2018-06676. Privacy Act; Implementation

AGENCY:

National Institutes of Health (NIH), Department of Health and Human Services (HHS).

ACTION:

Final rule.

SUMMARY:

The Department of Health and Human Services (HHS or Department), through the National Institutes of Health (NIH), is issuing this final rule to make effective the exemptions that HHS/NIH proposed for a subset of records covered in a new Privacy Act system of records, System No. 09-25-0225, NIH Electronic Research Administration (eRA) Records (NIH eRA Records). The new system covers records used in managing NIH research and development applications and awards throughout the award lifecycle. The listed exemptions are necessary to maintain the integrity of the NIH extramural peer review and award processes, and will enable the agency to prevent, when appropriate, individual record subjects from having access to, and other rights under the Privacy Act with respect to, confidential source-identifying material in the records.

DATES:

This final rule is effective April 3, 2018.

FOR FURTHER INFORMATION CONTACT:

Celeste Dade-Vinson, NIH Privacy Act Officer, Office of Management Assessment, National Institutes of Health, 6011 Executive Boulevard, Suite 601, MSC 7669, Rockville, Maryland 20852, telephone [phone], fax [phone], email [e-mail].

SUPPLEMENTARY INFORMATION:

In accordance with the Privacy Act of 1974 (Privacy Act), the exemptions were described in a Notice of Proposed Rulemaking (NPRM) published for public notice and comment on December 8, 2016 (81 FR 88637). The new system of records was described in a System of Records Notice (SORN) published for public notice and comment the same day (81 FR 88690). Only certain confidential source-identifying information was proposed to be exempted, from the accounting of disclosures, access and amendment, and notification provisions in subsections (c)(3) and (d)(1) through (4) of the Privacy Act, based on subsection (k)(5) of the Act. One comment was received on the NPRM and no comments were received on the SORN. No changes to the proposed exemptions or to the SORN were made as a result of comment received. The NIH research and development award programs provide funds through contracts, cooperative agreements, and grants to support biomedical and behavioral research and development projects and centers, training, career development, small business, and loan repayment and other research programs. The NIH is responsible to Congress and the U.S. taxpayers for carrying out its research and development award programs in a manner that facilitates research cost-effectively and in compliance with applicable statutes, rules and regulations, including 42 U.S.C. 217a, 281, 282, 41 U.S.C. 423 and 45 CFR part 75. The NIH uses an award process that relies on checks and balances, separation of responsibilities, and a two-level peer review system to ensure that funding applications submitted to the NIH are evaluated in a manner that is fair, equitable, timely, and free of bias. The two-level peer review system is authorized by 42 U.S.C. 216, 42 U.S.C. 282(b)(6), 42 U.S.C. 284(c)(3), and 42 U.S.C. 289a and governed by regulations at 42 CFR part 52h, “Scientific Peer Review of Research Grant Applications and Research and Development Contract Projects.” The two-level system separates the scientific assessment of proposed projects from policy decisions about scientific areas to be supported and the level of resources to be allocated, which permits a more objective and complete evaluation than would result from a single level of review. The two-level review system is designed to provide NIH officials with the best available advice about scientific and technical merit as well as program priorities and policy considerations. The initial or first level review involves panels of experts established according to scientific disciplines, generally referred to as Scientific Review Groups (SRGs), whose primary function is to evaluate the scientific merit of grant applications. The second level of review of grant applications is performed by National Advisory Boards or Councils composed of both scientific and lay representatives. The recommendations made by these Boards or Councils are based not only on considerations of scientific merit as judged by the SRG but also on the relevance of a proposed project to the programs and priorities of the NIH. Referees are those individuals who supply reference or other letters of recommendations for a grant or cooperative agreement applicant.

Confidential referee and peer reviewer identifying material is contained in records such as reference or recommendation letters, reviewer critiques, preliminary or final individual overall impact/priority score records, and/or assignment of peer reviewers to an application and other evaluative materials and data, which referees and peer reviewers provide to the NIH Office of Extramural Research (OER) under express promises that they will not be identified as the sources of the information, and which NIH/OER compiles solely for the purpose of determining applicants' suitability, eligibility, or qualifications for federal contracts, grants, or cooperative agreements. To the extent that records in System No. 09-25-0225 are retrieved by personal identifiers for individuals other than the referees and reviewers (for example, individual applicants), the exemptions for the new system will enable the agency to prevent, when appropriate, those individual record subjects from having access to, and other rights under the Privacy Act with respect to, confidential source-identifying material in the records.

Under the Privacy Act (5 U.S.C. 552a), individuals have a right of access to records about them in federal agency systems of records, and other rights with respect to those records (such as notification, amendment, and an accounting of disclosures), but the Act permits certain types of systems of records (identified in section 552a (j) and (k)) to be exempted from certain requirements of the Act. Subsection (k)(5) permits the head of an agency to promulgate rules to exempt from the requirements in subsections (c)(3) and (d)(1) through (4) of the Act investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal contracts, to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence.

On December 8, 2016, HHS/NIH published a System of Records Notice (SORN) describing the new system (81 FR 88690). On the same date, HHS/NIH also published a Notice of Proposed Rulemaking (NPRM) (81 FR 88637) proposing to exempt a subset of records in the system of records under subsection (k)(5) of the Privacy Act from requirements pertaining to providing an accounting of disclosures, access and amendment, and notification (5 U.S.C. 552a(c)(3) and (d)). The comment period for the SORN and NPRM was open through February 6, 2017. The Agency received one comment and recommendation on the NPRM during the rulemaking comment period. The comment applauded HHS/NIH's efforts to exempt information contained within the system of records as specified in this section of the notice. The commenter recommended that the Agency reassess information contained within the system of records on a recurrent basis to ensure that relevant records are appropriately treated as exempt from the Privacy Act provisions in question. After considering the comment and recommendation, HHS/NIH believes the exemptions are necessary to maintain the integrity of the NIH extramural peer review and award processes. Protecting referee and peer reviewer identities as the sources of the information they provide protects them from harassment, intimidation, and other attempts to improperly influence award outcomes, and ensures that they are not reluctant to provide sensitive information or frank assessments to the government under an express promise that their identities as sources would be held in confidence. Case law has held that exemptions promulgated under subsection (k)(5) may protect source-identifying material even where the identity of the source is known.

The specific rationales that support the exemptions, as to each affected Privacy Act provision, are as follows:

• Subsection (c)(3). An exemption from the requirement to provide an accounting of disclosures to record subjects is needed to protect the identity of any referee or peer reviewer source who is expressly promised confidentiality. Release of an accounting of disclosures to an individual who is related to the application under assessment or evaluation could identify particular referees and peer reviewers as sources of recommendations or evaluative input received, or to be received, on the application. Inappropriately revealing their identities in association with the nature and scope of their assessments or evaluations and could lead them to alter or destroy their assessments or evaluations or subject them to harassment, intimidation, or other improper influences, which would impede or compromise the fairness and objectivity of the grant or contract review process.
• Subsection (d)(1). An exemption from the access requirement is needed both during and after a grant or contract review proceeding, to avoid inappropriately revealing the identity of any referee or peer reviewer source who was expressly promised confidentiality. Protecting confidential referee and peer reviewer identifying material from inappropriate access by record subjects is necessary for the integrity of the peer review process to ensure such sources provide candid assessments or evaluations to the government without fear that their identities as linked to a specific work product will be inappropriately revealed. Allowing an individual applicant or other individual who is the subject of an assessment or evaluation to access material that would inappropriately reveal a confidential referee or peer reviewer source could interfere with or compromise the objectivity and fairness of grant and contract review proceedings, constitute an unwarranted invasion of the personal privacy of the source and violate the express promise of confidentiality made to the source.
• Subsections (d)(2) through (d)(4). An exemption from the amendment provisions is necessary while one or more related grant and/or contract review proceedings are pending, but only if and to the extent that disclosure of information in the amendment request process would inappropriately reveal the identity of any referee or peer reviewer source who was expressly promised confidentiality. This exemption will be limited to allowing the agency, when processing an amendment or correction request by an individual applicant or other individual who is the subject of an evaluation or assessment in a pending proceeding, to avoid disclosing the existence of the record and its contents, if doing so would inappropriately reveal the identity of any referee or peer reviewer source who was expressly promised confidentiality. Inappropriately revealing the identity of a confidential referee or peer reviewer source to an individual applicant or other individual who is the subject of an evaluation or assessment in a pending proceeding could interfere with that proceeding, would constitute an unwarranted invasion of the personal privacy of a source, or would violate the express promise of confidentiality made to the source.

Accordingly, pursuant to 5 U.S.C. 552a(k)(5), the agency is now exempting the following source-identifying material in system of records 09-25-0225 NIH eRA Records from the accounting, access, amendment and notification provisions of the Privacy Act (paragraphs (c)(3) and (d)(1) through (4)), based on the specific rationales indicated above:

Material that would inappropriately reveal the identities of referees who provide letters of recommendation and peer reviewers who provide written evaluative input and recommendations to NIH about particular funding applications under an express promise by the government that their identities in association with the written work products they authored and provided to the government will be kept confidential; this includes only material that would reveal a particular referee or peer reviewer as the author of a specific work product (e.g., reference or recommendation letters, reviewer critiques, preliminary or final individual overall impact/priority scores, and/or assignment of peer reviewers to an application and other evaluative materials and data compiled by NIH/OER); it includes not only an author's name but any content that could enable the author to be identified from context.

Notwithstanding the exemptions, consideration will be given to any requests for notification, access, and amendment that are addressed to the System Manager, as provided in the SORN for system of records 09-25-0225, and to accounting of disclosure requests.

The Federal Register notice containing the SORN proposed for new system of records 09-25-0225 (81 FR 88690, published December 8, 2016) provides for that SORN to be effective upon publication of this final rule. No changes were made to the SORN as a result of public comments and, therefore, the SORN, as published at 81 FR 88690, is now effective.

Analysis of Impacts

I. Review Under Executive Orders 12866, 13563, and 13771

The agency has reviewed this rule under Executive Orders 12866 and 13563, which direct agencies to assess costs and benefits of available regulatory alternatives and, if regulation is necessary, to maximize the net benefits. The agency believes that this rule is not a significant regulatory action under Executive Order 12866, and therefore does not constitute an Executive Order 13771 regulatory action, because it will not (1) have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or state, local or tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) materially alter the budgetary impact of entitlements, grants, user fees or loan programs, or the rights and obligations of recipients thereof; or (4) raise novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles set forth in Executive Order 12866. This rule renders certain Privacy Act requirements inapplicable to certain agency records (in this case, certain confidential source-identifying records in NIH research and development award records) in accordance with criteria established in subsection (k)(5) of the Privacy Act (5 U.S.C. 552a(k)(5)), based on a showing that agency compliance with those Privacy Act requirements with respect to those records would harm the effectiveness or integrity of the agency function or process for which the records are maintained (in this case, NIH research and development award processes).

II. Review Under the Regulatory Flexibility Act (5 U.S.C. 601-612)

The Regulatory Flexibility Act requires agencies to analyze regulatory options that would minimize any significant regulatory impacts of a rule on small entities. Because the rule imposes no duties or obligations on small entities, we have determined, and the Director certifies, that the rule will not have a significant economic impact on a substantial number of small entities.

III. Review Under the Unfunded Mandates Reform Act of 1995 (Section 202, Pub. L. 104-4)

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that agencies prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current threshold after adjustment for inflation is $144 million, using the most current (2015) Implicit Price Deflator for the Gross Domestic Product. The agency does not expect that this final rule would result in any 1-year expenditure by State, local, and tribal governments that would meet or exceed this amount.

IV. Review Under the Paperwork Reduction Act of 1995 (44 U.S.C. 35-1 et seq.)

This rule does not contain any information collection requirements subject to the Paperwork Reduction Act.

V. Review Under Executive Order 13132, Federalism

This rule will not have any direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government. Therefore, the requirements of Executive Order 13132 are inapplicable.

List of Subjects in 45 CFR Part 5b

• Privacy

For the reasons set out in the preamble, the Department amends part 5b of title 45 of the Code of Federal Regulations as follows:

PART 5b—PRIVACY ACT REGULATIONS

1. The authority citation for part 5b continues to read as follows:

Authority: 5 U.S.C. 301, 5 U.S.C. 552a.

2. Amend § 5b.11 by:

a. Removing “and,” from the end of paragraph (b)(2)(iv)(A);

b. Removing the period at the end of paragraph (b)(2)(iv)(B) and adding “; and” in its place; and

c. Adding paragraph (b)(2)(iv)(C).

The addition reads as follows:

§ 5b.11

Exempt systems.

* * * * *

(b) * * *

(2) * * *

(iv) * * *

(C) NIH Electronic Research Administration (eRA) Records, HHS/NIH/OD/OER, 09-25-0225.

* * * * *

Dated: February 5, 2018.

Francis S. Collins,

Director, National Institutes of Health.

Approved: March 28, 2018.

Alex M. Azar II,

Secretary, Department of Health and Human Services.