E9-25635. Privacy Act of 1974; Report of an Altered System of Records

AGENCY:

Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA).

ACTION:

Notice of an Altered System of Records (SOR).

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, the Health Resources and Services Administration (HRSA) is proposing to: change the security classification of the system from low to moderate; add an additional system location, to reflect the creation of a system contingency site; delete language from authorized users of the system; add information on physical safeguards pertaining to system security; delete the use of a receptionist controlled area from the physical safeguards for the system; change the room number for the system manager; change the legal authority cited for maintenance of system information; add a new routine use to Information Center (IC) Integrated Clearinghouse System (ICS), 09-15-0067, last published at 72 Federal Register 44846-44847 (August 9, 2007). The HRSA Office of Communications is responsible for the HRSA IC/ICS System of Records (SOR), which is an existing Agency SOR.

DATES:

HRSA filed an altered system report with the Chair of the House Committee on Government Reform and Oversight, the Chair of the Senate Committee on Homeland Security and Governmental Affairs, and the Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget (OMB) on October 15, 2009. To ensure all parties have adequate time in which to comment, the altered system, including the routine use, will be become effective 30 days from the publication of the notice or 40 days from the date it was submitted to OMB and Congress, whichever is later, unless HRSA receives comments that require alterations to this notice.

ADDRESSES:

Please address comments to Project Officer, Health Resources and Services Administration, Office of Communications, 5600 Fishers Lane, Room 14-27, Rockville, Maryland 20857; Telephone [phone]. Comments received will be available for inspection at this same address from 9 a.m. to 3 p.m. (Eastern Standard Time Zone), Monday through Friday. This is not a toll-free number.

FOR FURTHER INFORMATION CONTACT:

Judy Andrews, Acting Director, Office of Communications, Health Resources and Services Administration, 5600 Fishers Lane, Room 14-27, Rockville, Maryland 20857, Telephone: [phone]. Please note this is not a toll free telephone number.

SUPPLEMENTARY INFORMATION:

HRSA proposes to: Change the security classification of the system from low to moderate to reflect the existence of Personally Identifiable Information (PII) in the system; add an additional system location, to reflect the creation of a system contingency site for use in the event of an emergency or disaster; delete language from authorized users of the system; add information on physical safeguards pertaining to system security; delete the use of a receptionist controlled area from the physical safeguards for the system; change the room number for the system manager from 14-45 to 14-27; change the legal authority cited for maintenance of system information; add the following routine use language to the HRSA IC/ICS SOR: “To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.”

Dated: October 2, 2009.

Mary K. Wakefield,

Administrator.

SYSTEM NUMBER:

09-15-0067

SYSTEM NAME:

HRSA Information Center (IC) Integrated Clearinghouse System (ICS)

SECURITY CLASSIFICATION:

Moderate.

SYSTEM LOCATION(S):

HRSA IC, Circle Solutions, Inc., Corporate Office, 8280 Greensboro Drive, Suite 300, McLean, VA 22102; HRSA IC, Circle Solutions, Inc., Distribution Center, 22815 Glenn Drive, Suite 103, Sterling, VA 20164.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Members of the Public who Request Information or Publications from the HRSA IC.

CATEGORIES OF RECORDS IN THE SYSTEM:

The system includes: names, addresses, and telephone numbers of individuals who place orders via telephone, web, or written request for a 12-month period within receipt of the request.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

5 U.S.C. 301

PURPOSE(S) FOR RECORDS IN THIS SYSTEM:

To facilitate the delivery of publications and the response to questions pertaining to HRSA programs as requested by members of the general public.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

1. Disclosure may be made to a congressional office from the records of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.

2. In the event of litigation where the defendant is:

a. The Department, any component of the Department, or any employee of the Department in his or her official capacity;

b. The United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or,

c. Any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.

3. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.

4. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

1. Storage: All records are maintained in computer data files on servers maintained by the HRSA IC.

2. Retrievability: Records are maintained for ready retrieval and customer quality assurance by HRSA IC staff by requestor name for orders placed within the previous rolling 12-month period.

3. Safeguards:

Authorized users: Access to records is limited to designated HRSA IC staff. The HRSA IC maintains current lists of authorized users.

Physical safeguards: All computer equipment and files are stored in areas where fire and life safety codes are strictly enforced. All automated documents are protected on a 24-hour basis. Perimeter security includes intrusion alarms and key card controls. No hard copy files are maintained. Computer files are password protected and are accessible only by use of computers which are password protected.

Procedural safeguards: A password is required to access computer files. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised area. All authorized users sign a nondisclosure statement. All passwords, keys and/or combinations are changed when a person leaves or no longer has authorized duties. Access to records is limited to those authorized personnel trained in Government privacy procedures.

RETENTION AND DISPOSAL:

Records of orders placed with the HRSA IC are maintained for 12 months, after which the records are purged from the system. Orders received by mail are shredded after the required information is entered into the HRSA IC/ICS.

SYSTEM MANAGER(S) AND ADDRESS:

Director, Office of Communications, Health Resources and Services Administration, 5600 Fishers Lane, Parklawn Building, Room 14-27, Rockville, Maryland 20857

NOTIFICATION PROCEDURE:

Individuals may learn about personal information maintained in the system by contacting the system manager at the address above.

RECORD ACCESS PROCEDURES:

Same as notification procedure. Requestors should also provide a reasonable description of the record being sought. Requesters may also request an accounting of disclosures that have been made of their records, if any.

CONTESTING RECORD PROCEDURES:

Contact the system manager as identified above, and reasonably identify the record contested, the corrective action sought, and the reason for seeking the information to show how the record is inaccurate or incomplete.

RECORD SOURCE CATEGORIES:

Members of the general public who voluntarily make publication or information requests.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:

None.