2015-07899. Privacy Act of 1974; Report of an Altered System of Records

AGENCY:

Health Resources and Services Administration (HRSA), Department of Health and Human Services (HHS or Department).

ACTION:

Notice of an Altered System of Records.

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974 (5 U.S.C. 552a), the Health Resources and Services Administration (HRSA) is publishing notice of a proposed alteration of the system of records entitled and numbered “Public Health and National Health Service Corps Scholarship Program (NHSC SP), National Health Service Corps Loan Repayment Program (NHSC LRP), Students to Service, (S2S), NHSC Student/Resident Experiences and Rotations in Community Health (SEARCH), NURSE Corps Loan Repayment Program (NURSE Corps LRP) formerly the Nursing Education Loan Repayment Program (NELRP), NURSE Corps Scholarship Program (NURSE Corps SP) formerly the Nursing Scholarship Program (NSP), Native Hawaiian Health Scholarship Program (NHHSP), and Faculty Loan Repayment Program (FLRP), Applicants and/or Participants Records System, HHS/HRSA/BHW,” No. 09-15-0037. The proposed alterations affect the system name, system location, categories of records, purposes, routine uses, safeguards, records retention and disposal, system manager title and address, as well as minor editorial corrections and clarifications.

DATES:

HRSA filed an altered system report with the Chair of the House Committee on Government Reform and Oversight, the Chair of the Senate Committee on Homeland Security and Governmental Affairs, and the Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget (OMB) on March 30, 2015. To ensure all parties have adequate time in which to comment, the altered system, including the routine uses, will become effective 30 days from the publication of the notice or 40 days from the date it was submitted to OMB and Congress, whichever is later, unless HRSA receives comments that require alterations to this notice.

ADDRESSES:

Please address comments to: Associate Administrator, Bureau of Health Workforce (BHW), Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 11W-37, Rockville, MD 20857, telephone [phone], or FAX [phone]. Comments received will be available for inspection at this same address from 9:00 a.m. to 3:00 p.m. (Eastern Standard Time Zone), Monday through Friday.

FOR FURTHER INFORMATION CONTACT:

BMISS System Manager, Bureau of Health Workforce, Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 11W-37, Rockville, MD 20857, Telephone: [phone].

SUPPLEMENTARY INFORMATION:

I. Explanation of Changes

• The system of records notice name has been shortened to “HHS/HRSA/BHW Scholarship and Loan Repayment Program Records.”
• The Nursing Scholarship Program (NSP) has been renamed the NURSE Corps Scholarship Program (NURSE Corps SP), and the Nursing Education Loan Repayment Program (NELRP) has been renamed the NURSE Corps Loan Repayment Program (NURSE Corps LRP) and all associated records have been merged into a new central database system as noted below.
• A new information system, BHW Management Information System Solution (BMISS), has replaced Bureau of Health Care Delivery and Assistance NET (BHCDANET), and serves as the central database for information concerning the, NHSC SP, NHSC LRP, S2S, NURSE Corps SP, NURSE Corps LRP, FLRP, and NHHSP.
• The system location section has been updated to indicate that electronic records and electronic copies of paper records for applicants and participants under various programs are now stored in BMISS and to include locations of records not stored in BMISS (for example, Ambassador records are electronic but currently maintained in an online Web site directory while a BMISS database is being designed and built, at which point the records will be merged into BMISS).
• The categories of records have been updated to include “information concerning educational loans.”
• The purpose(s) section has been updated to consolidate certain descriptions (i.e., to combine the loan repayment and scholarship program monitoring activities previously described in purpose 4 with the other program selection and monitoring activities previously described in purpose 8), and to include intra-agency transfers of information previously described as routine uses by mistake (i.e., transfers to HHS' debt and financial management systems).
• The routine uses have been revised for editorial clarity and otherwise updated as follows:

○ Former routine use 15, pertaining to preparation of financial management and accounting documentation and information to be provided to the Department of the Treasury, has been deleted and is instead covered in the SORN for the “Unified Financial Management System,” System No. 09-90-0024, which receives information from this system for that purpose.

○ Former routine uses 17, 18, 21 and 22, and a portion of what is now routine use 16 (formerly 14 and 24), pertaining to collection of delinquent federal debts, have been deleted because they are included in the SORN for the “Debt Management and Collection System,” System No. 09-40-0012 (see 7, 10, 11, 13), which receives information from this system for those purposes.

○ Routine use 8 has been updated to specify that the information that may be disclosed includes a participant's name, Social Security number (SSN), mailing address, email address, phone number, health professions school, residency training, specialty, program status, award years, service start and end dates, and service site address and phone number.

○ Routine use 11 has been updated allowing HHS to release to the participant's service site information from the participant's file, including but not limited to, his/her allegations concerning conditions at the site, disputes with site management, or circumstances surrounding his/her resignation/termination for the purpose of monitoring the program participant's compliance with the service obligation, including fact-finding to calculate service credit, to decide transfer requests, or to make default determinations.

○ Routine use 14 has been added to allow HHS to disclose information consisting of name, address, SSN, health professions license number, and place of employment to a state or local government agency, including any agent thereof, maintaining criminal, civil, or administrative violation records, or other pertinent information such as records regarding the investigation or resolution of allegations involving a program participant. The purpose of this disclosure is to enable HHS to monitor compliance with program requirements and make determinations regarding administrative actions or other remedies, including default determinations.

○ Routine use 15 has been added to allow HHS to disclose Ambassador information consisting of name, email and social network address(es), phone number(s), employment information, and professional biographies to current and prospective participants in BHW programs and other interested individuals. The purpose of this disclosure is to allow these individuals to contact Ambassadors who serve as mentors and local resources for the NHSC programs.

○ Routine use 17 (formerly 16) has been updated to allow HHS to disclose information to loan servicing agencies for the purposes of obtaining payoff balances on educational loans and determining whether loans are eligible for repayment under the programs.

○ Routine use 19 (formerly 20) has been updated to allow HHS to disclose information to the Department of the Treasury to determine if the applicant's name appears on the Do Not Pay List for program integrity/applicant eligibility purposes.

• The safeguards section has been updated to include encryption, intrusion detection, and firewalls.
• The retention and disposal section has been expanded and updated to include records created in BMISS or digitized and migrated into BMISS, and to cite applicable disposition schedules.
• The system manager contact information has been updated.
• The notification procedure has been revised to reflect the information that must be included in a notification request made by mail.
• The record source categories have been revised to include these additional sources: System for Awards Management (SAM) (formerly the Excluded Parties List System); HHS Office of Inspector General Web site listing individuals excluded from Medicare, Medicaid, and all other federal health care programs; and HHS database of Health Professional Shortage Areas.
• Other minor editorial corrections have been made to reflect the elimination of the Bureau of Clinician Recruitment and Services (BCRS) and the transfer of its functions to the newly established Bureau of Health Workforce (BHW).

II. The Privacy Act

The Privacy Act (5 U.S.C. 552a) governs the means by which the U.S. Government collects, maintains, and uses information about individuals in a system of records. A “system of records” is a group of any records under the control of a federal agency from which information about an individual is retrieved by the individual's name or other personal identifier. The Privacy Act requires each agency to publish in the Federal Register a system of records notice (SORN) identifying and describing each system of records the agency maintains, including the purposes for which the agency uses information about individuals in the system, the routine uses for which the agency discloses such information outside the agency, and how individual record subjects can exercise their rights under the Privacy Act (e.g., to seek access to their records in the system).

Dated: March 31, 2015.

Mary K. Wakefield,

Administrator.

System Number: 09-15-0037

System name:

HHS/HRSA/BHW Scholarship and Loan Repayment Program Records

Security classification:

Unclassified

System location:

The servers for the central database (known as the Bureau of Health Workforce (BHW) Management Information System Solution (BMISS)) are located at the Center for Information Technology, National Institutes of Health, 12 South Drive, Room 1100, Bethesda, Maryland 20892, and are accessed from computer workstations in program offices listed below. Paper copies of records included in the central database, and any paper or electronic records not included in the central database, are also stored in the program offices listed below:

• Native Hawaiian Health Scholarship Program (NHHSP) records are located at the BHW, Health Resources and Services Administration (HRSA), U.S. Department of Health and Human Services (HHS), 5600 Fishers Lane, Room 9-105, Rockville, MD 20857 and at Papa Ola Lokahi, 894 Queen St., #706, Honolulu, HI 96813.
• Ready Responder electronic records are located at BHW, HRSA, HHS, 5600 Fishers Lane, Room 15W-21D, Rockville, MD 20857.
• NHSC Student/Resident Experiences and Rotations in Community Health (SEARCH) records are located at BHW HRSA, HHS, 5600 Fishers Lane, Room 7-100, Rockville, MD 20857.

Additional records (e.g., spreadsheets created to perform their duties) are kept by contractors who assist with the implementation of the NHSC LRP, NHSC SP, NURSE Corps LRP (formerly NELRP), NURSE Corps SP (formerly NSP), FLRP, and are maintained at the below contractor locations:

• Customer Care Center, Teletech, 8123 South Hardy Dr., Tempe, AZ 85284;
• Futrend Technology, Inc., 8605 Westwood Center Dr., Suite 502, Vienna, VA 22182;
• Sapient Government Services, 1515 N. Courthouse Rd., 4th Floor, Arlington, VA 22201.

Because contractors may change, a current listing of contractors and locations (if different from above) is available upon request by contacting the Policy-Coordinating Official. Archived records (including scanned paper files that have been merged into BMISS) are stored at the Washington National Records Center, 4205 Suitland Road, Suitland, MD 20746.

Categories of individuals covered by the system:

The system contains information about the following categories of individuals:

• Individuals who have applied for, who are receiving, or who have received awards under the following programs: the National Health Service Corps Scholarship Program (NHSC SP), the National Health Service Corps Loan Repayment Program (NHSC LRP), Students to Service (S2S), the NURSE Corps Loan Repayment Program (NURSE Corps LRP) formerly the Nursing Education Loan Repayment Program (NELRP), the NURSE Corps Scholarship Program (NURSE Corps SP) formerly the Nursing Scholarship Program (NSP), the Native Hawaiian Health Scholarship Program (NHHSP), and the Faculty Loan Repayment Program (FLRP).
• Individuals who have applied to participate, are participating, or have participated in the NHSC Student/Resident Experiences and Rotations in Community Health (SEARCH) Program.
• Individuals who are current or former Ambassadors, Alumni, or Ready Responders.
• Individuals who indicate an interest in employment in or an assignment to a medical facility located in a Health Professional Shortage Area (HPSA) or a medically underserved population area, including public and federal medical facilities, such as Bureau of Prisons medical facilities, Indian Health Service health care facilities, and other federally sponsored health care facilities.

Categories of records in the system:

Records include the individual's name, address(es), telephone number(s), email address(es), Social Security number (SSN); scholarship, loan repayment, Ambassadors, Alumni, Ready Responders or SEARCH application and associated forms/documents, contracts, employment data, professional performance and credentialing history of licensed health professionals; preference for site-selection; personal, professional, and demographic background information; academic and/or service progress reports (which include related data, correspondence, and professional performance information consisting of continuing education, performance awards, and adverse or disciplinary actions); commercial credit reports, educational data including tuition and other related education expenses; educational data including academic program and status; information concerning educational loans; employment status verification (which includes certifications and verifications of service obligation); medical data, financial data, payment data and related forms, deferment/placement/suspension/waiver data and supporting documentation; repayment/delinquent/default status information, correspondence to and from Program applicants and participants and/or their representatives, Claims Collection Litigation Reports for default cases referred to the Department of Justice (DOJ).

Authority for maintenance of the system:

• Section 333 of the Public Health Service (PHS) Act, as amended (42 U.S.C. 254f), Assignment of Corps Personnel;
• Section 225 of the PHS Act (42 U.S.C. 234), as in effect on September 30, 1977, PH/NHSC Scholarship Training Program;
• Section 409(b) of the Health Professions Educational Assistance Act of 1976, (42 U.S.C. 295g), PSASP;
• Sections 338A-H of the PHS Act, as amended (42 U.S.C. 254l-q), NHSC Scholarship and Loan Repayment Programs;
• Sections 336(c) and 331(b)(1) of the PHS Act (42 U.S.C. 254h-1(c) and 254d(b)(1)), SEARCH;
• Section 846 of the PHS Act, as amended (42 U.S.C. 297n), NURSE Corps Loan Repayment Program (formerly the Nursing Education Loan Repayment Program) and NURSE Corps Scholarship Program (formerly the Nursing Scholarship Program);
• Section 10 of the Native Hawaiian Health Care Improvement Act, as amended (42 U.S.C. 11709), NHHSP;
• Section 738(a) of the PHS Act (42 U.S.C. 293b(a)), Faculty Loan Repayment Program;
• Section 202 of Title II of Pub. L. 92-157 (42 U.S.C. 3505d), National Health Professional Shortage Clearinghouse;
• 31 U.S.C. 7701(c), Debt Collection Improvement Act of 1996, Requirement That Applicant Furnish Taxpayer Identifying Number;
• Section 215(a) of the PHS Act, as amended (42 U.S.C. 216(a)), pertaining to PHS commissioned officers, and 5 U.S.C. 3301 pertaining to civil service employees, both of which authorize verification of an individual's suitability for employment.

Purpose(s):

Relevant agency personnel use records about individuals from this system on a need to know basis for the following purposes:

1. To obtain marketing and recruitment information concerning individuals who registered to complete an online application, but did not submit or complete an application.

2. To identify and select qualified individuals to participate in the above-identified Programs.

3. To maintain records on and to verify Program applicants' or participants' credentials and educational background, and previous and current professional employment data and performance history information to verify that all claimed background and employment data are valid and all claimed credentials are current and in good standing from selection for an award through the completion of service.

4. To assist the HHS Program Support Center (PSC), the DOJ, and other government entities in the collection of Program debts.

5. To respond to inquiries from Program applicants and participants, their attorneys or other authorized representatives, and Congressional representatives.

6. To compile and generate managerial and statistical reports.

7. With respect to the PH/NHSC and NHSC SP, NHHSP, NURSE Corps SP (formerly NSP), NHSC LRP, NURSE Corps LRP (formerly NELRP), and FLRP: (a) to select and match scholarship recipients, loan repayors, and other individuals for assignment to or employment with a health care or other facility appropriate to the Programs' purposes; (b) to perform loan repayment and scholarship program administrative activities, including, but not limited to, payment tracking, deferment of the service obligation, monitoring a participant's compliance with the service requirements, determination of service completion, review of suspension or waiver requests, default determinations, and calculation of liability upon default; and (c) to monitor the services provided by the Programs' health care providers.

8. With respect to the SEARCH Program: (a) to track recruitment of SEARCH participants for the NHSC Scholarship and Loan Repayment Programs; and (b) to determine how many non-obligated SEARCH participants ultimately practice primary health care in a Health Professional Shortage Area (HPSA).

9. With respect to the Ambassador and Alumni activities: (a) to advocate for more health professions students to choose primary care; (b) to mentor students and clinicians; and (c) to recruit students and clinicians for the NHSC Scholarship and Loan Repayment Programs, and to train community leaders and local clinicians to care about and for people in need.

10. To transfer records of delinquent federal debts to System No. 09-40-0012, Debt Management and Collection System, for debt collection purposes.

11. To transfer information to System No. 09-90-0024, Unified Financial Management System (UFMS), for purposes of effecting payment of program funds (through the Department of the Treasury) and preparing and maintaining financial management and accounting documentation related to obligations and disbursements of funds, (including providing notifications to the Department of the Treasury) related to payments to, or on behalf of, awardees. Information transferred to UFMS for these purposes is limited to the individual's name, address, SSN and other information necessary to identify him/her, the funding being sought or amount of qualifying educational loans, and the program under which the awardee is being processed.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

In addition to the disclosures authorized by the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(b)(11), information about an individual may be disclosed from this system of records to parties outside HHS, without the individual's prior, written consent, for these routine uses:

1. HHS may disclose to a Member of Congress or to a Congressional staff member information from the record of an individual in response to a written inquiry from the Congressional office made at the written request of that individual.

2. HHS may disclose information from this system of records to the Department of Justice (DOJ) or to a court or other tribunal when

a. HHS, or any component thereof, or

b. Any HHS employee in his or her official capacity, or

c. Any HHS employee in his or her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee, or

d. The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, HHS determines that the records are both relevant and necessary to the litigation and that, therefore, the use of such records by the DOJ, court, or other tribunal is deemed by HHS to be compatible with the purpose for which the records were collected.

3. In the event that a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, disclosure may be made to the appropriate public authority, whether federal, state, local, tribal, or otherwise, responsible for enforcing, investigating or prosecuting such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto, if the information is relevant to the enforcement, regulatory, investigative, or prosecutorial responsibility of the receiving entity. This includes, but is not limited to, disciplinary actions by state licensing boards against current or former Program participants.

4. HHS may disclose information consisting of names, SSN, disciplines and/or medical specialties, current mailing addresses, dates of scholarship support, and dates of graduation of NHSC SP, NURSE Corps SP (formerly NSP) and NHHSP scholarship recipients to: (a) designated coordinators at each health professions school participating in the scholarship program for the purpose of determining educational expenses and resulting levels of scholarship support, and for the purpose of guiding and informing these recipients about the nature of their service obligation; and (b) schools attended by scholarship recipients who have taken a leave of absence from school, have terminated enrollment or been dismissed from school, or are repeating coursework, for the purpose of determining their academic status and whether their scholarship support should be suspended or resumed, as appropriate.

5. HHS may disclose information consisting of name, address, discipline and/or medical specialty, and SSN from this system of records to a Program participant's health professions school, residency program, or other postgraduate training program, for the purpose of ascertaining the participant's enrollment status and training completion or graduation date.

6. HHS may disclose records consisting of names, disciplines and/or medical specialties, current business or school mailing addresses, email addresses of the Programs' scholarship and loan repayment participants to contractors, Ambassadors, Alumni, and professional organizations in underserved communities for the purpose of supporting these clinicians in the course of their service obligation in a HPSA, school of nursing, or critical shortage facility.

7. HHS or its contractors may disclose records consisting of a SEARCH participant's name, mailing address, email address, phone number, health professions school, residency training and specialty to state Primary Care Offices (PCOs) and Primary Care Associations (PCAs) and site representatives for the purpose of matching participants to potential employment sites.

8. HHS may disclose records consisting of a participant's name, SSN, mailing address, email address, phone number, health professions school, residency training, specialty, program status, award years, service start and end dates, and service site address and phone number to Department grantees, contractors and subcontractors who assist with the implementation of the above-identified Programs, for the purposes of collecting, compiling, aggregating, analyzing, or refining records in the system, or improving Program operations. Grantees and contractors maintain, and contractors are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records.

9. HHS may disclose biographical data and information supplied by Program applicants or participants: (a) To references listed on the application and associated forms for the purpose of evaluating the applicant's or participant's professional qualifications, experience, and suitability; (b) to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity for the purpose of verifying that all claimed background and employment data are valid and all claimed credentials are current and in good standing; and (c) to prospective, current or former employers, or to site representatives, PCAs, and PCOs for the purpose of appraising the applicant's professional qualifications and suitability for site assignment or employment.

10. HHS may disclose an applicant's or participant's name, mailing address, email address, phone number, SSN, health professions school, residency training, and specialty to Department grantees, site representatives, contractors, and subcontractors who assist with the implementation of the above-identified Programs, for the purpose of recruiting, screening, evaluating, and matching, placing, or assigning health professionals to a service site appropriate to the relevant Program's purposes. In addition, Department grantees, contractors and subcontractors may disclose biographical data and information supplied by Program applicants, participants, or references listed on the application and associated forms: (a) To other references for the purpose of evaluating the applicant's or participant's professional qualifications, experience, and suitability; (b) to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity for the purpose of verifying that all claimed background and employment data are valid and all claimed credentials are current and in good standing; (c) to the System for Awards Management (formerly Excluded Parties List System) for the purpose of determining whether applicants or participants are suspended, debarred, or disqualified from participation in covered transactions; (d) to the National Practitioner Data Bank for the purpose of determining whether applicants or participants have information on their reports; and (e) to prospective employers, or to site representatives, for the purpose of appraising the applicant's or participant's professional qualifications and suitability for site assignment or employment. Grantees and contractors maintain, and contractors are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records.

11. HHS may disclose records consisting of name, mailing address, email address, phone number, SSN, specialty, and requested or actual placement site(s) to State Loan Repayment Grantees, state PCOs and PCAs, and site representatives to facilitate PCO, PCA and site activities related to recruitment and placement of Program participants at service sites. For the purpose of monitoring the program participant's compliance with the service obligation, including fact-finding to calculate service credit, to decide transfer requests, or to make default determinations, HHS may release to the participant's service site other information from the participant's file, including but not limited to, his/her allegations concerning conditions at the site, disputes with site management, or circumstances surrounding his/her resignation/termination.

12. HHS may disclose records to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity which maintains records concerning: (a) An individual's employment history; (b) the issuance, retention, suspension, revocation, or reinstatement of licenses or registrations necessary to practice a health professional occupation or specialty; (c) disciplinary action against the individual or other sanctions imposed by a state or local government licensing board; or (d) the individual's attempts to pass health professions licensure exam(s). This disclosure may include the applicant's or participant's name, address, SSN, employment history, educational data, accreditation, licensing, and professional qualification data, and facts concerning any clinical competence, unprofessional behavior, or substance abuse problem of which HHS is aware. The purposes of this disclosure are: (1) To enable HHS to obtain information relevant to a decision concerning a health professional's accomplishments, professional and personal background qualifications, experience, and any licensure sanctions related to substance abuse, to determine the individual's suitability for employment, retention, or termination as a health services provider at a health care facility approved by the relevant Program; and (2) to inform health professions licensing boards or the appropriate non-government entities about the health care practices or conduct of a practicing, terminated, resigned, or retired health services provider whose professional conduct so significantly failed to conform to generally accepted standards of professional practice for health care providers as to raise reasonable concern for the health and safety of patients.

13. HHS may disclose information consisting of name, address, SSN, health professions license number, and place of employment from this system of records to federal, state, or local health agencies and law enforcement regarding a program participant who has a physical or mental condition that is, or has the potential to become, a risk to patients or to the public at large, or whose aberrant behavior poses such a risk (e.g., commission of a sexual assault, illegal use or distribution of narcotics).

14. HHS may disclose information consisting of name, address, SSN, health professions license number, and place of employment to a state or local government agency, including any agent thereof, maintaining criminal, civil, or administrative violation records, or other pertinent information such as records regarding the investigation or resolution of allegations involving a program participant. The purpose of this disclosure is to enable HHS to monitor compliance with program requirements and make determinations regarding administrative actions or other remedies, including default determinations.

15. HHS may disclose Ambassador information consisting of name, email and social network address(es), phone number(s), employment information, and professional biographies to current and prospective participants in BHW programs and other interested individuals. The purpose of this disclosure is to allow these individuals to contact Ambassadors who serve as mentors and local resources for the NHSC programs.

16. HHS may disclose information from this system of records to a consumer reporting agency, as defined in 31 U.S.C. 3701(a)(3), for the following purposes:

a. To obtain a commercial credit report to assess the creditworthiness of a scholarship or loan repayment applicant;

b. To verify information provided on the scholarship or loan repayment application concerning whether the applicant has ever defaulted on a federal or non-federal obligation, or had delinquent federal or non-federal debts or judgment liens;

c. To determine and verify the eligibility of loans submitted for repayment;

d. To assess and verify ability of a debtor to repay debts owed to the federal government; and

e. To provide an incentive for debtors to repay federal debts by making these debts part of their credit records.

Pursuant to 31 U.S.C. 3711(e)(1)(F), the information disclosed to the consumer reporting agency is limited to (i) information necessary to establish the identity of the person, including name, address, and taxpayer identification number; (ii) the amount, status, and history of the claim; and (iii) the agency or program under which the claim arose.

17. HHS may disclose information about NHSC LRP, S2S, NURSE Corps LRP (formerly NELRP), and FLRP applicants or participants to lending institutions and loan servicing agencies for the purpose of obtaining payoff balances on educational loans and determining whether loans are eligible for repayment under the Program. Disclosure will be limited to the applicant/participant's name, address, SSN, the loan account number(s), the pre-verified loan balance, account status, and other information necessary to identify the LRP applicant/participant and his/her loans for this purpose.

18. HHS may disclose information to the Department of the Treasury, Internal Revenue Service (IRS), about an individual applying under the above-identified Programs to find out whether the applicant has a delinquent tax debt. This disclosure is for the sole purpose of determining the applicant's eligibility for funding and/or creditworthiness and is limited to the individual's name, address, SSN, other information necessary to identify him/her, and the program for which the information is being obtained.

19. HHS may disclose information from this system of records to another federal, state, or local agency or private employer to whom a Program defaulter has applied for federal grant funds, federal scholarship, loan, or loan repayment funds, or employment involving federal funds, for the purpose of ensuring that the Program defaulter does not receive federal funds for which he/she is ineligible. Disclosure will be limited to the defaulter's name, address, SSN, inclusion on the Do Not Pay List, and any other information necessary to identify him/her.

20. HHS may disclose information from this system of records to the DOJ and applicable state agencies in order to exclude a debtor from all federal health care programs, as defined in 42 U.S.C. 1320a-7b(f), including Medicare and Medicaid, or to conclude a settlement agreement staying such an exclusion.

21. HHS may disclose information from this system of records to other federal, state, and local agencies, and public and private entities that provide scholarship and/or loan repayment funding or include bonus clauses in employment contracts, for the following purposes: (a) to curtail fraud and abuse of federal funds by identifying individuals who have applied for, or accepted, funding from another source for performance of the same service; and (b) to determine if an applicant has an existing service obligation to another federal, state, local, or other entity.

22. HHS may disclose to federal, state, and local agencies, and public and private non-profit entities for research purposes, the name, address(es), SSN, discipline and service sites of applicants and participants in the above-identified Programs when the Department:

i. has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;

ii. has determined that a bona fide research/analysis purpose exists;

iii. has required the recipient to:

• establish strict limitations concerning the receipt and use of applicant- and participant-identified data;
• establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record;
• remove, destroy, or return the information that identifies the applicant or participant at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research nature for retaining such information; and
• make no further use or disclosure of the record except as authorized by HHS or when required by law; and

iv. has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.

23. Disclosure may be made in response to a subpoena from another federal agency having the power to subpoena other agencies' records, such as the IRS or U.S. Commission on Civil Rights.

24. Disclosure of information from this system of records may be made to the HHS/PSC/Federal Occupational Health contract physicians to review and provide a written opinion of the medical documentation submitted by scholarship and loan repayment Program participants seeking a suspension or waiver of their service or payment obligation.

25. Disclosure to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.

26. HHS may disclose records to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.

Because, as described in the Purposes section, certain information from this system of records is transferred to HHS' financial and debt management systems, those systems' SORNs should be consulted for additional routine use disclosures that may be made without the individual's consent. See Unified Financial Management System, System No. 09-90-0024, and Debt Management and Collection System, System No. 09-40-0012.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system—

Storage:

Records are maintained in electronic database servers and backup servers, file folders, and for NHHSP records, backup tapes.

Retrievability:

Records are retrieved by an individual's name, Social Security number, or other identifying numbers or characteristics.

Safeguards:

a. Authorized Users: Password-protected access is limited to persons authorized and needing to use the electronic records, which includes system managers and their staff, BHW headquarter officials and staff, HRSA Division of Regional Operations staff, financial and fiscal management personnel, Office of the General Counsel, Office of Information Technology personnel, and at Papa Ola Lokahi (POL), an entity which collaborates with HRSA/BHW in the administration of the Native Hawaiian Health Scholarship Program (NHHSP) through a Cooperative Agreement to assist with the implementation of the NHHSP. POL is physically located at 894 Queen St., Honolulu, HI 96813.

b. Additional Authorized Users: Password-protected access is also provided to applicants, participants, and service sites for the purpose of inputting data, uploading documents, or submitting queries through BMISS.

c. Physical Safeguards: Rooms where records are located are locked when not in use. During regular business hours, rooms are unlocked but are controlled by on-site personnel. Security guards perform random checks on the physical security of the offices (storage locations) after duty hours, including weekends and holidays.

Servers and other computer equipment used to process identifiable data are located in secured areas and use physical access devices (e.g., keys, locks, combinations, card readers) and/or security guards to control entries into the facility. All facilities housing HRSA information systems maintain fire suppression and detection devices/systems (e.g., sprinkler systems, handheld fire extinguishers, fixed fire hoses, and or smoke detectors) that can be activated in the event of a fire.

With respect to NHHSP records located at Papa Ola Lokahi (POL), an entity HRSA/BWH collaborates with to administer the NHHSP, the building in which POL's office is located is publicly accessible but secured, with limited accessibility before and after work hours. Security guards visit the building at night. NHHSP's office suite is kept locked during work hours and individual offices are also locked when vacant. Applicant and participant files are kept in a locked cabinet in a locked office. Access to these files is limited to approved staff members, and when the area the files are in is not under the direct control of NHHSP staff, the office and cabinet are kept locked. The file server is behind a locked office door in a locked server cabinet. Backup tapes are stored in a locked, fireproof floor safe, and a secure, confidential off-site vault.

Technical safeguards: Encryption, intrusion detection and firewalls are utilized. Scans are run against the BMISS platform for web and architecture vulnerabilities. Complex or strong passwords are required and are changed frequently.

Retention and disposal:

Records are retained and disposed of as follows:

• Files concerning participants who complete their obligations or whose obligations are waived, cancelled, or terminated are transferred to the Washington National Records Center in Suitland, Maryland and are destroyed 6 years after final payment, under disposition schedule HSA B-351 3. 1.
• HRSA has digitized and uploaded paper files concerning active participants in BHW scholarship and loan repayment programs into BMISS. The paper files are stored at the Washington National Records Center and are destroyed 15 years after closeout, under disposition schedule N1-512-92-01, item 25P 1 and 2.
• Unfunded or withdrawn applicant records are destroyed 6 months after the close of each fiscal year application period, under disposition schedule N1-512-92-01, item 25P 1.
• Currently, all records migrated to BMISS or created in BMISS are retained indefinitely, pending NARA's approval of a revised schedule.

System manager(s) and address:

The System Manager for the system of records is the following Policy-Coordinating Official:

Director, Division of Policy and Shortage Designation, Bureau of Health Workforce (BHW), Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 11W-42, Rockville, MD 20857.

Points of contact for specific programs/activities:

• NHSC SP and NHSC LRP Applications/Awards; Participant Placement/Assignment; Ready Responders: Director, Division of the National Health Service Corps, BHW, HRSA, 5600 Fishers Lane, Room 8C-26, Rockville, MD 20857.
• NURSE Corps LRP (formerly NELRP), NURSE Corps SP (formerly NSP), and FLRP Applications/Awards; Participant Placement/Assignment: Director, Division of Health Careers and Financial Support, BHW, HRSA, 5600 Fishers Lane, Room 9-105, Rockville, MD 20857.
• NHSC SP, NHSC LRP, S2S, NURSE Corps LRP (formerly NELRP), NURSE Corps SP (formerly NSP), and FLRP Participants' service from matching through service completion: Director, Division of Participant Support and Compliance, BHW, HRSA, 5600 Fishers Lane, Room 15W-50, Rockville, MD 20857.
• Suspension/Waiver/Default Determination for all BHW Programs: Chief, Legal and Compliance Branch, BHW, HRSA, 5600 Fishers Lane, Room 8-73, Rockville, MD 20857.
• NHHSP: Administrator, Papa Ola Lokahi, 894 Queen St., # 706, Honolulu, HI 96813.
• SEARCH and Ambassadors: Director, Division of External Affairs, BHW, HRSA, 5600 Fishers Lane, Room 7-100, Rockville, MD 20857.

Notification procedure:

To find out if the system contains records about you, contact the Policy-Coordinating Official, Director, Division of Policy and Shortage Designation, Bureau of Health Workforce (BHW), Health Resources and Services Administration (HRSA), 5600 Fishers Lane, Room 11W-42, Rockville, MD 20857 who will refer you to the appropriate Point of Contact for the program/activity.

Requests in person: A subject individual who appears in person at a specific location seeking access to or disclosure of records relating to him/her shall provide his/her name, current address, Social Security Number or other identifying information (e.g., date of birth), the name of the Program(s) in which the individual participated (or applied but was not selected), and at least one piece of tangible identification, such as driver's license, passport, or voter registration card. Identification papers with current photographs are preferred but not required. (A federally-issued picture ID is required to access many federal facilities such as the Parklawn Building.) If a subject individual has no identification but is personally known to an agency employee, such employee shall make a written record verifying the subject individual's identity. Where the subject individual has no identification papers, the responsible agency official shall require that the subject individual certify in writing that he/she is the individual who he/she claims to be and that he/she understands that the knowing and willful request for or acquisition of a record concerning an individual under false pretenses is a criminal offense subject to a $5,000 fine.

Requests by mail: A written request must contain the name and address of the requester, Social Security number or other identifying information, and his/her signature which is either notarized to verify his/her identity or includes a written certification that the requester is the person he/she claims to be and that he/she understands that the knowing and willful request for or acquisition of records pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine. In addition, the following information is needed: the name of the Program(s) in which the individual participated (or applied but was not selected), and the requester's current status (e.g., in training, in deferment, in service, or in default).

Requests by telephone: Because positive identification of the caller cannot be established, telephone requests are not honored.

Record access procedures:

Same as notification procedure. Requesters may also ask for an accounting of disclosures that have been made of their records, if any.

Contesting record procedures:

Same as notification procedure. Contact the Policy-Coordinating Official; specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories:

Records are obtained directly from the subject individuals, or from the following sources: educational institutions; internship and/or residency training programs; employers; NHSC-approved service sites; critical shortage facilities; schools of nursing; lending institutions and loan servicing agencies; health professional associations; National Practitioner Data Bank; System for Awards Management (formerly Excluded Parties List System); HHS Office of Inspector General Web site listing of individuals excluded from Medicare, Medicaid, and all other federal health care programs; HHS database of Health Professional Shortage Areas; HHS grantees and contractors/subcontractors; consumer reporting agencies/credit bureaus; other federal agencies, including but not limited to the Department of the Treasury, IRS, and the U.S. Postal Service; state health professions licensing boards and/or the Federation of State Medical Boards or a similar non-government entity; and third parties who provide references or other information concerning the subject individual.

System exempted from certain provisions of the Act:

None.