2010-8620. Privacy Act of 1974; Report of an Altered System of Records

AGENCY:

Department of Health and Human Services (HHS), Health Resources & Services Administration (HRSA).

ACTION:

Notice of an Altered System of Records (SOR).

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, the Health Resources and Services Administration (HRSA) is publishing notice of a proposal to alter an existing System of Records. The existing system of records, “State-Provided Physician Records for the Application Submission & Processing System (ASAPS), Office of Shortage Designation (OSD), Bureau of Health Professions (BHPr), HRSA,” SORN #09-15-0066, originally published on January 10, 2005, covers health care practitioners who are the subjects of databases collected and maintained by State Primary Care Offices/Associations. Such health care practitioners include physicians (both M.D.s and D.O.s), licensed or otherwise authorized by a State to provide health care services, dentists, and mental health professionals. This State collected data may now also be made available to contractors employed by the OSD to assist in the application review process. The States affected have signed a Data Use Agreement permitting the contractors to have access to their data.

The purposes of these alterations are to update the system manager location, authority for maintenance of the system, categories of individuals covered by the system and categories of records in the system. Additionally, HRSA is adding new routine uses numbers 4 and 5, to include the reviewing and processing assistance from contractors and the breach notification language. This system of records is required to comply with the implementation directives of Section 332 of the Public Health Service Act. The records will be used to support the ASAPS electronic application for the development, submission, and review of applications for HPSAs and MUPs. The most critical requirement for accurate designation determinations is accurate data on the location of health care providers relative to the population. To this end, OSD continually tries to obtain the latest data on primary care, dental, and mental health providers and their practice location(s) at the lowest geographical level possible for use in the designation process, with the objective of minimizing the level of effort required on the part of States and communities seeking designations.

DATES:

HRSA filed an altered system report with the Chair of the House Committee on Government Reform and Oversight, the Chair of the Senate Committee on Homeland Security and Governmental Affairs, and the Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget (OMB) on March 1, 2010. To ensure all parties have adequate time in which to comment, the altered system, including the routine uses, will become effective 30 days from the publication of the notice or 40 days from the date it was submitted to OMB and Congress, whichever is later, unless HRSA receives comments that require alterations to this notice.

ADDRESSES:

Please address comments to the Application Submission & Processing System (ASAP) System Manager, Office of Shortage Designation, Bureau of Health Professions, Health Resources and Services Administration, 5600 Fishers Lane, Room 8A-08, Rockville, Maryland 20857; telephone [phone]. This is not a toll-free number. Comments received will be available for inspection at this same address from 9 a.m. to 3 p.m., (Eastern Standard Time zone), Monday through Friday.

FOR FURTHER INFORMATION CONTACT:

Please contact the ASAPS, System Manager, Office of Shortage Designation, Bureau of Health Professions, Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 8A-08, Rockville, Maryland 20857; telephone [phone]. This is not a toll-free number.

SUPPLEMENTARY INFORMATION:

The following changes/additions are being made to the current System of Records Routine Uses: (4) The Office of Shortage Designation (OSD) has contracted with a vendor to assist OSD in the review and processing of the HPSA and/or MUA/P applications received by the State offices. Such access will only be granted to the contractors with the States' written permission, and all such contractors shall be required to sign a Rules of Behavior document, maintain Privacy Act safeguards with respect to such records, and return all records to HRSA; (5) The SORN will now include specific language to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance. Also being modified with this Altered System of Records Notice is the room number and program name for the location of the system manager. The room number is being changed from 8C-26 to 8A-08 and the program name is being changed from the Shortage Designation Branch to the Office of Shortage Designation. Lastly, the authority for the maintenance of the system has been changed from 42 CFR, chapter 1, part 5—Designation of Health Professional Shortage Areas and section 332 of the Public Health Service (PHS) Act to just section 332 of the Public Health Service (PHS) Act.

Dated: March 24, 2010.

Mary K. Wakefield,

Administrator.

SYSTEM NUMBER: 09-15-0066

SYSTEM NAME:

State-Provided Physician Records for the Application Submission & Processing System, OSD, BHPr, HRSA.

SECURITY CLASSIFICATION:

None.

SYSTEM LOCATION:

The Application Submission and Processing System (ASAPS) System Manager is located in Office of Shortage Designation, Bureau of Health Professions, Health Resources and Services Administration, 5600 Fishers Lane, Room 8A-08, Rockville, Maryland 20857. The actual computer server is located in Office of Information Technology, Health Resources and Services Administration, 5600 Fishers Lane, Room 10A-08, Rockville, Maryland 20857.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Health care practitioners who are the subjects of databases collected and maintained by State Primary Care Offices/Associations. Such health care practitioners include physicians (both M.D.s and D.O.s), dentists, and mental health care providers, licensed or otherwise authorized by a State to provide health care services.

CATEGORIES OF RECORDS IN THE SYSTEM:

The system will include records that show a value for each of the following fields for all of the physicians that are included in each States' database:

• Provider ID (System-Assigned).
• Provider Type.
• Provider Status.
• First Name.
• Middle Name.
• Last Name.
• Suffix.
• Physician License Number.
• Specialty Code.
• Visa Status.
• Federal Employee Status.
• National Health Service Corps Status.
• MD/DO/DDS.
• AMA ID.
• AOA ID.
• Hospital Privileges Status.
• Gender.
• Source Type.
• Address 1.
• Address 2.
• Address 3.
• City.
• State.
• Zip.
• FIPS State.
• FIPS County.
• Census Tract.
• Minor Civil Division.
• Longitude.
• Latitude.
• Address FTE.
• Office Visits (Per Year).
• New Patients Waiting Time For Appointments (days).
• Current Patients Waiting Time For Appointments (days).
• Average Wait for New Patient (hours).
• Average Wait for Current Patient (hours).
• Patient Percent—Homeless.
• Patient Percent—Medicaid.
• Patient Percent—Migrant Farmworker.
• Patient Percent—Native American.
• Patient Percent—Sliding Fee Scale.
• Patient Percent—Language Barrier Present.
• Patient Percent—Migrant/Seasonal Farmworker.
• Patient Percent—Other Population.
• Medicaid Claims.
• Hours Given Include Time Spent in Hospital.
• Accepts New Patients.
• Tour Hours in Direct Patient Care for this Address.
• Sub Specialty.
• Sub Specialty Percent.
• Language 1.
• Language 1 Percent.
• Language 2.
• Language 2 Percent.
• Language 3.
• Language 3 Percent.
• Age/Date of Birth (Dentists only).
• Number of Auxillaries (Dentists only).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Section 332 of the Public Health Service Act provides that the Secretary of Health and Human Services shall designate health professional shortage areas, or HPSAs, and/or Medically Underserved Populations, or MUPs, based on criteria established by regulation. The authority for designation of HPSAs is delegated to the Bureau of Health Professions Office of Shortage Designation (OSD). Criteria and the process used for designation of HPSAs and/or MUPs were developed in accordance with the requirements of Section 332. Designation as a HPSA is a prerequisite to application for National Health Service Corps recruitment assistance. To accomplish this task, the OSD relies on data specified in 42 CFR Part 5, which implements Section 332, and HPSA and/or MUP guidelines, to review applications submitted by State Primary Care Offices (PCO) and their affiliates for designation status.

PURPOSE(S):

The sole purpose of the system is to support the Application Submission and Processing System electronic application for the development, submission, and review of applications for HPSAs and MUPs. The most critical requirement for accurate designation determinations is accurate data on the location of health care providers relative to the population. To this end, Office of Shortage Designation continually tries to obtain the latest data on health care providers and their practice location(s) at the lowest geographical level possible for use in the designation process, with the objective of minimizing the level of effort required on the part of States and communities seeking designations.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

1. Each State Primary Care Office (and a few Primary Care Associations) may have access to provider data within their own State for Medically Underserved Population/Area (MUA/P) and/or Health Professional Shortage Area (HPSA) applications. These users will also have access to bordering States' data (one county-deep) at an aggregate level only.

2. Disclosure may be made to contractors engaged by the Department to geocode the physicians' address so that it may be seen on a computerized map, or to load the provider data into the Application Submission and Processing Systems. All such contractors shall be required to maintain Privacy Act safeguards with respect to such records and return all records to HRSA.

3. Disclosure may be made to contractors engaged by the Department to assist OSD in the review and processing of the HPSA and/or MUA/P applications received by the State offices. Such access will only be made with the State's permission (through a Data Use Agreement) and all such contractors shall be required to sign a Rules of Behavior document, maintain Privacy Act safeguards with respect to such records, and return all records to HRSA.

4. To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Records are maintained in file folders and in computer data files.

RETRIEVABILITY:

Retrieval of physician records is by use of personal identifiers used when entering the system.

SAFEGUARDS:

1. Authorized users: Access to records is limited to designated HRSA, HRSA hired contractors, and PCO/A staff. These employees are the only authorized users. HRSA maintains current lists of authorized users.

2. Physical Safeguards: All computer equipment and files are stored in areas where fire and life safety codes are strictly enforced. All automated and non-automated documents are protected on a 24-hour basis. Perimeter security includes intrusion alarms, on-site guard force, random guard patrol, key/passcard/combination controls, and receptionist controlled area. Hard copy files are maintained in a file room used solely for this purpose with access limited by combination lock to authorized users identified above. Computer files are password protected and are accessible only by use of computers which are password protected.

3. Procedural Safeguards: A password is required to access computer files. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised area. All authorized users sign a “Rules of Behavior” document. All passwords, keys and/or combinations are changed when a person leaves or no longer has authorized duties. Access to records is limited to those authorized personnel trained in accordance with the Privacy Act and ADP security procedures. The safeguards described above were established in accordance with DHHS Chapter 45-13 and supplementary chapter PHS hf:45-13 of the General Administration Manual; and the DHHS Information Resources Management Manual, Part 6, “ADP Systems Security.”

RETENTION AND DISPOSAL:

HRSA is working with the Records Officer and NARA to obtain the appropriate retention value.

SYSTEM MANAGER(S) AND ADDRESS:

Application Submission & Processing System System Manager, Office of Shortage Designation, Bureau of Health Professions, Health Resources and Services Administration, 5600 Fishers Lane, Room 8A-08, Rockville, Maryland 20857.

NOTIFICATION PROCEDURE:

Write to the Application Submission & Processing System System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a fine.

RECORD ACCESS PROCEDURE:

To obtain access to a record, contact the Application Submission and Processing System (ASAPS) System Manager at the address specified above. Requesters should provide the same information as is required under the Notification Procedures above. Individuals may also request listings of accountable disclosures that have been made of their records, if any.

CONTESTING RECORD PROCEDURES:

Write to the official specified under Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant. The right to contest records is limited to information which is incomplete, incorrect, untimely, or irrelevant.

RECORD SOURCE CATEGORIES:

Data are collected from the State Primary Care Offices and a few State Primary Care Associations.