02-2456. Privacy Act of 1974; Revision to Existing System of Records

AGENCY:

Employee Assistance Program, Office of the Assistant Secretary for Administration and Management, Office of the Secretary, HHS.

ACTION:

Notice of revision of Privacy Act Systems of Records.

SUMMARY:

In accordance with the Privacy Act, HHS is giving notice that it is revising one of its system of records, 09-90-0010, Employee Assistance Program, HHS/OS/ASAM. It was most recently published on March 7, 1997. The notice is being revised to modify certain procedures and update the list of system managers. Records in this system contain information on employees and their family members who have used the services of the Employee Assistance Program (EAP). It also contains information on employees and their family members from other Federal agencies that are contracting with HHS EAPs.

EFFECTIVE DATE:

This revision substantially modifies the language of this system of records by adding a new routine use. In addition to the above change, some minor revisions have been made to clarify and update procedures and other information. The modified language will take effect unless comments are received that result in a different conclusion. Other aspects of this amendment are effective on February 1, 2002.

FOR FURTHER INFORMATION CONTACT:

EAP Director, Office of Human Resources, Room 5-36E, 200 Independence Avenue, SW., Washington, DC 20201. Telephone number [phone] or [phone]

SUPPLEMENTARY INFORMATION:

Record destruction procedures in the previous notice were modified to reflect new legal opinions. In addition, this notice reflects reorganization in HHS and the resulting changes to the list of system managers.

The notice is published below in its entirety, as amended.

Dated: December 17, 2001.

Roy Tucker,

Acting Deputy Assistant Secretary for Human Resources.

09-90-0010

SYSTEM NAME:

Employee Assistance Program (EPA) Records, HHS/OS/ASAM/OHR.

SYSTEM LOCATION:

Offices designated to provide counseling and/or other EAP services for employees of HHS and their family members and employees of other Federal agencies contracting with HHS for EAP services and their family members. Since there are thousands of counselors available to provide EAP services, contact the appropriate system manager in Appendix 1 for more details about specific locations.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

This system covers the records of all HHS employees and their family members using the services of the EAP. It also covers the records of other Federal employees and their family members using the EAP through a contractual agreement between HHS and their organizations. (The remainder of this notice will refer to all persons covered by the system as “EAP client(s)”.)

CATEGORIES OF RECORDS IN THE SYSTEM:

This system contains a written or electronic record on each EAP client. These records will contain the following information: client name, date of birth, grade, job title, home address, telephone numbers, and (when appropriate) supervisor name and telephone number. The system includes records of services provided by HHS staff as well as services provided by contractors.

Certain clinical information is also normally maintained in each record including a psychosocial history, assessment of personal concerns, information regarding referrals to facilities in the community, and all intervention outcomes. It may contain correspondence with program clients, including electronic mail and word processing applications.

If the client is referred to the EAP by a supervisor due to work performance or conduct problems or if there is another reason to be concerned about these issues, the record may contain information such as leave usage, work quality, inappropriate behavior, and reason for referral. It may also contain information about previous and on-going supervisory/organizational interventions to correct the problem.

When the client is referred to the EAP because of a positive drug or alcohol test (as required by the drug-free workplace provisions or Department of Transportation regulations), the record will also contain information about substance abuse assessment, treatment, aftercare, and substance use monitoring results.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

5 U.S.C. 7361, 7362, 7901, 7904; 44 U.S.C. 3101.

PURPOSE(S):

The information contained in each record is a documentation of the nature and extent of the client's concerns. This information is necessary for the clinician to formulate and implement an intervention plan for resolving the concerns. When the intervention plan includes referral(s) to treatment or other facilities outside the EAP, the record also documents this referral information.

The information contained in each record is also used for monitoring the client's progress in resolving the concern(s).

Anonymous information from each record is also used to prepare statistical reports and to conduct research that helps with program management.

ROUTIEN USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

(1) HHS may transfer records to contractors (e.g. private organization, individual, or other group such as an EAP consortium) for the purpose of providing EAP services for HHS employees and their family members and/or for employees of other Federal agencies and their family members.

(2) HHS may transfer records to contractors or employees of other Federal agencies for the purpose of destroying records at the end of the required period of maintenance, but only in accordance with contracts and inter-agency agreements requiring that:

(A) A witness trained in the proper handling of confidential records will be present when any records are destroyed,

(B) Records will be destroyed by shredding or burning,

(C) Records stored on hard drives will be destroyed using software tools which ensure the protection of the confidential information by making reconstruction or compromise by reuse impracticable, and

(D) Records located away from the destruction site shall be transferred to the destruction site in a confidential manner.

(3) HHS may disclose information from this system of records for litigation purposes when

(A) HHS, or any of its components, or

(B) Any HHS employee in his or her official capacity, or

(C) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee, or

(D) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components is a party to litigation, and HHS determines that such use of records is relevant and necessary to the litigation and would help in the effective representation of the government party. The disclosure may be made to the Department of Justice. Except where the records are covered by the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 CFR Part 2, the disclosure may be made to a court or other tribunal, or to another party before such tribunal. Any disclosure of records covered by 42 CFR Part 2 must be pursuant to a qualified service organization agreement that meets the requirements of that part and must also comply with all other aspects of those regulations. The EAP Director (in ASAM) must personally approve any disclosure made under this routine use based on his or her determination that it is compatible with the purpose for which the records were collected.

(4) Records may be disclosed to student volunteers, individuals working under a personal services contract, and other individuals performing functions for the Department but technically not having the status of agency employees, if they need access to the records in order to perform their assigned agency functions.

Addendum: HHS may release statistical data (non-personal identifiers) derived from these records.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING AND DISPOSING OF RECORDS IN THE SYSTEM:

 

STORAGE:

Records are stored in written folders, computers, and on index type cards. They are stored according to a number of physical safeguards described below.

RETRIEVABILITY:

Records are retrieved by a case code number, unique to the client utilizing the program. these numbers are cross-indexed by name.

SAFEGUARDS:

(1) Authorized Users: Access to these records is limited to EAP Administrators who work directly with clients of the program and their immediate staffs (including counselors, secretaries, and contract or consortia administrators, counselors or secretaries). HHS EAP Administrators and HHS EAP headquarters staff in OS/ASAM/OHR, as well as EAP Administrators and Coordinators from other Federal agencies who contract with HHS, whether or not they directly provide clinical services, may have access to the records for the purposes of program evaluation, destroying records at the end of the period of maintenance, and transferring records from one contractor to another. HHS may also contract with either a private organization or other Federal agency to destroy these records. The personnel of these record destruction organizations or agencies may have access to the records at the end of their period of maintenance for the purpose of transferring records from the EAP office to a destruction site and subsequently destroying the records.

(2) Physical Safeguards: All paper records are stored in metal filing cabinets equipped with at least combination locks and preferably locking crash bars. These file cabinets are in secured areas, accessible only to the EAP staff outlined above, and are locked when not in use. These records are always maintained separate from other systems of record. Computer containing records are discrete from other computer systems and/or are password protected. Computers are also stored in secured areas, accessible only to the EAP staff outlined above.

(3) Procedural Safeguards: All persons having access to these records shall already have been trained in the proper handling of records covered by the Privacy Act and 42 CFR Part 2 (Confidentiality of Alcohol and Drug Abuse Patient Records). These acts restrict disclosures to unique situations, such as threats of physical harm, medical emergencies, and suspected child abuse, except where the client has consented in writing to such disclosure. Clients of the EAP will be informed in writing of the confidentiality provisions. Secondary disclosure of released information is prohibited without client consent.

RETENTION AND DISPOSAL:

Records are retained until three years after the client has ceased contact with the EAP or until any litigation is finally resolved. This will be true whether or not the client has terminated employment with HHS or another agency contracting with HSS for EAP services. Individual states may require longer retention. The rules in this system notice should not be construed to authorize any violation of such state laws that have greater restrictions.

Some HHS EAPs provide Substance Abuse Professional evaluations as part of Department of Transportation regulations. These records will be retained for five years after contact with the program has ceased or any litigation is completed. Individual states may require longer retention. The rules in this system notice should not be construed to authorize any violation of such state laws that have greater restrictions.

Files will be destroyed only after the required period of maintenance, with a witness present, by either (1) an HHS EAP Administrator or an EAP Administrator from another organization that contracts with HHS for EAP services, or (2) by designated staff of a private or governmental organization under contract with HHS to provide document destruction services. The witness must be trained in the proper handling of records covered by the Privacy Act and 42 CFR part 2.

Written records will be destroyed by shredding or burning. Records stored on hard drives will be destroyed using software tools which ensure the protection of the confidential information by making reconstruction or compromise by reuse impracticable. Records contained on back-up tapes/diskettes will be disposed by either physically destroying the tapes/diskettes or be deleting them using software tools which ensure the protection of the confidential information by making reconstruction or compromise by reuse impracticable.

Records located away from the destruction site shall be transferred to the destruction site in the confidential manner required by HHS and GSA policies. The name and case coding number of the destroyed record will be maintained on a list of other destroyed records. No other information about EAP clients may be maintained once these files have been destroyed.

SYSTEM MANAGERS AND ADDRESSES:

The EAP records of HHS employees and their family members are managed by the EAP Administrators in the various regional and headquarters offices (Appendix 1). The EAP records of employees from other organizations contracting with HHS and their family members are managed by EAP administrators designated in their agreements with HHS.

NOTIFICATION PROCEDURES:

If an HHS employee and/or family member wishes to inquire about his or her record, a written inquiry should be addressed to the HHS system manager, responsible for the area where the counseling was provided (see Appendix 1). The individual should provide his or her name, organization where employed, date of birth, location of counseling, and approximate date of counseling. If a third party is making the request, a written consent from the client must accompany the request.

If an inquiry is made from an employee and/or family member from another Federal agency serviced by the HHS EAP, a written inquiry shall be made using the same procedures described above. It should be addressed to the HHS contact person found in Appendix A. If the contract to obtain services from HHS has terminated, the request should be made through the designated EAP representative at the other Federal agency.

In some limited situations, an EAP record is considered a medical record. A client requesting notification or access to a medical record shall, at the time the request is made, designate in writing a responsible individual who would be willing to review the record. Upon receiving a request, the EAP system manager shall weigh the need for disclosure against the potential injury to the EAP client, to other affected persons, to the physician-patient relationship, and to the treatment services. The EAP manager will then determine whether to disclose the record directly to the client or to the designated individual. If disclosed to the designated individual, he or she will inform the client of its content but only at his or her discretion.

RECORD ACCESS PROCEDURES:

Same as notification procedures. Requestors should also reasonably specify the record contents being sought.

CONTESTING RECORD PROCEDURES:

Contact the EAP Administrator at the address found in Appendix 1, and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction.

RECORD SOURCE CATEGORIES:

Information in this system of records is: (1) Supplied directly by the individual using the program, or (2) supplied by a member of the employee's family, or (3) derived from information supplied by the employee, or (4) supplied by sources to/from whom the individual has been referred for assistance, or (5) supplied by Department officials (including drug testing officers), or (6) supplied by EAP counselors, or (7) supplied by other sources involved with the case.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:

None.

Appendix 1

All HHS Regional Offices and Those in the Rockville, MD; Hyattsville, MD; and College Park, MD Areas

(except those listed below) and any other office not listed here

Employee Assistance Program Director, Office of the Secretary, ASAM, 200 Independence Avenue, SW., Room 5-36E, Washington, DC 20201.

Centers for Disease Control and Prevention

(offices in the Atlanta, GA area)

CDC Employee Assistance Program Administrator, Personnel Management Office, 1600 Clifton Road, NE., Mail Stop F05, Atlanta, GA 30333.

Southwest DC Complex

Employee Assistance Program Administrator, Program Support Center, 330 C Street, SW., Room 1250, Washington, DC 20201.

Centers for Medicare and Medicaid Services

(all locations)

HCFA Employee Assistance Program Administrator, 7500 Security Boulevard, S1-23-27, Baltimore, MD 21244.

National Institutes of Health

(headquarters location)

NIH Employee Assistance Program Administrator, Building 31, Room 1C02, 9000 Rockville Pike, Bethesda, MD 20892.

All Other Organizations Contracting With HHS

Program Support Center, Federal Occupational Health, Employee Assistance Program, Two Illinois Center, 233 North Michigan Avenue, Suite 270, Chicago, IL 60601-5519.