2025-00670. Privacy Act; Implementation

Document Headings

Document headings vary by document type but may contain the following:

1. the agency or agencies that issued and signed a document
2. the number of the CFR title and the number of each part the document amends, proposes to amend, or is directly related to
3. the agency docket number / agency internal file number
4. the RIN which identifies each regulatory action listed in the Unified Agenda of Federal Regulatory and Deregulatory Actions

See the Document Drafting Handbook for more details.

Department of Health and Human Services

1. 45 CFR Part 5b
2. [Docket Number NIH-2022-0002]
3. RIN 0925-AA69

AGENCY:

National Institutes of Health (NIH), Department of Health and Human Services (HHS).

ACTION:

Final rule.

SUMMARY:

The Department of Health and Human Services (HHS or Department) is issuing this final rule to make effective the exemptions that were previously proposed for a new Privacy Act system of records, “NIH Police Records,” maintained by the National Institutes of Health (NIH), from certain requirements of the Act. The new system of records covers criminal and non-criminal law enforcement investigatory material maintained by the NIH Division of Police, a component of NIH which performs criminal law enforcement as its principal function. The exemptions are necessary and appropriate to protect the integrity of law enforcement proceedings and records compiled during the course of NIH Division of Police activities, prevent disclosure of investigative techniques, and protect the identity of confidential sources involved in those activities.

DATES:

This final rule is effective February 18, 2025.

FOR FURTHER INFORMATION CONTACT:

Dustin Close, Office of Management Assessment, National Institutes of Health, 6705 Rockledge Drive, Suite 601, Bethesda, Maryland 20892, telephone [phone], email [e-mail].

SUPPLEMENTARY INFORMATION:

I. Introduction

HHS/NIH published a Notice of Proposed Rulemaking (NPRM) in the Federal Register on June 7, 2024 (89 FR 48536), seeking notice and comment concerning proposed exemptions for a new system of records with respect to certain materials maintained by the NIH Division of Police. These proposals were made in accordance with the Privacy Act of 1974 (Privacy Act) and the Office of Management and Budget (OMB) Circular A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act. This new system of records was described in a System of Records Notice (SORN) that was published in the Federal Register (89 FR 48654) on the same day for notice and comment. A 60-day comment period was provided for both the NPRM and the SORN. The public comment period for both the NPRM and the SORN expired on August 6, 2024. One comment was received in response to the NPRM, and no comments were received in response to the SORN. The comment received in response to the NPRM supported the rulemaking action. HHS/NIH made no changes to the exemptions that were proposed in the NPRM or to the SORN in response to the public comment received. The NPRM, as published on June 7, 2024 (89 FR 48654), provided for the SORN to be effective upon publication of this final rule. Therefore, the SORN, as published on June 7, 2024 (89 FR 48654), is now effective.

II. Background on the NIH Police Division and New System of Records 09-25-0224

The NIH Division of Police, organizationally located within the Office of Research Services (ORS), Office of the Director, NIH, was established in 1968 to provide an immediate and primary law enforcement program for the NIH and derives its authority from Memorandum from the Assistant Secretary for Administration, Office of the Secretary (OS), to the Director, NIH, June 13, 1968, entitled: Delegation of Authority to Assist in Controlling Violations of Law at Certain HEW [Department of Health, Education, and Welfare] Facilities Located in Montgomery County, Maryland; 40 U.S.C. 1315 (Law enforcement authority of Secretary of Homeland Security for protection of public property; a Department of Homeland Security (DHS) delegation of authority to HHS/NIH; and an NIH delegation of authority to the NIH Division of Police); General ( print page 4674) Administrative Delegation of Authority Number 08, Control of Violations of Law at Certain NIH Facilities (Sept. 1, 2020). Based on that establishing authority, the Division of Police performs criminal law enforcement as its principal function. However, the Division of Police conducts criminal, civil, administrative, and regulatory law enforcement investigations.

The NIH Division of Police is directly responsible for the provision of daily law enforcement and criminal and civil investigative activities required to protect the life, safety, and property of NIH employees, contractors, patients, and visitors at NIH. To perform these responsibilities, the NIH Division of Police compiles and maintains records of complaints of incidents, inquiries, investigative findings, arrest records, and court dispositions which are retrieved by personal identifiers and therefore constitute a “system of records” as defined by the Privacy Act at 5 U.S.C. 552a(a)(5). The primary purposes for which the records are used are to: (1) record incidents of crime, civil disturbance, and traffic accidents on the NIH enclave, and the investigation of such incidents; (2) maintain information essential to the protection of life, safety, and property at NIH; (3) provide official records of law enforcement investigative efforts for use in administrative, criminal and/or civil proceedings; and (4) document criminal and civil law enforcement investigations.

III. Eligible Records and Exemptions

The new system of records includes both criminal and non-criminal ( e.g., civil, administrative, regulatory) law enforcement investigatory records which will be retrieved by subject individuals' personal identifiers. Such records are eligible to be exempted from certain Privacy Act requirements, as follows:

• Subsection (j)(2) of the Privacy Act (5 U.S.C. 552a(j)(2)) allows an agency head to exempt from certain Privacy Act provisions a system of records maintained by the agency or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws.
• Subsection (k)(2) of the Act (5 U.S.C. 552a(k)(2)) allows an agency head to exempt from certain Privacy Act provisions a system of records containing investigatory material compiled for law enforcement purposes, other than material within the scope of subsection (j)(2) (for example, material compiled for a civil, administrative, or regulatory law enforcement purpose, or material compiled for a criminal law enforcement purpose by an agency component that does not perform criminal law enforcement as its principal function). This exemption's effect on the subject individual's access rights is qualified in that if any individual is denied any right, privilege, or benefit to or for which the individual otherwise would be entitled by Federal law, or for which the individual would otherwise be eligible, as a result of the maintenance of the system of records, the individual must be provided the requested materials except to the extent that disclosure would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence.

HHS/NIH is establishing the following exemptions for the records:

• Based on5 U.S.C. 552a(k)(2), HHS/NIH is exempting non-criminal ( e.g., civil, administrative, regulatory) law enforcement investigatory material in System No. 09-25-0224 from the requirements in subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Privacy Act, which require the agency to provide an accounting of disclosures; provide notification, access, and amendment rights; maintain only relevant and necessary information authorized by a statute or Executive order; establish and describe procedures whereby an individual can be notified if a system of records contains information pertaining to that individual and how to gain access to pertinent records; identify categories of record sources; and promulgate rules regarding these procedures. The effect of this exemption on a subject individual's access rights will be to permit withholding the records during an ongoing investigation, but limited as required by subsection (k)(2) to information that would reveal the identity of a source who was expressly promised confidentiality in cases in which maintenance of the records results in denial of a Federal right, privilege, or benefit to or for which the individual would otherwise be entitled or eligible.
• Based on subsection5 U.S.C. 552a(j)(2), HHS/NIH is exempting criminal law enforcement investigatory material in System No. 09-25-0224 from the same requirements identified above, and from these additional subsections:

○ (c)(4), requiring the agency to inform disclosure recipients of corrections and notations of dispute affecting disclosed records;

○ (e)(2) and (3), requiring the agency to collect information directly from the subject individual to the greatest extent practicable and to provide a Privacy Act notice to the individual at the time of collection;

○ (e)(5), requiring the agency to maintain records used in agency determinations with sufficient accuracy, relevance, timeliness, and completeness to ensure fairness to individuals;

○ (e)(8), requiring the agency to attempt to notify an individual when a record about the individual is disclosed under compulsory legal process; and

○ (g), subjecting the agency to civil action and civil remedies for noncompliance with access, amendment, and accuracy, relevance, timeliness, and completeness requirements, and for noncompliance that adversely affects an individual.

Notwithstanding the establishment of these exemptions, individual record subjects may submit accounting, access, notification, and amendment requests, and HHS/NIH will consider such requests on a case-by-case basis. Only information that is not factually accurate, or is not relevant, timely, or complete may be contested.

In addition to the exemptions that HHS/NIH is establishing for system of records 09-25-0224 in this final rule, if any law enforcement investigatory material compiled in that system of records is from another system of records in which such material was exempted from access and other requirements of the Privacy Act based on 5 U.S.C. 552a(j)(2), NIH may claim the same exemptions in system of records 09-25-0224 on the same basis ( i.e.,5 U.S.C. 552a(j)(2)) and from the same requirements as in the source system from which they originated.

IV. Exemption Rationales

The following specific rationales explain why each exemption is necessary and appropriate for law enforcement investigation records maintained by the NIH Division of Police, in order to prevent interference with and protect the integrity of pending, closed, and future investigations, including related investigations. All subsections referenced are subsections of 5 U.S.C. 552a.

• Subsection (c)(3) (Provide Accountings of Disclosures). This exemption will apply to both criminal and non-criminal law enforcement investigatory material. Providing an accounting of disclosures to an individual record subject could reveal the existence of a pending or prior investigation or present or past investigative interest on the part of NIH or another agency. This would pose a serious impediment to law enforcement efforts and undermine the investigative ( print page 4675) process by enabling a subject individual or others in concert with that individual to harass, intimidate, or collude with witnesses, destroy, conceal, or tamper with evidence, threaten or endanger law enforcement personnel, alter patterns of behavior, and avoid detection or apprehension by law enforcement authorities.
• Subsection (c)(4) (Inform Disclosure Recipients of Corrections and Notations of Dispute). This exemption applies to only criminal law enforcement investigatory material. Because system of records 09-25-0224 will be exempt from amendment requirements in subsection (d) and HHS/NIH's compliance with amendment requirements therefore will be voluntary, it is necessary and appropriate that HHS/NIH's compliance with the requirement in subsection (c)(4) be voluntary also. This will give HHS/NIH the flexibility to decide which cases warrant expending resources to meet those administratively burdensome requirements.
• Subsection (d)(1) through (4) (Provide Notification, Access, and Amendment Rights). These exemptions apply to both criminal and non-criminal law enforcement investigatory material. Providing subject individuals with the right to be notified of whether the system of records contains a record about them and to access and amend such records could reveal the existence of a pending or prior investigation or present or past investigative interest by NIH or another agency and details about the investigation, including identities of sources of information, personal information about third parties, and sensitive investigative techniques. This could impair pending and future investigations by chilling or deterring sources of information from providing information to investigators (particularly if they are not certain of its accuracy or fear retribution), by providing an opportunity for subject individuals and others acting in concert with subject individuals to tamper with witnesses or evidence, and by allowing individuals to alter their behavior to defeat investigative techniques and avoid detection or apprehension. Complying with amendment requirements could significantly delay investigations while attempts are made to resolve questions of accuracy, relevance, timeliness, and completeness and would impose an impossible administrative burden by requiring investigations to be continuously reinvestigated. In the case of criminal investigations, since the system of records will be exempt from having to maintain records that are accurate, relevant, timely, and complete, the exemption from amendments seeking to correct to those standards is also appropriate.
• Subsection (e)(1) (Maintain Only Relevant and Necessary Information Authorized by Statute or Executive order). This exemption applies to both criminal and non-criminal law enforcement investigatory material. In the course of a law enforcement investigation, and especially in the early stages of an investigation, the relevance and necessity of information obtained or introduced may be unclear or the information may not be strictly relevant or necessary to a specific investigation but may lead to discovery of relevant information. In the interests of effective law enforcement, it is appropriate to retain all information that may aid in establishing patterns of unlawful activity.
• Subsections (e)(2) and (3) (Collect Information Directly From the Subject Individual to the Greatest Extent Practicable, and Provide a Privacy Act Notice). These exemptions apply to only criminal law enforcement investigatory material. It is not always practicable to collect information sought in a criminal law enforcement investigation directly from subject individuals. Individuals who could be adversely affected by an investigation may intentionally provide unreliable information to avoid being implicated in criminal activity. Questioning subject individuals and providing a Privacy Act notice to them (i.e., informing them of the purposes for which information collected from them will be used and disclosed and how providing or not providing it could affect them), could inappropriately reveal the existence, nature, scope, and details of the investigation. This would provide an opportunity for the subject individual or others acting in concert with that individual to conceal evidence, alter patterns of behavior, or take other actions that could thwart investigative efforts; reveal the identity of witnesses in investigations, thereby providing an opportunity for the subjects of the investigations or others to harass, intimidate, or otherwise interfere with the collection of evidence or other information from such witnesses; or reveal the identity of confidential or other informants who provide information to investigators, which would negatively affect an informant's usefulness in any ongoing or future investigations and discourage members of the public from cooperating with future investigations.
• Subsections (e)(4)(G) and (H) (Describe Procedures for Notification, Access, and Amendment). These exemptions apply to both criminal and non-criminal law enforcement investigatory material. Because system of records 09-25-0224 will be exempt from request requirements in subsection (d)(1) through (4) (Provide Notification, Access, and Amendment Rights) and HHS/NIH's compliance with those request requirements will therefore be voluntary, it is appropriate that HHS/NIH's compliance with the requirements in subsection (e)(4)(G) and (H) to provide request procedures be voluntary also. HHS/NIH has included request procedures in the SORN for system of records 09-25-0224 because, notwithstanding the exemptions, individual record subjects may submit access and amendment requests, and HHS/NIH will consider such requests on a case-by-case basis.
• Subsection (e)(4)(I) (Identify Categories of Record Sources in the SORN). This exemption applies to both criminal and non-criminal law enforcement investigatory material. Because the information in these records may come from any source, it is not possible to know every category in advance in order to include them all in the SORN. Further, some record source categories would not be appropriate to publish in the SORN if, for example, revealing them could thwart or impede pending and future law enforcement investigations by enabling record subjects or other individuals to discover sensitive investigative techniques and devise ways to bypass or defeat them to evade detection and apprehension.
• Subsection (e)(5) (Maintain Records Used in Agency Determinations with Sufficient Accuracy, Relevance, Timeliness, and Completeness to Ensure Fairness). This exemption applies to only criminal law enforcement investigatory material. It is not always possible to know whether criminal law enforcement investigation information is accurate, relevant, timely, and complete. With regard to relevance, in the course of a law enforcement investigation, and especially in the early stages of an investigation, the relevance of information obtained or introduced may be unclear or the information may not be strictly relevant to a specific investigation. Compliance with (e)(5) would preclude NIH agents from using their investigative training and exercise of good judgment to both conduct and report on investigations.
• Subsection (e)(8) (Make Reasonable Efforts to Provide Notice of Disclosures Made Under Compulsory Legal Process When Such Process Becomes A Matter of Public Record). This exemption applies to only criminal law enforcement investigatory material. ( print page 4676) Compliance with this requirement would risk revealing an ongoing criminal investigation to the target of an investigation who otherwise might not be aware of it, defeating a law enforcement advantage in those cases. Compliance with this requirement would also risk revealing a criminal investigation by mistake or inappropriately in cases in which an investigation was not in fact a matter of public record or was not intended to be made public.
• Subsection (g) (Civil Liability for Noncompliance with Notification, Access, Amendment, and Accuracy, Relevance, Timeliness, and Completeness Requirements, or for Noncompliance That Causes an Adverse Effect). This exemption applies to only criminal law enforcement investigatory material. The exemption would prevent a subject individual from bringing a civil action against the agency for violations of Privacy Act requirements as to those records; this would include violations of the preceding requirements, from which the agency would be exempt anyway (which violations therefore would be unlikely to support a successful civil action), and any other violations causing an adverse effect on the individual. Any civil action (even an untenable one) could interfere with, delay, and undermine pending and prospective investigations, reveal sensitive investigative techniques and evidence, cause unwarranted invasions of personal privacy, and reveal identities of witnesses, potential witnesses, and confidential sources.

Subsection (f) (Promulgate Rules Regarding These Procedures). This exemption applies to both criminal and non-criminal law enforcement investigatory material provided however, that for investigative material compiled for law enforcement purposes other than material within the scope of 5 UC 552a(j)(2), if any individual is denied any right, privilege, or benefit for which he or she would otherwise be eligible, as a result of the maintenance of these records, such material shall be provided to such individual, except to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence. Compliance with this requirement may help protect the agency from a claim regarding adequacy of or procedural objections to any relevant rules.

For the reasons stated, HHS/NIH believes that the exemptions authorized in 5 U.S.C. 552a(j)(2) and (k)(2) are essential to system of records 09-25-0224 to prevent interference with and protect the integrity of all investigations concerning the NIH Division of Police. In NIH's past experience, not having these protections has led to the overall hinderance of law enforcement operations. These exemptions will help prevent such problems from recurring in the future.

Accordingly, HHS exempts both criminal and non-criminal law enforcement investigatory material in system of records 09-25-0224 NIH Police Records from the requirements in subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Privacy Act, based on 5 U.S.C. 552a(j)(2) and (k)(2), and exempts criminal law enforcement investigatory material in the same system of records from the additional requirements in subsections (c)(4), (e)(2) and (3), (e)(5), (e)(8), and (g) of the Privacy Act, based on 5 U.S.C. 552a(j)(2).

Regulatory Impact Analysis

I. Introduction

We examined the impacts of this rule under Executive Order 12866, Regulatory Planning and Review; Executive Order 13563, Improving Regulation and Regulatory Review; Executive Order 14094, Modernizing Regulatory Review; the Regulatory Flexibility Act (5 U.S.C. 601-612); the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), the Paperwork Reduction Act of 1995 (44 U.S.C. 35-1 et seq., and Executive Order 13132, Federalism.

II. Review Under Executive Orders 12866, 13563, and 14094

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). The Executive Order 14094 entitled “Modernizing Regulatory Review” amends section 3(f) of Executive Order 12866 (Regulatory Planning and Review). The amended section 3(f) of Executive Order 12866 defines a “significant regulatory action” as an action that is likely to result in a rule that may: (1) have an annual effect on the economy of $200 million or more in any 1 year (adjusted every 3 years by the Administrator of OIRA for changes in gross domestic product); or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, territorial, or tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) materially alter the budgetary impacts of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) raise legal or policy issues for which centralized review would meaningfully further the President's priorities or the principles set forth in this Executive order, as specifically authorized in a timely manner by the Administrator of OIRA in each case.

A regulatory impact analysis (RIA) must be prepared for major rules with significant regulatory action/s and/or with significant effects as per section 3(f)(1) ($200 million or more in any 1 year). OMB's Office of Information and Regulatory Affairs has determined that this rulemaking is “not significant” under section 3(f) and does not meet the criteria set forth in 5 U.S.C. 804(2) under Subtitle E of the Small Business Regulatory Enforcement Fairness Act of 1996 (also known as the Congressional Review Act). Thus, an RIA is unnecessary.

This rule renders certain Privacy Act requirements inapplicable to certain records (in this case, law enforcement investigatory records) in accordance with criteria established in the Privacy Act based on a showing that agency compliance with those requirements with respect to those records would harm the effectiveness or integrity of the agency function or process for which the records are maintained (in this case, law enforcement investigations). However, OMB has reviewed this regulation under its Privacy Act oversight authority.

III. Review Under the Regulatory Flexibility Act (5 U.S.C. 601-612)

The Regulatory Flexibility Act requires agencies to analyze regulatory options that would minimize any significant impact of a rule on small entities. Because the rule concerns records about individuals, it imposes no duties or obligations on small entities; the agency therefore certifies that the rule will not have a significant economic impact on a substantial number of small entities.

IV. Review Under the Unfunded Mandates Reform Act of 1995 (Section 202, Pub. L. 104-4)

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that agencies prepare a written statement, which includes an assessment of anticipated costs and ( print page 4677) benefits, before issuing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current inflation-adjusted statutory threshold is approximately $156 million based on the Bureau of Labor Statistics inflation calculator. The agency does not expect this rule will result in any one-year expenditure that would meet or exceed this amount.

V. Review Under the Paperwork Reduction Act of 1995 (44 U.S.C. 35-1 et seq.)

This rule does not contain any information collection requirements subject to the Paperwork Reduction Act.

VI. Review Under Executive Order 13132, Federalism

This rule will not have any direct effects on States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government. Therefore, no federalism assessment is required.

List of Subjects in 45 CFR Part 5b

• Privacy

For the reasons set out in the preamble, the Department of Health and Human Services amends 45 CFR part 5b as follows:

PART 5B—PRIVACY ACT REGULATIONS

1. The authority citation for part 5b continues to read as follows:

Authority: 5 U.S.C. 301, 5 U.S.C. 552a.

2. Amend § 5b.11 by adding paragraph (b)(2)(ix) to read as follows:

§ 5b.11

Exempt systems.

* * * * *

(b) * * *

(2) * * *

(ix) Pursuant to subsections (j)(2) and (k)(2) of the Act:

(A) NIH Police Records, 09-25-0224. (All law enforcement investigatory records are exempt from subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Act; criminal law enforcement investigatory records are exempt from additional subsections (c)(4), (e)(2) and (3), (e)(5), (e)(8), and (g); the access exemption for non-criminal law enforcement investigatory records is limited as provided in subsection (k)(2).)

(B) [Reserved]

* * * * *

Xavier Becerra,

Secretary, Department of Health and Human Services.