2023-01145. Notice of Privacy Act of 1974; System of Records

AGENCY:

Office of Infectious Disease and HIV/AIDS Policy, Office of the Assistant Secretary for Health, Office of the Secretary, Department of Health and Human Services.

ACTION:

Notice of a new system of records.

SUMMARY:

In accordance with the Privacy Act, the Department of Health and Human Services (HHS) is establishing a new system of records to be maintained by the Office of Infectious Disease and HIV/AIDS Policy within the Office of the Assistant Secretary for Health (OASH/OIDP), System No. 09-90-2101 “HIV Prevention Medication Distribution Records.” The new system of records will consist of records about individual patients who participate in the Ending the HIV Epidemic—Pre-Exposure Prophylaxis Implementation and Distribution Services Program (PrEP Program), which will provide donated HIV prevention medication to patients in the United States who are at substantial risk of acquiring the human immunodeficiency virus (HIV).

DATES:

In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is effective upon publication, subject to a 30-day period in which to comment on the routine uses, described below. Please submit any comments by February 22, 2023.

ADDRESSES:

The public should submit comments on the new system of records by email to [e-mail].

FOR FURTHER INFORMATION CONTACT:

General questions about the system of records may be submitted to Ann Abercrombie, OASH/OIDP at [phone], or [e-mail].

SUPPLEMENTARY INFORMATION:

Within the U.S. Department of Health and Human Services (HHS), the Office of the Assistant Secretary for Health (OASH) leads development of agency-wide public health policy recommendations and oversees core public health offices, including the Office of the Surgeon General and the U.S. Public Health Service Commissioned Corps, as well as 10 regional health offices across the nation and 10 presidential and secretarial advisory committees. The mission of the Office of Infectious Disease and HIV/AIDS Policy (OIDP) is to provide strategic leadership and management, while encouraging collaboration, coordination, and innovation among federal agencies and stakeholders to reduce the burden of infectious diseases, including the human immunodeficiency virus (HIV).

The initiative to End the HIV Epidemic in the U.S. is part of a national HIV prevention and control effort to reduce the number of new HIV infections by 75% in five years and 90% in 10 years. A key component of the initiative is expanding access to HIV prevention medication for patients who are at substantial risk of acquiring the disease. Pursuant to a donation agreement executed May 8, 2019, a drug manufacturer, Gilead Sciences, Inc. (Gilead), donated certain HIV prevention medication (emtricitabine/tenofovir disoproxil fumarate and emtricitabine/tenofovir alafenamide tablets, collectively referred to as “Product”) to HHS for distribution through the Ending the HIV Epidemic—Pre-Exposure Prophylaxis (PrEP) Implementation and Distribution Services Program (PrEP Program), which will be administered by OASH/OIDP subject to the terms of the donation agreement between Gilead and HHS. Under the terms of the donation agreement, Gilead will donate Product for up to 200,000 individuals each year up to end of 2030 or earlier. The PrEP Program, through a contractor engaged by OASH/OIDP, will issue an enrollment card or electronic enrollment confirmation, containing a unique identification number, to each qualified eligible patient in the United States who applies to the program (up to 200,000 individuals per year). This will enable the patient to obtain the Product at no cost, either in person or by mail, from a participating pharmacy. The contractor will operate a mail order pharmacy to acquire the Product from Gilead and dispense it to patients who elect to receive the Product by mail. The contractor will also engage a subcontractor to serve as a claims processor to verify the validity of enrollment identification numbers for pharmacies before pharmacies dispense the Product, and to reimburse the pharmacies' acquisition costs and taxes. All prescription and shipping costs will be 100% covered by OIDP and the Gilead donation. However, costs that patients incur for clinic visits and lab tests required to remain eligible for the program are not covered by the program.

The mail-order pharmacy and other pharmacies that wish to participate in the program must sign an agreement with HHS agreeing that they will donate their services (agreeing to be reimbursed only for wholesale acquisition cost and taxes for the Product they dispense). Participating pharmacies also sign an addendum with the claims processor acknowledging that they will receive reimbursement for wholesale acquisition cost and taxes only, with no dispensing or other fees. The list of participating pharmacies is available on this website https://www.hiv.gov/​federal-response/​ending-the-hiv-epidemic/​prep-pharmacies.

The claims processor (subcontractor) will have access to enrollment identification numbers and the dates the numbers are valid (not other information about patients). The contractor will collect and maintain all records needed to determine patients' initial and continued eligibility for the Program and to operate the mail-order pharmacy. The contractor will, for example, obtain twice yearly confirmations of the patient's continued eligibility from the patient and the patient's prescribing health care provider; and, if the patient elects mail order, the contractor will notify the provider to send the prescription to the mail-order pharmacy to be filled. The mail-order pharmacy will confirm the patient's shipping information and current eligibility for the program, using the patient's enrollment identification number.

Dated: December 6, 2022.

Rucia A. Abercrombie,

Lead Management Analyst, OIDP.

SYSTEM NAME AND NUMBER:

HIV Prevention Medication Distribution Records, 09-90-2101.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

The address of the agency component responsible for the system of records is the Office of Infectious Disease and HIV/AIDS Policy (OASH/OIDP), U.S. Department of Health & Human Services, 330 C St. SW—Suite L100, Washington, DC 20024. The records will be housed in a contractor-owned information technology (IT) system.

SYSTEM MANAGER(S):

Director, Office of Infectious Disease and HIV/AIDS Policy (OASH/OIDP), Department of Health & Human Services, 330 C St. SW-Suite L100, Washington, DC 20201, [phone].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Authorization to collect and maintain the records is provided under sections 301, 1702, and 1703 of the Public Health Service Act (42 U.S.C. 241, 300u-1, and 300u-2).

PURPOSE(S) OF THE SYSTEM:

The records in this system of records will be used to administer the Pre-Exposure Prophylaxis (PrEP) Implementation and Distribution Services Program (PrEP Program, or Program), the goal of which is to distribute donated HIV prevention medication (Product) appropriately to qualifying patients in the United States who are at high risk of acquiring HIV, in order to reduce transmission of HIV. To administer the Program, OASH/OIDP, through a contractor, will use the records for these specific purposes:

• To determine if patients who apply for enrollment in the Program are eligible to receive the Product under the terms of the donation agreement between HHS and the drug manufacturer, Gilead Sciences, Inc. (Gilead);
• To enroll qualified eligible patients in the Program and issue an enrollment card or confirmation containing a unique enrollment identification number to each enrolled patient, and, thereafter, to confirm each patient's continued eligibility to remain enrolled in the Program;
• To verify the validity of enrollment identification numbers, for Product dispensing and cost reimbursement purposes.
• To reimburse participating pharmacies' wholesale acquisition cost and taxes, for the Product they dispense to patients;
• To monitor and audit the Program to prevent, detect, and address any program violations, errors, fraud, and improper distribution of benefits, to ensure the integrity of the Program; and
• To compile statistics for reports and to conduct research to evaluate the effectiveness of the Program.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The records will be about patients who apply for Product through the PrEP Program.

CATEGORIES OF RECORDS IN THE SYSTEM:

The records will consist of application records, enrolled patient records, and reimbursement records.

• Application records will include information needed to identify a patient and verify the patient's initial eligibility to be enrolled in the Program, to include: patient name, date of birth, location, and the last four digits of the patient's Social Security Number; name and address of prescribing practitioner and practice location; the patient's certification that the patient is not covered by a health insurance plan or policy that covers outpatient prescription drugs; and the patient's consent to information sharing between OASH/OIDP, its contractor, the Product manufacturer, and the patient's prescribing health care provider. A patient (or the patient's health care provider) can submit an application to the program through the Program's online portal or call center hub. Demographic information (race, ethnicity, gender identity, and sex assigned at birth) will be included in both application records and enrolled patient records, for statistical purposes only, to use in government analyses of the data at an aggregate level.

• Enrolled patient records will include the above application information; a unique identifier assigned to the patient by the OASH/OIDP contractor (included on the patient's enrollment card or enrollment confirmation); twice yearly confirmations of the patient's continued eligibility ( e.g., negative HIV status based on quarterly HIV tests) from the patient's prescribing health care provider; amount of Product dispensed to the patient, reported by the participating pharmacy; and periodic re-certification(s) from the patient attesting that the patient is not covered by a health insurance plan or policy that covers outpatient prescription drugs. The records will also indicate whether the patient elected to receive Product by mail or was issued an enrollment card to use to obtain the Product from the participating pharmacy's customary retail inventory.

• The claims processor will use the enrollment identification number provided by a participating pharmacy to verify patient eligibility in the program and to generate a claim number used to reimburse the pharmacy's wholesale acquisition cost and taxes for the Product dispensed.

RECORD SOURCE CATEGORIES:

Information in the patient's application records and enrolled patient records will be obtained directly from the patient or the patient's prescribing health care provider. The OASH/OIDP contractor will assign the unique enrollment identification number to the patient upon enrollment.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to other disclosures that may be made without the patient's prior, written consent which are authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(1)-(b)(2) and (b)(4)-(11), HHS may disclose information about a patient from this system of records to parties outside the agency pursuant to these routine uses.

1. Records may be disclosed to agency contractors, consultants, or others who have been engaged by the agency to assist in accomplishment of an HHS function relating to the purposes of this system of records and who need to have access to the records in order to assist HHS. Note that this routine use will authorize any such disclosures which are not adequately covered by the patient's consent provided on or with the enrollment application. Any contractor will be required to comply with the requirements of the Privacy Act.

2. Records may be disclosed to a patient's prescribing healthcare provider to verify the patient's initial, or continued, eligibility for enrollment. Note that this routine use will authorize any such disclosures which are not adequately covered by the patient's consent on or with the enrollment application.

3. Records may be disclosed to Gilead Sciences, Inc., to ensure individuals are not actively enrolling in both Gilead's Advancing Access program and HHS' Ready, Set, PrEP program simultaneously. Note that this routine use will authorize any such disclosures which are not adequately covered by the patient's consent on or with the enrollment application.

4. Information may be disclosed to the U.S. Department of Justice (DOJ) or to a court or other tribunal in litigation or other proceedings, when the agency or any component thereof, or any employee of the agency in his or her official capacity, or any employee of the agency in his or her individual capacity where DOJ has agreed to represent the employee, or the United State Government is a party to the proceedings or has an interest in such proceedings and, by careful review, HHS determines that the records are both relevant and necessary to the proceedings.

5. Records may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of that individual.

6. Records may be disclosed to representatives of the National Archives and Records Administration (NARA) during records management inspections conducted pursuant to 44 U.S.C. 2904 and 2906.

7. Records may be disclosed to appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records, (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the federal government, or national security, and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

8. Records may be disclosed to another federal agency or federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the federal government, or national security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

The records will be stored on electronic media.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records will be retrieved by the patient's unique enrollment identification number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

OASH is developing a disposition schedule for the records and plans to propose a retention period of approximately 10 years for the records. Until the schedule has been submitted to and approved by the National Archives and Records Administration (NARA), the records will be retained indefinitely.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

The records will be safeguarded in accordance with applicable laws, rules and policies, including the pertinent National Institutes of Standards and Technology (NIST) publications and OMB Circular A-130, Managing Information as a Strategic Resource. Records will be protected from unauthorized access through appropriate administrative, physical, and technical safeguards. Safeguards will conform to the HHS Information Security and Privacy Program, https://www.hhs.gov/​ocio/​securityprivacy/​.

The safeguards will include protecting the facilities where records are stored or accessed with security guards, badges and cameras; limiting access to electronic databases to authorized users based on roles and the principle of least privilege and either two-factor authentication or user name and password; using a secured operating system protected by encryption, firewalls, and intrusion detection systems; using an SSL connection for secure encrypted transmissions; requiring encryption for records stored on removable media; and training personnel in Privacy Act and information security requirements. Records that are eligible for destruction will be disposed of using secure destruction methods prescribed by NIST SP 800-88.

RECORD ACCESS PROCEDURES:

An individual seeking access to records about him or her in this system of records must submit a written access request to the System Manager (see above “System Manager” section). The request must contain the requester's full name, address, and signature. The request should also contain the requester's contact information and sufficient identifying particulars (such as, the unique identifier from the individual's enrollment card or enrollment confirmation) to enable HHS to locate the requested records. To verify the requester's identity, the signature must be notarized or the request must include the requester's written certification that the requester is the individual who the requester claims to be and that the requester understands that the knowing and willful request for or acquisition of records pertaining to an individual under false pretenses is a criminal offense subject to a fine of up to $5,000. Requesters may also ask for an accounting of disclosures that have been made of records about them, if any.

CONTESTING RECORD PROCEDURES:

An individual seeking to amend a record about him or her in this system of records must submit a written amendment request to the System Manager (see above “System Manager” section), containing the same information required for an access request and including verification of the requester's identity in the same manner required for an access request. In addition, the request must reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction; and should include supporting information, showing how the record is inaccurate, incomplete, untimely, or irrelevant.

NOTIFICATION PROCEDURES:

An individual who wishes to know if this system of records contains records about that individual must submit a written notification request to the System Manager (see above “System Manager” section). The request must contain the same information required for an access request and and must include verification of the requester's identity in the same manner required for an access request.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

None.