2020-11899. Social Security Number Fraud Prevention

AGENCY:

Nuclear Regulatory Commission.

ACTION:

Direct final rule.

SUMMARY:

The U.S. Nuclear Regulatory Commission (NRC) is amending its regulations to implement the Social Security Number Fraud Prevention Act of 2017. This statute directed agencies to issue regulations that prohibit the inclusion of an individual's Social Security account number (Social Security number or SSN) on any document sent through the mail unless the head of the agency deems it necessary and the appropriate precautions are taken to protect the SSN. Applicants, licensees, and members of the public who are required to submit a form containing a SSN may be affected.

DATES:

This direct final rule is effective August 17, 2020, unless significant adverse comments are received by July 2, 2020. If this direct final rule is withdrawn as a result of such comments, timely notice of the withdrawal will be published in the Federal Register. Comments received after this date will be considered if it is practical to do so, but the NRC is able to ensure consideration only for comments received on or before this date. Comments received on this direct final rule will also be considered to be comments on a companion proposed rule published in the Proposed Rules section of this issue of the Federal Register.

ADDRESSES:

You may submit comments by any of the following methods:

• Federal Rulemaking Website: Go to https://www.regulations.gov and search for Docket ID NRC-2018-0303. Address questions about NRC dockets to Carol Gallagher; telephone: [phone]; email: [e-mail]. For technical questions contact the individuals listed in the FOR FURTHER INFORMATION CONTACT section of this document.
• Email comments to: [e-mail]. If you do not receive an automatic email reply confirming receipt, then contact us at 301-415-1677.
• Mail comments to: Secretary, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, ATTN: Rulemakings and Adjudications Staff.

For additional direction on obtaining information and submitting comments, see “Obtaining Information and Submitting Comments” in the SUPPLEMENTARY INFORMATION section of this document.

FOR FURTHER INFORMATION CONTACT:

Alexa Sieracki, Office of Nuclear Materials Safety and Safeguards, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; telephone: [phone], email: [e-mail].

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Obtaining Information and Submitting Comments

II. Procedural Background

III. Discussion

IV. Section-by-Section Analysis

V. Regulatory Flexibility Certification

VI. Regulatory Analysis

VII. Backfitting and Issue Finality

VIII. Plain Writing

IX. Environmental Assessment and Final Finding of No Significant Environmental Impact

X. Paperwork Reduction Act Statement

XI. Congressional Review Act

I. Obtaining Information and Submitting Comments

A. Obtaining Information

Please refer to Docket ID NRC-2018-0303 when contacting the NRC about the availability of information for this action. You may obtain publicly-available information related to this action by any of the following methods:

• Federal Rulemaking Website: Go to https://www.regulations.gov and search for Docket ID NRC-2018-0303.
• NRC's Agencywide Documents Access and Management System (ADAMS): You may obtain publicly-available documents online in the ADAMS Public Documents collection at https://www.nrc.gov/​reading-rm/​adams.html. To begin the search, select “Begin Web-based ADAMS Search.” For problems with ADAMS, please contact the NRC's Public Document Room (PDR) reference staff at 1-800-397-4209, 301-415-4737, or by email to [e-mail].
• Attention: The Public Document Room (PDR), where you may examine and order copies of public documents is currently closed. You may submit your request to the PDR via email at [e-mail] or call 1-800-397-4209 between 8:00 a.m. and 4:00 p.m. (EST), Monday through Friday, except Federal holidays.

B. Submitting Comments

Please include Docket ID NRC-2018-0303 in your comment submission.

The NRC cautions you not to include identifying or contact information that you do not want to be publicly disclosed in your comment submission. The NRC will post all comment submissions at https://www.regulations.gov as well as enter the comment submissions into ADAMS. The NRC does not routinely edit comment submissions to remove identifying or contact information.

If you are requesting or aggregating comments from other persons for submission to the NRC, then you should inform those persons not to include identifying or contact information that they do not want to be publicly disclosed in their comment submission. Your request should state that the NRC does not routinely edit comment submissions to remove such information before making the comment submissions available to the public or entering the comment into ADAMS.

II. Procedural Background

Because the NRC anticipates that this action will be non-controversial, the NRC is using the “direct final rule procedure” for this rule. The amendments to the rule will become effective on August 17, 2020. However, if the NRC receives significant adverse comments on this direct final rule by July 2, 2020, then the NRC will publish a document that withdraws this action and will subsequently address the comments received in a final rule as a response to the companion proposed rule published in the Proposed Rules section of this issue of the Federal Register. Absent significant modifications to the proposed revisions requiring republication, the NRC will not initiate a second comment period on this action.

A significant adverse comment is a comment where the commenter explains why the rule would be inappropriate, including challenges to the rule's underlying premise or approach, or would be ineffective or unacceptable without a change. A comment is adverse and significant if it meets the following criteria:

(1) The comment opposes the rule and provides a reason sufficient to require a substantive response in a notice-and-comment process. For example, a substantive response is required in the following circumstances:

(a) The comment causes the NRC to reevaluate (or reconsider) its position or conduct additional analysis;

(b) The comment raises an issue serious enough to warrant a substantive response to clarify or complete the record; or

(c) The comment raises a relevant issue that was not previously addressed or considered by the NRC.

(2) The comment proposes a change or an addition to the rule, and it is apparent that the rule would be ineffective or unacceptable without incorporation of the change or addition.

(3) The comment causes the NRC to make a change (other than editorial) to the rule. For detailed instructions on filing comments, please see the ADDRESSES section of this document.

III. Discussion

The President signed into law the Social Security Number Fraud Prevention Act of 2017 (the Act) on September 15, 2017, to reduce the risk of identity theft by directing agencies to “issue regulations specifying the circumstances under which inclusion of a social security account number on a document sent by mail is necessary.” ^[1] The Act restricts the inclusion of an SSN on any document sent by mail “unless the head of the agency determines that the inclusion of the [SSN] on the document is necessary.” ^[2] The Act directs agencies to issue regulations that specify when inclusion of an SSN is necessary, include instructions for the partial redaction of SSNs where feasible, and provide a requirement that SSNs not be visible on the outside of any package sent by mail.^[3] These regulations must be issued no later than 5 years after the date of enactment of the Act.

The NRC determined that rulemaking was necessary because the Act requires the NRC to amend its regulations. This effort could not be achieved through issuing guidance, as guidance documents are not legally binding and cannot be used to amend regulations. The NRC's rulemaking is narrowly tailored to address the requirements specifically set forth in the Act; therefore, the NRC determined that a direct final rule was appropriate, because the amendments are required by statute, expected to be non-controversial, and unlikely to yield public comment resulting in a significant change to the NRC's proposal. A direct final rule is preferable to a final rule because it allows for the opportunity for public comment, should there be any additional regulations that the public identifies as needing amendment or any additional considerations the NRC needs to evaluate to implement the Act.

To comply with the Act, the NRC examined whether SSNs are necessary in any of the written communications to the NRC required by regulation. The Act only applies to written communications sent or received via mail by the NRC that include SSNs. The Act does not apply to a licensee's validation of an individual's SSN because the SSN would not be included in written communications with the NRC in those cases. If inclusion of SSNs is not necessary, then each associated regulation would need to be amended to remove the inclusion of the SSN in the required documents. If inclusion of SSNs is necessary, the NRC must consider whether partial redaction of the SSN is feasible and amend the regulations accordingly to meet the “requirement that [SSNs] not be visible on the outside of any package sent by mail.” ^[4]

Based on its review, the agency has concluded that, in all instances where it requires full or partial SSNs to be included in written communications, this information is necessary for identity confirmation. Reasons for this include instances when individuals have similar or same names and cases where outside factors require the NRC to collect either a full or partial SSN. For example, the collection may be required by law or by another agency. The NRC already requests SSNs to be partially redacted in documents sent by mail whenever feasible. Therefore, the NRC concluded that minimal changes to its regulations are needed to reduce the inclusion of full or partial SSNs. However, the agency determined that the following amendments are needed to fully implement the Act:

• In § 9.1, a new Subpart E needs to be added concerning the use of SSNs in documents sent by mail.
• In §§ 35.3045 and 35.3047, language should be revised to prioritize the use of identification numbers that are not SSNs when identifying patients.

In anticipation of the above revisions, all applicable NRC forms have been proactively modified to include language that SSNs must not be visible on the outside of any package sent by mail.

IV. Section-by-Section Analysis

The following paragraphs describe the specific changes in this direct final rule.

Section 9.1 Scope and Purpose

This direct final rule adds new paragraph (e).

Subpart E—Social Security Number Fraud Prevention Act Requirements

This direct final rule adds new subpart E—Social Security Number Fraud Prevention Act Requirements.

Section 35.3045 Report and Notification of a Medical Event

This direct final rule revises paragraph (g)(1)(ii) to replace “social security number or identification number” with “identification number or if no other identification number is available, the social security number.”

Section 35.3047 Report and Notification of a Dose to an Embryo/Fetus or a Nursing Child

This direct final rule revises paragraph (f)(1)(ii) to replace “social security number or identification number” with “identification number or if no other identification number is available, the social security number.”

V. Regulatory Flexibility Certification

Under the Regulatory Flexibility Act (5 U.S.C. 605(b)), the NRC certifies that this rule will not, if issued, have a significant economic impact on a substantial number of small entities. This direct final rule affects a number of “small entities” as defined by the Regulatory Flexibility Act or the size standards established by the NRC (10 CFR 2.810). However, as indicated in the regulatory analysis contained in this document, these amendments do not have a significant economic impact on the affected small entities.

VI. Regulatory Analysis

The NRC has prepared a final regulatory analysis for this direct final rule. The analysis examines the costs and benefits of the alternatives considered by the NRC. The key findings are as follows:

• Benefits. This final rule ensures that the NRC is in compliance with the Act by doing the following:

(1) Revising regulations in 10 CFR part 9, § 35.3045(g)(1)(ii), and § 35.3047(f)(1)(ii) to address the intent of the Act; and

(2) Ensuring that NRC forms comply with the intent of the Act.

In accordance with the Act, the NRC requests that a SSN be included in documents sent by mail only when necessary and partially redacted whenever feasible. The redacted SSN should list only the number of digits necessary and must not be visible from the outside of packages sent to and from the NRC.

• Cost to the Industry. This direct final rule results in no incremental costs to material or reactor licensees.
• Cost to the Public. This direct final rule results in no incremental costs to the public.
• Cost to the NRC. This direct final rule results in no incremental costs to the NRC beyond those necessary to prepare and issue this direct final rule and make conforming changes to NRC forms, which are considered costs that have already been incurred.

VII. Backfitting and Issue Finality

This direct final rule modifies the NRC regulations to implement the requirements of the Act to use SSNs only where necessary and to partially redact SSNs to the extent practicable. These regulations relate solely to information collection and reporting requirements. The NRC has long taken the position that information collection and reporting requirements are not subject to the NRC's backfitting and issue finality regulations in 10 CFR 50.109, 10 CFR 70.76, 10 CFR 72.62, 10 CFR 76.76, and 10 CFR part 52. Therefore, the NRC has determined that the various backfitting and issue finality provisions do not apply to this final rule and has not prepared a backfit analysis.

VIII. Plain Writing

The Plain Writing Act of 2010 (Pub. L. 111-274) requires Federal agencies to write documents in a clear, concise, and well-organized manner. The NRC has written this document to be consistent with the Plain Writing Act as well as the Presidential Memorandum, “Plain Language in Government Writing,” published June 10, 1998 (63 FR 31883).

IX. Environmental Assessment and Final Finding of No Significant Environmental Impact

The Commission has determined under the National Environmental Policy Act of 1969, as amended, and the Commission's regulations in subpart A of 10 CFR part 51, that this direct final rule, if adopted, would not be a major Federal action significantly affecting the quality of the human environment and, therefore, an environmental impact statement is not required.

This direct final rule amends NRC's regulations in 10 CFR parts 9 and 35. These amendments are necessary to comply with the Social Security Number Fraud Prevention Act of 2017, which directed agencies to issue regulations that prohibit the inclusion of an individual's SSN on any document sent through the mail unless the head of the agency deems it necessary and the appropriate precautions are taken to protect the SSN. These amendments do not increase any effect on the environment.

The determination of this environmental assessment is that there will be no significant environmental impacts from this action.

X. Paperwork Reduction Act

This direct final rule does not contain any new or amended collections of information subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing collections of information were approved by the Office of Management and Budget (OMB), approval numbers 3150-0043, 3150-0014, 3150-0046, and 3150-0010.

Public Protection Notification

The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB control number.

XI. Congressional Review Act

This direct final rule is not a rule as defined in the Congressional Review Act (5 U.S.C. 801-808).

List of Subjects

10 CFR Part 9

• Administrative practice and procedure
• Courts
• Freedom of information
• Government employees
• Privacy
• Reporting and recordkeeping requirements
• Sunshine Act

10 CFR Part 35

• Biologics
• Drugs
• Health facilities
• Health professions
• Labeling
• Medical devices
• Nuclear energy
• Occupational safety and health
• Penalties
• Radiation protection
• Reporting and recordkeeping requirements

For the reasons set out in the preamble and under the authority of the Atomic Energy Act of 1954, as amended; the Energy Reorganization Act of 1974, as amended; and 5 U.S.C. 552 and 553, the NRC is adopting the following amendments to parts 9 and 35:

PART 9—PUBLIC RECORDS

1. The authority citation for part 9 continues to read as follows:

Authority: Atomic Energy Act of 1954, sec. 161 (42 U.S.C. 2201); Energy Reorganization Act of 1974, sec. 201 (42 U.S.C. 5841); 44 U.S.C. 3504 note.

Subpart A also issued under 31 U.S.C. 9701.

Subpart B also issued under 5 U.S.C. 552a.

Subpart C also issued under 5 U.S.C. 552b.

2. In § 9.1, add paragraph (e) to read as follows:

§ 9.1

Scope and purpose.

* * * * *

(e) Subpart E implements the provisions of the Social Security Number Fraud Prevention Act of 2017, Public Law 115-59, concerning the use of Social Security account numbers in documents sent by mail.

3. Add subpart E, consisting of §§ 9.300 and 9.301, to read as follows:

Subpart E—Social Security Number Fraud Prevention Act Requirements

§ 9.300

Scope of subpart.

This subpart implements the Social Security Number Fraud Prevention Act of 2017, Public Law 115-59, with respect to the use of Social Security account numbers in documents sent by mail and requirements applicable to NRC personnel for redacting Social Security account numbers in documents sent by mail.

§ 9.301

Social Security account numbers in documents sent by mail.

(a) Social Security account numbers shall not be visible on the outside of any package sent by mail.

(b) A document sent by mail may only include the Social Security account number of an individual if it is determined by the head of the agency that the inclusion of a Social Security account number is necessary.

(c) The inclusion of a Social Security account number of an individual on a document sent by mail is necessary when—

(1) Required by law; or

(2) Necessary to identify a specific individual and no adequate substitute is available.

(d) Social Security account numbers must be partially redacted in documents sent by mail whenever feasible.

PART 35—MEDICAL USE OF BYPRODUCT MATERIAL

4. The authority citation for part 35 continues to read as follows:

Authority: Atomic Energy Act of 1954, secs. 81, 161, 181, 182, 183, 223, 234, 274 (42 U.S.C. 2111, 2201, 2231, 2232, 2233, 2273, 2282, 2021); Energy Reorganization Act of 1974, secs. 201, 206 (42 U.S.C. 5841, 5846); 44 U.S.C. 3504 note.

5. In § 35.3045, revise paragraph (g)(1)(ii) to read as follows:

§ 35.3045

Report and notification of a medical event.

* * * * *

(g) * * *

(1) * * *

(ii) Identification number or if no other identification number is available, the social security number of the individual who is the subject of the event; and

* * * * *

10. In § 35.3047, revise paragraph (f)(1)(ii) to read as follows:

§ 35.3047

Report and notification of a dose to an embryo/fetus or a nursing child.

* * * * *

(f) * * *

(1) * * *

(ii) Identification number or if no other identification number is available, the social security number of the individual who is the subject of the event; and

* * * * *

Dated: May 28, 2020.

For the Nuclear Regulatory Commission.

Annette L. Vietti-Cook,

Secretary of the Commission.

Footnotes

1.  Public Law 115-59, Section 2(b).

2.  Public Law 115-59, Section 2(a).

3.  Public Law 115-59, Section 2(b)(1)-(2).

4.  Public Law115-59, Section 2(b)(2).