals.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    Any disclosures of information will be compatible with the purpose 
for which the Agency collected the information. Under the following 
routine uses that are unique to this system of records, information in 
this system may be disclosed:
    (1) to external medical professionals and independent entities to 
support internal and external reviews for purposes of medical quality 
assurance; (2) to private or other government health care providers for 
consultation, referral, or mission medical contingency support; (3) to 
the Office of Personnel Management, Occupational Safety and Health 
Administration, and other Federal or State agencies as required in 
accordance with the Federal agency's special program responsibilities; 
(4) to insurers for referrals or reimbursement; (5) to employers of 
non-NASA personnel in support of the Mission Critical Space Systems 
Personnel Reliability Program; (6) to international partners for 
mission support and continuity of care for their employees pursuant to 
NASA Space Act agreements; (7) to non-NASA personnel performing 
research, studies, or other activities through arrangements or 
agreements with NASA; (8) to the public of pre-space flight information 
having mission impact concerning an individual crewmember, limited to 
the crewmember's name and the fact that a medical condition exists; (9) 
to the public, limited to the crewmember's name and the fact that a 
medical condition exists, if a flight crewmember is, for medical 
reasons, unable to perform a scheduled public event following a space 
flight mission/landing; (10) to the public to advise of medical 
conditions arising from accidents, consistent with NASA regulations; 
and (12) in accordance with standard routine uses as set forth here.
    In addition, the following routine uses of information contained in 
SORs are standard for many NASA systems and are compatible with the 
purpose for which the Agency collected the information.
    Standard Routine Use No. 1--In the event this system of records 
indicates a violation or potential violation of law, whether civil, 
criminal, or regulatory in nature, and whether arising by general 
statute or particular program statute, or by regulation, rule or order 
issued pursuant thereto, the relevant records in the SOR may be 
referred to the appropriate agency, whether Federal, State, local or 
foreign, charged with the responsibility of investigating or 
prosecuting such violation or charged with enforcing or implementing 
the statute, or rule, regulation or order issued pursuant thereto.
    Standard Routine Use No. 2--A record from this SOR may be disclosed 
to a Federal, State, or local agency maintaining civil, criminal, or 
other relevant enforcement information or other pertinent information, 
such as current licenses, if necessary to obtain information relevant 
to an agency decision concerning the hiring or retention of an 
employee, the issuance of a security clearance, the letting of a 
contract, or the issuance of a license, grant, or other benefit.
    Standard Routine Use No. 3-- A record from this SOR may be 
disclosed to a Federal agency, in response to its request, in 
connection with the hiring or retention of an employee, the issuance of 
a security clearance, the reporting of an investigation of an employee, 
the letting of a contract, or the issuance of a license, grant, or 
other benefit by the requesting agency, to the extent that the 
information is relevant and necessary to the requesting agency's 
decision on the matter.
    Standard Routine Use No. 4--A record from this system may be 
disclosed to the Department of Justice including United States Attorney 
Offices, or other federal agency conducting litigation or in 
proceedings before any court, adjudicative or administrative body, when 
the record is relevant or necessary to the litigation or the agency has 
an interest in such litigation when (a) the Agency, or any component 
thereof; or (b) any employee of the Agency in his or her official 
capacity; or (c) any employee of the Agency in his or her individual 
capacity where the Department of Justice or the Agency has agreed to 
represent the employee; or (d) the United States, where the Agency 
determines that litigation is likely to affect the Agency or any of its 
components, is a party to litigation or has an interest in such 
litigation, and the use of such records by the Department of Justice or 
the Agency is deemed by the Agency to be relevant and necessary to the 
litigation.

[[Page 71099]]

    Standard Routine Use No. 5--A record from this SOR may be disclosed 
in an appropriate proceeding before a court, grand jury, or 
administrative or adjudicative body, when NASA determines that the 
records are relevant to the proceeding; or in an appropriate proceeding 
before an administrative or adjudicative body when the adjudicator 
determines the records to be relevant to the proceeding.
    Standard Routine Use No. 6--A record from this SOR may be disclosed 
to appropriate agencies, entities, and persons when (1) NASA suspects 
or has confirmed that there has been a breach of the system of records; 
(2) NASA has determined that as a result of the suspected or confirmed 
breach there is a risk of harm to individuals, NASA (including its 
information systems, programs, and operations), the Federal Government, 
or national security; and (3) the disclosure made to such agencies, 
entities, and persons is reasonably necessary to assist in connection 
with NASA's efforts to respond to the suspected or confirmed breach or 
to prevent, minimize, or remedy such harm.
    Standard Routine Use No. 7--A record from this system may be 
disclosed to contractors, grantees, experts, consultants, students, and 
others performing or working on a contract, service, grant, cooperative 
agreement, or other assignment for the federal government, when 
necessary to accomplish an Agency function related to this system of 
records.
    Standard Routine Use No. 8--A record from this system may be 
disclosed to a Member of Congress or staff acting upon the Member's 
behalf when the Member or staff requests the information on behalf of, 
and at the request of, the individual who is the subject of the record.
    Standard Routine Use No. 9--A record from this system may be 
disclosed to another Federal agency or Federal entity, when NASA 
determines that information from this system of records is reasonably 
necessary to assist the recipient agency or entity in (1) responding to 
a suspected or confirmed breach or (2) preventing, minimizing, or 
remedying the risk of harm to individuals, the recipient agency or 
entity (including its information systems, programs, and operations), 
the Federal Government, or national security, resulting from a 
suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records are stored in multiple formats including paper, digital, 
micrographic, photographic, and as medical recordings such as 
electrocardiograph tapes, x-rays and strip charts.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records are retrieved from the system by the individual's name, 
date of birth, or unique assigned Numbers.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records are maintained in Agency files and destroyed in accordance 
with NASA Records Retention Schedule 1, Items 126 and 127, and NASA 
Records Retention Schedule 8, Item 57.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    Records are maintained on secure NASA servers and protected in 
accordance with all Federal standards and those established in NASA 
regulations at 14 CFR 1212.605. Additionally, server and data 
management environments employ infrastructure encryption technologies 
both in data transmission and at rest on servers. Electronic messages 
sent within and outside of the Agency that convey sensitive data are 
encrypted and transmitted by staff via pre-approved electronic 
encryption systems as required by NASA policy. Approved security plans 
are in place for information systems containing the records in 
accordance with the Federal Information Security Management Act of 2014 
(FISMA) and OMB Circular A-130, Management of Federal Information 
Resources. Only authorized personnel requiring information in the 
official discharge of their duties are authorized access to records 
through approved access or authentication methods. Access to electronic 
records is achieved only from workstations within the NASA Intranet, or 
remotely via a secure Virtual Private Network (VPN) connection 
requiring two-factor token authentication using NASA-issued computers 
or via employee PIV badge authentication from NASA-issued computers. 
The CORITY Chicago Data Center and Salesforce Government Cloud and 
Disaster Recovery Center maintain documentation and verification of 
commensurate safeguards in accordance with FISMA, NASA Procedural 
Requirements (NPR) 2810.1A, and NASA ITS-HBK-2810.02-05. Non-electronic 
records are secured in locked rooms or files.

RECORD ACCESS PROCEDURES:
    In accordance with 14 CFR part 1212, Privacy Act--NASA Regulations, 
information may be obtained by contacting in person or in writing the 
system or subsystem manager listed above at the location where the 
records are created and/or maintained. Requests must contain the 
identifying data concerning the requester, e.g., first, middle and last 
name; date of birth; description and time periods of the records 
desired. NASA Regulations also address contesting contents and 
appealing initial determinations regarding records access.

CONTESTING RECORD PROCEDURES:
    In accordance with 14 CFR part 1212, Privacy Act--NASA Regulations, 
information may be obtained by contacting in person or in writing the 
system or subsystem manager listed above at the location where the 
records are created and/or maintained. Requests must contain the 
identifying data concerning the requester, e.g., first, middle and last 
name; date of birth; description and time periods of the records 
desired. NASA Regulations also address contesting contents and 
appealing initial determinations regarding records access.

NOTIFICATION PROCEDURES:
    In accordance with 14 CFR part 1212, Privacy Act--NASA Regulations, 
information may be obtained by contacting in person or in writing the 
system or subsystem manager listed above at the location where the 
records are created and/or maintained. Requests must contain the 
identifying data concerning the requester, e.g., first, middle and last 
name; date of birth; description and time periods of the records 
desired. NASA Regulations also address contesting contents and 
appealing initial determinations regarding records access.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    2020-27051, 85 FR 79224, pp. 79224-79227.

[FR Doc. 2021-27041 Filed 12-13-21; 8:45 am]
BILLING CODE 7510-13-P