Privacy Act of 1974; System of Records, 63109-63114 [2023-19875]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Administration for Children & Families

[Federal Register Volume 88, Number 177 (Thursday, September 14, 2023)]
[Notices]
[Pages 63109-63114]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-19875]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Administration for Children & Families


Privacy Act of 1974; System of Records

AGENCY: Office of Human Services Emergency Preparedness and Response 
(OHSEPR), Administration for Children & Families (ACF), Department of 
Health and Human Services (HHS).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS) is modifying 
a system of records maintained by the Administration for Children & 
Families (ACF), 09-80-0327 ORR Repatriation Program Records, to reflect 
the change ownership of the repatriation program that was transferred 
to ACF's Office of Human Services Emergency Preparedness and Response 
(OHSEPR), and to broaden the scope of the system of records to include 
functionally similar records that OHSEPR uses to identify, assess, and 
address immediate unmet human services (i.e., social services) needs of 
survivors of federally-declared disasters in the United States. To 
reflect the transfer and broadened scope, HHS is changing the name of 
the system of records to OHSEPR Repatriation and Disaster Human 
Services Case Management Records.

DATES: This modified system of records is applicable September 14, 
2023, subject to a 30-day period to comment on the new and revised 
routine uses. Submit any comments by October 16, 2023. The new and 
revised routine uses will become effective on October 16, 2023 unless 
the Department receives comments that would persuade us to modify the 
notice.

ADDRESSES: The public should address written comments on the proposed 
system of records to Anita Alford, Senior Official for Privacy, 
Administration for Children & Families by email, to 
[email protected].

FOR FURTHER INFORMATION CONTACT: General questions about the system of 
records may be submitted to the OHSEPR Deputy Director, Byron R. Mason, 
by telephone at (202) 365-8110 or by email to [email protected].

SUPPLEMENTARY INFORMATION: HHS established system of records 09-80-0327 
in 2016 to cover records about temporary assistance provided to 
repatriated U.S. citizens and their dependents under ACF's repatriation 
program, to meet the individuals' human service's needs. At that time, 
the repatriation program was administered by ACF's Office of Refugee 
Resettlement (ORR). In 2018, ACF transferred responsibility for the 
repatriation program to ACF's Office of Human Services Emergency 
Preparedness and Response (OHSEPR) that also administers ACF's disaster 
assistance program. Because the records used for both programs are 
functionally similar (i.e., they are case files documenting services 
provided to meet the individuals' human service's needs), HHS is 
broadening the scope of system of records 09-80-0327 to include

[[Page 63110]]

disaster assistance program records. The modifications include:
     Changing the name of the system of records to refer to 
OHSEPR instead of ORR and to reflect the expanded scope of the system 
of records.
     Updating the System Location and System Manager(s) 
sections to provide address and contact information for OHSEPR instead 
of ORR, and to add service provider and contractor locations to the 
System Location section.
     Revising the Authorities section to add authorities for 
the disaster assistance program, and to add a Social Security Number 
(SSN) collection authority that applies to the repatriation program 
only.
     Adding descriptions of disaster assistance program records 
throughout the SORN.
     Revising the Purpose(s) section to describe the primary 
purpose for repatriation program records used as ``making eligibility 
determinations before temporary assistance is provided;'' to add, as an 
additional secondary purpose for the use of repatriation program 
records, ``providing training and technical assistance to State human 
services departments and local services providers;'' to add purposes 
for disaster program records use; and to add a note at the end of the 
section stating that records of repatriation assistance to particular 
individuals are referred from this system of records to a separate 
system of records for debt management and collection purposes.
     Revising the Categories of Records section to describe the 
categories of records maintained for the repatriation program as case 
files containing correspondence, and to summarize the data elements 
contained in those records instead of listing them; to add categories 
of records maintained for the disaster assistance program; and to 
include a note explaining that records OHSEPR maintains as a result of 
providing disaster assistance services on behalf of another HHS 
component or another agency are not covered by this SORN.
     Specifying, in the Record Source Categories section the 
sources that apply to the repatriation program or both programs.
     Adding and revising routine uses, and removing unnecessary 
routine uses, as follows. A note has been added, stating that a routine 
use applies to both the repatriation program and the disaster 
assistance programs unless worded to apply to only one of those 
programs.
    Revised routine uses:
    [cir] Routine use 1, Disclosure to Contractors, Grantees, and Other 
Agents (4 in the existing SORN), has been revised to add ``(including 
another federal agency acting as a service provider),'' ``other 
agencies,'' and ``OHSEPR'' and will now apply to the disaster 
assistance program too.
    [cir] Routine use 2, Disclosure to Department of State (1 in the 
existing SORN), has been revised to add ``to repatriates'' to correct a 
typographical error.
    [cir] Routine use 4, Disclosure to Service Provider (3 in the 
existing SORN), has been revised to add ``for eligible repatriates'' 
and to change ``services'' to ``assistance.''
    [cir] Routine use 5 (4 in the existing SORN), is now titled 
Disclosure to Agency for Temporary Assistance (instead of Disclosure to 
Agency for Temporary Services), and the word ``services'' in the text 
of the routine use has been changed to ``assistance.''
    [cir] Routine use 6, Disclosure for Law Enforcement Purposes (5 in 
the existing SORN), will now apply to the disaster assistance program 
too.
    [cir] Routine use 7, Disclosure for Administrative Claim, 
Complaint, and Appeal (13 in the existing SORN), has been revised to 
add ``about a repatriation assistance recipient.''
    [cir] Routine use 8 (15 in the existing SORN), is now titled 
Disclosure in Connection with Settlement Discussions (instead of 
Disclosure in Connection with Litigation), and it has been revised to 
be limited to settlement discussions to avoid duplicating a litigation-
related routine use and to add ``about a repatriation assistance 
recipient.''
    [cir] Routine use 12, Disclosure for Private Relief Legislation (8 
in the existing SORN), has been revised to add ``about a repatriation 
assistance recipient.''
    [cir] Routine use 13, Disclosure to Congressional Office (9 in the 
existing SORN), will now apply to the disaster assistance program too.
    [cir] Routine use 14, Disclosure to Department of Justice or in 
Proceedings (10 in the existing SORN), has been revised to omit 
redundant wording that repeated part of the definition of a routine use 
(i.e., ``provided that the disclosure is compatible with the purpose 
for which the records were collected''), and will now apply to the 
disaster assistance program too.
    [cir] Routine use 15, Disclosure to the National Archives and 
Records Administration (11 in the existing SORN), has been revised to 
add ``conducted pursuant to 44 U.S.C. 2904 and 2906'' and will now 
apply to the disaster assistance program too.
    [cir] Routine uses 16 and 17, Disclosure in the Event of a Security 
Breach Experienced by HHS, and Disclosure to Assist Another Agency 
Experiencing a Breach (16 and 18 in the existing SORN), which were 
added to the SORN in February 2018, will now apply to the disaster 
assistance program too.
    [cir] Routine use 18, Disclosure for Cybersecurity Monitoring 
Purposes (17 in the existing SORN), will now apply to the disaster 
assistance program too.
    New routine uses:
    [cir] Routine uses 9 and 10, Disclosure to Ensure Continuity of 
Disaster Assistance Services and Disclosure to Locate Missing Children 
or Reunite Families, have been added for the disaster assistance 
program.
    [cir] Routine use 11, Disclosure to Combat Fraud, Waste, and Abuse, 
has been added for both the repatriation program and the disaster 
assistance program.
    Deleted routine uses:
    [cir] Routine uses formerly numbered as 6, 7, and 14, Disclosure 
Incident to Requesting Information; Disclosure for Employee Retention, 
Security, Contract, or Other Benefit; and Disclosure to the Office of 
Personnel Management, were determined to be unnecessary and are now 
omitted, because such disclosures are not made from this system of 
records.
     Removing the section titled Disclosure to Consumer 
Reporting Agencies, because such disclosures are not made by ACF/OHSEPR 
from this system of records. Such disclosures are made by HHS' Program 
Support Center from the system of records that covers records used for 
debt management and collection purposes.
     Revising the Storage section to describe the storage media 
as hard copy files, electronic storage media, and cloud/network 
storage, instead of stating that the records are stored on a grantee's 
computer network and safe/file cabinet.
     Revising the Retrieval section to add that disaster 
assistance case records are retrieved by the individual's name or case 
file number.
     Revising the Retention section to cite the disposition 
schedule and retention periods applicable to records about disaster 
survivors.
     Revising the Safeguards section to describe the particular 
administrative, technical, and physical safeguards used to prevent 
unauthorized access to the records, instead of simply stating that 
safeguards conform to the HHS Information Security Program; and to 
mention ``grantees'' in addition to contractors.
     Updating the procedures for making access, correction, and 
notification

[[Page 63111]]

requests no longer require requests to include the subject individual's 
social security number, and to now state that requests should identify 
either the repatriation program or the applicable disaster, to assist 
OHSEPR in locating the records.
    Because this modification includes significant changes, HHS 
provided advance notice of the modified system of records to the Office 
of Management and Budget and Congress as required by 5 U.S.C. 552a(r) 
and OMB Circular A-108.

Natalie N. Grant,
Director, Office of Human Services Emergency Preparedness and Response.

SYSTEM NAME AND NUMBER:
    OHSEPR Repatriation and Disaster Human Services Case Management 
Records, 09-80-0389.

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    The address of the agency component responsible for this system of 
records is Administration for Children & Families (ACF), Office of 
Human Services Emergency Preparedness and Response (OHSEPR), 330 C 
Street SW--4th Floor, Washington, DC 20201.
    On behalf of ACF, a grantee located in Baltimore MD stores ACF's 
repatriation program records in a cloud-based system. A contractor and 
subcontractor located in Washington, DC manage ACF's disaster 
assistance database housed on an ACF server.

SYSTEM MANAGER(S):
    The System Manager is: OHSEPR Repatriation Specialist, HHS, ACF, 
Office of Human Services Emergency Preparedness and Response (OHSEPR), 
330 C Street SW--4th Floor, Washington, DC 20201; [email protected].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Authority to maintain repatriation assistance records: 42 U.S.C. 
1313 (Assistance for United States citizens returned from foreign 
countries) and 24 U.S.C. 321-329 (Hospitalization of mentally ill 
nationals returned from foreign countries).
    Authority to collect Social Security Number (SSN) (applicable to 
the repatriation program only): 31 U.S.C. 7701(c) requires an agency to 
collect the taxpayer identifying number of individuals ``doing business 
with a federal agency,'' one example of which is being ``in a 
relationship with the agency that may give rise to a receivable due to 
that agency.'' Receiving temporary assistance--which is defined in 42 
U.S.C. 1313(c) as money payments, medical care, temporary lodging, 
transportation, and other goods and services necessary for the health 
or welfare of individuals--and is provided to repatriates in the form 
of a service loan repayable to the U.S. Government, fits that example 
and therefore qualifies as ``doing business with a Federal agency.'' 
For purposes of 31 U.S.C. 7701(c), the taxpayer identifying number is 
the individual's social security number (SSN).
    Authority to maintain disaster assistance records: Statement of 
Organization, Functions, and Delegations of Authority, 71 FR 71549 
(Dec. 11, 2006); E.O. 12656, 53 FR 47491 (Nov. 18, 1988), reprinted in 
42 U.S.C. 5195.

PURPOSE(S) OF THE SYSTEM:
    The purpose of the system of records is to enable OHSEPR to provide 
assistance in an efficient and expeditious manner to repatriated U.S. 
citizens and their dependents and to disaster survivors. Specifically:
     Records for the repatriation program are used by OHSEPR 
for the primary purposes of making eligibility determinations before 
temporary assistance is provided to U.S. citizens and their dependents 
who are without available resources in the U.S. upon their arrival from 
abroad and for up to 90 days after their arrival, not exceeding 90 days 
as may be provided in regulations of the Secretary of HHS and 
supporting repayment of assistance allocable to individual recipients. 
Temporary assistance may include money payments, medical care, 
temporary billeting, transportation, and other goods and services 
necessary for the health or welfare of individuals (including guidance, 
counseling, and other welfare services). All temporary assistance 
provided under the repatriation program and allocable to individual 
recipients is repayable to the Federal Government. OHSEPR may use the 
records for the secondary purpose of providing training and technical 
assistance to State human services departments and local services 
providers, in addition to creating aggregate datasets to use in 
monitoring and assessing the effectiveness of the repatriation program.
     Records for the disaster assistance program are used by 
OHSEPR for the primary purpose of identifying, assessing, and 
addressing immediate, unmet disaster-caused human services needs of 
survivors of federally declared disasters. Disaster assistance may 
include conducting intake assessments and referrals, providing outreach 
and triage, developing a Disaster Survivor Recovery Plan, and 
connecting the disaster survivor to resources that are locally 
available. OHSEPR may use the records for the secondary purposes of 
creating aggregate datasets to use in providing financial assistance to 
State or local government agencies or qualified private organizations 
assisting survivors, building local disaster case management capacity 
through the provision of training and technical assistance to States, 
Tribes, Territories, and local governments, and monitoring and 
assessing the effectiveness of the disaster assistance program.

    Note: OHSEPR will refer records from this system of records 
about temporary assistance allocable to individuals receiving 
repatriation assistance that is repayable to the Federal Government, 
to the Program Support Center within the Office of the Assistant 
Secretary for Administration for debt management and collection 
purposes. Records used for debt management and collection purposes 
are maintained under SORN 09-40-0012, Debt Management and Collection 
Records, and may be used and disclosed for the purposes described in 
that SORN.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The categories of individuals covered by this system are:
     U.S. citizens and their dependents who are receiving 
temporary assistance and are identified by the Department of State as 
having returned or been brought from a foreign country to the U.S. 
because of destitution, illness, war, threat of war, or a similar 
crisis.
     Survivors of disasters who reside within a jurisdiction 
included in federally declared disaster or emergency and apply for 
disaster assistance under an HHS authority (e.g., not under a Federal 
Emergency Management Agency (FEMA) authority).

CATEGORIES OF RECORDS IN THE SYSTEM:
    The categories of records are:
     Case files containing correspondence about repatriated 
U.S. citizens and their dependents receiving temporary assistance. 
Information about a repatriate may include full name, current mailing 
address, social security number, passport number, date and place of 
birth, dependents, and information about any medical care, temporary 
billeting, transportation, or other goods and services (e.g., food, 
clothing) necessary for the health or welfare of the individual 
(including guidance, counseling, and other welfare services) that was 
furnished to the individual.
     Case files about disaster survivors who apply for disaster 
assistance under

[[Page 63112]]

an HHS (e.g., not FEMA) authority. (Note that these files are separate 
and apart from those maintained in performing Immediate Disaster Case 
Management (IDCM) pursuant to a Mission Assignment agreement with 
FEMA.) The files include intake assessment records, resource referral 
lists, case notes, status reports, and recovery plans. Information 
about a disaster survivor may include disaster number, full name, 
current mailing address, date of birth, transitional housing location 
type, transitional housing mailing address, damaged dwelling mailing 
address, damaged county, location at time of registration, phone 
numbers, email addresses, homeowners insurance coverage details 
(including flood coverage), details on health care coverage, household 
size, household composition and member ages, details on damage to real 
and personal property, degree of total damage incurred, self-reported 
income, assistance sought, assistance received, source of assistance, 
persons residing in a dwelling, Federal disaster assistance referral 
status, and status of access and functional, and/or emergency needs.
    Note that this system of records does not include the following 
records:
     Records of immediate disaster case management services 
that OHSEPR provides on behalf of another component of HHS or another 
agency. For example, pursuant to an interagency agreement, OHSEPR 
provides immediate disaster case management (IDCM) services on behalf 
of the Department of Homeland Security, FEMA (DHS/FEMA), under mission 
assignments from DHS/FEMA. Records of those services are covered under 
a FEMA SORN; currently, DHS/FEMA-008 Disaster Recovery Assistance Files 
System of Records.
     Disaster response records maintained by another component 
of HHS, such as the records maintained by the Office of the Assistant 
Secretary for Preparedness and Response (ASPR) under SORNs 09-90-0039 
National Disaster Claims Processing System, and 09-90-0040 National 
Disaster Medical System (NDMS) Disaster Medical Information Suite 
(DMIS).

RECORD SOURCE CATEGORIES:
    Information in repatriation program records is received directly 
from the subject individual (i.e., client) or from a member of the 
client's or client's family or household, or a relative or 
representative of the client, or may be provided by other governmental 
entities (e.g., Federal, State, local, or Tribal agencies) and local 
service providers, international agencies, foreign governments, 
employers, health care institutions, and public information sources.
    Information in disaster assistance program records is received 
directly from the subject individual (i.e., client) or from a member of 
the client's or client's family or household, or a relative or 
representative of the client, or may be provided by other governmental 
entities (e.g., Federal, State, local, or Tribal agencies) and social 
service organizations.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    In addition to other disclosures permitted under 5 U.S.C. 
552a(b)(1) and (2) and (4) through (11), OHSEPR may disclose a record 
about an individual from this system of records to parties outside HHS 
as provided in these routine uses, which are published pursuant to 5 
U.S.C. 552a(b)(3). A routine use applies to both the repatriation 
program and the disaster assistance program, unless worded to apply to 
only one of those programs. Each proposed disclosure of information 
under these routine uses will be evaluated to ensure that the 
disclosure is legally permissible, including but not limited to 
ensuring that the purpose of the disclosure is compatible with the 
purpose for which the information was collected.
    1. Disclosure to Contractors, Grantees, and Other Agents. Records 
may be disclosed to contractors (including another Federal agency 
acting as a service provider), grantees, consultants, volunteers, or 
other agents of OHSEPR who are assisting OHSEPR with the accomplishment 
of an OHSEPR function relating to the purposes of this system of 
records and need to have access to the records in order to provide the 
assistance.
    2. Disclosure to Department of State. Records about a repatriation 
assistance applicant may be disclosed to the Department of State in 
connection with determinations of eligibility, referral, planning, and 
provision of temporary assistance of or to repatriates in cases 
referred to HHS.
    3. Disclosure to States. Records about a repatriation assistance 
applicant may be disclosed to the States in connection with 
coordination and/or provision of temporary services for eligible 
repatriates.
    4. Disclosure to Service Provider. Records about a repatriation 
assistance applicant may be disclosed to providers of services (e.g., 
community-based organizations, hospitals) and to local State 
institutions (e.g., courts and social service agencies) that assist in 
coordination and/or the provision of temporary assistance for eligible 
repatriates.
    5. Disclosure to Agency for Temporary Assistance. Records about a 
repatriation assistance applicant may be disclosed to other Federal 
agencies and nongovernmental agencies for planning or provision of 
temporary assistance to eligible repatriates. Federal agencies include 
but are not limited to Department of State, Department of Defense, 
Department of Justice, Department of Homeland Security, Department of 
Housing and Urban Development, Federal Emergency Management Agency, 
Department of Agriculture, and United States Department of 
Transportation. Nongovernmental agencies include but are not limited to 
American Red Cross and Salvation Army.
    6. Disclosure for Law Enforcement Purposes. Records may be 
disclosed to the appropriate Federal, State, local, Tribal, or foreign 
agency responsible for investigating, prosecuting, enforcing, or 
implementing a statute, rule, regulation, or order, if the information 
is relevant to a violation or potential violation of civil or criminal 
law or regulation within the jurisdiction of the receiving entity.
    7. Disclosure for Administrative Claim, Complaint, and Appeal. 
Records about a repatriation assistance recipient may be disclosed to 
an authorized appeal grievance examiner, formal complaints examiner, 
equal employment opportunity investigator, arbitrator or other person 
properly engaged in investigation or settlement of an administrative 
grievance, complaint, claim, or appeal filed by an employee, but only 
to the extent that the information is relevant and necessary to the 
proceeding. Agencies that may obtain information under this routine use 
include, but are not limited to, the Office of Personnel Management, 
Office of Special Counsel, Merit Systems Protection Board, Federal 
Labor Relations Authority, Equal Employment Opportunity Commission, and 
Office of Government Ethics.
    8. Disclosure in Connection with Settlement Discussions. Records 
about a repatriation assistance recipient may be disclosed in 
connection with settlement discussions regarding claims by or against 
HHS, including public filing with a court, to the extent that 
disclosure of the information is relevant and necessary to the 
litigation or discussions.
    9. Disclosure to Ensure Continuity of Disaster Assistance Services. 
Records about a disaster assistance applicant

[[Page 63113]]

may be disclosed to DHS/FEMA pursuant to an interagency sharing and 
access agreement and to the State, local, Tribal, or Territorial 
departments of human services to ensure continuity of services for each 
disaster survivor.
    10. Disclosure to Locate Missing Children or Reunite Families. 
Records about a disaster assistance applicant may be disclosed to a 
Federal or State law enforcement authority, Federal or State agency, or 
private organization authorized to investigate, coordinate, or locate 
missing children and/or reunite families.
    11. Disclosure to Combat Fraud, Waste, and Abuse. Records may be 
disclosed to another Federal agency, or instrumentality of any 
governmental jurisdiction, within or under the control of the United 
States (including the-State or local governmental agency) that 
administers or has the authority to investigate potential fraud, waste, 
or abuse in federally funded programs when reasonably necessary by HHS 
to prevent, deter, discover, detect, investigate, or sue with respect 
to defend against, correct, remedy, or otherwise combat fraud, waste or 
abuse in such programs.
    12. Disclosure for Private Relief Legislation. Records about a 
repatriation assistance recipient may be disclosed to the Office of 
Management and Budget at any stage in the legislative coordination and 
clearance process in connection with private relief legislation as set 
forth in OMB Circular A-19.
    13. Disclosure to Congressional Office. Records may be disclosed to 
a congressional office from the record of an individual in response to 
a written inquiry from the congressional office made at the written 
request of the individual.
    14. Disclosure to Department of Justice or in Proceedings. Records 
may be disclosed to the Department of Justice (DOJ), or in a proceeding 
before a court, adjudicative body, or other administrative body before 
which HHS is authorized to appear, when:

     HHS, or any component thereof; or
     Any employee of HHS in his or her official capacity; or
     Any employee of HHS in his or her individual capacity 
where DOJ or HHS has agreed to represent the employee; or
     The United States, if HHS determines that the litigation 
is likely to affect HHS or any of its components,

    is a party to the litigation or has an interest in the litigation 
and the use of the records by DOJ or HHS is deemed by HHS to be 
relevant and necessary to the litigation.

    15. Disclosure to the National Archives and Records Administration. 
Records may be disclosed to representatives of the National Archives 
and Records Administration (NARA) in records management inspections 
conducted pursuant to 44 U.S.C. 2904 and 2906.
    16. Disclosure in the Event of a Security Breach Experienced by 
HHS. Records may be disclosed to appropriate agencies, entities, and 
persons when (1) HHS suspects or has confirmed that there has been a 
breach of the system of records; (2) HHS has determined that as a 
result of the suspected or confirmed breach there is a risk of harm to 
individuals, the agency (including its information systems, programs 
and operations), the Federal Government, or national security; and (3) 
the disclosure made to such agencies, entities, and persons is 
reasonably necessary to assist in connection with HHS' efforts to 
respond to the suspected or confirmed breach or to prevent, minimize, 
or remedy such harm.
    17. Disclosure to Assist Another Agency Experiencing a Breach. 
Records may be disclosed to another Federal agency or Federal entity, 
when HHS determines that information from this system of records is 
reasonably necessary to assist the recipient agency or entity in (1) 
responding to a suspected or confirmed breach or (2) preventing, 
minimizing, or remedying the risk of harm to individuals, the recipient 
agency or entity (including its information systems, programs, and 
operations), the Federal Government, or national security, resulting 
from a suspected or confirmed breach.
    18. Disclosure for Cybersecurity Monitoring Purposes. Records may 
be disclosed to the DHS if captured in an intrusion detection system 
used by HHS and DHS pursuant to a DHS cybersecurity program that 
monitors internet traffic to and from Federal Government computer 
networks to prevent a variety of types of cybersecurity incidents.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records are stored in hard copy files, electronic storage media, 
and cloud/network storage.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Disaster assistance case records are retrieved by the individual's 
name or case file number. Repatriate case records are retrieved by the 
individual's name, case file number, or social security number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records about individuals receiving repatriation assistance are 
retained and disposed of in accordance with NARA-approved disposition 
schedule N1-292-93-1, as follows:
     Files are transferred to a Federal records center one year 
after termination of collection efforts and are destroyed five years 
after termination of collection efforts.
    Records about disaster survivors are disposed of in accordance with 
NARA-approved disposition schedule DAA-0292-2019-0001, as follows:
     Database intake assessment records: Cut off at the end of 
the calendar year, following the end of a disaster mission; Destroy 10 
years after cutoff.
     Resource referral list: Cut off at the end of the calendar 
year, following the end of a disaster mission; Destroy 10 years after 
cutoff.
     Disaster Survivor Recovery Plans: Cut off at the end of 
the calendar year, following the end of a disaster mission; Destroy 3 
years after cutoff.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    Safeguards conform to the HHS Information Security and Privacy 
Program, https://www.hhs.gov/ocio/securityprivacy/. 
Information is safeguarded in accordance with applicable laws, rules 
and policies, including the HHS Information Technology Security Program 
Handbook, the E-Government Act of 2002 that includes the Federal 
Information Security Management Act of 2002 (FISMA), 44 U.S.C. 3541-
3549, as amended by the Federal Information Security Modernization act 
of 2014, 44 U.S.C. 3551-3558, all pertinent National Institutes of 
Standards and Technology (NIST) publications; and OMB Circular A-130, 
Managing Information as a Strategic Resource. Records are protected 
from unauthorized access through appropriate administrative, physical, 
and technical safeguards. These safeguards include requiring 
contractors and grantees to maintain confidentiality throughout the 
case management process by assuring that client records are kept in a 
safe, secure environment within contractor or grantee facilities. All 
direct contractor or grantee staff are required to sign a 
confidentiality agreement and to receive training on security, privacy, 
and confidentiality policies and procedures, including methods of 
protecting client confidentiality. Client records are filed according 
to OHSEPR protocols and access to records is controlled through

[[Page 63114]]

log-in/out processes for both computer and paper files.
    Case managers, should they need to use paper records into the 
field, will take only those records needed to complete field 
activities, and all paper files will be kept in a locking file box 
while in transport and kept in a controlled facility when not being 
directly used for case management functions. Records in electronic 
format are accessible only to authorized users using two-factor 
authentication and password protection through a secured system 
protected by encryption, firewalls, and intrusion detection systems 
that require additional encryption for records stored on removable 
media. Records that become eligible for destruction are disposed of in 
alignment with the destruction methods prescribed by the NIST Special 
Publication (SP) 800-88. The associated information technology (IT) 
system(s) receive Authority to Operate (ATO) under the guidance of NIST 
SP 800-37.

RECORD ACCESS PROCEDURES:
    Individuals seeking access to records about them in this system of 
records must submit a written access request to the System Manager 
identified in the ``System Manager(s)'' section of this SORN, in 
accordance with the Department's Privacy Act implementation regulations 
in 45 CFR. The request must contain the requester's full name, address, 
telephone number and/or email address, date and place of birth, and 
signature, and should identify the repatriation program or the 
applicable disaster, or otherwise provide enough information to enable 
OHSEPR to locate the requested records.
    So that HHS may verify the requester's identity, the requester's 
signature must be notarized or the request must include the requester's 
written certification that the requester is the individual who the 
requester claims to be and that the requester understands that the 
knowing and willful request for or acquisition of a record pertaining 
to an individual under false pretenses is a criminal offense subject to 
a fine of up to $5,000.
    You may request that a copy of the record be sent to you, or you 
may request an appointment to review the record in person (including 
with a person of your choosing, if you provide written authorization 
for agency personnel to discuss the record in that person's presence). 
You may also request an accounting of disclosures that have been made 
of the record, if any.

CONTESTING RECORDS PROCEDURES:
    Individuals seeking to amend records about them in this system of 
records must submit a written amendment request to the System Manager 
identified in the ``System Manager(s)'' section of this SORN, in 
accordance with the Department's Privacy Act implementation regulations 
in 45 CFR. The request must contain the same information required for 
an access request. The request must include verification of the 
requester's identity in the same manner required for an access request; 
must reasonably identify the record and specify the information 
contested, the corrective action sought, and the reasons for requesting 
the correction; and should include supporting information to show how 
the record is factually inaccurate, incomplete, untimely, or 
irrelevant.

NOTIFICATION PROCEDURES:
    Individuals who wish to know if this system contains records about 
them should submit a written notification request to the System Manager 
identified in the ``System Manager(s)'' section of this SORN, in 
accordance with the Department's Privacy Act implementation regulations 
in 45 CFR. The request must contain the same information required for 
an access request and must include verification of the requester's 
identity in the same manner required for an access request.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    81 FR 46687 (July 18, 2016), 83 FR 6591 (Feb. 14, 2018).

[FR Doc. 2023-19875 Filed 9-13-23; 8:45 am]
BILLING CODE 4184-01-P