2010-9893. Privacy Act of 1974; System of Records

AGENCY:

Office of the Secretary, DoD.

ACTION:

Notice to alter a system of records.

SUMMARY:

The Office of the Secretary of Defense proposes to alter a system of records to its inventory of record systems subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended.

DATES:

This proposed action would be effective without further notice on June 1, 2010 unless comments are received which result in a contrary determination.

ADDRESSES:

You may submit comments, identified by docket number and title, by any of the following methods:

• Federal Rulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.
• Mail: Federal Docket Management System Office, 1160 Defense Pentagon, Washington, DC 20301-1160.

Instructions: All submissions received must include the agency name and docket number for this Federal Register document. The general policy for comments and other submissions from members of the public is to make these submissions available for public viewing on the Internet at http://www.regulations.gov as they are received without change, including any personal identifiers or contact information.

FOR FURTHER INFORMATION CONTACT:

Ms. Cindy Allard at [phone].

SUPPLEMENTARY INFORMATION:

The Office of the Secretary of Defense notices for systems of records subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended, have been published in the Federal Register and are available from the Chief, OSD/JS Privacy Office, Freedom of Information Directorate, Washington Headquarters Services, 1155 Defense Pentagon, Washington, DC 20301-1155.

The proposed system report, as required by 5 U.S.C. 552a(r) of the Privacy Act of 1974, as amended, was submitted on April 16, 2010, to the House Committee on Oversight and Government Reform, the Senate Committee on Governmental Affairs, and the Office of Management and Budget (OMB) pursuant to paragraph 4c of Appendix I to OMB Circular No. A-130, “Federal Agency Responsibilities for Maintaining Records About Individuals,” dated February 8, 1996 (February 20, 1996; 61 FR 6427).

Dated: April 23, 2010.

Mitchell S. Bryman,

Alternate OSD Federal Register Liaison Officer, Department of Defense.

DHA 08

SYSTEM NAME:

Health Affairs Survey Data Base (April 28, 1999; 64 FR 22837).

CHANGES:

* * * * *

SYSTEM NAME:

Delete entry and replace with “Health Affairs Survey and Study Data Base.”

SYSTEM LOCATION:

Delete entry and replace with “Office of the Assistant Secretary of Defense (Health Affairs), TRICARE Management Activity Health Program Analysis and Evaluation, Suite 810, 5111 Leesburg Pike, Skyline Building 5, Falls Church, Virginia 22041-3206.”

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Delete entry and replace with “Uniformed services beneficiaries enrolled in the Defense Eligibility Enrollment Reporting System who are eligible for medical and dental health care; veterans and their dependents; individuals who submit Medicare and/or Medicaid claims and are linked to DoD health care; DoD civilian employees and contractor personnel including contracted providers, and health care workers.”

CATEGORIES OF RECORDS IN THE SYSTEM:

Delete entry and replace with “Records in the system include name, address, sponsor and dependent's Social Security Numbers (SSN), family member prefix code, demographics categories that include age, sex, date of birth, telephone number, e-mail address, military rank group officer and enlisted or civilian.

Personal health information and clinical encounter data regarding interactions with health care systems such as diagnoses, procedures, treatments, services, and benefits; self-reported health and health related response datasets such as surveys and focus groups; health care administrative data, such as inpatient, dental, outpatient, and pharmacy utilization rates; budgetary and managerial cost accounting data, such as claims processing, direct and purchased care workload and costs; contingency tracking system data such as deployment status; and health plan eligibility and enrollment data.”

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Delete entry and replace with “10 U.S.C. 136, Under Secretary of Defense for Personnel and Readiness; 10 U.S.C. 1071 (NOTE), Annual Beneficiary Survey; 10 U.S.C. Chapter 55, Medical and Dental Care; 42 U.S.C. 11131-11152, Health Care Improvement Act of 1986; 32 CFR 199.17, TRICARE program; 45 CFR parts 160 and 164, General Administrative Requirements and Security and Privacy; DoDD 3216.2, Protection of Human Subjects and Adherence to Ethical Standards in DoD-Supported Research; DoDD 6025.13, Medical Quality Assurance (MQA) in the Military Health System (MHS); and E.O. 9397 (SSN), as amended.”

PURPOSE(S):

Delete entry and replace with “To collect, assemble, interpret, analyze, report and publish surveys; research, study, statistical and informational data, in order to improve the quality of DoD health care and the health status, welfare and well-being of the DoD beneficiary population. Uses of identifiable data include primary analysis; secondary analysis; non-response analysis; and cross-mapping analysis. Results will only be reported in the aggregate.”

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSE OF SUCH USES:

Delete entry and replace with “In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, these records may specifically be disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

To the Department of Health and Human Services and/or the Department of Veterans Affairs consistent with their statutory administrative responsibilities pursuant to 10 U.S.C. Chapter 55, Medical and Dental Care, and 38 U.S.C. Chapter 3, Department of Veterans Affairs.

To the Office of Personnel Management for purposes related to DoD Federal employees and/or their health care benefits in DoD.

To State Departments of Health for health care delivery programs, where such programs effect benefits determinations between these Department-level programs, continuity of clinical care, or effect payment for care between Departmental programs inclusive of care provided by commercial entities under contract to these three Departments.

To Academia, non profit and commercial entities, for surveys or research, where such releases are consistent with the mission of the Military Health System and where exchange and coordination of information and data are consistent with the Privacy Act of 1974, the Heath Insurance Portability and Accountability Act of 1996 Privacy and Security Rules, and applicable DoD Information Security regulations.

The DoD `Blanket Routine Uses' set forth at the beginning of the Office of the Secretary of Defense compilation of systems of records notices apply to this system with the following noted exceptions:

Note:

This system of records contains individually identifiable health information. The DoD Health Information Privacy Regulation DoD 6025.18-R issued pursuant to the Health Insurance Portability and Accountability Act of 1996, applies to most health information. DoD 6025.18-R may place additional procedural requirements on the uses and disclosures of such information beyond those found in the Privacy Act of 1974 or mentioned in this system of records notice.

”

STORAGE:

Delete entry and replace with “Paper and/or electronic storage media.”

RETRIEVABILITY:

Delete entry and replace with “Records of beneficiaries may be retrieved by patient identifiers, such as name, address, sponsor and dependent's Social Security Number (SSN), family member prefix code, and demographic categories, such as age, sex, e-mail address, military rank group officer, enlisted, or civilian.”

SAFEGUARDS:

Delete entry and replace with “Media, data and/or records are maintained in a controlled area. The computer system is accessible only to authorized personnel. Entry into these areas is restricted to those personnel with a valid requirement and authorization to enter. Physical entry is restricted by the use of locks, passwords which are changed periodically, and administrative procedures. The system provides two-factor authentication including Common Access Cards and passwords. Access to personal information is restricted to those who require the data in the performance of the official duties, and have received proper training relative to the Privacy Act of 1974, Health Insurance Portability and Accountability Act of 1996 Privacy and Security Rules, and Information Assurance.”

RETENTION AND DISPOSAL:

Delete entry and replace with “Disposition pending. Until the National Archives and Records Administration has approved the retention and disposal of these records, treat them as permanent.”

SYSTEM MANAGER(S) AND ADDRESS:

Delete entry and replace with “TRICARE Management Activity, Health Plans Operations/Health Program Analysis and Evaluation, Suite 810, Skyline Building 5, 5111 Leesburg Pike, Falls Church, VA 22041-3206.”

NOTIFICATION PROCEDURE:

Delete entry and replace with “Individuals seeking to determine whether this system contains information about themselves should address written inquiries to TRICARE Management Activity, Health Plans Operations/Health Program Analysis and Evaluation, Suite 810, Skyline Building 5, 5111 Leesburg Pike, Falls Church, VA 22041-3206.

Written requests for the information should contain the individual's full name, address, last 4 numbers of the Social Security Number (SSN), the name and number of this system of records notice and signature.”

RECORD ACCESS PROCEDURES:

Delete entry and replace with “Individuals seeking access to records about themselves contained in this system should address written inquiries to TRICARE Management Activity, Attention: Freedom of Information Act Requester Service Center, 16401 East Centretech Parkway Aurora, CO 80011-9066.

Requests should contain the individual's full name, address, last 4 numbers of the Social Security Number (SSN), the name and number of this system of records notice and signature.”

CONTESTING RECORD PROCEDURES:

Delete entry and replace with “The Office of the Secretary of Defense rules for accessing records, for contesting contents and appealing initial agency determinations are published in Office of the Secretary of Defense Administrative Instruction 81; 32 CFR part 311; or may be obtained from the system manager.”

RECORD SOURCE CATEGORIES:

Delete entry and replace with “Individuals, the Defense Enrollment Eligibility Reporting System, the Uniformed Services medical and dental treatment facilities and facilities contracted by DoD to perform medical care for Military members, former members and dependents.”

* * * * *

DHA 08

SYSTEM NAME:

Health Affairs Survey and Study Data Base.

SYSTEM LOCATION:

Office of the Assistant Secretary of Defense (Health Affairs), TRICARE Management Activity Health Program Analysis and Evaluation, Suite 810, 5111 Leesburg Pike, Skyline Building 5, Falls Church, Virginia 22041-3206.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Uniformed services beneficiaries enrolled in the Defense Eligibility Enrollment Reporting System who are eligible for medical and dental health care under 10 U.S.C. Chapter 55; veterans and their dependents; individuals who submit Medicare and/or Medicaid claims and linked to DoD health care; DoD civilian employees and contractor personnel including contracted providers, and health care workers.

CATEGORIES OF RECORDS IN THE SYSTEM:

Records in the system include name, address, sponsor and dependents Social Security Number (SSN), family member prefix code, demographics categories that include age, sex, date of birth, telephone number, e-mail address, military rank group officer and enlisted or civilian.

Personal health information and clinical encounter data regarding interactions with health care systems such as diagnoses, procedures, treatments, services, and benefits; self-reported health and health related response datasets such as surveys and focus groups; health care administrative data, such as inpatient, dental, outpatient, and pharmacy utilization rates; budgetary and managerial cost accounting data, such as claims processing, direct and purchased care workload and costs; contingency tracking system data such as deployment status; and health plan eligibility and enrollment data.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

10 U.S.C. 136, Under Secretary of Defense for Personnel and Readiness; 10 U.S.C. 1071 (NOTE), Annual Beneficiary Survey; 10 U.S.C. Chapter 55, Medical and Dental Care; 42 U.S.C. 11131-11152, Health Care Improvement Act of 1986; 32 CFR 199.17, TRICARE program; 45 CFR parts 160 and 164, General Administrative Requirements and Security and Privacy; DoDD 3216.2, Protection of Human Subjects and Adherence to Ethical Standards in DoD-Supported Research; DoDD 6025.13, Medical Quality Assurance (MQA) in the Military Health System (MHS); and E.O. 9397 (SSN), as amended.

PURPOSE(S):

To collect, assemble, interpret, analyze, report and publish surveys; research, study, statistical and informational data, in order to improve the quality of DoD health care and the health status, welfare and well-being of the DoD beneficiary population. Uses of identifiable data include primary analysis; secondary analysis; non-response analysis; and cross-mapping analysis. Results will only be reported in the aggregate.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSE OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, these records may specifically be disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

To the Department of Health and Human Services and/or the Department of Veterans Affairs consistent with their statutory administrative responsibilities pursuant to 10 U.S.C. Chapter 55, Medical and Dental Care, and 38 U.S.C. Chapter 3, Department of Veterans Affairs.

To the Office of Personnel Management for purposes related to DoD Federal employees and/or their health care benefits in DoD.

To State Departments of Health for health care delivery programs, where such programs effect benefits determinations between these Department-level programs, continuity of clinical care, or effect payment for care between Departmental programs inclusive of care provided by commercial entities under contract to these three Departments.

To Academia, non profit and commercial entities, for surveys or research, where such releases are consistent with the mission of the Military Health System and where exchange and coordination of information and data are consistent with the Privacy Act of 1974, the Heath Insurance Portability and Accountability Act of 1996 Privacy and Security Rules, and applicable DoD Information Security regulations.

The DoD `Blanket Routine Uses' set forth at the beginning of the Office of the Secretary of Defense compilation of systems of records notices apply to this system with the following noted exceptions:

Note:

This system of records contains individually identifiable health information. The DoD Health Information Privacy Regulation, DoD 6025.18-R issued pursuant to the Health Insurance Portability and Accountability Act of 1996, applies to most health information. DoD 6025.18-R may place additional procedural requirements on the uses and disclosures of such information beyond those found in the Privacy Act of 1974 or mentioned in this system of records notice.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Paper and/or electronic storage media.

RETRIEVABILITY:

Records of beneficiaries may be retrieved by patient identifiers, such as name, address, sponsor and dependent's Social Security Number (SSN), family member prefix code, and demographic categories, such as age, sex, e-mail address, military rank group officer, enlisted, or civilian.

SAFEGUARDS:

Media, data and/or records are maintained in a controlled area. The computer system is accessible only to authorized personnel. Entry into these areas is restricted to those personnel with a valid requirement and authorization to enter. Physical entry is restricted by the use of locks, passwords which are changed periodically, and administrative procedures. The system provides two-factor authentication including Common Access Cards and passwords. Access to personal information is restricted to those who require the data in the performance of the official duties, and have received proper training relative to the Privacy Act of 1974, Health Insurance Portability and Accountability Act of 1996 Privacy and Security Rules, and Information Assurance.

RETENTION AND DISPOSAL:

Disposition pending. Until the National Archives and Records Administration has approved the retention and disposal of these records, treat them as permanent.

SYSTEM MANAGER(S) AND ADDRESS:

TRICARE Management Activity, Health Plans Operations/Health Program Analysis and Evaluation, Suite 810, Skyline Building 5, 5111 Leesburg Pike, Falls Church, VA 22041-3206.

NOTIFICATION PROCEDURE:

Individuals seeking to determine whether this system contains information about themselves should address written inquiries to TRICARE Management Activity, Health Plans Operations/Health Program Analysis and Evaluation, Suite 810, Skyline Building 5, 5111 Leesburg Pike, Falls Church, VA 22041-3206.

Written requests should contain the individual's full name, address, Last 4 numbers of the Social Security Number (SSN), the name and number of this system of records notice and signature.

RECORD ACCESS PROCEDURES:

Individuals seeking access to records about themselves contained in this system should address written inquiries to TRICARE Management Activity, Attention: Freedom of Information Act Requester Service Center, 16401 East Centretech Parkway, Aurora, CO 80011-9066.

Written requests should contain the individual's full name, address, Last 4 numbers of the Social Security Number (SSN), the name and number of this system of records notice and signature.

CONTESTING RECORD PROCEDURES:

The Office of the Secretary of Defense rules for accessing records, for contesting contents and appealing initial agency determinations are published in Office of the Secretary of Defense Administrative Instruction 81; 32 CFR part 311; or may be obtained from the system manager.

RECORD SOURCE CATEGORIES:

Individuals, the Defense Enrollment Eligibility Reporting System, and the Uniformed Services medical and dental treatment facilities and facilities contracted by DoD to perform medical care for Military members, former members and dependents.

EXEMPTIONS CLAIMED FOR THE SYSTEM:

None.