2020-00633. Privacy Act of 1974; System of Records Notice

AGENCY:

National Institutes of Health (NIH), Department of Health and Human Services (HHS).

ACTION:

Notice of a modified system of records and rescindment of a system of records notice.

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, as amended, the Department of Health and Human Services (HHS) through the National Institutes of Health (NIH) is modifying system of records 09-90-0067 to reflect that the records are now maintained by NIH, the Food and Drug Administration (FDA), and the Centers for Disease Control and Prevention (CDC) and to rename the system of records “Invention, Patent, and Licensing Documents Related to Inventions By Public Health Service Employees, Grantees, Fellowship Recipients, and Contractors.” In addition, HHS/NIH is rescinding a related NIH system of records, 09-25-0168.

DATES:

The modified system of records is effective February 18, 2020, with the exception of the new and revised routine uses. The new and revised routine uses will be effective 30 days after publication of this notice, unless comments are received that warrant a revision to this notice. Comments should be submitted within 30 days of publication, but may be made at any time.

ADDRESSES:

You may submit comments, identified by the Privacy Act system of records number 09-90-0067, by any of the following methods:

• Federal eRulemaking Portal: http://regulations.gov. Follow the instructions for submitting comments.
• Email: [e-mail] and include the system of records number, 09-90-0067, in the subject line of the message.
• Phone: [phone].
• Fax: [phone].
• Mail: NIH Privacy Act Officer, Office of Management Assessment, National Institutes of Health, 6011 Executive Blvd., Suite 601, MSC 7669, Rockville, MD 20892.
• Hand Delivery/Courier: 6011 Executive Blvd., Suite 601, MSC 7669, Rockville, MD 20892.

Comments received will be available for inspection and copying at this same address from 9:00 a.m. to 3:00 p.m., Monday through Friday, federal holidays excepted.

FOR FURTHER INFORMATION CONTACT:

General questions about the modified system of records may be submitted by mail or telephone to: Celeste Dade-Vinson, NIH Privacy Act Officer, Office of Management Assessment (OMA), Office of the Director (OD), National Institutes of Health (NIH), 6011 Executive Blvd., Suite 601, MSC 7669, Rockville, MD 20892, telephone number [phone] (not a toll-free number).

SUPPLEMENTARY INFORMATION:

I. Modifications to System of Records 09-90-0067

This system of records was established in 1979 or earlier (see 44 FR 58144, at 58164) by HHS' Office of General Counsel which managed the records until approximately 1993, when that responsibility was transferred to NIH and NIH established related system of records 09-25-0168 (see 58 FR 45111). Until fiscal year (FY) 2017, NIH managed all records on behalf of the relevant Public Health Service (PHS) components (NIH, FDA, and CDC) whose funding, employment, or other activities give rise to the records. Starting in FY 2017, records related to an invention arising in FY 2017 or later that is associated with only one PHS component are managed by that component, and NIH now manages only the following records for other components: (i) Records related to inventions that arose prior to FY 2017, and (ii) records related to joint inventions associated with more than one component. Consequently, HHS has decided to update the department-level system of records notice (SORN) 09-90-0067 to cover all three components' records to avoid the need for multiple component-specific SORNs, and to rescind NIH SORN 09-25-0168.

The modifications to SORN 09-90-0067 include the following substantive changes, in addition to formatting changes required by OMB Circular A-108 and minor wording changes throughout the SORN:

• The system name has been changed from “Invention Reports Submitted to the Department of Health and Human Services by its Employees, Grantees, Fellowship Recipients, and Contractors” to “Invention, Patent, and Licensing Documents Related to Inventions By Public Health Service Employees, Grantees, Fellowship Recipients, and Contractors.”
• The “System Location” and “System Manger(s)” sections now provide contact information for each relevant PHS component (NIH, FDA, and CDC) instead of for OGC.
• The “Authorities” section, which formerly cited only 45 CFR parts 6, 7, and 8 and Executive Orders (E.O.s) 9865 and 10096, no longer cites 45 CFR parts 6 and 8 but now cites many additional authorities which were cited in NIH SORN 09-25-0168, plus these additional authorities which were not cited in that SORN: 42 U.S.C. secs. 241, 282, and 284; 37 CFR part 401; and 15 U.S.C. 3701-3708.
• The “Categories of Records” section now identifies more categories than just invention reports and includes the list of data elements that was in NIH SORN 09-25-0168, updated to include employing office or organization name and address, email address, phone, and fax numbers, status as Fellow or contract employee, educational degree(s), and citizenship, and to remove Social Security Number (SSN). SSN is needed only by HHS finance offices, to disburse royalty payments to an inventor; records used for disbursement and related functions are covered under another system of records (e.g., 09-90-0024 HHS Financial Management System Records).
• The “Purposes” section, which previously stated: “To maintain the information and patent records for the entire Department,” now includes the four purposes described in NIH SORN 09-25-0168 (now numbered as 1, 2, 3, and 7) and three additional purposes (4, 5, and 6).
• The “Record Source Categories” section now includes these additional, broadened, or updated categories: Other inventors, co-inventors, collaborating persons; grantees, fellowship recipients and contractors; other federal agencies; United States and foreign patent offices; prospective licensees; PHS technology development coordinators; internet and commercial databases; and third parties who PHS contacts to determine individual invention ownership or government ownership.
• The “Routine Uses” section has been modified as follows:

○ It includes nine new routine uses (1, 4, 5, 6, 7, 8, 10, 11, and 14; however, closely similar versions of 5 and 10 were in NIH SORN 09-25-0168).

○ It includes three revised routine uses:

—Routine use 2: This routine use, which authorizes disclosures to a congressional office when responding to its inquiries regarding constituent requests, has been reworded to include the word “written” in describing the constituents' requests and the congressional office's inquiries.

—Routine use 3: Two previously separate litigation-related routine uses are now combined in routine use 3.

—Routine use 9: Six previously separate routine uses (which were combined in one routine use in NIH SORN 09-25-0168 but divided in subparts numbered a. through f.) are now combined in routine use 9 and divided in subparts numbered a. through f.

○ Two breach response-related routine uses which were published for all HHS systems of records on February 14, 2018 (see 83 FR 6591) as required by OMB Memorandum M-17-12 are now numbered as 12 and 13.

○ Five routine uses which were in NIH SORN 09-25-0168 (numbered as 4, 5, 6, 7, and 10 in that SORN) have not been included in modified SORN 09-90-0067 because the disclosures they described would be made by other systems of record or otherwise are no longer needed for this system of records.

• The “Storage” section has been updated to include electronic media and to list types of portable devices that could be used, with prior HHS approval, to access and store system records.
• The “Safeguards” section has been updated to list additional safeguards which are now used to protect records from unauthorized access (e.g., privacy and security documents and training, encryption, smart cards, biometrics, firewalls, and intrusion detection).
• The “Retention” section, which previously reflected that records are maintained onsite for the life of the patent (17 years) or for 7 years if the invention was not patented, and are then stored offsite at a federal records center (without indicating when they would be destroyed), now states that, currently, all records are retained in accordance with a NIH disposition schedule which provides for records to be retained for a maximum of 30 years, and that, if required, separate schedules will be developed for the records managed by FDA and CDC in FY 2017 or later.
• The “Record Access Procedures,” “Contesting Record Procedures,” and “Notification Procedures” sections now provide more detailed instructions for making a sufficiently specific request and now also include identity verification requirements.

II. Rescindment of NIH System of Records Notice (SORN) 09-25-0168

As modified, the department-level SORN 09-90-0067 now includes updated descriptions of the same NIH records that are covered in NIH SORN 09-25-0168. Accordingly, HHS is rescinding NIH SORN 09-25-0168 as duplicative of modified SORN 09-90-0067.

Dated: January 9, 2020.

Alfred C. Johnson,

Deputy Director for Management, National Institutes of Health.

SYSTEM NAME AND NUMBER:

Invention, Patent, and Licensing Documents Related to Inventions By Public Health Service Employees, Grantees, Fellowship Recipients, and Contractors, 09-90-0067.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

The address of each agency component responsible for the system of records is as shown in the System Manager(s) section.

SYSTEM MANAGER(S):

The System Managers are as follows:

• For NIH invention records, joint invention records, and records related to inventions that arose prior to FY 2017: National Institutes of Health, Director, Office of Technology Transfer, Office of Intramural Research, Office of the Director, 6011 Executive Blvd., Suite 325, Rockville, MD 20892-7660, [e-mail], [phone].
• For FDA invention records related to inventions that arose in FY 2017 or later: Food and Drug Administration, Director, FDA Technology Transfer Program, Office of the Chief Scientist, 10903 New Hampshire Ave., Silver Spring, MD 20993, [e-mail].
• For CDC invention records related to inventions that arose in FY 2017 or later: Centers for Disease Control and Prevention, Associate Director for Science, Office of Technology and Innovation, 1600 Clifton Rd. NE, M/S D-42, Atlanta GA 30329-4018, [e-mail], [phone].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

15 U.S.C. secs. 3701-3710d, National Technology Transfer and Advancement Act; 35 U.S.C. secs. 200-212, Patent Rights in Inventions Made with Federal Funding Assistance; 42 U.S.C. secs. 241, 282 and 284, the Public Health Service Act; Executive Order (E.O.) 9865, Providing for the Protection Abroad of Inventions Resulting from Research Financed by the Government; and E.O. 10096, Providing for a Uniform Patent Policy for the Government with Respect to Inventions made by Government Employees and for the Administration of Such Policy. See also 37 CFR parts 401 and 404, and 45 CFR part 7.

PURPOSE(S) OF THE SYSTEM:

The records are maintained and used by HHS for these purposes:

1. To obtain patent protection for inventions reported by Public Health Service (PHS) employees, inventors, contractors, and non-profit and educational institutions to which title is owned or co-owned by the Federal Government.

2. To grant licenses to patents obtained through the invention reports.

3. To provide royalty payments to the relevant PHS employees, inventors, contractors, and non-profit and educational institutions.

4. To manage all assets of the technology transfer process (i.e., marketing, statistics, technology abstracts).

5. To refer to for information needed during award processing, querying, and reporting.

6. To share relevant information with other HHS offices that manage grants, contracts, or personnel associated with the invention, including any information needed to investigate matters such as possible law, contract, or grant agreement violations and issues concerning an individual's or entity's suitability or eligibility for federal employment, contracts, grants, licenses, or other federal benefits. Records used by other HHS offices for such purposes, if retrieved by personal identifier, would be covered under other Systems of Records Notices (SORNs); see, for example, OPM/GOVT-3 covering Adverse Action Files, 09-90-0020 covering Suitability for Employment Records, and 09-90-0100 covering Civil and Administrative Investigative Files of the Inspector General.

7. To provide documentation needed for related financial management and debt collection functions, including effecting disbursements of royalty awards and payments by the Department of the Treasury (Treasury), coordinating with Treasury to recover any improper payments or other claims through offsets against federal salary and tax refund payments, and reporting royalty payments and uncollectible debt amounts to the Internal Revenue Service (IRS) as income. Records used for financial management and debt collection purposes are covered under other HHS System of Records Notices (SORNs); see, e.g., HHS SORN Nos. 09-90-0024 HHS Financial Management System Records and 09-40-0012 Debt Management and Collection System for descriptions of purposes for which such records are used within HHS and routine uses for which such records may be disclosed to the Department of Treasury and other parties outside HHS.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The records are about inventors; i.e., any individual involved in the development of an NIH, FDA, or CDC technology who reported an invention, applied for a patent, was granted a patent, and/or is receiving royalties from a patent to which title is owned or co-owned by the Federal Government or by a grantee, fellowship recipient, or contractor of the Federal Government. The inventor may be a PHS (or other HHS) employee, extramural grantee, fellowship recipient, independent contractor, or other outside inventor or co-inventor.

CATEGORIES OF RECORDS IN THE SYSTEM:

The records consist of invention reports, patent prosecution and licensing documents (such as patent applications and license agreements) and related documents, containing all information necessary to be included in such documents, for all individuals who contributed to the invention. Applicable data elements may include: Inventor name, job title, employing office or organization name and address, contact information (mailing and email addresses, phone numbers, and fax numbers), HHS employee identification number or other unique identifier, inventor's status as a fellow or contract employee, educational degree(s), citizenship, title and description of the invention, Employee Invention Report (EIR) number, license number (if an agreement provides for royalties to be paid by a third party), number assigned to submitted invention report, case/serial number, prior art related to the invention, evaluation of the commercial potential of the invention, prospective licensees' intended development of the invention, and royalty payment information.

RECORD SOURCE CATEGORIES:

Sources of information about inventors contained in these records include the subject individual (i.e., inventor); other inventors, co-inventors, and collaborating persons; grantees, fellowship recipients and contractors; other federal agencies; scientific experts from non-government organizations; contract patent counsel and their employees and foreign contract personnel; United States and foreign patent offices; prospective licensees; PHS technology development coordinators; internet and commercial databases; and third parties who PHS contacts to determine individual invention ownership or government ownership.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

In addition to other disclosures authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(4) through (11), information about an inventor may be disclosed from this system of records to following parties outside of HHS without the individual's prior written consent, for these purposes:

1. HHS may make the inventor's name and other information public, when making information about the invention public. For example, HHS makes the inventor's name public in the Federal Register and/or on the internet when it lists inventions that are available for collaboration and/or licensing (i.e., to seek parties interested in licensing the invention or in undertaking collaborative research activities to further develop, evaluate, or commercialize the invention), and when publicizing results of agency research activities. Information made public without the inventor's prior, written consent would be limited to information that HHS would be required to release to a requester under the Freedom of Information Act (FOIA); meaning, information that would not result in a clearly unwarranted invasion of privacy.

2. Disclosure may be made to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of the individual.

3. A record may be disclosed to the Department of Justice (DOJ) or to a court or other tribunal in litigation or other proceedings when: (a) HHS, or any component thereof; (b) any HHS employee in his/her official capacity; (c) any HHS employee in his/her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States Government, is a party to the proceeding or has a direct and substantial interest in the proceeding and, by careful review, HHS determines that the records are both relevant and necessary to the proceeding.

4. Records may be disclosed to authorized federal agencies, programs, or other entities for purposes of program evaluation and assessment, including quality assurance or peer review, audit, or accreditation activities.

5. Information may be disclosed to federal agencies and HHS contractors, grantees, consultants, or volunteers who have been engaged by HHS to assist in accomplishment of an HHS function relating to the purposes of this system of records and need to have access to the records in order to assist HHS. Any contractor will be required to comply with the requirements of the Privacy Act of 1974, as amended.

6. Information about an inventor may be included in information disclosed to an awardee or contractor entity in connection with the performance, administration, or evaluation of its contract under the conditions of the particular award or contract.

7. Information about an inventor may be included in contractor past performance information disclosed to a federal agency upon request.

8. As prescribed in HHS regulations, HHS may disclose system information to qualified experts not within the definition of HHS employees in order to obtain their advice about patent, licensing, and other issues involved in the transfer, among agencies, of scientific and technical discoveries.

9. HHS may disclose information from this system of records for the purpose of obtaining patent protection for HHS inventions and licenses to:

a. Scientific personnel, both in this agency and other government agencies, and in non-governmental organizations such as universities, who possess the expertise to understand the invention and evaluate its importance as a scientific advance;

b. Contract patent counsel and their employees and foreign contract personnel retained by HHS for patent searching and prosecution in both the United States and foreign patent offices;

c. All other government agencies whom HHS contacts regarding the possible use, interest in, or ownership rights in HHS inventions;

d. Prospective licensees or technology finders who may further make the invention available to the public through sale or use;

e. Parties, such as supervisors of inventors, whom HHS contacts to determine ownership rights, and those parties contacting HHS to determine the Federal Government's ownership; and,

f. The United States and foreign patent offices involved in the filing of HHS patent applications.

10. Disclosure may be made to: (a) Potential clinical trial participants, consistent with the rules and regulations governing the HHS human subjects protections program, when informing the participants of an investigator's financial interests that might be relevant for their consideration when deciding whether or not to participate in a trial (i.e., if the financial interests include interests in an invention); and (b) the general public to reveal summary-level compensation that government scientists receive, under 15 U.S.C. 3710c, on licensed inventions generated during their government work.

11. HHS may disclose information to the National Archives and Records Administration (NARA), General Services Administration (GSA), or other relevant federal agencies pursuant to records management inspections conducted under the authority of 44 U.S.C. 2904 and 2906.

12. A record may be disclosed to appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records; (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

13. A record may be disclosed to another federal agency or federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

14. Records may be disclosed to the Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are stored in electronic media (including, with prior approval, on approved portable/mobile devices such as laptops, tablets, PDAs, USB drives, media cards, portable hard drives, Blackberrys, Smartphones, CDs, DVDs, and/or other mobile storage devices) and in paper form.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by inventor name or identifying number (for example, the NIH Enterprise Directory or NED ID number).

POLICIES AND PROCEDURES FOR RETENTION AND DISPOSAL OF RECORDS:

Currently, all records are retained and disposed of in accordance with NIH records disposition schedule N1-443-10-1 and NIH Manual Chapter 1743, Keeping and Destroying Records, Appendix 1, item 1100-L, which provides for records to be kept for a maximum of thirty years. In the event that separate disposition schedules are required for records managed by FDA and CDC in FY 2017 or later, HHS will submit disposition schedules for approval by the National Archives and Records Administration (NARA) to cover those records.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Measures to prevent unauthorized disclosures are implemented as appropriate for each location or form of storage and for the types of records maintained. Safeguards conform to the HHS Information Security and Privacy Program, https://www.hhs.gov/​ocio/​securityprivacy/​. Site(s) implement personnel and procedural safeguards such as the following:

• Authorized Users: Access is strictly limited to authorized personnel whose official duties require such access (i.e., valid, business need to know).
• Administrative Safeguards: Controls to ensure proper protection of information and information technology systems include, but are not limited to, the completion of a Security Assessment and Authorization (SA&A) package and a Privacy Impact Assessment (PIA) and mandatory completion of annual Information Security and Privacy Awareness training. The SA&A package consists of a Security Categorization, e-Authentication Risk Assessment, System Security Plan, evidence of Security Control Testing, Plan of Action and Milestones (if applicable), Contingency Plan, and evidence of Contingency Plan Testing. When the design, development, or operation of a system of records is performed by a contractor to accomplish an agency function, the applicable Privacy Act Federal Acquisition Regulation (FAR) clauses are inserted in solicitations and contracts.
• Technical Safeguards: Controls that are generally executed by the computer system and are employed to minimize the possibility of unauthorized access, use, or dissemination of the data in the system include, but are not limited to, user identification, password protection, firewalls, virtual private network, encryption, intrusion detection system, common access cards, smart cards, biometrics and public key infrastructure.
• Physical Safeguards: Controls to secure the data and protect paper and electronic records, buildings, and related infrastructure against threats associated with their physical environment include, but are not limited to, the use of the HHS Employee ID and/or badge number and key cards, security guards, cipher locks, biometrics and closed-circuit TV. Paper records are secured in locked file cabinets, offices and facilities. Electronic media are kept on secure servers or computer systems. Records are stored in a dedicated file room or in locking file cabinets in file folders. During normal business hours, assigned agency personnel, including Records Management staff and on-site contractor personnel, regulate availability of the files. During evening and weekend hours the offices are locked.

RECORD ACCESS PROCEDURES:

An individual who wishes to access a record about him or her in this system of records must submit a written request to the relevant System Manager, reasonably specify the record sought, and include (a) the inventor's full name and address, (b) the approximate date(s) the information was submitted, (c) the type(s) of information collected, and (d) the office(s) or official(s) responsible for the collection of information. In addition, the requester must verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act, subject to a fine of up to five thousand dollars. Individuals may also request an accounting of disclosures that have been made of any records about them.

CONTESTING RECORD PROCEDURES:

Records that contain factually incorrect information may be contested. To contest information in a record about you, write to the relevant System Manager; provide the same information described under “Record Access Procedures,” including identity verification information; and specify the information which is contested, the corrective action sought, and the reason(s) for requesting the correction, along with supporting information. The right to contest records is limited to information which is factually inaccurate, incomplete, irrelevant, or untimely (obsolete).

NOTIFICATION PROCEDURES:

An individual who wishes to know if this system of records contains a record about him or her must write to the relevant System Manager and provide the same information described under “Record Access Procedures,” including identity verification information.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

47 FR 45514 (Oct. 13, 1982), 59 FR 55845 (Nov. 9, 1994), 83 FR 6591 (Feb. 14, 2018).

NOTICE OF RESCINDMENT:

The following system of records is rescinded as duplicative of system 09-90-0067:

SYSTEM NAME AND NUMBER:

Invention, Patent, and Licensing Documents Submitted to the Public Health Service by its Employees, Grantees, Fellowship Recipients, and Contractors, 09-25-0168.

HISTORY:

71 FR 46496 (Aug. 14, 2006), 83 FR 6591 (Feb. 14, 2018).