Privacy Act; Implementation, 4673-4677 [2025-00670]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 90, Number 10 (Thursday, January 16, 2025)]
[Rules and Regulations]
[Pages 4673-4677]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2025-00670]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 5b

[Docket Number NIH-2022-0002]
RIN 0925-AA69


Privacy Act; Implementation

AGENCY: National Institutes of Health (NIH), Department of Health and 
Human Services (HHS).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS or 
Department) is issuing this final rule to make effective the exemptions 
that were previously proposed for a new Privacy Act system of records, 
``NIH Police Records,'' maintained by the National Institutes of Health 
(NIH), from certain requirements of the Act. The new system of records 
covers criminal and non-criminal law enforcement investigatory material 
maintained by the NIH Division of Police, a component of NIH which 
performs criminal law enforcement as its principal function. The 
exemptions are necessary and appropriate to protect the integrity of 
law enforcement proceedings and records compiled during the course of 
NIH Division of Police activities, prevent disclosure of investigative 
techniques, and protect the identity of confidential sources involved 
in those activities.

DATES: This final rule is effective February 18, 2025.

FOR FURTHER INFORMATION CONTACT: Dustin Close, Office of Management 
Assessment, National Institutes of Health, 6705 Rockledge Drive, Suite 
601, Bethesda, Maryland 20892, telephone 301-402-6469, email 
[email protected].

SUPPLEMENTARY INFORMATION:

I. Introduction

    HHS/NIH published a Notice of Proposed Rulemaking (NPRM) in the 
Federal Register on June 7, 2024 (89 FR 48536), seeking notice and 
comment concerning proposed exemptions for a new system of records with 
respect to certain materials maintained by the NIH Division of Police. 
These proposals were made in accordance with the Privacy Act of 1974 
(Privacy Act) and the Office of Management and Budget (OMB) Circular A-
108, Federal Agency Responsibilities for Review, Reporting, and 
Publication under the Privacy Act. This new system of records was 
described in a System of Records Notice (SORN) that was published in 
the Federal Register (89 FR 48654) on the same day for notice and 
comment. A 60-day comment period was provided for both the NPRM and the 
SORN. The public comment period for both the NPRM and the SORN expired 
on August 6, 2024. One comment was received in response to the NPRM, 
and no comments were received in response to the SORN. The comment 
received in response to the NPRM supported the rulemaking action. HHS/
NIH made no changes to the exemptions that were proposed in the NPRM or 
to the SORN in response to the public comment received. The NPRM, as 
published on June 7, 2024 (89 FR 48654), provided for the SORN to be 
effective upon publication of this final rule. Therefore, the SORN, as 
published on June 7, 2024 (89 FR 48654), is now effective.

II. Background on the NIH Police Division and New System of Records 09-
25-0224

    The NIH Division of Police, organizationally located within the 
Office of Research Services (ORS), Office of the Director, NIH, was 
established in 1968 to provide an immediate and primary law enforcement 
program for the NIH and derives its authority from Memorandum from the 
Assistant Secretary for Administration, Office of the Secretary (OS), 
to the Director, NIH, June 13, 1968, entitled: Delegation of Authority 
to Assist in Controlling Violations of Law at Certain HEW [Department 
of Health, Education, and Welfare] Facilities Located in Montgomery 
County, Maryland; 40 U.S.C. 1315 (Law enforcement authority of 
Secretary of Homeland Security for protection of public property; a 
Department of Homeland Security (DHS) delegation of authority to HHS/
NIH; and an NIH delegation of authority to the NIH Division of Police); 
General

[[Page 4674]]

Administrative Delegation of Authority Number 08, Control of Violations 
of Law at Certain NIH Facilities (Sept. 1, 2020). Based on that 
establishing authority, the Division of Police performs criminal law 
enforcement as its principal function. However, the Division of Police 
conducts criminal, civil, administrative, and regulatory law 
enforcement investigations.
    The NIH Division of Police is directly responsible for the 
provision of daily law enforcement and criminal and civil investigative 
activities required to protect the life, safety, and property of NIH 
employees, contractors, patients, and visitors at NIH. To perform these 
responsibilities, the NIH Division of Police compiles and maintains 
records of complaints of incidents, inquiries, investigative findings, 
arrest records, and court dispositions which are retrieved by personal 
identifiers and therefore constitute a ``system of records'' as defined 
by the Privacy Act at 5 U.S.C. 552a(a)(5). The primary purposes for 
which the records are used are to: (1) record incidents of crime, civil 
disturbance, and traffic accidents on the NIH enclave, and the 
investigation of such incidents; (2) maintain information essential to 
the protection of life, safety, and property at NIH; (3) provide 
official records of law enforcement investigative efforts for use in 
administrative, criminal and/or civil proceedings; and (4) document 
criminal and civil law enforcement investigations.

III. Eligible Records and Exemptions

    The new system of records includes both criminal and non-criminal 
(e.g., civil, administrative, regulatory) law enforcement investigatory 
records which will be retrieved by subject individuals' personal 
identifiers. Such records are eligible to be exempted from certain 
Privacy Act requirements, as follows:
     Subsection (j)(2) of the Privacy Act (5 U.S.C. 552a(j)(2)) 
allows an agency head to exempt from certain Privacy Act provisions a 
system of records maintained by the agency or component thereof which 
performs as its principal function any activity pertaining to the 
enforcement of criminal laws.
     Subsection (k)(2) of the Act (5 U.S.C. 552a(k)(2)) allows 
an agency head to exempt from certain Privacy Act provisions a system 
of records containing investigatory material compiled for law 
enforcement purposes, other than material within the scope of 
subsection (j)(2) (for example, material compiled for a civil, 
administrative, or regulatory law enforcement purpose, or material 
compiled for a criminal law enforcement purpose by an agency component 
that does not perform criminal law enforcement as its principal 
function). This exemption's effect on the subject individual's access 
rights is qualified in that if any individual is denied any right, 
privilege, or benefit to or for which the individual otherwise would be 
entitled by Federal law, or for which the individual would otherwise be 
eligible, as a result of the maintenance of the system of records, the 
individual must be provided the requested materials except to the 
extent that disclosure would reveal the identity of a source who 
furnished information to the Government under an express promise that 
the identity of the source would be held in confidence.
    HHS/NIH is establishing the following exemptions for the records:
     Based on 5 U.S.C. 552a(k)(2), HHS/NIH is exempting non-
criminal (e.g., civil, administrative, regulatory) law enforcement 
investigatory material in System No. 09-25-0224 from the requirements 
in subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through 
(I), and (f) of the Privacy Act, which require the agency to provide an 
accounting of disclosures; provide notification, access, and amendment 
rights; maintain only relevant and necessary information authorized by 
a statute or Executive order; establish and describe procedures whereby 
an individual can be notified if a system of records contains 
information pertaining to that individual and how to gain access to 
pertinent records; identify categories of record sources; and 
promulgate rules regarding these procedures. The effect of this 
exemption on a subject individual's access rights will be to permit 
withholding the records during an ongoing investigation, but limited as 
required by subsection (k)(2) to information that would reveal the 
identity of a source who was expressly promised confidentiality in 
cases in which maintenance of the records results in denial of a 
Federal right, privilege, or benefit to or for which the individual 
would otherwise be entitled or eligible.
     Based on subsection 5 U.S.C. 552a(j)(2), HHS/NIH is 
exempting criminal law enforcement investigatory material in System No. 
09-25-0224 from the same requirements identified above, and from these 
additional subsections:
    [cir] (c)(4), requiring the agency to inform disclosure recipients 
of corrections and notations of dispute affecting disclosed records;
    [cir] (e)(2) and (3), requiring the agency to collect information 
directly from the subject individual to the greatest extent practicable 
and to provide a Privacy Act notice to the individual at the time of 
collection;
    [cir] (e)(5), requiring the agency to maintain records used in 
agency determinations with sufficient accuracy, relevance, timeliness, 
and completeness to ensure fairness to individuals;
    [cir] (e)(8), requiring the agency to attempt to notify an 
individual when a record about the individual is disclosed under 
compulsory legal process; and
    [cir] (g), subjecting the agency to civil action and civil remedies 
for noncompliance with access, amendment, and accuracy, relevance, 
timeliness, and completeness requirements, and for noncompliance that 
adversely affects an individual.
    Notwithstanding the establishment of these exemptions, individual 
record subjects may submit accounting, access, notification, and 
amendment requests, and HHS/NIH will consider such requests on a case-
by-case basis. Only information that is not factually accurate, or is 
not relevant, timely, or complete may be contested.
    In addition to the exemptions that HHS/NIH is establishing for 
system of records 09-25-0224 in this final rule, if any law enforcement 
investigatory material compiled in that system of records is from 
another system of records in which such material was exempted from 
access and other requirements of the Privacy Act based on 5 U.S.C. 
552a(j)(2), NIH may claim the same exemptions in system of records 09-
25-0224 on the same basis (i.e., 5 U.S.C. 552a(j)(2)) and from the same 
requirements as in the source system from which they originated.

IV. Exemption Rationales

    The following specific rationales explain why each exemption is 
necessary and appropriate for law enforcement investigation records 
maintained by the NIH Division of Police, in order to prevent 
interference with and protect the integrity of pending, closed, and 
future investigations, including related investigations. All 
subsections referenced are subsections of 5 U.S.C. 552a.
     Subsection (c)(3) (Provide Accountings of Disclosures). 
This exemption will apply to both criminal and non-criminal law 
enforcement investigatory material. Providing an accounting of 
disclosures to an individual record subject could reveal the existence 
of a pending or prior investigation or present or past investigative 
interest on the part of NIH or another agency. This would pose a 
serious impediment to law enforcement efforts and undermine the 
investigative

[[Page 4675]]

process by enabling a subject individual or others in concert with that 
individual to harass, intimidate, or collude with witnesses, destroy, 
conceal, or tamper with evidence, threaten or endanger law enforcement 
personnel, alter patterns of behavior, and avoid detection or 
apprehension by law enforcement authorities.
     Subsection (c)(4) (Inform Disclosure Recipients of 
Corrections and Notations of Dispute). This exemption applies to only 
criminal law enforcement investigatory material. Because system of 
records 09-25-0224 will be exempt from amendment requirements in 
subsection (d) and HHS/NIH's compliance with amendment requirements 
therefore will be voluntary, it is necessary and appropriate that HHS/
NIH's compliance with the requirement in subsection (c)(4) be voluntary 
also. This will give HHS/NIH the flexibility to decide which cases 
warrant expending resources to meet those administratively burdensome 
requirements.
     Subsection (d)(1) through (4) (Provide Notification, 
Access, and Amendment Rights). These exemptions apply to both criminal 
and non-criminal law enforcement investigatory material. Providing 
subject individuals with the right to be notified of whether the system 
of records contains a record about them and to access and amend such 
records could reveal the existence of a pending or prior investigation 
or present or past investigative interest by NIH or another agency and 
details about the investigation, including identities of sources of 
information, personal information about third parties, and sensitive 
investigative techniques. This could impair pending and future 
investigations by chilling or deterring sources of information from 
providing information to investigators (particularly if they are not 
certain of its accuracy or fear retribution), by providing an 
opportunity for subject individuals and others acting in concert with 
subject individuals to tamper with witnesses or evidence, and by 
allowing individuals to alter their behavior to defeat investigative 
techniques and avoid detection or apprehension. Complying with 
amendment requirements could significantly delay investigations while 
attempts are made to resolve questions of accuracy, relevance, 
timeliness, and completeness and would impose an impossible 
administrative burden by requiring investigations to be continuously 
reinvestigated. In the case of criminal investigations, since the 
system of records will be exempt from having to maintain records that 
are accurate, relevant, timely, and complete, the exemption from 
amendments seeking to correct to those standards is also appropriate.
     Subsection (e)(1) (Maintain Only Relevant and Necessary 
Information Authorized by Statute or Executive order). This exemption 
applies to both criminal and non-criminal law enforcement investigatory 
material. In the course of a law enforcement investigation, and 
especially in the early stages of an investigation, the relevance and 
necessity of information obtained or introduced may be unclear or the 
information may not be strictly relevant or necessary to a specific 
investigation but may lead to discovery of relevant information. In the 
interests of effective law enforcement, it is appropriate to retain all 
information that may aid in establishing patterns of unlawful activity.
     Subsections (e)(2) and (3) (Collect Information Directly 
From the Subject Individual to the Greatest Extent Practicable, and 
Provide a Privacy Act Notice). These exemptions apply to only criminal 
law enforcement investigatory material. It is not always practicable to 
collect information sought in a criminal law enforcement investigation 
directly from subject individuals. Individuals who could be adversely 
affected by an investigation may intentionally provide unreliable 
information to avoid being implicated in criminal activity. Questioning 
subject individuals and providing a Privacy Act notice to them (i.e., 
informing them of the purposes for which information collected from 
them will be used and disclosed and how providing or not providing it 
could affect them), could inappropriately reveal the existence, nature, 
scope, and details of the investigation. This would provide an 
opportunity for the subject individual or others acting in concert with 
that individual to conceal evidence, alter patterns of behavior, or 
take other actions that could thwart investigative efforts; reveal the 
identity of witnesses in investigations, thereby providing an 
opportunity for the subjects of the investigations or others to harass, 
intimidate, or otherwise interfere with the collection of evidence or 
other information from such witnesses; or reveal the identity of 
confidential or other informants who provide information to 
investigators, which would negatively affect an informant's usefulness 
in any ongoing or future investigations and discourage members of the 
public from cooperating with future investigations.
     Subsections (e)(4)(G) and (H) (Describe Procedures for 
Notification, Access, and Amendment). These exemptions apply to both 
criminal and non-criminal law enforcement investigatory material. 
Because system of records 09-25-0224 will be exempt from request 
requirements in subsection (d)(1) through (4) (Provide Notification, 
Access, and Amendment Rights) and HHS/NIH's compliance with those 
request requirements will therefore be voluntary, it is appropriate 
that HHS/NIH's compliance with the requirements in subsection (e)(4)(G) 
and (H) to provide request procedures be voluntary also. HHS/NIH has 
included request procedures in the SORN for system of records 09-25-
0224 because, notwithstanding the exemptions, individual record 
subjects may submit access and amendment requests, and HHS/NIH will 
consider such requests on a case-by-case basis.
     Subsection (e)(4)(I) (Identify Categories of Record 
Sources in the SORN). This exemption applies to both criminal and non-
criminal law enforcement investigatory material. Because the 
information in these records may come from any source, it is not 
possible to know every category in advance in order to include them all 
in the SORN. Further, some record source categories would not be 
appropriate to publish in the SORN if, for example, revealing them 
could thwart or impede pending and future law enforcement 
investigations by enabling record subjects or other individuals to 
discover sensitive investigative techniques and devise ways to bypass 
or defeat them to evade detection and apprehension.
     Subsection (e)(5) (Maintain Records Used in Agency 
Determinations with Sufficient Accuracy, Relevance, Timeliness, and 
Completeness to Ensure Fairness). This exemption applies to only 
criminal law enforcement investigatory material. It is not always 
possible to know whether criminal law enforcement investigation 
information is accurate, relevant, timely, and complete. With regard to 
relevance, in the course of a law enforcement investigation, and 
especially in the early stages of an investigation, the relevance of 
information obtained or introduced may be unclear or the information 
may not be strictly relevant to a specific investigation. Compliance 
with (e)(5) would preclude NIH agents from using their investigative 
training and exercise of good judgment to both conduct and report on 
investigations.
     Subsection (e)(8) (Make Reasonable Efforts to Provide 
Notice of Disclosures Made Under Compulsory Legal Process When Such 
Process Becomes A Matter of Public Record). This exemption applies to 
only criminal law enforcement investigatory material.

[[Page 4676]]

Compliance with this requirement would risk revealing an ongoing 
criminal investigation to the target of an investigation who otherwise 
might not be aware of it, defeating a law enforcement advantage in 
those cases. Compliance with this requirement would also risk revealing 
a criminal investigation by mistake or inappropriately in cases in 
which an investigation was not in fact a matter of public record or was 
not intended to be made public.
     Subsection (g) (Civil Liability for Noncompliance with 
Notification, Access, Amendment, and Accuracy, Relevance, Timeliness, 
and Completeness Requirements, or for Noncompliance That Causes an 
Adverse Effect). This exemption applies to only criminal law 
enforcement investigatory material. The exemption would prevent a 
subject individual from bringing a civil action against the agency for 
violations of Privacy Act requirements as to those records; this would 
include violations of the preceding requirements, from which the agency 
would be exempt anyway (which violations therefore would be unlikely to 
support a successful civil action), and any other violations causing an 
adverse effect on the individual. Any civil action (even an untenable 
one) could interfere with, delay, and undermine pending and prospective 
investigations, reveal sensitive investigative techniques and evidence, 
cause unwarranted invasions of personal privacy, and reveal identities 
of witnesses, potential witnesses, and confidential sources.
    Subsection (f) (Promulgate Rules Regarding These Procedures). This 
exemption applies to both criminal and non-criminal law enforcement 
investigatory material provided however, that for investigative 
material compiled for law enforcement purposes other than material 
within the scope of 5 UC 552a(j)(2), if any individual is denied any 
right, privilege, or benefit for which he or she would otherwise be 
eligible, as a result of the maintenance of these records, such 
material shall be provided to such individual, except to the extent 
that the disclosure of such material would reveal the identity of a 
source who furnished information to the Government under an express 
promise that the identity of the source would be held in confidence. 
Compliance with this requirement may help protect the agency from a 
claim regarding adequacy of or procedural objections to any relevant 
rules.
    For the reasons stated, HHS/NIH believes that the exemptions 
authorized in 5 U.S.C. 552a(j)(2) and (k)(2) are essential to system of 
records 09-25-0224 to prevent interference with and protect the 
integrity of all investigations concerning the NIH Division of Police. 
In NIH's past experience, not having these protections has led to the 
overall hinderance of law enforcement operations. These exemptions will 
help prevent such problems from recurring in the future.
    Accordingly, HHS exempts both criminal and non-criminal law 
enforcement investigatory material in system of records 09-25-0224 NIH 
Police Records from the requirements in subsections (c)(3), (d)(1) 
through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Privacy Act, 
based on 5 U.S.C. 552a(j)(2) and (k)(2), and exempts criminal law 
enforcement investigatory material in the same system of records from 
the additional requirements in subsections (c)(4), (e)(2) and (3), 
(e)(5), (e)(8), and (g) of the Privacy Act, based on 5 U.S.C. 
552a(j)(2).

Regulatory Impact Analysis

I. Introduction

    We examined the impacts of this rule under Executive Order 12866, 
Regulatory Planning and Review; Executive Order 13563, Improving 
Regulation and Regulatory Review; Executive Order 14094, Modernizing 
Regulatory Review; the Regulatory Flexibility Act (5 U.S.C. 601-612); 
the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), the Paperwork 
Reduction Act of 1995 (44 U.S.C. 35-1 et seq., and Executive Order 
13132, Federalism.

II. Review Under Executive Orders 12866, 13563, and 14094

    Executive Orders 12866 and 13563 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). The 
Executive Order 14094 entitled ``Modernizing Regulatory Review'' amends 
section 3(f) of Executive Order 12866 (Regulatory Planning and Review). 
The amended section 3(f) of Executive Order 12866 defines a 
``significant regulatory action'' as an action that is likely to result 
in a rule that may: (1) have an annual effect on the economy of $200 
million or more in any 1 year (adjusted every 3 years by the 
Administrator of OIRA for changes in gross domestic product); or 
adversely affect in a material way the economy, a sector of the 
economy, productivity, competition, jobs, the environment, public 
health or safety, or State, local, territorial, or tribal governments 
or communities; (2) create a serious inconsistency or otherwise 
interfere with an action taken or planned by another agency; (3) 
materially alter the budgetary impacts of entitlements, grants, user 
fees, or loan programs or the rights and obligations of recipients 
thereof; or (4) raise legal or policy issues for which centralized 
review would meaningfully further the President's priorities or the 
principles set forth in this Executive order, as specifically 
authorized in a timely manner by the Administrator of OIRA in each 
case.
    A regulatory impact analysis (RIA) must be prepared for major rules 
with significant regulatory action/s and/or with significant effects as 
per section 3(f)(1) ($200 million or more in any 1 year). OMB's Office 
of Information and Regulatory Affairs has determined that this 
rulemaking is ``not significant'' under section 3(f) and does not meet 
the criteria set forth in 5 U.S.C. 804(2) under Subtitle E of the Small 
Business Regulatory Enforcement Fairness Act of 1996 (also known as the 
Congressional Review Act). Thus, an RIA is unnecessary.
    This rule renders certain Privacy Act requirements inapplicable to 
certain records (in this case, law enforcement investigatory records) 
in accordance with criteria established in the Privacy Act based on a 
showing that agency compliance with those requirements with respect to 
those records would harm the effectiveness or integrity of the agency 
function or process for which the records are maintained (in this case, 
law enforcement investigations). However, OMB has reviewed this 
regulation under its Privacy Act oversight authority.

III. Review Under the Regulatory Flexibility Act (5 U.S.C. 601-612)

    The Regulatory Flexibility Act requires agencies to analyze 
regulatory options that would minimize any significant impact of a rule 
on small entities. Because the rule concerns records about individuals, 
it imposes no duties or obligations on small entities; the agency 
therefore certifies that the rule will not have a significant economic 
impact on a substantial number of small entities.

IV. Review Under the Unfunded Mandates Reform Act of 1995 (Section 202, 
Pub. L. 104-4)

    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that agencies prepare a written statement, which includes an assessment 
of anticipated costs and

[[Page 4677]]

benefits, before issuing ``any rule that includes any Federal mandate 
that may result in the expenditure by State, local, and tribal 
governments, in the aggregate, or by the private sector, of 
$100,000,000 or more (adjusted annually for inflation) in any one 
year.'' The current inflation-adjusted statutory threshold is 
approximately $156 million based on the Bureau of Labor Statistics 
inflation calculator. The agency does not expect this rule will result 
in any one-year expenditure that would meet or exceed this amount.

V. Review Under the Paperwork Reduction Act of 1995 (44 U.S.C. 35-1 et 
seq.)

    This rule does not contain any information collection requirements 
subject to the Paperwork Reduction Act.

VI. Review Under Executive Order 13132, Federalism

    This rule will not have any direct effects on States, on the 
relationship between the National Government and the States, or on the 
distribution of power and responsibilities among the various levels of 
government. Therefore, no federalism assessment is required.

List of Subjects in 45 CFR Part 5b

    Privacy.

    For the reasons set out in the preamble, the Department of Health 
and Human Services amends 45 CFR part 5b as follows:

PART 5B--PRIVACY ACT REGULATIONS

0
1. The authority citation for part 5b continues to read as follows:

    Authority: 5 U.S.C. 301, 5 U.S.C. 552a.


0
2. Amend Sec.  5b.11 by adding paragraph (b)(2)(ix) to read as follows:


Sec.  5b.11  Exempt systems.

* * * * *
    (b) * * *
    (2) * * *
    (ix) Pursuant to subsections (j)(2) and (k)(2) of the Act:
    (A) NIH Police Records, 09-25-0224. (All law enforcement 
investigatory records are exempt from subsections (c)(3), (d)(1) 
through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Act; 
criminal law enforcement investigatory records are exempt from 
additional subsections (c)(4), (e)(2) and (3), (e)(5), (e)(8), and (g); 
the access exemption for non-criminal law enforcement investigatory 
records is limited as provided in subsection (k)(2).)
    (B) [Reserved]
* * * * *

Xavier Becerra,
Secretary, Department of Health and Human Services.
[FR Doc. 2025-00670 Filed 1-15-25; 8:45 am]
BILLING CODE 4150-01-P