2023-23964. Privacy Act of 1974; System of Records

AGENCY:

Indian Health Service, Department of Health and Human Services.

ACTION:

Notice of a new system of records.

SUMMARY:

In accordance with the Privacy Act of 1974, as amended, the Department of Health and Human Services (HHS) is establishing a new system of records maintained by the Indian Health Service (IHS) Office of Clinical and Preventive Services (OCPS), System Number 09–17–0006, “Community Health Aide Program (CHAP) Records.” The records in the new system of records are about individual healthcare providers who have applied for Federal certification under the Community Health Aide Program (CHAP) created under the Indian Health Care Improvement Act, as amended; and individuals serving as CHAP Certification Board members who review and evaluate the certification/recertification applications for completeness and verify that the candidates meet the minimum standards for certification. The CHAP Certification Board will provide the respective Area Director with its recommendation to either certify, recertify, or deny certification after reviewing the certification applications.

DATES:

In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is applicable October 31, 2023, subject to a 30-day comment period on the routine uses described below. Please submit any comments by November 30, 2023.

ADDRESSES:

Written comments may be submitted by mail or email to: Dr. Lori Christensen, Chief Medical Officer, IHS, 5600 Fishers Lane—Mail Stop: 08E37A, Rockville, MD 20857, or [e-mail]. Comments are reviewable at same location. To review comments in person, please contact the Office of the Chief Medical Officer at 240–701–3890.

FOR FURTHER INFORMATION CONTACT:

General questions about this system of records may be submitted to Heather McClane, IHS Privacy Act Officer, ATTN: National Community Health Aide Program, 5600 Fishers Lane—Mail Stop: 09E70, Rockville, MD 20857, or by email at [e-mail], or by phone at 240–479–8521. General questions may also be submitted to the Community Health Aide Program, Office of Clinical and Preventive Services, at [e-mail]. Additional information is available at www.ihs.gov/​chap.

SUPPLEMENTARY INFORMATION:

Consistent with 25 U.S.C. 1616 l, the records system will be referred to as the Community Health Aide Program (CHAP) Records. The purpose of the new system of records is to preserve and process records related to Federal certification of health providers under the CHAP. CHAP providers include the disciplines and provider types approved by the National CHAP Certification Board.

The records include: (1) applications for CHAP certification submitted by individual providers (those seeking certification at any level— e.g., levels I, II, III, IV, Practitioner, and Therapist, those seeking recertification, those previously certified seeking an additional or different certification, those denied Federal certification, and those with revoked Federal certification); and (2) the qualifications and recommendations of CHAP certification board members who review certification applications and provide recommendations to Area Directors for the certification, recertification, or denial of certification. The Area Certification Board may also provide review requests for decertifications and make recommendations to Area Directors to decertify individual providers.

A Tribe or Tribal Organization supporting a CHAP Certification Board under an Indian Self-Determination and Education Assistance Act (ISDEAA) agreement may maintain a copy of a record, but the Tribe's copy would be a Tribal record, not a Federal agency record that is subject to the Privacy Act, Federal Records Act, or the Freedom of Information Act, nor would it constitute the official Federal record.

Roselyn Tso,

Director, Indian Health Service.

SYSTEM NAME AND NUMBER:

Community Health Aide Program (CHAP) Records, 09–17–0006.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

The addresses of the agency components responsible for the system of records are found in the Appendix.

SYSTEM MANAGER(S):

The official listed in the Appendix for the Area Office that processed the particular certification application involving the subject individual as an applicant, or with respect to a board member from that Area's Certification Board, is the relevant System Manager who the subject individual must contact to make a Privacy Act request.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

The Indian Health Care Improvement Act, as amended (25 U.S.C. 1601 et seq.), and specifically 25 U.S.C. 1616 l.

PURPOSE(S) OF THE SYSTEM:

The records in this system of records will be used to implement the CHAP under 25 U.S.C. 1616 l, including for these principal purposes:

1. Purposes for which records about individual providers will be used:

• To process applications for certification that are submitted by prospective, current, and former CHAP providers seeking initial or renewal Federal certification to provide community health care, behavioral health, oral health services, or other services authorized by the IHS National CHAP Certification Board to be provided in a Federal or Tribal facility operating a CHAP.
• To document the dates and certification status of CHAP providers, including changes/modifications in categories and levels of certification. An example of a category modification would be a Dental Health Aide Therapist adding a level I Behavioral Health Aide certification. An example of a change in level would be a level IV Community Health Aide becoming a Community Health Aide Practitioner.
• To secure reciprocity for CHAP providers across jurisdictions and IHS-defined geographical areas (often referred to as “Areas”) by enabling the National Certification Board, in its oversight role, to ensure each Area's education/training requirements, standards and procedures meet or exceed the National standards.

• To ensure that Federal and Tribal healthcare facilities seeking to hire current, prospective, and former Federally certified CHAP providers have access to the certification status of providers certified under 25 U.S.C. 1616 l.

• To ensure that CHAP providers are qualified, competent, and capable of delivering quality healthcare consistent with the National CHAP Program Standards and Policies at large, and that the CHAP providers' scopes of practice are in line with their competency, their training, and the ability of the facility to provide adequate support, equipment, services, and staff.
• To inform the staff of health care facilities seeking to employee CHAP providers for the purpose of assessing the providers' professional competence, character, and fitness.
• To inform State health professional boards that have oversight of CHAP providers of information they need to carry out their legally assigned functions.

2. Purposes for which records about CHAP Certification Board members will be used:

• For board staffing and other administrative purposes and to ensure program integrity ( i.e., to recruit and select individuals who are qualified to render certification decisions that maintain appropriate CHAP levels of care).

• To document each member's membership effective dates and separations, qualifications, and decisions related to Area Certification Board recommendations to Area Directors.

IHS may also use the records for secondary purposes, such as program planning and evaluation, individual evaluation, continuous quality improvement, compiling of numbers and types of providers certified each cycle, and other purposes consistent with the authorities in 25 U.S.C. 1616 l.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The records will be about these categories of individuals:

• Prospective, current, and former CHAP providers working or seeking to work in Tribal and Federal healthcare facilities and those denied certification, described in more detail as follows:

○ Prospective —Those who have sought Federal certification and are awaiting a decision.

○ Current —Those who have sought Federal certification and have been recommended and issued Federal certification for any level of provider approved by the National CHAP Certification Board. This includes those who may have advanced, regressed, or changed their provider type category.

○ Former —Those who sought Federal certification and were recommended and issued Federal certification for any level of recognized CHAP providers but whose certification is not current.

○ Individuals Denied Certification or Certification Revoked —Those who applied for certification but whose application for certification was denied or had certifications revoked.

• Individuals serving as CHAP Certification Board Members who review applications for certification/recertification and requests for decertifications to make recommendations to the respective Area Director.

CATEGORIES OF RECORDS IN THE SYSTEM:

The categories of records will include:

1. Application for CHAP certification, which contains:

a. the legal name, other names/alias, and date of birth of the provider/applicant;

b. provider/applicant contact information such as mailing and email addresses, phone number, and communication preferences;

c. the names and dates of training and education programs attended, skills verification with address and contact phone number, including such programs attended as required for renewal or continuation of certification;

d. applicable employment information such as employer, employer address, work phone, work email, fax, and states where services are provided or intend to be provided; and

e. application status ( e.g. complete, incomplete, provisional, approved, denied).

2. Additional records may include:

a. transcripts and training logs from educational/training programs;

b. documentation of previous certifications held, revoked, or denied;

c. information regarding liability insurance coverage;

d. professional performance and achievement records, such as, continuing education certificates, performance awards, adverse or disciplinary actions, and evaluations and approvals completed by employers and supervisors; and employer-validated complaints against providers;

e. records relating to the processing of and decision on applications for Federal certification and recertification or decertification; and for other relevant Federal certification and recertification or decertification actions; and

f. records related to the qualifications of Certification Board Members, including letters of nomination, letters from supervisors indicating support of or opposition to nominations, Curriculum Vitae, professional contact information, and dates of membership.

RECORD SOURCE CATEGORIES:

Information in the records may be provided by these sources:

• subject individual;
• CHAP Certification Boards;
• educational institutions attended;
• continuing education entities;
• internship, preceptorship, and practicum sites;
• human resource departments;
• professional associations;
• State and Tribal licensing boards;
• financial institutions from which these applicants have obtained educational loans;
• HHS contractors/subcontractors;
• PHS Commissioned Personnel Operations Division and U.S. Office of Personnel Operations Division and U.S. Office of Personnel Management personnel records;
• any HHS OPDIV or other Federal agencies maintaining records relevant to the applicant's qualifications, such as an agency where the individual worked as an employee or contractor, or the Department of the Treasury which maintains records of individuals disqualified to receive Federal payments;
• State or local governments;
• professional boards such as the Federation of State Medical Boards or similar non-government entities; and
• third parties providing reviews concerning the subject individual.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to the disclosures authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(1), (b)(2), and (b)(4) through (b)(11), these routine uses specify circumstances under which the agency may disclose information from this system of records to a non-HHS officer or employee without the consent of the subject individual. IHS will prohibit redisclosures, or may permit only certain redisclosures, as required or authorized by law. Each proposed disclosure permitted directly in the Privacy Act or under these routine uses will also be evaluated to ensure that the disclosure is legally permissible under any other applicable laws.

1. Disclosures for Evaluation of Healthcare Delivery Services. Records about applicants and certified providers may be disclosed to organizations authorized to conduct evaluation studies concerning the delivery of health care services by the IHS and HHS ( e.g., Joint Commission on the Accreditation of Healthcare Organizations).

2. Disclosures to CHAP Certification Boards and Contractors to perform duties. Certification records about CHAP providers may be disclosed to CHAP Certification Boards authorized by IHS, consistent with 25 U.S.C 1616 l. This includes disclosures to the non-Federal members of a CHAP Certification Board and to employees of a Tribe or Tribal organization who have a need to have access to the information in performance of their duties or activities for such boards and organizations operating under an Indian Self-Determination and Education Assistance Act (ISDEAA) agreement.

3. Disclosures for certification software vendors/contractors. Records may be disclosed to a certification software vendor performing or working on a contract for IHS and who has a need to have access to the information in the performance of its duties or activities for IHS in accordance with law and with the contract.

4. Disclosures for Evaluation or Verification of Application Data. IHS may disclose biographic data and information supplied by an applicant to (a) contacts listed on the applications and associated forms for the purpose of evaluating the applicant's professional qualifications, personal characteristics, experience, and suitability, (b) a Federal, state, or local government health profession licensing or certification board, or (c) a health care oversight or professional monitoring organization or program ( e.g., accreditation surveyors, or the National Practitioner Data Bank) for the purpose of verifying that a clinician's claimed background and employment data are valid and all claimed credentials are current and in good standing.

5. Disclosures for Reimbursement of Care Purposes. Records about a provider's certification status may be disclosed to Federal, state, private and third-party payers that need to know the provider's certification status to issue reimbursements for care rendered by the provider.

6. Disclosures to OPM. Records about providers may be disclosed to the Office of Personnel Management (OPM) if the records are relevant to the individual's application for or maintenance of Civil Service appointments.

7. Disclosures for human resource matters. Records pertaining to IHS certification decisions may be disclosed to Federal, state, local, or Tribal entities when necessary for them to address human resources matters arising from IHS certification decisions.

8. Disclosures for Compliance Monitoring. Records about a current provider or board member may be disclosed to relevant governmental agencies for the purpose of monitoring the individual's compliance with applicable laws and standards, on an ongoing basis, to ensure that the individual remains qualified for Federal certification or to serve as a CHAP Certification Board member.

9. Disclosure to Department of Justice or in Proceedings. HHS may disclose information from this system of records to the Department of Justice (DOJ), or to a court or other tribunal, when any of the following is a party to litigation or similar proceedings or has an interest in such proceedings, and HHS determines that the proceedings are likely to affect HHS or any of its components: (a) HHS, or any component thereof; (b) any HHS employee in their official capacity; (c) any HHS employee in their individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof. In order to disclose information in these circumstances, HHS must determine that the use of such records by the DOJ, the court or other tribunal is relevant and necessary to the proceedings and would help in the effective representation of the governmental party or interest.

10. Disclosures to Congressional Office. Records may be disclosed to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.

11. Reporting Violations or Potential Violations of Law. In the event that a record in this system of records on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, the relevant records in this system of records may be referred to the appropriate agency, whether Federal, state, local, or Tribal, charged with enforcing or implementing the statute or rule, regulation, or order issued pursuant thereto.

12. Disclosure in the Event of a Security Breach Experienced by HHS. Records may be disclosed to appropriate agencies, entities, and persons when: (1) HHS suspects or has confirmed that there has been a breach of the system of records; (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

13. Disclosure to Assist another Agency Experiencing a Security Breach. Records may be disclosed to another Federal agency or Federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in: (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

14. Medical Quality Assurance Disclosures. Records about providers and board members may be disclosed for any purpose authorized by 25 U.S.C. 1675(d) or (e)(2). To the extent the records are protected by 25 U.S.C. 1675, the records may only be disclosed in accordance with the exceptions in 25 U.S.C. 1675(d) and (e)(2).

15. Disclosures of Certification Status. Records about current or former CHAP providers, individuals denied certification, or individuals seeking certification may be disclosed to Federal, state, local and Tribal governmental entities with authority to maintain records concerning the issuance, retention, or revocation of Federal certifications necessary to practice a health professional occupation or specialty.

16. Disclosures to the public. Information about a provider's certification status may be made public for awareness of which providers are currently in good standing as CHAP providers, or to share how many providers are certified to help determine the need for more providers or training facilities based on clinical need, and would be limited to information that would be required to be disclosed to the public under the Freedom of Information Act.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

The records will be stored in file folders and computer-based electronic files on the secure IHS network indexed by name and record number in accordance with current IHS policy.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

The records will be retrieved by the subject individual's name or certification number (for current and former CHAP providers) and any other identifying numbers necessary to ensure that the records retrieved are about the intended individual.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Upon approval of a disposition schedule by the National Archives and Records Administration (NARA), the records will be disposed of when eligible for destruction under the schedule, if the records are no longer needed for administrative, audit, legal, or operational purposes. While the records are unscheduled, they must be retained indefinitely. Note that CHAP is an expansion of the use of CHAP providers throughout the IHS health system, and only the Alaska CHAP maintains historical and archived records.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

The records will be protected from unauthorized access by the following safeguards. All safeguards will conform to applicable laws, rules, and policies, including the HHS Information Security and Privacy Program, https://www.hhs.gov/​ocio/​securityprivacy/​, the E-Government Act of 2002, as amended (44 U.S.C. ch. 35), pertinent National Institutes of Standards and Technology (NIST) publications, and OMB Circular A–130, Managing Information as a Strategic Resource.

Authorized Users: Access will be limited to authorized users who (1) have a need for such records in the performance of their official duties and (2) are advised of the confidentiality of the records and the civil and criminal penalties for misuse. Particularly as the IHS transitions to an electronic records system, authorized users may include individuals and entities outside of HHS who are given certain access for purposes of facilitating specific disclosures authorized under the Privacy Act, including the routine uses described above. For example, authorized users may include: National Certification Board members, Area Certification Board members, IHS Area Offices, Office of Clinical and Preventive Services CHAP staff, clinical supervision staff and additional IHS or Tribal staff with oversight responsibilities related to CHAP providers within an Indian Health Program, as defined in 25 U.S.C. 1603(12).

At each location where records in this system will be maintained, a list of users or categories of users having an official need-to-know has been developed and is maintained.

Physical Safeguards: Paper records will be kept in locked metal filing cabinets or in locked desk drawers in secured rooms at all times when not actually in use during working hours and at all times during non-working hours. Record storage areas, including file cabinets and desks, are not left unattended or unlocked during office hours, including lunch hours.

Administrative Safeguards: Only persons who have an official need-to-know will be entrusted with records from this system of records, and they will be instructed to safeguard the confidentiality of the records and to destroy all copies or to return such records when the need to know has ended. Instructions will include the statutory penalties for noncompliance. Proper charge-out procedures will be followed for the removal of records from the area in which they are maintained. Authorized users will receive privacy and security training before record access is granted and annually thereafter. When copying records for authorized purposes, employees are instructed to ensure that any imperfect pages are not left in the reproduction room where they can be read but are destroyed or obliterated. Area Privacy Coordinators have routine access for monitoring compliance with privacy regulations.

Technical Safeguards: Records in the electronic system will be secured by encryption and intrusion detection systems. Access to electronic records will be controlled by user name and password.

RECORD ACCESS PROCEDURES:

To request access to records about you in this system of records, submit a written access request addressed to the relevant System Manager (see the Appendix and the “System Manager(s)” section of this SORN). The request must:

• Reasonably describe the records sought.
• Include (as applicable) the name of the IHS Service Unit relevant to your certification application, or the name of the Area Certification Board on which you served, and pertinent dates.
• Include (for contact purposes and identity verification purposes) your full name, current address, telephone number and/or email address, date and place of birth, signature, evidence of other names used (if seeking records retrieved by a name other than your current name), and, if needed by the agency, sufficient particulars contained in the records (such as, record number or other identifying numbers) to enable the agency to locate the records and distinguish between records on subject individuals with the same name.

In addition, to verify your identity, your signature on the request must be notarized or the request must include, above your signature, your written certification that you are the individual who you claim to be and that you understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a fine of up to $5,000.

In your written request, you may request that copies of the records be sent to you or include your signed, written consent directing that the records be sent to a third party, or you may request an appointment to review the records in person (including with a person of your choosing, if you provide written authorization for agency personnel to discuss the records in that person's presence). If you make an appointment to review the records in person, you must bring at least one piece of tangible identification, such as a driver's license or passport, to the appointment. You may also request an accounting of disclosures that have been made of records about you, if any. Requests by telephone will not be accepted.

To the extent the records are Medical Quality Assurance records protected by 25 U.S.C. 1675, the records may be disclosed only in accordance with the exceptions in 25 U.S.C. 1675(d) and (e)(2), because the Privacy Act right of access provisions are superseded by the confidentiality provisions protecting Medical Quality Assurance Records. Accordingly, Medical Quality Assurance Records will only be released pursuant to the Privacy Act when the Agency has decided to release the records in accordance with 25 U.S.C. 1675(d) or (e)(2).

CONTESTING RECORD PROCEDURES:

To request correction of a record about you in this system of records, submit a written request to the relevant System Manager (see the Appendix and the “System Manager(s)” section of this SORN). The request must contain the same information required for an access request and include verification of your identity in the same manner required for an access request. In addition, the request must reasonably identify the record, specify the information contested, and state the corrective action sought and the reasons for requesting the correction. The request should include supporting information to show how the record is factually inaccurate, incomplete, untimely, or irrelevant. The right to contest records is limited to information that is factually inaccurate, incomplete, untimely (obsolete), or irrelevant.

NOTIFICATION PROCEDURES:

To find out if the system of records contains a record about you, submit a written notification request to the relevant System Manager (see the Appendix and the “System Manager(s)”section of this SORN). The request must identify this system of records, contain the same information required for an access request, and include verification of identity in the same manner required for an access request.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

None.

Appendix:

Chief Medical Officer, Office of the Director, HQ, 5600 Fishers Lane, MS 08E37A, Rockville, MD 20857, Phone: [phone], Fax No: 301–594–6213

Director—Alaska Area Office, 4141 Ambassador Dr., Suite 300, Anchorage AK 99508, Phone: [phone]

Director—Albuquerque Area Office, 4101 Indian School Rd. NE, Suite 225, Albuquerque, NM 87110–3988, Phone: [phone], Fax No. 505–256–6847

Director—Bemidji Area Office, Indian Health Service, U.S. Department of Health and Human Services, Bemidji Technology Park, 2225 Cooperative Ct. NW, Bemidji, MN 56601, Phone: [phone]

Director—Billings Area Office, 2900 4th Avenue North, Billings, MT 59101

Director—California Area Office, 650 Capitol Mall, Suite 7–100, Sacramento, CA 95814, Phone: [phone], Fax No: 916–930–3952

Director—Great Plains Area Office, 115 4th Avenue SE, Room 309, Aberdeen, SD 57401, Phone: [phone], Fax No: 605–226–7541

Director—Nashville Area Office, 711 Stewarts Ferry Pike, Nashville, TN 37214, Phone: [phone]

Director—Navajo Area Office, P.O. Box 9020, Window Rock, AZ 86515, Phone: [phone], Fax No: 928–871–5872

Director—Oklahoma City Area Office, 701 Market Drive, Oklahoma City, OK 73114, Phone: [phone], Fax: [phone]

Director—Phoenix Area Office, Two Renaissance Square, 40 N Central Avenue, Suite 504, Phoenix, AZ 85004, Phone: [phone]

Director—Portland Area Indian Health Service, 1414 NW Northrup Street, Suite 800, Portland, OR 97209, Phone: [phone] Fax: [phone]

Director—Tucson Area Office, 7900 South J Stock Road, Tucson, AZ 85746, Phone: [phone]