Privacy Act of 1974; System of Records, 77081-77085 [2022-27150]
Download as PDF
Federal Register / Vol. 87, No. 241 / Friday, December 16, 2022 / Notices
0750–0001, using any of the following
methods:
Æ Federal eRulemaking Portal:
https://www.regulations.gov. Follow the
instructions for submitting comments.
Æ Email: osd.dfars@mail.mil. Include
OMB Control Number 0750–0001 in the
subject line of the message.
Comments received generally will be
posted without change to https://
www.regulations.gov, including any
personal information provided.
FOR FURTHER INFORMATION CONTACT: Mr.
David Johnson, at 202–913–5764.
SUPPLEMENTARY INFORMATION:
Title and OMB Number: Defense
Federal Acquisition Regulation
Supplement (DFARS) PerformanceBased Payments—Representation; OMB
Control Number 0750–0001.
Affected Public: Businesses or other
for-profit and not-for-profit institutions.
Respondent’s Obligation: Required to
obtain or retain benefits.
Reporting Frequency: On occasion.
Number of Respondents: 144.
Responses per Respondent: 1.
Annual Responses: 144.
Average Burden per Response: 0.1
hour.
Annual Burden Hours: 14.4.
Needs and Uses: This information
collection concerns the Defense Federal
Acquisition Regulation Supplement
(DFARS) solicitation provision at
252.232–7015, Performance-Based
Payments—Representation. This
provision is prescribed at DFARS
232.1005–70(b) for use in solicitations
where the resulting contract may
include performance-based payments.
This representation will be included in
the annual representations and
certifications in the System for Award
Management. Paragraph (b) of the
provision requires the offeror to check a
box indicating whether the offeror’s
financial statements are in compliance
with Generally Accepted Accounting
Principles. DoD will use this
information to decide whether the
offeror is eligible for performance-based
payments.
Jennifer D. Johnson,
Editor/Publisher, Defense Acquisition
Regulations System.
[FR Doc. 2022–27208 Filed 12–15–22; 8:45 am]
BILLING CODE 5001–06–P
lotter on DSK11XQN23PROD with NOTICES1
DEPARTMENT OF DEFENSE
Office of the Secretary
Privacy Act of 1974; System of
Records
Department of Defense (DoD).
VerDate Sep<11>2014
20:05 Dec 15, 2022
Jkt 259001
Notice of a new system of
records.
In accordance with the
Privacy Act of 1974, the DoD is
establishing a new Department-wide
system of records titled, ‘‘Declared
Public Health Emergency Exposure
Records,’’ DoD–0013. This system of
records covers DoD’s maintenance of
records about individuals necessitated
by a declared public health emergency
(DPHE) by an appropriate official,
including the Secretary of Health and
Human Services pursuant to the Public
Health Services Act, a DoD official, or
other authorized state, local, or other
governmental public health official
pursuant to applicable law. These
records are maintained to assist the DoD
in establishing safe environments,
identifying and protecting DoDaffiliated individuals at risk of
transmission of or contracting the
disease or agent at issue, and in
supporting mission readiness.
Additionally, the DoD is issuing a direct
final rule, which is exempting this
system of records from certain
provisions of the Privacy Act, elsewhere
in today’s issue of the Federal Register.
DATES: This system of records is
effective upon publication; however,
comments on the Routine Uses will be
accepted on or before January 17, 2023.
The Routine Uses are effective at the
close of the comment period.
ADDRESSES: You may submit comments,
identified by docket number and title,
by any of the following methods:
* Federal Rulemaking Portal: https://
www.regulations.gov. Follow the
instructions for submitting comments.
* Mail: Department of Defense, Office
of the Assistant to the Secretary of
Defense for Privacy, Civil Liberties, and
Transparency, Regulatory Directorate,
4800 Mark Center Drive, Attn: Mailbox
24, Suite 08D09, Alexandria, VA 22350–
1700.
Instructions: All submissions received
must include the agency name and
docket number for this Federal Register
document. The general policy for
comments and other submissions from
members of the public is to make these
submissions available for public
viewing on the internet at https://
www.regulations.gov as they are
received without change, including any
personal identifiers or contact
information.
SUMMARY:
Ms.
Rahwa Keleta, Defense Privacy and Civil
Liberties Division, Directorate for
Privacy, Civil Liberties and Freedom of
Information, Office of the Assistant to
the Secretary of Defense for Privacy,
FOR FURTHER INFORMATION CONTACT:
[Docket ID: DoD–2022–OS–0138]
AGENCY:
ACTION:
PO 00000
Frm 00025
Fmt 4703
Sfmt 4703
77081
Civil Liberties, and Transparency,
Department of Defense, 4800 Mark
Center Drive, Mailbox #24, Suite 08D09,
Alexandria, VA 22350–1700;
OSD.DPCLTD@mail.mil; (703) 571–
0070.
SUPPLEMENTARY INFORMATION:
I. Background
DoD is establishing the Declared
Public Health Emergency Exposure
Records, DoD–0013 as a DoD-wide
Privacy Act system of records. A DoDwide system of records notice (SORN)
supports multiple DoD paper or
electronic recordkeeping systems
operated by more than one DoD
component that maintain the same kind
of information about individuals for the
same purpose. The establishment of
DoD-wide SORNs helps DoD
standardize the rules governing the
collection, maintenance, use, and
sharing of personal information in key
areas across the enterprise. DoD-wide
SORNs also reduce duplicative and
overlapping SORNs published by
separate DoD components. The creation
of DoD-wide SORNs is expected to make
locating relevant SORNs easier for DoD
personnel and the public, and create
efficiencies in the operation of the DoD
privacy program.
DoD prioritizes the safety of its
workforce to ensure Department’s
missions are able to be accomplished
successfully at all times in defense of
the Nation. To do that, DoD must
maintain operationally ready
capabilities, including operating within
degraded environments such as during
a DPHE. Public health emergencies are
varied; they may be broad or limited in
geographical scope and may be declared
by various authorities such as the
Secretary of Health and Human Services
or the responsible, designated State,
local, tribal, or territorial official, or
cognizant military commander.
Responses to public health emergencies
depend on the nature of the emergency,
but in some cases the degraded
environment created by the public
health emergency may require the DoD
to collect personal information to ensure
a safe and secure workplace for
employees and visitors to DoD facilities,
and ultimately, to ensure DoD is able to
continue to carry out its mission.
DoD Instruction 6200.03, ‘‘Public
Health Emergency Management within
the DoD,’’ establishes DoD policy for
DPHE. This includes the authority and
responsibilities of DoD commanders and
other officials during a DPHE, and
various activities that may be required
to address the emergency. For example,
paragraph 3.1.d(1) provides that DoD
E:\FR\FM\16DEN1.SGM
16DEN1
lotter on DSK11XQN23PROD with NOTICES1
77082
Federal Register / Vol. 87, No. 241 / Friday, December 16, 2022 / Notices
may need to initiate actions to collect
and analyze data on the health hazard
causing the DPHE, and paragraph
3.1.d(3) provides that DoD may need to
act to ensure identification, interview,
and tracking of all individuals or groups
suspected to have been exposed to the
health hazard to characterize the source
and spread of the health hazard. In
carrying out these and other activities,
DoD may collect and maintain
information about individuals that is
subject to the Privacy Act and therefore
requires a SORN, but is not already
covered by other DoD SORNs. Examples
of the types of data in records that may
be uniquely covered by this SORN
include contact tracing data, which is
the identification and contact
information of individuals suspected or
confirmed to have contracted a disease
or illness, or exposed to an individual
suspected or confirmed to have
contracted a disease or illness, related to
a DPHE; individual circumstances and
dates of suspected exposure; and health
status information. The data may also
include information about individuals
exposed to a public health threat other
than a communicable disease such as a
radiological exposure or the release of a
toxin or chemical agents, related to a
DPHE. This system of records also
supports the sharing of information that
may need to occur during a DPHE, such
as sharing of exposure information
about individuals with public health
authorities to support public health
goals, such as contact tracing and the
reduction of the spread of a health
hazard.
The information covered by this
system of records is separate and unique
from other DoD systems of records
which contain records maintained by
DoD for accountability and assessment
of DoD-affiliated personnel, or created
during the normal course of DoD’s
delivery of occupational health and
safety services, which DoD provides
routinely to members of the military and
DoD civilians, and sometimes to DoD
visitors, concessionaires, and
contractors. These records are covered
by other SORNs, and are specifically
identified in the notice below for clarity.
DoD maintains this information to
ensure mission success through the
appropriate management and response
to the public health emergency, and to
reduce the risk of disease or illness
among DoD military and civilian
personnel, contractors, concessionaires,
and visitors to DoD facilities. The
collection and use of records covered by
this system of records is only permitted
during times of a declared public health
emergency.
VerDate Sep<11>2014
20:05 Dec 15, 2022
Jkt 259001
Finally, the Health Insurance
Portability and Accountability Act of
1996 (HIPAA) Rules, as amended by the
Omnibus Final Rule, include the HIPAA
Privacy Rule, the HIPAA Breach Rule,
the HIPAA Security Rule, and the
HIPAA Enforcement (Parts 160 and 164
of Title 45 CFR), permit a DoD covered
entity to use or disclose protected health
information for public health activities
as noted in DoD Manual 6025.18. Under
HIPAA, ‘‘public health authority’’
means an agency or authority of the
United States, a State, a territory, a
political subdivision of a State or
territory, or an Indian tribe, or a person
or entity acting under a grant of
authority from or contract with such
public agency, including the employees
or agents of such public agency or its
contractors or persons or entities to
whom it has granted authority, that is
responsible for public health matters as
part of its official mandate. 45 CFR
164.501 (definition of ‘‘public health
authority’’). The HIPAA Rules only
apply if the entity or individual that is
disclosing protected health information
meets the definition of a HIPAA covered
entity or business associate. The records
covered under this SORN are not subject
to the HIPAA Rules.
Additionally, the DoD is issuing a
direct final rule to exempt this system
of records from certain provisions of the
Privacy Act elsewhere in today’s issue
of the Federal Register. DoD SORNs
have been published in the Federal
Register and are available from the
address in FOR FURTHER INFORMATION
CONTACT or at the Defense Privacy, Civil
Liberties, and Freedom of Information
Directorate website at https://
dpcld.defense.gov.
II. Privacy Act
Under the Privacy Act, a ‘‘system of
records’’ is a group of records under the
control of an agency from which
information is retrieved by the name of
an individual or by some identifying
number, symbol, or other identifying
particular assigned to the individual. In
the Privacy Act, an individual is defined
as a U.S. citizen or lawful permanent
resident.
In accordance with 5 U.S.C. 552a(r)
and Office of Management and Budget
(OMB) Circular No. A–108, DoD has
provided a report of this system of
records to the OMB and to Congress.
PO 00000
Frm 00026
Fmt 4703
Sfmt 4703
Dated: December 9, 2022.
Aaron T. Siegel,
Alternate OSD Federal Register Liaison
Officer, Department of Defense.
SYSTEM NAME AND NUMBER:
Declared Public Health Emergency
Exposure Records, DoD–0013.
SECURITY CLASSIFICATION:
Unclassified and classified.
SYSTEM LOCATION:
Department of Defense (Department or
DoD), located at 1000 Defense Pentagon,
Washington, DC 20301–1000, and other
Department installations, offices, or
mission locations. Information may also
be stored within a government-certified
cloud, implemented and overseen by
the Department’s Chief Information
Officer (CIO), 6000 Defense Pentagon,
Washington, DC 20301–6000.
SYSTEM MANAGERS:
The system managers for this system
of records are as follows:
A. Office of the Assistant Secretary of
Defense for Health Affairs, Under
Secretary of Defense (Personnel and
Readiness), 1000 Defense Pentagon,
Washington, DC 20301–1100.
B. Deputy Assistant Secretary of the
Army, Office of the Surgeon General,
U.S. Army Medical Command, 2050
Worth Road, Suite 13, Fort Sam
Houston, TX 78234–6013.
C. Air Force Occupational Safety and
Health (AFOSH), Department of the Air
Force, 1000 Defense Pentagon,
Washington, DC 20301–1100,
usaf.pentagon.af-a1.mbx.a1q-workflow@mail.mil.
D. Chief of Naval Personnel,
Occupational and Environmental
Medicine, Navy & Marine Corps Public
Health Center, 620 John Paul Jones
Circle, Suite 1100, Portsmouth, VA
23708–2103.
E. The Privacy Act responsibilities
concerning access, amendment, and
disclosure of the records within this
system of records have been delegated
to the DoD components. DoD
components include the Military
Departments of the Army, Air Force
(including the U.S. Space Force), and
Navy (including the U.S. Marine Corps),
field operating agencies, major
commands, field commands,
installations, and activities. To contact
the system managers at the DoD
component with oversight of the
records, go to www.FOIA.gov to locate
the contact information for each
component’s Freedom of Information
Act (FOIA) office.
E:\FR\FM\16DEN1.SGM
16DEN1
Federal Register / Vol. 87, No. 241 / Friday, December 16, 2022 / Notices
AUTHORITY FOR MAINTAINANCE OF THIS SYSTEM:
10 U.S.C. 113, Secretary of Defense;
10 U.S.C. 136, Under Secretary of
Defense for Personnel and Readiness; 10
U.S.C. 2672, Protection of Buildings,
Grounds, Property, and Persons and
Implementation of Section 2672 of Title
10, United States Code; E.O. 14043,
Requiring Coronavirus Disease 2019
Vaccination for Federal Employees; DoD
Directive 5525.21, Protection of
Buildings, Grounds, Property, and
Persons; DoDI 6200.03, Public Health
Emergency Management within the
DoD; and DoDI 6055.17, DoD Emergency
Management Program; or successor DoD
policies, and E.O. 9397, as amended.
Note 1: The records covered under this
SORN, while covered by the Privacy Act, are
not subject to the HIPAA Rules.
lotter on DSK11XQN23PROD with NOTICES1
PURPOSE(S) OF THE SYSTEM:
A. To support required or authorized
activities during a declared public
health emergency, such as contact
tracing and coordination with medical
and public health officials, for the
purpose of maintaining safe and healthy
DoD environments, including work and
training environments, transportation
facilities and vehicles, base housing,
retail and recreation areas, hospitals,
and other health care facilities.
B. To support the managing,
monitoring, tracking, reporting and
sharing of records created during a
declared public health emergency to
protect DoD Service members and their
dependents, the civilian workforce,
contractors, concessionaires, and
visitors to DoD facilities.
C. To identify and protect individuals
at risk for transmitting or contracting a
communicable disease related to a
declared public health emergency; to
identify and protect those who may be
at elevated risk of symptomatic or
severe disease from a public health
threat, such as a communicable disease
or biohazard, or exposure to radiation,
toxins, or chemical agents; and to limit
exposure to the source(s) of infection or
illness through public health mitigation
and surveillance activities, such as
monitoring and contact tracing.
D. To support DoD and non-DoD
health care personnel, including public
health officials, who need to collect,
use, and review this information in
performance of their duties related to
the public health emergency or to
delivering health care to affected
individuals.
E. To support use of this information
by other DoD officials to determine
mission readiness and conduct afteraction reviews. Statistical data instead
VerDate Sep<11>2014
20:05 Dec 15, 2022
Jkt 259001
of identifiable information will be used
wherever practicable for these efforts.
Note 2: A declared public health
emergency may be limited or broad in
geographic scope, and could affect one,
many, or all DoD installations and facilities.
This system of records may support
worldwide DoD public health emergency
activities in the case of a pandemic, or local
or regional DoD activities in the case of a
geographically limited public health
emergency.
CATEGORIES OF INDIVIDUALS COVERED BY THE
SYSTEM:
DoD military Service members (Active
Duty, Guard/Reserve, and Coast Guard
personnel when acting as a military
service with the Navy), civilian
personnel (including non-appropriated
fund employees), DoD spouses/
dependents and cohabitants, military
retirees, and DoD contractors. Also,
personnel of partner organizations,
visitors, eligible patrons, or
concessionaires accessing or sharing
DoD facilities or attending DoDsponsored events, and individuals
residing in military housing during a
declared public health emergency,
including a pandemic.
CATEGORIES OF RECORDS IN THE SYSTEM:
A. Personal and Employment
Information: name, Employee
Identification Number/DoD ID number,
Social Security Number, date of birth,
gender, address, phone number(s),
email(s), demographic or biographical
information, recent domestic and
international travel and status (e.g.,
Service member, dependent, civilian,
contractor, visitor, etc.); emergency
contact information (emergency
contact’s name, phone number, address,
email address, and relationship to the
individual); employment information
(title, organizational affiliation, duty
location); employment time and
attendance records; disability
information; personnel accountability
information (such as current work status
of the individual and affiliated leave
status information).
B. Medical Information: confirmed
medical test results, physician
assessment of medical transmission risk
status (either for the individual or
because the individual cohabitates with
others who may be considered
medically high-risk); medical diagnoses
and prognosis information; dates of
medical visits or tests, individual
symptoms; potential or actual exposure
to the public health threat (e.g.,
biohazard or communicable disease);
medical history related to the treatment
of a virus or communicable disease
essential to mitigate the spread of
PO 00000
Frm 00027
Fmt 4703
Sfmt 4703
77083
disease during a public health
emergency; immunizations and
vaccination information; medical
directives and/or expressions of interest
in receiving a vaccine or other medical
treatments, religious or other objections
to medical treatment; correspondence
with individuals or medical/family
representatives on medical treatment;
medical, treatment, or disclosure
consent forms;, medical or health
emergency notification forms.
C. Contact Tracing Information:
proximity tracking information of
individuals after diagnosis or suspected
exposure, to include dates when the
individual visited a DoD facility or
attended a DoD-sponsored event, the
locations visited within the facility (e.g.,
floor, room number), time duration
spent in the facility, and identification
of persons in contact with while at the
facility; records that indicate an
individual’s location and/or proximity
to others on DoD property or at the
event over time as compiled through
either manual or through technical
means (such as badge access, office
location, and information technology
system login information; and any other
relevant information completed,
obtained, or developed as a result of an
individual attending, working or
entering a DoD facility/event during a
public health emergency).
Note 3: Excluded from this system of
records are employee occupational medical
records covered by the U.S. Office of
Personnel Management (OPM) regulation at 5
CFR part 293, subpart E, Employee Medical
File System Records. The regulation requires
agencies that are subject to OPM’s
recordkeeping requirements to maintain
employee occupational medical records in
the agency’s Employee Medical File System.
Such records are covered exclusively by the
OPM/GOVT–10, Employee Medical File
System of Records.
Note 4: Excluded from this system of
records are DoD accountability and
assessment records as described in DoD–
0012, Defense Accountability and
Assessment Records SORN. Records in DoD–
0012 are collected and used to account for
DoD-affiliated personnel in a natural or manmade disaster, during a public health
emergency, or when directed by the Secretary
of Defense. During a declared public health
emergency, DoD may collect and maintain
records under both the DoD–0012 SORN to
support DoD accountability and assessment
for DoD-affiliated individuals, and this SORN
to support contract tracing and other
authorized public health objectives
necessitated by the declared public health
emergency.
RECORD SOURCE CATEGORIES:
Records and information stored in
this system of records are obtained from:
E:\FR\FM\16DEN1.SGM
16DEN1
77084
Federal Register / Vol. 87, No. 241 / Friday, December 16, 2022 / Notices
Individuals, healthcare personnel,
entities designated as public health
authorities, and information systems
maintaining data described in the
Categories of Records section above,
such as DoD medical systems, DoD
human resources/personnel systems,
DoD identity and credentialing software
for information technology systems; and
visitor, security, and access control
systems for DoD facilities or locations
where DoD-sponsored events are held.
When the individual is a minor or is
otherwise unable to provide information
about themselves due to illness or other
incapacity, DoD may collect information
from appropriate sources such as family
members, co-workers, friends, or cohabitants for the purposes described in
this notice.
lotter on DSK11XQN23PROD with NOTICES1
ROUTINE USES AND RECORDS MAINTAINED IN THE
SYSTEM, INCLUDING CATEGORIES OF USERS AND
THE PURPOSES OF SUCH USES:
In addition to those disclosures
generally permitted under 5 U.S.C.
552a(b) of the Privacy Act of 1974, as
amended, all or a portion of the records
or information contained herein may
specifically be disclosed outside the
DoD as Routine Use pursuant to 5 U.S.C.
552a(b)(3) as follows:
A. To contractors, grantees, experts,
consultants, students, and others
performing or working on a contract,
service, grant, cooperative agreement, or
other assignment for the Federal
government when necessary to
accomplish an agency function related
to this system of records.
B. To the appropriate Federal, State,
local, territorial, tribal, foreign, or
international law enforcement authority
or other appropriate entity where a
record, either alone or in conjunction
with other information, indicates a
violation or potential violation of law,
whether criminal, civil, or regulatory in
nature.
C. To any component of the
Department of Justice for the purpose of
representing the DoD, or its
components, officers, employees, or
members in pending or potential
litigation to which the record is
pertinent.
D. In an appropriate proceeding
before a court, grand jury, or
administrative or adjudicative body or
official, when the DoD or other Agency
representing the DoD determines that
the records are relevant and necessary to
the proceeding; or in an appropriate
proceeding before an administrative or
adjudicative body when the adjudicator
determines the records to be relevant to
the proceeding.
E. To the National Archives and
Records Administration for the purpose
VerDate Sep<11>2014
20:05 Dec 15, 2022
Jkt 259001
of records management inspections
conducted under the authority of 44
U.S.C. 2904 and 2906.
F. To a Member of Congress or staff
acting upon the Member’s behalf when
the Member or staff requests the
information on behalf of, and at the
request of, the individual who is the
subject of the record.
G. To appropriate agencies, entities,
and persons when (1) the DoD suspects
or confirms a breach of the system of
records; (2) the DoD determines as a
result of the suspected or confirmed
breach there is a risk of harm to
individuals, the DoD (including its
information systems, programs, and
operations), the Federal government, or
national security; and (3) the disclosure
made to such agencies, entities, and
persons is reasonably necessary to assist
in connection with the DoD’s efforts to
respond to the suspected or confirmed
breach or to prevent, minimize, or
remedy such harm.
H. To another Federal agency or
Federal entity, when the DoD
determines that information from this
system of records is reasonably
necessary to assist the recipient agency
or entity in (1) responding to a
suspected or confirmed breach or (2)
preventing, minimizing, or remedying
the risk of harm to individuals, the
recipient agency or entity (including its
information systems, programs and
operations), the Federal government, or
national security, resulting from a
suspected or confirmed breach.
I. To another Federal, State or local
agency for the purpose of comparing to
the agency’s system of records or to nonFederal records, in coordination with an
Office of Inspector General in
conducting an audit, investigation,
inspection, evaluation, or some other
review as authorized by the Inspector
General Act of 1978, as amended.
J. To such recipients and under such
circumstances and procedures as are
mandated by Federal statue or treaty.
K. To Federal, State, local, foreign, or
international public health agencies and
officials, including the Centers for
Disease Control and Prevention, to the
extent necessary to comply with laws or
policies governing reporting on the
impact of a communicable disease,
agent, or other cause responsible for the
declared public health emergency.
L. To an emergency contact for
purposes of locating an individual to
communicate possible exposure to or
treatment options for a public health
threat such as a communicable disease
or exposure to a biohazard.
M. To the U.S. Department of State
when it requires information to consider
or provide an informed response to a
PO 00000
Frm 00028
Fmt 4703
Sfmt 4703
request for information from a foreign,
international, or intergovernmental
agency, authority, or organization about
public health relating to DoD personnel,
facilities, or activities abroad.
N. To individuals for the purpose of
determining if they have had contact
with a person known or suspected to
have a communicable disease, illness, or
other exposure that requires quarantine,
and to identify and protect the health
and safety of others who may have been
exposed.
O. To hospitals, physicians, and other
healthcare providers for the purpose of
protecting the health and safety of
individuals who may have been
exposed to a contagion or biohazard, or
to assist such persons or organizations
in preventing exposure to or
transmission of a communicable
disease.
P. To Federal, state, local, tribal,
territorial, or foreign governmental
agencies; multilateral governmental
organizations; medical facilities or
providers, or other public health
entities, for the purpose of protecting
the vital interests of a record subject or
other persons, including to assist such
agencies or organizations during an
epidemiological investigation, in
facilitating continuity of care, or in
preventing exposure to or transmission
of a communicable disease or biohazard
of public health significance.
POLICIES AND PRACTICES FOR STORAGE OF
RECORDS:
Records may be stored electronically
or on paper in secure facilities in a
locked drawer behind a locked door.
Electronic records may be stored locally
on digital media; in agency-owned
cloud environments; or in vendor Cloud
Service Offerings certified under the
Federal Risk and Authorization
Management Program (FedRAMP).
POLICIES AND PRACTICES FOR RETRIEVAL OF
RECORDS:
Records may be retrieved by an
individual’s name and/or individual
identification number, such as Social
Security Number or DoD ID Number.
POLICIES AND PRACTICES FOR RETENTION AND
DISPOSAL OF RECORDS:
Records are to be retained by the
Office of the Secretary of Defense, the
Joint Staff, the Military Departments, the
Defense Agencies, and the Defense Field
Activities in accordance with their
NARA-approved records retention
schedules.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL
SAFEGUARDS:
DoD safeguards records in this system
of records according to applicable rules,
E:\FR\FM\16DEN1.SGM
16DEN1
Federal Register / Vol. 87, No. 241 / Friday, December 16, 2022 / Notices
policies, and procedures, including all
applicable DoD automated systems
security and access policies. DoD
policies require the use of controls to
minimize the risk of compromise of
personally identifiable information (PII)
in paper and electronic form and to
enforce access by those with a need to
know and with appropriate clearances.
Additionally, DoD has established
security audit and accountability
policies and procedures which support
the safeguarding of PII and detection of
potential PII incidents. DoD routinely
employs safeguards such as the
following to information systems and
paper recordkeeping systems:
Multifactor log-in authentication
including Common Access Card (CAC)
authentication and password; physical
token as required; physical and
technological access controls governing
access to data; network encryption to
protect data transmitted over the
network; disk encryption securing disks
storing data; key management services
to safeguard encryption keys; masking
of sensitive data as practicable;
mandatory information assurance and
privacy training for individuals who
will have access; identification,
marking, and safeguarding of PII;
physical access safeguards including
multifactor identification physical
access controls, detection and electronic
alert systems for access to servers and
other network infrastructure; and
electronic intrusion detection systems
in DoD facilities.
Personal information maintained will
be the minimum necessary and only
used for the purposes stated in this
notice. Such information will be
retained for the minimum amount of
time, remain accessible only to
personnel with a valid operational need,
and only be used for the public health
emergency and no other purposes.
These records may be provided in
aggregate for accountability and mission
readiness purposes, as long as the
information may not be easily reidentified.
lotter on DSK11XQN23PROD with NOTICES1
Individuals seeking access to their
records should follow the procedures in
32 CFR part 310. Individuals should
address written inquiries to the DoD
component with oversight of the
records, as the component has Privacy
Act responsibilities concerning access,
amendment, and disclosure of the
records within this system of records.
The public may identify the contact
information for the appropriate DoD
office through the following website:
www.FOIA.gov. Signed written requests
should contain the name and number of
20:05 Dec 15, 2022
CONTESTING RECORD PROCEDURES:
Individuals seeking to amend or
correct the content of records about
them should follow the procedures in
32 CFR part 310.
NOTIFICATION PROCEDURES:
Individuals seeking to determine
whether information about themselves
is contained in this system of records
should follow the instructions for
Record Access Procedures above.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
The DoD has exempted records
maintained in this system from 5 U.S.C.
552a(c)(3); (d)(1), (2), (3), and (4); (e)(1);
(e)(4)(G), (H), and (I); and (f) pursuant to
5 U.S.C. 552a(k)(1). In addition, when
exempt records received from other
systems of records become part of this
system, the DoD also claims the same
exemptions for those records that are
claimed for the prior system(s) of
records of which they were a part, and
claims any additional exemptions set
forth here. An exemption rule for this
system has been promulgated in
accordance with requirements of 5
U.S.C. 553(b)(1), (2), and (3), (c) and (e),
and published in 32 CFR part 310.
HISTORY:
RECORD ACCESS PROCEDURES:
VerDate Sep<11>2014
this system of records notice along with
the full name, current address, and
email address of the individual. In
addition, the requester must provide
either a notarized statement or an
unsworn declaration made in
accordance with 28 U.S.C. 1746, in the
appropriate format:
If executed outside the United States:
‘‘I declare (or certify, verify, or state)
under penalty of perjury under the laws
of the United States of America that the
foregoing is true and correct. Executed
on (date). (Signature).’’
If executed within the United States,
its territories, possessions, or
commonwealths: ‘‘I declare (or certify,
verify, or state) under penalty of perjury
that the foregoing is true and correct.
Executed on (date). (Signature).’’
Jkt 259001
None.
[FR Doc. 2022–27150 Filed 12–15–22; 8:45 am]
BILLING CODE 5001–06–P
DEPARTMENT OF DEFENSE
Office of the Secretary
[Docket ID DoD–2022–OS–0139]
Privacy Act of 1974; System of
Records
AGENCY:
PO 00000
Department of Defense (DoD).
Frm 00029
Fmt 4703
Sfmt 4703
ACTION:
77085
Notice of a new system of
records.
In accordance with the
Privacy Act of 1974, the DoD is
establishing a new Department-wide
system of records titled, ‘‘Enterprise
Identity, Credential, and Access
Management (ICAM) Records, DoD–
0015.’’ This system of records will
support the management of individual
identity information, support the
provision of credentials to individuals
and entities to provide them access to
the DoD information services and data
they require, and support a standardized
DoD-wide process and protocol for
individual system and data access
across the enterprise to improve security
and cost savings.
DATES: This system of records is
effective upon publication; however,
comments on the Routine Uses will be
accepted on or before January 17, 2023.
The Routine Uses are effective at the
close of the comment period.
ADDRESSES: You may submit comments,
identified by docket number and title,
by either of the following methods:
* Federal Rulemaking Portal: https://
www.regulations.gov. Follow the
instructions for submitting comments.
* Mail: Department of Defense, Office
of the Assistant to the Secretary of
Defense for Privacy, Civil Liberties, and
Transparency, Regulatory Directorate,
4800 Mark Center Drive, Attn: Mailbox
24, Suite 08D09, Alexandria, VA 22350–
1700.
Instructions: All submissions received
must include the agency name and
docket number for this Federal Register
document. The general policy for
comments and other submissions from
members of the public is to make these
submissions available for public
viewing on the internet at https://
www.regulations.gov as they are
received without change, including any
personal identifiers or contact
information.
FOR FURTHER INFORMATION CONTACT: Ms.
Rahwa Keleta, Defense Privacy and Civil
Liberties Division, Directorate for
Privacy, Civil Liberties and Freedom of
Information, Office of the Assistant to
the Secretary of Defense for Privacy,
Civil Liberties, and Transparency,
Department of Defense, 4800 Mark
Center Drive, Mailbox #24, Suite 08D09,
Alexandria, VA 22350–1700;
OSD.DPCLTD@mail.mil; (703) 571–
0070.
SUPPLEMENTARY INFORMATION:
SUMMARY:
I. Background
DoD is establishing the Enterprise
Identity, Credentialing, and Access
E:\FR\FM\16DEN1.SGM
16DEN1
Agencies
[Federal Register Volume 87, Number 241 (Friday, December 16, 2022)]
[Notices]
[Pages 77081-77085]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-27150]
-----------------------------------------------------------------------
DEPARTMENT OF DEFENSE
Office of the Secretary
[Docket ID: DoD-2022-OS-0138]
Privacy Act of 1974; System of Records
AGENCY: Department of Defense (DoD).
ACTION: Notice of a new system of records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, the DoD is
establishing a new Department-wide system of records titled, ``Declared
Public Health Emergency Exposure Records,'' DoD-0013. This system of
records covers DoD's maintenance of records about individuals
necessitated by a declared public health emergency (DPHE) by an
appropriate official, including the Secretary of Health and Human
Services pursuant to the Public Health Services Act, a DoD official, or
other authorized state, local, or other governmental public health
official pursuant to applicable law. These records are maintained to
assist the DoD in establishing safe environments, identifying and
protecting DoD-affiliated individuals at risk of transmission of or
contracting the disease or agent at issue, and in supporting mission
readiness. Additionally, the DoD is issuing a direct final rule, which
is exempting this system of records from certain provisions of the
Privacy Act, elsewhere in today's issue of the Federal Register.
DATES: This system of records is effective upon publication; however,
comments on the Routine Uses will be accepted on or before January 17,
2023. The Routine Uses are effective at the close of the comment
period.
ADDRESSES: You may submit comments, identified by docket number and
title, by any of the following methods:
* Federal Rulemaking Portal: https://www.regulations.gov. Follow
the instructions for submitting comments.
* Mail: Department of Defense, Office of the Assistant to the
Secretary of Defense for Privacy, Civil Liberties, and Transparency,
Regulatory Directorate, 4800 Mark Center Drive, Attn: Mailbox 24, Suite
08D09, Alexandria, VA 22350-1700.
Instructions: All submissions received must include the agency name
and docket number for this Federal Register document. The general
policy for comments and other submissions from members of the public is
to make these submissions available for public viewing on the internet
at https://www.regulations.gov as they are received without change,
including any personal identifiers or contact information.
FOR FURTHER INFORMATION CONTACT: Ms. Rahwa Keleta, Defense Privacy and
Civil Liberties Division, Directorate for Privacy, Civil Liberties and
Freedom of Information, Office of the Assistant to the Secretary of
Defense for Privacy, Civil Liberties, and Transparency, Department of
Defense, 4800 Mark Center Drive, Mailbox #24, Suite 08D09, Alexandria,
VA 22350-1700; [email protected]; (703) 571-0070.
SUPPLEMENTARY INFORMATION:
I. Background
DoD is establishing the Declared Public Health Emergency Exposure
Records, DoD-0013 as a DoD-wide Privacy Act system of records. A DoD-
wide system of records notice (SORN) supports multiple DoD paper or
electronic recordkeeping systems operated by more than one DoD
component that maintain the same kind of information about individuals
for the same purpose. The establishment of DoD-wide SORNs helps DoD
standardize the rules governing the collection, maintenance, use, and
sharing of personal information in key areas across the enterprise.
DoD-wide SORNs also reduce duplicative and overlapping SORNs published
by separate DoD components. The creation of DoD-wide SORNs is expected
to make locating relevant SORNs easier for DoD personnel and the
public, and create efficiencies in the operation of the DoD privacy
program.
DoD prioritizes the safety of its workforce to ensure Department's
missions are able to be accomplished successfully at all times in
defense of the Nation. To do that, DoD must maintain operationally
ready capabilities, including operating within degraded environments
such as during a DPHE. Public health emergencies are varied; they may
be broad or limited in geographical scope and may be declared by
various authorities such as the Secretary of Health and Human Services
or the responsible, designated State, local, tribal, or territorial
official, or cognizant military commander. Responses to public health
emergencies depend on the nature of the emergency, but in some cases
the degraded environment created by the public health emergency may
require the DoD to collect personal information to ensure a safe and
secure workplace for employees and visitors to DoD facilities, and
ultimately, to ensure DoD is able to continue to carry out its mission.
DoD Instruction 6200.03, ``Public Health Emergency Management
within the DoD,'' establishes DoD policy for DPHE. This includes the
authority and responsibilities of DoD commanders and other officials
during a DPHE, and various activities that may be required to address
the emergency. For example, paragraph 3.1.d(1) provides that DoD
[[Page 77082]]
may need to initiate actions to collect and analyze data on the health
hazard causing the DPHE, and paragraph 3.1.d(3) provides that DoD may
need to act to ensure identification, interview, and tracking of all
individuals or groups suspected to have been exposed to the health
hazard to characterize the source and spread of the health hazard. In
carrying out these and other activities, DoD may collect and maintain
information about individuals that is subject to the Privacy Act and
therefore requires a SORN, but is not already covered by other DoD
SORNs. Examples of the types of data in records that may be uniquely
covered by this SORN include contact tracing data, which is the
identification and contact information of individuals suspected or
confirmed to have contracted a disease or illness, or exposed to an
individual suspected or confirmed to have contracted a disease or
illness, related to a DPHE; individual circumstances and dates of
suspected exposure; and health status information. The data may also
include information about individuals exposed to a public health threat
other than a communicable disease such as a radiological exposure or
the release of a toxin or chemical agents, related to a DPHE. This
system of records also supports the sharing of information that may
need to occur during a DPHE, such as sharing of exposure information
about individuals with public health authorities to support public
health goals, such as contact tracing and the reduction of the spread
of a health hazard.
The information covered by this system of records is separate and
unique from other DoD systems of records which contain records
maintained by DoD for accountability and assessment of DoD-affiliated
personnel, or created during the normal course of DoD's delivery of
occupational health and safety services, which DoD provides routinely
to members of the military and DoD civilians, and sometimes to DoD
visitors, concessionaires, and contractors. These records are covered
by other SORNs, and are specifically identified in the notice below for
clarity.
DoD maintains this information to ensure mission success through
the appropriate management and response to the public health emergency,
and to reduce the risk of disease or illness among DoD military and
civilian personnel, contractors, concessionaires, and visitors to DoD
facilities. The collection and use of records covered by this system of
records is only permitted during times of a declared public health
emergency.
Finally, the Health Insurance Portability and Accountability Act of
1996 (HIPAA) Rules, as amended by the Omnibus Final Rule, include the
HIPAA Privacy Rule, the HIPAA Breach Rule, the HIPAA Security Rule, and
the HIPAA Enforcement (Parts 160 and 164 of Title 45 CFR), permit a DoD
covered entity to use or disclose protected health information for
public health activities as noted in DoD Manual 6025.18. Under HIPAA,
``public health authority'' means an agency or authority of the United
States, a State, a territory, a political subdivision of a State or
territory, or an Indian tribe, or a person or entity acting under a
grant of authority from or contract with such public agency, including
the employees or agents of such public agency or its contractors or
persons or entities to whom it has granted authority, that is
responsible for public health matters as part of its official mandate.
45 CFR 164.501 (definition of ``public health authority''). The HIPAA
Rules only apply if the entity or individual that is disclosing
protected health information meets the definition of a HIPAA covered
entity or business associate. The records covered under this SORN are
not subject to the HIPAA Rules.
Additionally, the DoD is issuing a direct final rule to exempt this
system of records from certain provisions of the Privacy Act elsewhere
in today's issue of the Federal Register. DoD SORNs have been published
in the Federal Register and are available from the address in FOR
FURTHER INFORMATION CONTACT or at the Defense Privacy, Civil Liberties,
and Freedom of Information Directorate website at https://dpcld.defense.gov.
II. Privacy Act
Under the Privacy Act, a ``system of records'' is a group of
records under the control of an agency from which information is
retrieved by the name of an individual or by some identifying number,
symbol, or other identifying particular assigned to the individual. In
the Privacy Act, an individual is defined as a U.S. citizen or lawful
permanent resident.
In accordance with 5 U.S.C. 552a(r) and Office of Management and
Budget (OMB) Circular No. A-108, DoD has provided a report of this
system of records to the OMB and to Congress.
Dated: December 9, 2022.
Aaron T. Siegel,
Alternate OSD Federal Register Liaison Officer, Department of Defense.
SYSTEM NAME AND NUMBER:
Declared Public Health Emergency Exposure Records, DoD-0013.
SECURITY CLASSIFICATION:
Unclassified and classified.
SYSTEM LOCATION:
Department of Defense (Department or DoD), located at 1000 Defense
Pentagon, Washington, DC 20301-1000, and other Department
installations, offices, or mission locations. Information may also be
stored within a government-certified cloud, implemented and overseen by
the Department's Chief Information Officer (CIO), 6000 Defense
Pentagon, Washington, DC 20301-6000.
SYSTEM MANAGERS:
The system managers for this system of records are as follows:
A. Office of the Assistant Secretary of Defense for Health Affairs,
Under Secretary of Defense (Personnel and Readiness), 1000 Defense
Pentagon, Washington, DC 20301-1100.
B. Deputy Assistant Secretary of the Army, Office of the Surgeon
General, U.S. Army Medical Command, 2050 Worth Road, Suite 13, Fort Sam
Houston, TX 78234-6013.
C. Air Force Occupational Safety and Health (AFOSH), Department of
the Air Force, 1000 Defense Pentagon, Washington, DC 20301-1100,
[email protected]
D. Chief of Naval Personnel, Occupational and Environmental
Medicine, Navy & Marine Corps Public Health Center, 620 John Paul Jones
Circle, Suite 1100, Portsmouth, VA 23708-2103.
E. The Privacy Act responsibilities concerning access, amendment,
and disclosure of the records within this system of records have been
delegated to the DoD components. DoD components include the Military
Departments of the Army, Air Force (including the U.S. Space Force),
and Navy (including the U.S. Marine Corps), field operating agencies,
major commands, field commands, installations, and activities. To
contact the system managers at the DoD component with oversight of the
records, go to www.FOIA.gov to locate the contact information for each
component's Freedom of Information Act (FOIA) office.
[[Page 77083]]
AUTHORITY FOR MAINTAINANCE OF THIS SYSTEM:
10 U.S.C. 113, Secretary of Defense; 10 U.S.C. 136, Under Secretary
of Defense for Personnel and Readiness; 10 U.S.C. 2672, Protection of
Buildings, Grounds, Property, and Persons and Implementation of Section
2672 of Title 10, United States Code; E.O. 14043, Requiring Coronavirus
Disease 2019 Vaccination for Federal Employees; DoD Directive 5525.21,
Protection of Buildings, Grounds, Property, and Persons; DoDI 6200.03,
Public Health Emergency Management within the DoD; and DoDI 6055.17,
DoD Emergency Management Program; or successor DoD policies, and E.O.
9397, as amended.
Note 1: The records covered under this SORN, while covered by
the Privacy Act, are not subject to the HIPAA Rules.
PURPOSE(S) OF THE SYSTEM:
A. To support required or authorized activities during a declared
public health emergency, such as contact tracing and coordination with
medical and public health officials, for the purpose of maintaining
safe and healthy DoD environments, including work and training
environments, transportation facilities and vehicles, base housing,
retail and recreation areas, hospitals, and other health care
facilities.
B. To support the managing, monitoring, tracking, reporting and
sharing of records created during a declared public health emergency to
protect DoD Service members and their dependents, the civilian
workforce, contractors, concessionaires, and visitors to DoD
facilities.
C. To identify and protect individuals at risk for transmitting or
contracting a communicable disease related to a declared public health
emergency; to identify and protect those who may be at elevated risk of
symptomatic or severe disease from a public health threat, such as a
communicable disease or biohazard, or exposure to radiation, toxins, or
chemical agents; and to limit exposure to the source(s) of infection or
illness through public health mitigation and surveillance activities,
such as monitoring and contact tracing.
D. To support DoD and non-DoD health care personnel, including
public health officials, who need to collect, use, and review this
information in performance of their duties related to the public health
emergency or to delivering health care to affected individuals.
E. To support use of this information by other DoD officials to
determine mission readiness and conduct after-action reviews.
Statistical data instead of identifiable information will be used
wherever practicable for these efforts.
Note 2: A declared public health emergency may be limited or
broad in geographic scope, and could affect one, many, or all DoD
installations and facilities. This system of records may support
worldwide DoD public health emergency activities in the case of a
pandemic, or local or regional DoD activities in the case of a
geographically limited public health emergency.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
DoD military Service members (Active Duty, Guard/Reserve, and Coast
Guard personnel when acting as a military service with the Navy),
civilian personnel (including non-appropriated fund employees), DoD
spouses/dependents and cohabitants, military retirees, and DoD
contractors. Also, personnel of partner organizations, visitors,
eligible patrons, or concessionaires accessing or sharing DoD
facilities or attending DoD-sponsored events, and individuals residing
in military housing during a declared public health emergency,
including a pandemic.
CATEGORIES OF RECORDS IN THE SYSTEM:
A. Personal and Employment Information: name, Employee
Identification Number/DoD ID number, Social Security Number, date of
birth, gender, address, phone number(s), email(s), demographic or
biographical information, recent domestic and international travel and
status (e.g., Service member, dependent, civilian, contractor, visitor,
etc.); emergency contact information (emergency contact's name, phone
number, address, email address, and relationship to the individual);
employment information (title, organizational affiliation, duty
location); employment time and attendance records; disability
information; personnel accountability information (such as current work
status of the individual and affiliated leave status information).
B. Medical Information: confirmed medical test results, physician
assessment of medical transmission risk status (either for the
individual or because the individual cohabitates with others who may be
considered medically high-risk); medical diagnoses and prognosis
information; dates of medical visits or tests, individual symptoms;
potential or actual exposure to the public health threat (e.g.,
biohazard or communicable disease); medical history related to the
treatment of a virus or communicable disease essential to mitigate the
spread of disease during a public health emergency; immunizations and
vaccination information; medical directives and/or expressions of
interest in receiving a vaccine or other medical treatments, religious
or other objections to medical treatment; correspondence with
individuals or medical/family representatives on medical treatment;
medical, treatment, or disclosure consent forms;, medical or health
emergency notification forms.
C. Contact Tracing Information: proximity tracking information of
individuals after diagnosis or suspected exposure, to include dates
when the individual visited a DoD facility or attended a DoD-sponsored
event, the locations visited within the facility (e.g., floor, room
number), time duration spent in the facility, and identification of
persons in contact with while at the facility; records that indicate an
individual's location and/or proximity to others on DoD property or at
the event over time as compiled through either manual or through
technical means (such as badge access, office location, and information
technology system login information; and any other relevant information
completed, obtained, or developed as a result of an individual
attending, working or entering a DoD facility/event during a public
health emergency).
Note 3: Excluded from this system of records are employee
occupational medical records covered by the U.S. Office of Personnel
Management (OPM) regulation at 5 CFR part 293, subpart E, Employee
Medical File System Records. The regulation requires agencies that
are subject to OPM's recordkeeping requirements to maintain employee
occupational medical records in the agency's Employee Medical File
System. Such records are covered exclusively by the OPM/GOVT-10,
Employee Medical File System of Records.
Note 4: Excluded from this system of records are DoD
accountability and assessment records as described in DoD-0012,
Defense Accountability and Assessment Records SORN. Records in DoD-
0012 are collected and used to account for DoD-affiliated personnel
in a natural or man-made disaster, during a public health emergency,
or when directed by the Secretary of Defense. During a declared
public health emergency, DoD may collect and maintain records under
both the DoD-0012 SORN to support DoD accountability and assessment
for DoD-affiliated individuals, and this SORN to support contract
tracing and other authorized public health objectives necessitated
by the declared public health emergency.
RECORD SOURCE CATEGORIES:
Records and information stored in this system of records are
obtained from:
[[Page 77084]]
Individuals, healthcare personnel, entities designated as public health
authorities, and information systems maintaining data described in the
Categories of Records section above, such as DoD medical systems, DoD
human resources/personnel systems, DoD identity and credentialing
software for information technology systems; and visitor, security, and
access control systems for DoD facilities or locations where DoD-
sponsored events are held. When the individual is a minor or is
otherwise unable to provide information about themselves due to illness
or other incapacity, DoD may collect information from appropriate
sources such as family members, co-workers, friends, or co-habitants
for the purposes described in this notice.
ROUTINE USES AND RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b) of the Privacy Act of 1974, as amended, all or a portion of the
records or information contained herein may specifically be disclosed
outside the DoD as Routine Use pursuant to 5 U.S.C. 552a(b)(3) as
follows:
A. To contractors, grantees, experts, consultants, students, and
others performing or working on a contract, service, grant, cooperative
agreement, or other assignment for the Federal government when
necessary to accomplish an agency function related to this system of
records.
B. To the appropriate Federal, State, local, territorial, tribal,
foreign, or international law enforcement authority or other
appropriate entity where a record, either alone or in conjunction with
other information, indicates a violation or potential violation of law,
whether criminal, civil, or regulatory in nature.
C. To any component of the Department of Justice for the purpose of
representing the DoD, or its components, officers, employees, or
members in pending or potential litigation to which the record is
pertinent.
D. In an appropriate proceeding before a court, grand jury, or
administrative or adjudicative body or official, when the DoD or other
Agency representing the DoD determines that the records are relevant
and necessary to the proceeding; or in an appropriate proceeding before
an administrative or adjudicative body when the adjudicator determines
the records to be relevant to the proceeding.
E. To the National Archives and Records Administration for the
purpose of records management inspections conducted under the authority
of 44 U.S.C. 2904 and 2906.
F. To a Member of Congress or staff acting upon the Member's behalf
when the Member or staff requests the information on behalf of, and at
the request of, the individual who is the subject of the record.
G. To appropriate agencies, entities, and persons when (1) the DoD
suspects or confirms a breach of the system of records; (2) the DoD
determines as a result of the suspected or confirmed breach there is a
risk of harm to individuals, the DoD (including its information
systems, programs, and operations), the Federal government, or national
security; and (3) the disclosure made to such agencies, entities, and
persons is reasonably necessary to assist in connection with the DoD's
efforts to respond to the suspected or confirmed breach or to prevent,
minimize, or remedy such harm.
H. To another Federal agency or Federal entity, when the DoD
determines that information from this system of records is reasonably
necessary to assist the recipient agency or entity in (1) responding to
a suspected or confirmed breach or (2) preventing, minimizing, or
remedying the risk of harm to individuals, the recipient agency or
entity (including its information systems, programs and operations),
the Federal government, or national security, resulting from a
suspected or confirmed breach.
I. To another Federal, State or local agency for the purpose of
comparing to the agency's system of records or to non-Federal records,
in coordination with an Office of Inspector General in conducting an
audit, investigation, inspection, evaluation, or some other review as
authorized by the Inspector General Act of 1978, as amended.
J. To such recipients and under such circumstances and procedures
as are mandated by Federal statue or treaty.
K. To Federal, State, local, foreign, or international public
health agencies and officials, including the Centers for Disease
Control and Prevention, to the extent necessary to comply with laws or
policies governing reporting on the impact of a communicable disease,
agent, or other cause responsible for the declared public health
emergency.
L. To an emergency contact for purposes of locating an individual
to communicate possible exposure to or treatment options for a public
health threat such as a communicable disease or exposure to a
biohazard.
M. To the U.S. Department of State when it requires information to
consider or provide an informed response to a request for information
from a foreign, international, or intergovernmental agency, authority,
or organization about public health relating to DoD personnel,
facilities, or activities abroad.
N. To individuals for the purpose of determining if they have had
contact with a person known or suspected to have a communicable
disease, illness, or other exposure that requires quarantine, and to
identify and protect the health and safety of others who may have been
exposed.
O. To hospitals, physicians, and other healthcare providers for the
purpose of protecting the health and safety of individuals who may have
been exposed to a contagion or biohazard, or to assist such persons or
organizations in preventing exposure to or transmission of a
communicable disease.
P. To Federal, state, local, tribal, territorial, or foreign
governmental agencies; multilateral governmental organizations; medical
facilities or providers, or other public health entities, for the
purpose of protecting the vital interests of a record subject or other
persons, including to assist such agencies or organizations during an
epidemiological investigation, in facilitating continuity of care, or
in preventing exposure to or transmission of a communicable disease or
biohazard of public health significance.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records may be stored electronically or on paper in secure
facilities in a locked drawer behind a locked door. Electronic records
may be stored locally on digital media; in agency-owned cloud
environments; or in vendor Cloud Service Offerings certified under the
Federal Risk and Authorization Management Program (FedRAMP).
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records may be retrieved by an individual's name and/or individual
identification number, such as Social Security Number or DoD ID Number.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records are to be retained by the Office of the Secretary of
Defense, the Joint Staff, the Military Departments, the Defense
Agencies, and the Defense Field Activities in accordance with their
NARA-approved records retention schedules.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
DoD safeguards records in this system of records according to
applicable rules,
[[Page 77085]]
policies, and procedures, including all applicable DoD automated
systems security and access policies. DoD policies require the use of
controls to minimize the risk of compromise of personally identifiable
information (PII) in paper and electronic form and to enforce access by
those with a need to know and with appropriate clearances.
Additionally, DoD has established security audit and accountability
policies and procedures which support the safeguarding of PII and
detection of potential PII incidents. DoD routinely employs safeguards
such as the following to information systems and paper recordkeeping
systems: Multifactor log-in authentication including Common Access Card
(CAC) authentication and password; physical token as required; physical
and technological access controls governing access to data; network
encryption to protect data transmitted over the network; disk
encryption securing disks storing data; key management services to
safeguard encryption keys; masking of sensitive data as practicable;
mandatory information assurance and privacy training for individuals
who will have access; identification, marking, and safeguarding of PII;
physical access safeguards including multifactor identification
physical access controls, detection and electronic alert systems for
access to servers and other network infrastructure; and electronic
intrusion detection systems in DoD facilities.
Personal information maintained will be the minimum necessary and
only used for the purposes stated in this notice. Such information will
be retained for the minimum amount of time, remain accessible only to
personnel with a valid operational need, and only be used for the
public health emergency and no other purposes. These records may be
provided in aggregate for accountability and mission readiness
purposes, as long as the information may not be easily re-identified.
RECORD ACCESS PROCEDURES:
Individuals seeking access to their records should follow the
procedures in 32 CFR part 310. Individuals should address written
inquiries to the DoD component with oversight of the records, as the
component has Privacy Act responsibilities concerning access,
amendment, and disclosure of the records within this system of records.
The public may identify the contact information for the appropriate DoD
office through the following website: www.FOIA.gov. Signed written
requests should contain the name and number of this system of records
notice along with the full name, current address, and email address of
the individual. In addition, the requester must provide either a
notarized statement or an unsworn declaration made in accordance with
28 U.S.C. 1746, in the appropriate format:
If executed outside the United States: ``I declare (or certify,
verify, or state) under penalty of perjury under the laws of the United
States of America that the foregoing is true and correct. Executed on
(date). (Signature).''
If executed within the United States, its territories, possessions,
or commonwealths: ``I declare (or certify, verify, or state) under
penalty of perjury that the foregoing is true and correct. Executed on
(date). (Signature).''
CONTESTING RECORD PROCEDURES:
Individuals seeking to amend or correct the content of records
about them should follow the procedures in 32 CFR part 310.
NOTIFICATION PROCEDURES:
Individuals seeking to determine whether information about
themselves is contained in this system of records should follow the
instructions for Record Access Procedures above.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
The DoD has exempted records maintained in this system from 5
U.S.C. 552a(c)(3); (d)(1), (2), (3), and (4); (e)(1); (e)(4)(G), (H),
and (I); and (f) pursuant to 5 U.S.C. 552a(k)(1). In addition, when
exempt records received from other systems of records become part of
this system, the DoD also claims the same exemptions for those records
that are claimed for the prior system(s) of records of which they were
a part, and claims any additional exemptions set forth here. An
exemption rule for this system has been promulgated in accordance with
requirements of 5 U.S.C. 553(b)(1), (2), and (3), (c) and (e), and
published in 32 CFR part 310.
HISTORY:
None.
[FR Doc. 2022-27150 Filed 12-15-22; 8:45 am]
BILLING CODE 5001-06-P