Privacy Act; Implementation, 48536-48540 [2024-12469]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 89, Number 111 (Friday, June 7, 2024)]
[Proposed Rules]
[Pages 48536-48540]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-12469]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 5b

[Docket Number NIH-2022-0002]
RIN 0925-AA69


Privacy Act; Implementation

AGENCY: National Institutes of Health (NIH), Department of Health and 
Human Services (HHS).

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: In accordance with subsections (j)(2) and (k)(2) of the 
Privacy Act of 1974, as amended (the Privacy Act or the Act), the 
Department of Health and Human Services (HHS or Department) is 
proposing to exempt a new system of records maintained by the National 
Institutes of Health (NIH), System No. 09-25-0224, ``NIH Police 
Records,'' from certain requirements of the Act. The new system of 
records will cover criminal and non-criminal law enforcement 
investigatory material maintained by the NIH Division of Police, a 
component of NIH which performs criminal law enforcement as its 
principal function. The exemptions are necessary and appropriate to 
protect the integrity of law enforcement proceedings and records 
compiled in the course of NIH Division of Police activities, prevent 
disclosure of investigative techniques, and protect the identity of 
confidential sources involved in those activities. Elsewhere in the 
Federal Register, HHS/NIH has published a System of Records Notice 
(SORN) for System No. 09-25-0224 for public notice and comment which 
describes the new system of records in more detail.

DATES: Submit either electronic or written comments regarding this 
document by August 6, 2024.

ADDRESSES: Submit comments, identified by Docket No NIH-2022-0002, by 
any of the following methods:

Electronic Submissions

    Submit electronic comments in the following way:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.

Written Submissions

    Submit written submissions in the following ways:
     Fax: 301-402-0169 (not a toll-free number).
     Mail: Daniel Hernandez, NIH Regulations Officer, Office of 
Management Assessment, National Institutes of Health, 6705 Rockledge 
Drive, (RK1) 601-U, Rockville, MD 20892-7901.
    To ensure timelier processing of comments, HHS/NIH is no longer 
accepting comments submitted to the agency by email. HHS/NIH encourages 
you to continue to submit electronic comments by using the Federal 
eRulemaking Portal, as described previously, in the ADDRESSES portion 
of this document under Electronic Submissions.
    Instructions: All submissions received must include the agency name 
and Docket No. for this rulemaking. All comments received may be posted 
without change to https://www.regulations.gov, including any personal 
information provided.
    Docket: For access to the docket to read background documents or 
comments received, go to https://www.regulations.gov and follow the 
instructions provided for conducting a search, using the docket 
number(s) found in brackets in the heading of this document.

FOR FURTHER INFORMATION CONTACT: General questions about the exemptions 
may be submitted to Daniel Hernandez, NIH Regulations Officer, Office 
of Management Assessment, National Institutes of Health, 6705 Rockledge

[[Page 48537]]

Drive, (RK1) 601-U, Rockville, MD 20892-7901, telephone 301-496-4607, 
fax 301-402-0169, email [email protected].

SUPPLEMENTARY INFORMATION:

I. Background on the NIH Police Division and New System of Records 09-
25-0224

    Elsewhere in the Federal Register, HHS/NIH has published notice of 
its establishment of a new system of records 09-25-0224, ``NIH Police 
Records.'' The purpose of this rulemaking is to exempt that system of 
records from certain requirements of the Privacy Act as permitted by 5 
U.S.C. 552a(j)(2) and (k)(2). The new system of records will cover 
records maintained by the NIH Division of Police, Office of Research 
Services (ORS), in the NIH Office of the Director. The Division of 
Police was established in 1968 to provide an immediate and primary law 
enforcement program for the NIH and derives its authority from 
Memorandum from the Assistant Secretary for Administration, OS, to the 
Director, NIH, June 13, 1968; Memorandum from the Assistant Secretary 
for Administration, OS, to the Director, NIH, June 13, 1968, entitled: 
Delegation of Authority to Assist in Controlling Violations of Law at 
Certain HEW Facilities Located in Montgomery County, Maryland; 40 
U.S.C. 1315 (Law enforcement authority of Secretary of Homeland 
Security for protection of public property; a Department of Homeland 
Security (DHS) delegation of authority to HHS/NIH; and an NIH 
delegation of authority to the NIH Division of Police); General 
Administrative Delegation of Authority Number 08, Control of Violations 
of Law at Certain NIH Facilities (Sept. 1, 2020). Based on that 
establishing authority, the Division of Police performs criminal law 
enforcement as its principal function. However, the Division of Police 
conducts both criminal and non-criminal (e.g., civil, administrative, 
regulatory) law enforcement investigations.
    The NIH Division of Police is directly responsible for the 
provision of daily law enforcement and criminal and civil investigative 
activities required to protect the life, safety, and property of NIH 
employees, contractors, patients, and visitors at NIH. To perform these 
responsibilities, the NIH Division of Police compiles and maintains 
records of complaints of incidents, inquiries, investigative findings, 
arrest records, and court dispositions which are retrieved by personal 
identifiers and therefore constitute a ``system of records'' as defined 
by the Privacy Act at 5 U.S.C. 552a(a)(5). The primary purposes for 
which the records are used are to: (1) record incidents of crime, civil 
disturbance, and traffic accidents on the NIH enclave, and the 
investigation of such incidents; (2) maintain information essential to 
the protection of life, safety, and property at NIH; (3) provide 
official records of law enforcement investigative efforts for use in 
administrative, criminal and/or civil proceedings; and (4) document 
criminal and civil law enforcement investigations.

II. Eligible Records and Exemptions

    The new system of records will include both criminal and non-
criminal (e.g., civil, administrative, regulatory) law enforcement 
investigatory records which will be retrieved by subject individuals' 
personal identifiers. Such records are eligible to be exempted from 
certain Privacy Act requirements, as follows:
     Subsection (j)(2) of the Privacy Act (5 U.S.C. 552a(j)(2)) 
allows an agency head to exempt from certain Privacy Act provisions a 
system of records maintained by the agency or component thereof which 
performs as its principal function any activity pertaining to the 
enforcement of criminal laws.
     Subsection (k)(2) of the Act (5 U.S.C. 552a(k)(2)) allows 
an agency head to exempt from certain Privacy Act provisions a system 
of records containing investigatory material compiled for law 
enforcement purposes, other than material within the scope of 
subsection (j)(2) (for example, material compiled for a civil, 
administrative, or regulatory law enforcement purpose, or material 
compiled for a criminal law enforcement purpose by an agency component 
that does not perform criminal law enforcement as its principal 
function). This exemption's effect on the subject individual's access 
rights is qualified in that if any individual is denied any right, 
privilege, or benefit to or for which the individual otherwise would be 
entitled by Federal law, or for which the individual would otherwise be 
eligible, as a result of the maintenance of the system of records, the 
individual must be provided the requested materials except to the 
extent that disclosure would reveal the identity of a source who 
furnished information to the Government under an express promise that 
the identity of the source would be held in confidence.
    HHS/NIH is establishing the following exemptions for the records:
     Based on 5 U.S.C. 552a(k)(2), HHS/NIH is exempting non-
criminal (e.g., civil, administrative, regulatory) law enforcement 
investigatory material in System No. 09-25-0224 from the requirements 
in subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through 
(I), and (f) of the Privacy Act, which require the agency to provide an 
accounting of disclosures; provide notification, access, and amendment 
rights; maintain only relevant and necessary information authorized by 
a statute or Executive order; establish and describe procedures whereby 
an individual can be notified if a system of records contains 
information pertaining to that individual and how to gain access to 
pertinent records; identify categories of record sources; and 
promulgate rules regarding these procedures. The effect of this 
exemption on a subject individual's access rights will be limited as 
required by subsection (k)(2) to information that would reveal the 
identity of a source who was expressly promised confidentiality in 
cases in which maintenance of the records results in denial of a 
Federal right, privilege, or benefit to or for which the individual 
would otherwise be entitled or eligible.
     Based on subsection 5 U.S.C. 552a(j)(2), HHS/NIH is 
exempting criminal law enforcement investigatory material in System No. 
09-25-0224 from the same requirements identified above, and from these 
additional subsections:
    [cir] (c)(4), requiring the agency to inform disclosure recipients 
of corrections and notations of dispute affecting disclosed records;
    [cir] (e)(2) and (3), requiring the agency to collect information 
directly from the subject individual to the greatest extent practicable 
and to provide a Privacy Act notice to the individual at the time of 
collection;
    [cir] (e)(5), requiring the agency to maintain records used in 
agency determinations with sufficient accuracy, relevance, timeliness, 
and completeness to ensure fairness to individuals;
    [cir] (e)(8), requiring the agency to attempt to notify an 
individual when a record about the individual is disclosed under 
compulsory legal process; and
    [cir] (g), subjecting the agency to civil action and civil remedies 
for noncompliance with access, amendment, and accuracy, relevance, 
timeliness, and completeness requirements, and for noncompliance that 
adversely affects an individual.
    Notwithstanding the establishment of these exemptions, individual 
record subjects may submit accounting, access, notification, and 
correction requests, and HHS/NIH will consider such requests on a case-
by-case basis. Only information that is not factually

[[Page 48538]]

accurate, or is not relevant, timely, or complete may be contested.
    In addition to the exemptions that HHS/NIH is establishing for 
system of records 09-25-0224 in this proposed rule, if any law 
enforcement investigatory material compiled in that system of records 
is from another system of records in which such material was exempted 
from access and other requirements of the Privacy Act based on 5 U.S.C. 
5525a(j)(2), it will be exempt in system of records 09-25-0224 on the 
same basis (i.e., 5 U.S.C. 552a(j)(2)) and from the same requirements 
as in the source system.

III. Exemption Rationales

    The following specific rationales explain why each exemption is 
necessary and appropriate for law enforcement investigation records 
maintained by the NIH Division of Police, in order to prevent 
interference with and protect the integrity of pending, closed, and 
future investigations, including related investigations. All 
subsections referenced are subsections of 5 U.S.C. 552a.
     Subsection (c)(3) (Provide Accountings of Disclosures). 
This exemption will apply to both criminal and non-criminal law 
enforcement investigatory material. Providing an accounting of 
disclosures to an individual record subject could reveal the existence 
of a pending or prior investigation or present or past investigative 
interest on the part of NIH or another agency. This would pose a 
serious impediment to law enforcement efforts and undermine the 
investigative process by enabling a subject individual or others in 
concert with that individual to harass, intimidate, or collude with 
witnesses, destroy, conceal, or tamper with evidence, threaten or 
endanger law enforcement personnel, alter patterns of behavior, and 
avoid detection or apprehension by law enforcement authorities.
     Subsection (c)(4) (Inform Disclosure Recipients of 
Corrections and Notations of Dispute). This exemption applies to only 
criminal law enforcement investigatory material. Because system of 
records 09-25-0224 will be exempt from amendment requirements in 
subsection (d) and HHS/NIH's compliance with amendment requirements 
therefore will be voluntary, it is necessary and appropriate that HHS/
NIH's compliance with the requirement in subsection (c)(4) be voluntary 
also. This will give HHS/NIH the flexibility to decide which cases 
warrant expending resources to meet those administratively burdensome 
requirements.
     Subsection (d)(1) through (4) (Provide Notification, 
Access, and Amendment Rights). These exemptions apply to both criminal 
and non-criminal law enforcement investigatory material. Providing 
subject individuals with the right to be notified of whether the system 
of records contains a record about them and to access and amend such 
records could reveal the existence of a pending or prior investigation 
or present or past investigative interest by NIH or another agency and 
details about the investigation, including identities of sources of 
information, personal information about third parties, and sensitive 
investigative techniques. This could impair pending and future 
investigations by chilling or deterring sources of information from 
providing information to investigators (particularly if they are not 
certain of its accuracy or fear retribution), by providing an 
opportunity for subject individuals and others acting in concert with 
subject individuals to tamper with witnesses or evidence, and by 
allowing individuals to alter their behavior to defeat investigative 
techniques and avoid detection or apprehension. Complying with 
amendment requirements could significantly delay investigations while 
attempts are made to resolve questions of accuracy, relevance, 
timeliness, and completeness and would impose an impossible 
administrative burden by requiring investigations to be continuously 
reinvestigated. In the case of criminal investigations, since the 
system of records will be exempt from having to maintain records that 
are accurate, relevant, timely, and complete, the exemption from 
amendments seeking to correct to those standards is also appropriate.
     Subsection (e)(1) (Maintain Only Relevant and Necessary 
Information Authorized by Statute or Executive order). This exemption 
applies to both criminal and non-criminal law enforcement investigatory 
material. In the course of a law enforcement investigation, and 
especially in the early stages of an investigation, the relevance and 
necessity of information obtained or introduced may be unclear or the 
information may not be strictly relevant or necessary to a specific 
investigation but may lead to discovery of relevant information. In the 
interests of effective law enforcement, it is appropriate to retain all 
information that may aid in establishing patterns of unlawful activity.
     Subsections (e)(2) and (3) (Collect Information Directly 
From the Subject Individual to the Greatest Extent Practicable, and 
Provide a Privacy Act Notice). These exemptions apply to only criminal 
law enforcement investigatory material. It is not always practicable to 
collect information sought in a criminal law enforcement investigation 
directly from subject individuals. Individuals who could be adversely 
affected by an investigation may intentionally provide unreliable 
information to avoid being implicated in criminal activity. Questioning 
subject individuals and providing a Privacy Act notice to them (i.e., 
informing them of the purposes for which information collected from 
them will be used and disclosed and how providing or not providing it 
could affect them), could inappropriately reveal the existence, nature, 
scope, and details of the investigation. This would provide an 
opportunity for the subject individual or others acting in concert with 
that individual to conceal evidence, alter patterns of behavior, or 
take other actions that could thwart investigative efforts; reveal the 
identity of witnesses in investigations, thereby providing an 
opportunity for the subjects of the investigations or others to harass, 
intimidate, or otherwise interfere with the collection of evidence or 
other information from such witnesses; or reveal the identity of 
confidential or other informants who provide information to 
investigators, which would negatively affect an informant's usefulness 
in any ongoing or future investigations and discourage members of the 
public from cooperating with future investigations.
     Subsections (e)(4)(G) and (H) (Describe Procedures for 
Notification, Access, and Amendment). These exemptions apply to both 
criminal and non-criminal law enforcement investigatory material. 
Because system of records 09-25-0224 will be exempt from request 
requirements in subsection (d)(1) through (4) (Provide Notification, 
Access, and Amendment Rights) and HHS/NIH's compliance with those 
request requirements will therefore be voluntary, it is appropriate 
that HHS/NIH's compliance with the requirements in subsection (e)(4)(G) 
and (H) to provide request procedures be voluntary also. 
Notwithstanding these exemptions, HHS/NIH has included request 
procedures in the SORN for system of records 09-25-0224 because, 
notwithstanding the exemptions, individual record subjects may submit 
access and amendment requests, and HHS/NIH will consider such requests 
on a case-by-case basis.
     Subsection (e)(4)(I) (Identify Categories of Record 
Sources in the SORN). This exemption applies to both

[[Page 48539]]

criminal and non-criminal law enforcement investigatory material. 
Because the information in these records may come from any source, it 
is not possible to know every category in advance in order to include 
them all in the SORN. Further, some record source categories would not 
be appropriate to publish in the SORN if, for example, revealing them 
could thwart or impede pending and future law enforcement 
investigations by enabling record subjects or other individuals to 
discover sensitive investigative techniques and devise ways to bypass 
or defeat them to evade detection and apprehension.
     Subsection (e)(5) (Maintain Records Used in Agency 
Determinations with Sufficient Accuracy, Relevance, Timeliness, and 
Completeness to Ensure Fairness). This exemption applies to only 
criminal law enforcement investigatory material. It is not always 
possible to know whether criminal law enforcement investigation 
information is accurate, relevant, timely, and complete. With regard to 
relevance, in the course of a law enforcement investigation, and 
especially in the early stages of an investigation, the relevance of 
information obtained or introduced may be unclear or the information 
may not be strictly relevant to a specific investigation. Compliance 
with (e)(5) would preclude NIH agents from using their investigative 
training and exercise of good judgment to both conduct and report on 
investigations.
     Subsection (e)(8) (Make Reasonable Efforts to Provide 
Notice of Disclosures Made Under Compulsory Legal Process When Such 
Process Becomes A Matter of Public Record). This exemption applies to 
only criminal law enforcement investigatory material. Compliance with 
this requirement would risk revealing an ongoing criminal investigation 
to the target of an investigation who otherwise might not be aware of 
it, defeating a law enforcement advantage in those cases. Compliance 
with this requirement would also risk revealing a criminal 
investigation by mistake or inappropriately in cases in which an 
investigation was not in fact a matter of public record or was not 
intended to be made public.
     Subsection (g) (Civil Liability for Noncompliance with 
Notification, Access, Amendment, and Accuracy, Relevance, Timeliness, 
and Completeness Requirements, or for Noncompliance That Causes an 
Adverse Effect). This exemption applies to only criminal law 
enforcement investigatory material. The exemption would prevent a 
subject individual from bringing a civil action against the agency for 
violations of Privacy Act requirements as to those records; this would 
include violations of the preceding requirements, from which the agency 
would be exempt anyway (which violations therefore would be unlikely to 
support a successful civil action), and any other violations causing an 
adverse effect on the individual. Any civil action (even an untenable 
one) could interfere with, delay, and undermine pending and prospective 
investigations, reveal sensitive investigative techniques and evidence, 
cause unwarranted invasions of personal privacy, and reveal identities 
of witnesses, potential witnesses, and confidential sources.
    Other Federal agencies have promulgated the same or similar 
exemptions for their law enforcement investigatory systems of records 
based on rationales that are the same or similar to those stated for 
this system of records. See, e.g., the Final Rules published at 68 FR 
4923 (Jan. 31, 2003) and 74 FR 42578 (Aug. 24, 2009) by the Department 
of Justice for Criminal Investigation Report System, Justice/ATF-003, 
and by the Department of Homeland Security for Security Facility and 
Perimeter Access Control and Visitor Management, DHS/ALL-024, 
respectively. For the same reasons, HHS/NIH believes that the 
exemptions authorized in 5 U.S.C. 552a(j)(2) and (k)(2) are essential 
to system of records 09-25-0224 to ensure that law enforcement 
investigatory material in NIH Division of Police files is not disclosed 
inappropriately to subject individuals. In NIH's past experience, 
access to such material by record subjects has led to the destruction, 
fabrication, alteration, or creation of information. The proposed 
exemptions will help prevent such problems from recurring in the 
future.
    Accordingly, HHS proposes to exempt both criminal and non-criminal 
law enforcement investigatory material in system of records 09-25-0224 
NIH Police Records from the requirements in subsections (c)(3), (d)(1) 
through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Privacy Act, 
based on 5 U.S.C. 552a(j)(2) and (k)(2), and to exempt criminal law 
enforcement investigatory material in the same system of records from 
the additional requirements in subsections (c)(4), (e)(2) and (3), 
(e)(5), (e)(8), and (g) of the Privacy Act, based on 5 U.S.C. 
552a(j)(2).

Analysis of Impacts

I. Review Under Executive Orders 12866, 13563, and 14094

    The agency believes that this proposed rule is not a significant 
rule under Executive Orders 12866, Regulatory Planning and Review; 
13563, Improving Regulation and Regulatory Review; or 14094, 
Modernizing Regulatory Review, because it will not (1) have an annual 
effect on the economy of $200 million or more; or adversely affect in a 
material way the economy, a sector of the economy, productivity, 
competition, jobs, the environment, public health or safety, or State, 
local or Tribal governments or communities; (2) create a serious 
inconsistency or otherwise interfere with any action taken or planned 
by another agency; (3) materially alter the budgetary impact of 
entitlements, grants, user fees or loan programs, or the rights and 
obligations of recipients thereof; or (4) raise legal or policy issues 
for which centralized review would meaningfully further the President's 
priorities or the principles set forth in these Executive orders. This 
proposed rule renders certain Privacy Act requirements inapplicable to 
certain records (in this case, law enforcement investigatory records) 
in accordance with criteria established in the Privacy Act based on a 
showing that agency compliance with those requirements with respect to 
those records would harm the effectiveness or integrity of the agency 
function or process for which the records are maintained (in this case, 
law enforcement investigations). However, the Office of Management and 
Budget (OMB) has reviewed this regulation under its Privacy Act 
oversight authority.

II. Review Under the Regulatory Flexibility Act (5 U.S.C. 601-612)

    The Regulatory Flexibility Act requires agencies to analyze 
regulatory options that would minimize any significant impact of a rule 
on small entities. Because the proposed rule concerns records about 
individuals, it imposes no duties or obligations on small entities; the 
agency therefore certifies that the proposed rule will not have a 
significant economic impact on a substantial number of small entities.

III. Review under the Unfunded Mandates Reform Act of 1995 (Section 
202, Pub. L. 104-4)

    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that agencies prepare a written statement, which includes an assessment 
of anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation)

[[Page 48540]]

in any one year.'' The current inflation-adjusted statutory threshold 
is approximately $156 million based on the Bureau of Labor Statistics 
inflation calculator. The agency does not expect that this proposed 
rule will result in any one-year expenditure that would meet or exceed 
this amount.

IV. Review Under the Paperwork Reduction Act of 1995 (44 U.S.C. 35-1 et 
seq.)

    This proposed rule does not contain any information collection 
requirements subject to the Paperwork Reduction Act.

V. Review Under Executive Order 13132, Federalism

    This proposed rule will not have any direct effects on States, on 
the relationship between the National Government and the States, or on 
the distribution of power and responsibilities among the various levels 
of government. Therefore, no federalism assessment is required.

List of Subjects in 45 CFR Part 5b

    Privacy.

    For the reasons set out in the preamble, the Department of Health 
and Human Services proposes to amend 45 CFR part 5b as follows:

PART 5b--PRIVACY ACT REGULATIONS

0
1. The authority citation for part 5b continues to read as follows:

    Authority: 5 U.S.C. 301, 5 U.S.C. 552a.

0
2. Amend Sec.  5b.11 by adding paragraph (b)(2)(ix) to read as follows:


Sec.  5b.11  Exempt systems.

* * * * *
    (b) * * *
    (2) * * *
    (ix) Pursuant to subsections (j)(2) and (k)(2) of the Act:
    (A) NIH Police Records, 09-25-0224. (All law enforcement 
investigatory records are exempt from subsections (c)(3), (d)(1) 
through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Act; 
criminal law enforcement investigatory records are exempt from 
additional subsections (c)(4), (e)(2) and (3), (e)(5), (e)(8), and (g); 
the access exemption for non-criminal law enforcement investigatory 
records is limited as provided in subsection (k)(2).)
    (B) [Reserved]
* * * * *

Xavier Becerra,
Secretary, Department of Health and Human Services.
[FR Doc. 2024-12469 Filed 6-6-24; 8:45 am]
BILLING CODE 4140-01-P