07-3097. Office of the Assistant Secretary for Preparedness & Response, Office of Preparedness & Emergency Operations; Privacy Act of 1974; Report of a New System of Records

AGENCY:

Department of Health and Human Services (HHS), Office of the Assistant Secretary for Preparedness and Response (ASPR), Office of Preparedness and Emergency (OPEO).

ACTION:

Notice of a new System of Records (SOR).

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, we are proposing to establish a new system titled, “The National Disaster Medical System (NDMS) Patient Treatment and Tracking Records System,” System Number 09-90-0040. The primary purpose of the NDMS Patient Treatment and Tracking Records System is to collect data from individuals using the medical care capabilities provided by NDMS.

EFFECTIVE DATES:

NDMS filed a new SOR report with the Chair of the House Committee on Oversight and Government Reform; the Chair of the Senate Committee on Homeland Security and Governmental Affairs; and the Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget (OMB) on June 18, 2007. The proposed SOR will be effective 30 days from the publication of the notice or 40 days from the date mailed to ensure that all parties have adequate time in which to comment. However, a request has been submitted to the OMB to grant HHS a 10 day waiver of the review period due to the impending start of the hurricane season. We may defer implementation of this system and retrieve the request for waiver should we receive comments that are contrary and requires the document to be altered.

ADDRESSES:

You may submit comments, identified by one of the following methods: The Federal e-Rulemaking Portal at http://www.regulations.gov and following the instructions for submitting comments, or send to the NDMS Chief Medical Officer, National Disaster Medical System, 330 Independence Avenue, SW., Room G-644, Washington, DC 20201.

FOR FURTHER INFORMATION CONTACT:

CAPT Ana Marie Balingit-Wines, Chief Nurse, NDMS Electronic Medical Records Project Officer, ASPR/OPEO/NDMS, 330 Independence Avenue, SW., Room G-644, Washington, DC 20201. CAPT Balingit-Wines can be contacted by telephone at 202-205-8088, or e-mail at [e-mail] for issues related to the SOR.

SUPPLEMENTARY INFORMATION:

NDMS operates pursuant to Section 2812 of the Public Health Service Act (42 U.S.C. 300hh-11), and currently resides in HHS under ASPR in accordance with the Pandemic and All Hazards Preparedness Act (PAHPA), Public Law 109-417. With the passage of PAHPA, ASPR has been designated as the agency responsible for medical response to include the deployment of NDMS and Field Medical Station assets as well as the management of the officers of the Public Health Service Commissioned Corps deployed during a response. ASPR medical components, in particular NDMS, function in a coordinated effort with DHS, DoD, and the VA. In a disaster situation, NDMS and other ASPR components will augment the public health and health care activities of State and local governments.

The Privacy Act embodies fair information principles in a statutory framework governing the means by which the United States Government collects, maintains, uses, and disseminates personally identifiable information. The Privacy Act applies to information that is maintained in a SOR, which is a group of any records under the control of an agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular, such as property address, mailing address, assigned to the individual. As a component of Emergency Support Function (ESF) #8, NDMS has shared medical records with the other agencies and departments that comprise ESF #8, due to the Function's shared statutory authority over the collection of medical information. NDMS has three key functions to which each of the ESF partners contribute and require the collection of medical information: medical response, patient evacuation, and definitive medical care.

The medical response function of NDMS is related to the activation and deployment of NDMS response teams, comprised of medical and logistical personnel, to assess the health and medical needs of disaster victims. In response to the overall needs of the patients, NDMS teams are activated to provide physical and mental health, as well as evacuation during a public health emergency as cause for activation as defined in 42 U.S.C. 300hh-11(a)(3)(A).

The patient evacuation function of NDMS relates to the establishment of communications, transportation, and a medical regulating system to evacuate and move patients from a staging center near a disaster site to patient reception sites known as Federal Coordinating Centers (FCCs). The DoD and VA have the prime responsibility for activating and managing the FCCs. In turn, upon receiving the patients, the FCCs have the authority to arrange for necessary referrals and admissions or NDMS evacuated patients.

CMS is responsible for establishing and administering the reimbursement process for health care rendered to patients provided under the umbrella of NDMS in accordance with Section 2812 of the Public Health Service Act, 42 U.S.C. 300hh-11, for “definitive care.” The SOR for the collection of information for the purpose of reimbursement has been filed separately and was published on November 23, 2005, under 70 FR 70849. NDMS health care providers, in the course of providing health care, collect data that identifies the patient's name, address, contact information, gender, insurance information, prior medical history, and all treatment information to include, but not limited to, symptoms, vital signs, diagnosis, and medications prescribed through the health care continuum. NDMS veterinary providers, in the course of providing care to animals, may collect contact information from the animal's owner. The medical records could also include x-rays, lab results, and providers' comments relative to their observations about the patient. NDMS has a need for the collection of information for health care, patient movement, and tracking, as well as for reimbursement of health care rendered.

The collection of the data as a result of illness or injury from a disaster or other event mandating the deployment of NDMS medical personnel is accomplished through a combination of paper and electronic records. The patient data collected will also be used for tracking the patient through the continuum. The collection of information during an event such as a patient evacuation will assist NDMS in quickly tracking and sending the patient and the medical information from the casualty collection site to the designated FCC. The system will also allow NDMS to track how many patients are sent to each FCC along with their discharge and location status. The information will include but not be limited to name, address, phone numbers, ethnic background, and other contact and/or identifying information as well as medical information including laboratory tests performed, diagnosis, treatment provided, medications prescribed, referrals, and any treatment advice provided by the medical professional to the patient. Pursuant to 5 U.S.C. 552a(b)(1), information collected would be disclosed to other Department of Health and Human Services (HHS) agencies such as the Centers for Disease Control and Prevention (CDC), the Centers for Medicare and Medicaid Services (CMS), and the Agency for Health Care Research and Quality (AHRQ), for the purpose of research, evaluation or epidemiologic and longitudinal surveillance studies related to health care, which may impact the care provided to disaster victims.

Information in this system will be disclosed as “routine uses” to the following entities:

1. Emergency Support Function #8 (ESF #8) is a coordinated effort between the Department of Health and Human Service (HHS), the Department of Homeland Security (DHS), the Department of Defense (DoD), and the Department of Veterans Affairs (VA). As such, the medical treatment and evacuation of patients is a shared responsibility between these agencies and disclosure of health related information is necessary to adequately manage the overall care of the patient.

2. Disclosure to a member of Congress on behalf of a constituent's inquiry.

3. Disclosure to the Department of Justice (DOJ), court or adjudicatory body when the agency is involved in litigation or has an interest in litigation.

4. Disclosure to agency contractors, consultants, or grantees engaged in the performance of service related to this collection and who may need to have access to the records in order to perform the activity.

5. To assist another Federal or State agency, agency of a state government, an agency established by State law, or its fiscal agent to assess the location or the status of their beneficiary.

6. Disclosure to family members of a patient about the location or the status of the patient.

The Privacy Act requires each agency to publish in the Federal Register a description denoting the type and character of each system of records that the agency maintains, and the routine uses that are contained in each system in order to make agency recordkeeping practices transparent, to notify individuals regarding the uses to which personally identifiable information is annotated, and to assist individuals to easily find such files within the agency. NDMS, as a component of the OPEO, which resides within ASPR, intends to create a separate and distinct system of records. Below is the description of the NDMS Patient Treatment and Tracking Records System.

Dated: June 14, 2007.

Kevin Yeskey,

Deputy Assistant Secretary, Office of Preparedness and Emergency Operations.

SYSTEM NO. 09-90-0040

SYSTEM NAME:

“National Disaster Medical System (NDMS) Patient Treatment and Tracking,” HHS/ASPR/OPEO.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

For a specified period and in accordance with the archiving rules, the paper records will be resident at NDMS headquarters, located at 409 3rd Street SW., Suite 330, Washington, DC 20024. The electronic copy of the record will be resident at the data center at the Unisys Corporation, 11720 Plaza America Drive, Reston, VA 20190.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The individuals covered by the system are all persons and owners of animals treated by NDMS medical personnel when the NDMS Disaster Medical Assistance Teams (DMATs) and Veterinary Medical Assistance Teams (VMATs) are activated to respond to emergency situations, or as a response to any other situation for which they are activated.

CATEGORIES OF RECORDS IN THE SYSTEM:

All records pertaining to treatment and movement of patients to include the following (both in hard copy and electronic format):

Category A: Completed Patient Treatment Record form that includes:

1. NDMS Team Identification.

2. Chart Number.

3. Time and Date Patient seeks treatment.

4. Triage Category and health status.

5. Location where Patient is seen and transferred.

6. Patient Identification—Name, Address, City, State, Zip, Date of Birth, Phone Number, Employment, Weight, Next of Kin.

7. Complaints/Symptoms.

8. Vital Signs/Treatment Recommended and/or Prescribed.

9. Discharge—Time, Date, Disposition, Recommendations.

10. Patient Authorization—Requires Patient Signature in Front of Witness and Witness Verification through Signature.

11. Any potential attachments such as X-rays and laboratory reports showing test results.

Category B: Veterinarian Treatment Records on animals:

1. Privacy Act Data such as the name, address and telephone contact information of owners of animals will be maintained to be associated with the animal patient. However, animal treatment records themselves are not subject to the Privacy Act protections.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

NDMS Statute, 42 U.S.C. 300hh-11; Title VI of the Civil Rights Act of 1964; and Section 504 of the Rehabilitation Act of 1973. Records disposition of this medical SOR is determined under laws governing federal records through the National Archives, 44 U.S.C. 3303a.

PURPOSE(S):

Medical and demographic information is collected on all patients seen and/or treated by NDMS or ASPR personnel. This SOR will also provide the location, time, and date the patient was transported during an evacuation. The information collected will include but not be limited to the patient's (1) Medical treatment history, (2) their pre-existing conditions, (3) their described symptoms, (4) any medical opinion rendered by an attending medical professional(s), (5) medications that were prescribed, or (6) any other medical advice provided. The collection of data contained in medical records provides a mechanism by which teams can have the ability to conduct medical quality assurance and establish a quality improvement process (QIP). Through QIP, teams can analyze and judge their performance on a specific deployment and if necessary enable them to better plan for future deployments. These patient records are also important sources of information to be used for research projects related to the prevention of disease or disability as a result of a disaster. Most importantly, these patient records document medical treatment rendered, especially if questions of liability arise about the treatment or the subsequent condition of the patient while he/she is under the care of NDMS.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTENM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, all or a portion of the records or information contained in this system may be disclosed outside HHS as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

1. ESF #8 is a coordinated effort between HHS, DHS, DoD, and the VA. As such, the medical treatment and movement of patients is a shared responsibility between the ESF #8 partnership agencies. The medical and demographic information collected during the treatment of a patient is shared with the partners to ensure that patients treated through NDMS receive the maximum level of health care possible.

2. Disclosure to a member of Congress or a Congressional staff member in response to an inquiry from the Congressional office made at the behest of the constituent about whom the record is maintained.

3. Disclosure to the Department of Justice (DOJ), court, or adjudicatory body when the following situations arise:

a. The agency or any component thereof, or

b. Any employee of the agency whether in his/her official or individual capacity, where DOJ has agreed to represent the employee, or

c. The United States government is a party to litigation or has an interest in such litigation and after careful review, the agency deems that the records requested are relevant and necessary to the litigation and that the use of such records by DOJ, court, or adjudicatory body is compliant with the purpose for which the agency collected the records.

4. Disclosure to agency contractors, consultants, or grantees who have been engaged by the agency to assist in the performance of a service related to this collection and who need to have access to the records in order to perform the activity.

5. To assist another Federal and/or State agency, agency of a state government, an agency established by State law, or its fiscal agent:

a. To establish the benefit entitlement of the patient.

b. To establish the relationship between the existing state benefit and the benefit funded in whole or part with Federal funds, such as the one associated with the NDMS definitive care.

c. To collaborate with the state and state agencies on behalf of family members regarding the current location and placement of their evacuated family member or patient population.

6. Disclosure to family members of a patient about the location or the status of the patient.

Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of Records in the System:

Category A: Patient Care Forms or other Medical Records:

Records in this system will be retained in accordance with the records disposition authority approved by the National Archives and Records Administration (NARA) for the Office of Public Health and Emergency Preparedness (OPHEP) in compliance with N1-468-07-1. The Pandemic and All Hazards Preparedness Act (Pub. L. 109-417), established the ASPR to serve in a similar capacity as OPHEP for medical disaster response. The records disposition authority used for these records will N1-468-07-1.

Disposition authority:

Patient Care Forms or other Medical Records regulated under the Health Insurance Portability and Accountability Act (HIPAA), created by the Federal Medical Station(s) or by any component of HHS/ASPR during a response to an event while caring for victims of that event. Disposition: Cutoff is at the end of the response activity by the Federal Medical Station(s) for a particular event. Retire to the Washington National Records Center 2 years after cutoff. Destroy 75 years after cutoff. This disposition instruction is media neutral; it applies regardless of media or format of the records.

Category B—The information collected on animals and their owners will not be destroyed until NARA approves a disposition schedule for those records.

Storage:

Paper records from this system are stored in the NDMS headquarters at 409 3rd Street, SW., Suite 330, Washington, DC 20024. The electronic database or server where information is entered and stored is maintained at the HHS data center located at Unisys Corporation, 11720 Plaza America Drive, Reston, VA 20190. During deployments, NDMS stores the records securely in their deployed location, the electronic data is stored in a secured server, and all procedures required for protection of Privacy Act documents are implemented as identified in “Safeguards” section below.

Retrievability:

NDMS Patient Treatment and Tracking Records in electronic and paper copy are organized by event, location, and date of treatment. Data from the records are stored in an electronic database enabling data from the records to be retrievable by name and other demographic information provided by the patient (or for veterinary records, by pet owner), as well as by location of treatment, diagnosis, and other data fields within the database.

Safeguards:

NDMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements for both paper copies and electronically stored information. Information in this system is safeguarded in accordance with applicable laws, rules and policies, including the HHS Information Technology Security Program Handbook, all pertinent National Institutes of Standards and Technology publications and OMB Circular A-130, Management of Federal resources. All records are protected from unauthorized access through appropriate administrative, physical, and technical safeguards. These safeguards include restricting access to authorized personnel who have a need-to-know, using physical locks in the office environment, and the process of authentication using user IDs and passwords function as protection identification features. HHS file areas are locked after normal duty hours and the facilities are protected from the outside by security personnel.

SYSTEM MANAGER AND ADDRESS:

The NDMS Chief Medical Officer located at 409 3rd Street, SW., Washington, DC 20024. Mailing address: 330 Independence Avenue, SW., Room G-644, Washington, DC 20201.

NOTIFICATION PROCEDURES:

Requests for Privacy Act protected information generally are governed by HHS regulations found at 45 CFR, Part 5b. They must be made in writing and clearly marked as a “Privacy Act Request” on the envelope and letter. Inquiries regarding this SOR should be addressed to the System Manager. Inquiries related to patient medical records should include the full name of the individual, the appropriate personal identification, and the current address, and should be sent to the Chief Medical Officer, NDMS, 330 Independence Avenue, SW., Room G-644, Washington, DC 20201. The name of the requester, the nature of the record sought, and the verification of identify must be clearly indicated, as required by HHS regulations at 45 CFR 5b.5. Requests may also be sent to: HHS Privacy Act Officer 200 Independence Avenue, SW., Washington, DC 20201.

RECORD ACCESS PROCEDURES:

Same as Notification Procedure above.

CONTESTING RECORD PROCEDURES:

Same as the Notification Procedure above. The letter should state clearly and concisely what information you are contesting, the reasons for contesting it, and the proposed amendment to the information that you seek pursuant to HHS Privacy Act regulations, 45 CFR 5b.7.

RECORD SOURCE CATEGORIES:

Sources for providing data for NDMS Patient Treatment Records will only be provided by patients, medical personnel treating the patients or by accessing their personal health records (PHR). In the case of minors or other individuals unable to explain symptoms, information may be sought from a parent or guardian. For animals, information will be gathered by NDMS veterinary personnel and/or owners or caretakers of animals.

EXEMPTIONS CLAIMED FOR THE SYSTEM:

None.