2010-1970. Privacy Act of 1974; Report of an Altered System of Records

AGENCY:

Health Resources and Services Administration (HRSA), Department of Health and Human Services (HHS).

ACTION:

Notice of an Altered System of Records (SOR).

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, the Health Resources and Services Administration (HRSA) is publishing notice of a proposal to alter the system of records for the Health Education Assistance On-Line Processing System (HOPS), 09-15-0044.

The purposes of these alterations are to update the location of this system and the system manager, to modify routine use number 6, correct typographical errors, and to add routine use number 17 related to notification of breaches in security or confidentiality of records maintained in the system. In addition, the section for Policies and Practices for Storing, Retrieving, Accessing, Retaining and Disposing of Records in the System was updated. The “Authority for Maintenance of System” provision has been modified to reference Section 702 of the Public Health Service Act [42 U.S.C. Section 292a], as amended, and to add the Debt Collection Improvement Act (31 U.S.C. Sections 3701 and 3711-3720E). Lastly, the “Disclosure to Consumer Reporting Agencies” provision was modified to reference the definition of a “consumer reporting agency” as stated in the Fair Credit Reporting Act (15 U.S.C.1681a(f)) and the Debt Collection Improvement Act (31 U.S.C. 3701(a)(3)).

DATES:

HRSA filed an altered system report with the Chair of the House Committee on Government Reform and Oversight, the Chair of the Senate Committee on Homeland Security and Governmental Affairs, and the Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget (OMB) on 01/15/2010. To ensure all parties have adequate time in which to comment, the altered systems, including the routine uses, will become effective 30 days from the publication of the notice or 40 days from the date it was submitted to OMB and Congress, whichever is later, unless HRSA receives comments that require alterations to this notice.

ADDRESSES:

The public should address comments to the Health Resources and Services Administration, 5600 Fishers Lane, Room 9-105, Rockville, Maryland 20857; telephone [phone]. This is not a toll-free number. Comments received will be available for review and inspection, by appointment, at this same address from 9 a.m. to 3 p.m. eastern time zone, Monday through Friday.

FOR FURTHER INFORMATION CONTACT:

Judy Rodgers, Chief, Health Education Assistance Loan Program, Division of Student Loans and Scholarships, 5600 Fishers Lane, Room 9-105, Rockville, Maryland 20857; telephone [phone]. This is not a toll-free number.

SUPPLEMENTARY INFORMATION:

HRSA maintains system of records 09-15-0044, “Health Education Assistance On-Line Processing System (HOPS)” to: (1) Identify students participating in the HEAL Program; (2) monitor the loan status of HEAL recipients, which includes the collection of overdue debts owed under the HEAL Program; and (3) compile and generate managerial and statistical reports.

HRSA is proposing a change to the name and room number of the HRSA division responsible for the operation of the HEAL Program from the Division of Health Careers Diversity and Development in room 8-37 to the Division of Student Loans and Scholarships in room 9-105, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857. HRSA is correcting typographical errors in the system of records as well. HRSA is also modifying routine use number 6 to remove a reference to the Government Accountability Office, which is redundant with a permitted disclosure found in the Privacy Act at 5 U.S.C. 552a(b)(10). Furthermore, HRSA is adding a new routine use (number 17) to permit disclosures to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance. This routine use is compatible with the purpose for which the records were collected. In addition, the “Policies and Practices for Storing, Retrieving, Accessing, Retaining and Disposing of Records in the System” provision was updated to reflect enhanced data storage, to allow external users read-only access only. HRSA is upgrading the System Manager to Chief, Health Education Assistance Loan Program.

Section “Authority for Maintenance of System” is being updated.

Dated: November 17, 2009.

Mary K. Wakefield,

Administrator.

System Number 09-15-0044

SYSTEM NAME:

Health Education Assistance On-Line Processing System (HOPS).

SECURITY CLASSIFICATION:

None.

SYSTEM LOCATION:

• Division of Student Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, Room 9-105, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.
• Records are also located at contractor sites. A list of contractor sites where individually identifiable data are currently located is available upon request to the System Manager.
• Washington National Records Center, 4205 Suitland Road, Suitland, MD 20409.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Recipients of Health Education Assistance Loans.

CATEGORIES OF RECORDS IN THE SYSTEM:

Contains name, social security number or other identifying number, birth date, demographic background, educational status, loan location and status, and financial information about the individual for whom the record is maintained. Contains lender and school identification.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Sections 701 and 702 of the Public Health Service Act, as amended (42 U.S.C. 292 and 292a), which authorize the establishment of a Federal program of student loan insurance; Section 715 of the Public Health Service Act, as amended (42 U.S.C. 292n), which directs the Secretary to require institutions to provide information for each student who has a loan; Section 709 of the Public Health Service Act, as amended (42 U.S.C. 292h), which authorizes disclosure and publication of HEAL defaulters; and the Debt Collection Improvement Act (31 U.S.C. 3701 and 3711-3720E).

PURPOSE(S) FOR RECORDS IN THIS SYSTEM:

The purpose of this system is:

1. To identify borrowers participating in the HEAL Program;

2. To monitor the loan status of HEAL recipients, which includes the collection of overdue debts owed under the HEAL Program; and

3. To compile and generate managerial and statistical reports.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

1. Disclosure may be made to Federal, State, or local agencies, to private parties such as relatives, present and former employers, business and personal associates, educational and financial institutions, and collection agencies. The purpose of such disclosures is to verify the identity of the loan applicant, to determine program eligibility and benefits, to enforce the conditions or terms of the loan, to counsel the borrower in repayment efforts, to investigate possible fraud and abuse, to verify compliance with program regulations, and to locate delinquent borrowers through pre-claims assistance. Information may be disclosed to educational or financial institutions to assist them in loan management.

2. Disclosure may be made to a Congressional office from the record of an individual in response to an inquiry from the Congressional office made at the request of that individual.

3. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.

4. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with enforcing or implementing the statute or any rule, regulation or order issued pursuant thereto.

5. HRSA will disclose from this system of records a delinquent debtor's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose, as follows: (a) To another Federal agency so that agency can effect a salary offset for debts owed by Federal employees; if the claim arose under the Social Security Act, the employee must have agreed in writing to the salary offset. (b) To another Federal agency so that agency can affect an authorized administrative offset; i.e., withhold money payable to, or held on behalf of, debtors other than Federal employees. (c) To the Treasury Department, Internal Revenue Service (IRS), to request a debtor's current mailing address to locate him/her for purposes of either collecting or compromising a debt or to have a commercial credit report prepared.

6. Records may be disclosed to the Office of Management and Budget for auditing financial obligations to determine compliance with programmatic, statutory, and regulatory provisions.

7. HRSA may disclose information from this system of records to a consumer reporting agency (credit bureau) to obtain a commercial credit report for the following purposes: (a) To establish creditworthiness of a loan applicant; and (b) to assess and verify the ability of a debtor to repay debts owed to the Federal Government. Disclosures are limited to the individual's name, address, Social Security number and other information necessary to identify him/her; the funding being sought or amount and status of the debt; and the program under which the application or claim is being processed.

8. HRSA may disclose to the Internal Revenue Service (IRS), U.S. Department of the Treasury (Treasury Department), information about an individual applying for a loan under any loan program authorized by the Public Health Service Act to find out whether the loan applicant has a delinquent tax account. This disclosure is for the sole purpose of determining the applicant's creditworthiness and is limited to the individual's name, address, Social Security number, other information necessary to identify him/her, and the program for which the information is being obtained.

9. HRSA will report to the IRS, Treasury Department, as taxable income, the written-off amount of a debt owed by an individual to the Federal Government when a debt becomes partly or wholly uncollectible—either because the time period for collection under the statute of limitations has expired, or because the Government agrees with the individual to forgive or compromise the debt.

10. HRSA will disclose to debt collection agents, other Federal agencies, and other third parties who are authorized to collect a Federal debt, information necessary to identify a delinquent debtor. Disclosure will be limited to the debtor's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose.

11. HRSA will disclose information from this system of records to any third party that may have information about a delinquent debtor's current address, such as the U.S. Postal Service, a consumer reporting agency (credit bureau), a State motor vehicle administration, a professional organization, an alumni association, etc., for the purpose of obtaining the debtor's current address. This disclosure will be limited to information necessary to identify the individual (defaulter's name, latest known City and State of residence, total amount of the HEAL debt).

12. Records may be disclosed to Department contractors and subcontractors for the purpose of assisting HEAL program managers in collating, compiling, aggregating, or analyzing records used in administering the HEAL program. Contractors maintain, and are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to the records.

13. HRSA may disclose from this system of records to the IRS, Treasury Department: (a) A delinquent debtor's name, address, Social Security number, and other necessary information to identify the debtor; (b) the amount of the debt; and (c) the program under which the debt arose, so that the IRS can offset against the debt any income tax refunds which may be due to the debtor.

14. HRSA may disclose the complete loan file of defaulted HEAL recipients to potential purchasers of HEAL loans to enable them to value and price the loans, and to actual purchasers to enable them to collect the defaulted loans. The purpose of this disclosure will be to facilitate the sale and collection of defaulted HEAL loans. Potential purchasers are required to maintain Privacy Act safeguards with respect to the records.

15. In accordance with the directive in 42 U.S.C. 292h(c)(1), the names of HEAL borrowers who are in default will be published in the Defaulted Borrowers Web site, http://www.defaulteddocs.dhhs.gov,, by city and State along with the amounts of their HEAL debts. The individual's address also may be published if the address is a matter of public record as a result of legal proceedings having been filed concerning the individual's HEAL debt.

16. In accordance with the directive in 42 U.S.C. 292h(c)(2), disclosure may be made to relevant Federal agencies, schools, school associations, professional and specialty associations, State licensing boards, hospitals with which a HEAL defaulter may be associated, and other similar organizations.

17. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.

DISCLOSURE TO CONSUMER REPORTING AGENCIES:

Disclosures pursuant to 5 U.S.C. 552a(b)(12), (as set forth in 31 U.S.C. Section 3711(e)): Disclosures may be made from this system to “consumer reporting agencies” as defined in the Fair Credit Reporting Act (15 U.S.C. 1681a(f)) or the Debt Collection Improvement Act (31 U.S.C. 3701(a)(3)). The purposes of these disclosures are:

1. To provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records; and

2. To enable HRSA to improve the quality of loan and scholarship decisions by taking into account the financial reliability of applicants. Disclosure of records will be limited to the individual's name, Social Security number (SSN), and other information necessary to establish the identity of the individual, the amount, status, and history of the claim, and the agency or program under which the claim arose.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

• Storage: Records are maintained in database servers, file folders, cd's, dvd's and magnetic tapes.
• Retrievability: Social Security Number or other identifying number.
• Safeguards:

1. Authorized users: Access is limited to authorized HEAL personnel and contractors responsible for administering the HEAL program. Authorized personnel include HEAL employees and officials, financial and fiscal management personnel, computer personnel and program managers who have responsibility for implementing the HEAL program. Read-Only users: Read-only access is given to Servicers, Holders and financial/fiscal management personnel.

2. Physical safeguards: Magnetic tapes, disc packs, computer equipment and other forms of personal data are stored in areas where fire and life safety codes are strictly enforced. All documents are protected during lunch hours and non-working hours in locked file cabinets or locked storage areas. Twenty-four hour, seven-day security guards perform random checks on the physical security of the records storage areas.

3. Procedural safeguards: A password is required to access the terminal and a data set name controls the release of data to only authorized users. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office. In addition, all sensitive data is encrypted using Oracle Transparent Data Encryption functionality. Access to records is strictly limited to those staff members trained in accordance with the Privacy Act and ADP security procedures. Contractors are required to maintain, and are also required to ensure that subcontractors maintain, confidentiality safeguards with respect to these records. Contractors and subcontractors are instructed to make no further disclosure of the records except as authorized by the System Manager and permitted by the Privacy Act. All individuals who have access to these records receive the appropriate ADP security clearances. HEAL personnel make site visits to ADP facilities for the purpose of ensuring that ADP security procedures continue to be met. Privacy Act and ADP system security requirements are specifically included in contracts. The HRSA project directors, project officers, and the System Manager oversee compliance with these requirements.

4. Implementing guidelines: The safeguards described above were established in accordance with DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual; and the http://www.hhs.gov/​ocio/​policy#Security Web site.

RETENTION AND DISPOSAL:

HRSA is working with the Records Officer and NARA to obtain the appropriate retention value.

SYSTEM MANAGER(S) AND ADDRESS:

• Chief, Health Education Assistance Loan Program, Division of Student Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, 5600 Fishers Lane, Room 9-105, Rockville, MD 20857.

NOTIFICATION PROCEDURE:

To find out if the system contains records about you contact the System Manager.

REQUESTS IN PERSON:

A subject individual who appears in person at a specific location seeking access or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of tangible identification such as driver's license, passport, voter registration card, or union card. Identification papers with current photographs are preferred but not required. Additional identification may be requested when there is a request for access to records which contain an apparent discrepancy between information contained in the record and that provided by the individual requesting access to the record. No verification of identity shall be required where the record is one which is required to be disclosed under the Freedom of Information Act.

REQUESTS BY MAIL:

Written requests for information and/or access to records received by mail must contain information providing the identity of the writer and a reasonable description of the record desired. Written requests must contain the name and address of the requester, his/her date of birth and at least one piece of information which is also contained in the subject record, and his/her signature for comparison purposes.

REQUESTS BY TELEPHONE:

Since positive identification of the caller cannot be established, telephone requests are not honored.

RECORD ACCESS PROCEDURES:

Same as notification procedures. Requesters should also provide a reasonable description of the record being sought. Requesters may also request an accounting of disclosures that have been made of their records, if any.

CONTESTING RECORD PROCEDURES:

Contact the System Manager, provide a reasonable description of the record, specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

RECORD SOURCE CATEGORIES:

Individual loan recipients, HEAL schools, lenders, and holders of HEAL loans and their agents.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:

None.