2013-15599. Privacy Act, Exempt Record System; Implementation

AGENCY:

Office of the Secretary, Food and Drug Administration, HHS.

ACTION:

Final rule.

SUMMARY:

The Food and Drug Administration (FDA or Agency) of the Department of Health and Human Services (HHS or Department) is exempting a system of records from certain requirements of the Privacy Act to protect the integrity of FDA's scientific research misconduct proceedings and to protect the identity of confidential sources in such proceedings.

DATES:

This rule is effective July 31, 2013.

FOR FURTHER INFORMATION CONTACT:

Frederick Sadler, Division of Freedom of Information, Food and Drug Administration, 12420 Parklawn Dr., Rockville, MD 20857, 301-796-8975, [e-mail].

SUPPLEMENTARY INFORMATION:

I. Background

HHS/FDA is exempting a system of records, 09-10-0020, “FDA Records Related to Research Misconduct Proceedings, HHS/FDA/OC,” under subsections (k)(2) and (k)(5) of the Privacy Act (5 U.S.C. 552a) from notification, access, accounting, and amendment provisions of the Privacy Act.

The purpose of this system of records is to implement FDA's responsibilities under the Public Health Service (PHS) Policies on Research Misconduct (42 CFR part 93) for research performed by persons who are FDA employees, agents of the Agency, or who are affiliated with the Agency by contract or agreement. The term “research misconduct” is defined at 42 CFR 93.103 to mean “fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results.” The general policy of the PHS Policies on Research Misconduct is that “Research misconduct involving PHS support is contrary to the interests of the PHS and the Federal government and to the health and safety of the public, to the integrity of research, and to the conservation of public funds.” (42 CFR 93.100(a)).

Under the Privacy Act, individuals have a right of access to information pertaining to them which is contained in a system of records. At the same time, the Privacy Act permits certain types of systems to be exempt from some of the Privacy Act requirements. For example, section 552a(k)(2) of the Privacy Act allows Agency heads to exempt from certain Privacy Act provisions a system of records containing investigatory material compiled for law enforcement purposes. This exemption's effect on the record access provision is qualified in that if the maintenance of the material results in the denial of any right, privilege, or benefit that the individual would otherwise be entitled to by Federal law, the individual must be granted access to the material except to the extent that the access would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence. In addition, section (k)(5) of the Privacy Act permits an Agency to exempt investigatory material from certain Privacy Act provisions where such material is compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information. This exemption is also limited as it will be applied only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise of confidentiality.

FDA may take administrative action in response to a research misconduct proceeding and, where there is a reasonable indication that a civil or criminal fraud may have taken place, will refer the matter to the appropriate investigative body. As such, FDA's records related to research misconduct proceedings are compiled for law enforcement purposes, and the subsection (k)(2) exemption is applicable to this system of records. Moreover, where records related to research misconduct proceedings are compiled solely for the purpose of making determinations as to the suitability for appointment as special Government employees or eligibility for Federal contracts from PHS Agencies, the subsection (k)(5) exemption is applicable.

On August 28, 2012, HHS/FDA published a system of records notice (SORN) for this system (77 FR 52036). On the same date, HHS/FDA also published a proposed rule (77 FR 51949) and, anticipating no significant adverse comment, a direct final rule (77 FR 51910) to exempt this system of records under subsections (k)(2) and (k)(5) of the Privacy Act from the notification, access, accounting, and amendment provisions of the Privacy Act. The comment period was open through November 13, 2012. The Agency received three comments regarding the exemptions. One comment was positive and in favor of the exemptions. Another comment appears to have misunderstood the scope and applicability of the exceptions, because it assumed that the purpose of the rule was to exempt these records from access by the general public. The third comment broadly opposed the exemptions as a governmental over-reach restricting citizens' ability to maintain awareness of the actions of regulatory bodies. FDA construed this last comment as sufficiently adverse to merit withdrawal of the direct final rule on January 10, 2013 (78 FR 2892; January 15, 2013). HHS/FDA now publishes this final rule under the standard notice and comment rulemaking process.

After considering the comments, HHS/FDA believes the exemptions at issue are necessary to fulfill the Agency's responsibilities for addressing research misconduct. The exemptions are essential in order for FDA to protect the confidentiality of sources who provide information relevant to a research misconduct proceeding and to guard against the premature disclosure of research misconduct records that might obstruct or compromise proceedings. The exemptions will thereby enable FDA to maintain the integrity and effectiveness of research misconduct proceedings.

Failure to adopt the exemptions would jeopardize the integrity and effectiveness of FDA's research misconduct proceedings. FDA's new system of records is modeled after the system of records maintained by HHS' Office of Research Integrity (ORI) entitled “HHS Records Related to Research Misconduct Proceedings, HHS/OS/ORI” System No. 09-37-0021 (59 FR 36776, July 19, 1994; revised most recently at 74 FR 44847, August 31, 2009). ORI has exempted these records under subsections (k)(2) and (k)(5) of the Privacy Act from the notification, access, accounting, and amendment provisions of the Privacy Act, to ensure that these records will not be disclosed inappropriately (59 FR 36717). Likewise, HHS/FDA believes that exempting the new FDA system from the same Privacy Act provisions is essential to ensure that material in FDA's files related to research misconduct proceedings is not disclosed inappropriately.

Subject to its obligations under the PHS Policies on Research Misconduct, 42 CFR Part 93, and other applicable law, HHS/FDA is therefore exempting this system under subsections (k)(2) and (k)(5) of the Privacy Act from the notification, access, and amendment provisions of the Privacy Act (subsections (c)(3), (d)(1) to (d)(4), (e)(4)(G) and (e)(4)(H), and (f)). The specific rationales for applying each of the exemptions are as follows:

• Subsection (c)(3). An exemption from the requirement to provide an accounting of disclosures is needed during the pendency of a research misconduct proceeding. Release of an accounting of disclosures to an individual who is the subject of a pending research misconduct assessment, inquiry, or investigation could prematurely reveal the nature and scope of the assessment, inquiry, or investigation and could result in the altering or destruction of evidence, improper influencing of witnesses, and other evasive actions that could impede or compromise the proceeding.
• Subsection (d)(1). An exemption from the access requirement is needed both during and after a research misconduct proceeding, to avoid revealing the identity of any source who was expressly promised confidentiality. Only material that would reveal a confidential source will be exempt from access. Protecting the identity of a source is necessary when the source is unwilling to report possible research misconduct because of fear of retaliation (e.g., from an employer or coworkers).
• Subsections (d)(2) through (d)(4). An exemption from the amendment provisions is necessary while one or more related research misconduct proceedings are pending. Allowing amendment of investigative records in a pending proceeding could interfere with that proceeding; even after that proceeding is concluded, an amendment could interfere with other pending or prospective research misconduct proceedings, or could significantly delay inquiries or investigations in an attempt to resolve questions of accuracy, relevance, timeliness, and completeness.
• Subsection (e)(4)(G) and (e)(4)(H). An exemption from the Privacy Act notification provisions is necessary during the pendency of a research misconduct proceeding, because notifying an individual who is the subject of an assessment, inquiry, or investigation of the fact of such proceedings could prematurely reveal the nature and scope of the proceedings and result in the altering or destruction of evidence, improper influencing of witnesses, and other evasive actions that could impede or compromise the proceeding. This exemption does not alter FDA's obligations to provide notice to the respondent in a research misconduct proceeding as described in the PHS Policies on Research Misconduct, 42 CFR Part 93.
• Subsection (f). An exemption from the requirement to establish procedures for notification, access to records, amendment of records, or appeals of denials of access to records is appropriate because the procedures would serve no purpose in light of the other exemptions, to the extent that those exemptions apply.

To avoid the unnecessary application of the exemptions, FDA will give case-by-case consideration to requests for notification, access, and amendment submitted to FDA's Research Integrity Officer (System Manager) or Privacy Act Coordinator. Except for information that would reveal the identity of a source who was expressly promised confidentiality, the access exemption will not prohibit HHS/FDA from granting respondents' access requests consistent with the PHS Policies on Research Misconduct (42 CFR part 93), including in those cases in which a finding of research misconduct has become final and an administrative action has been imposed. The request submission process is described in the SORN previously published for this system (77 FR 52036) and available online at http://www.fda.gov/​RegulatoryInformation/​FOI/​PrivacyAct/​ucm323341.htm.

II. Analysis of Impacts

HHS/FDA has examined the impacts of the final rule under Executive Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4). Executive Orders 12866 and 13563 direct Agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity). The Agency believes that this final rule is not a significant regulatory action under Executive Order 12866.

The Regulatory Flexibility Act requires Agencies to analyze regulatory options that would minimize any significant impact of a rule on small entities. Because the final rule imposes no duties or obligations on small entities, the Agency certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that Agencies prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current threshold after adjustment for inflation is $139 million, using the most current (2011) Implicit Price Deflator for the Gross Domestic Product. HHS/FDA does not expect this final rule to result in any 1-year expenditure that would meet or exceed this amount.

List of Subjects

21 CFR Part 21

• Privacy

45 CFR Part 5b

• Privacy

Therefore, the Department of Health and Human Services is amending 21 CFR part 21 and 45 CFR part 5b to read as follows:

Title 21

PART 21—PROTECTION OF PRIVACY

1. The authority citation for 21 CFR part 21 continues to read as follows:

Authority: 21 U.S.C. 371; 5 U.S.C. 552, 552a.

2. Section 21.61 is amended by adding paragraph (d) to read as follows:

§ 21.61

Exempt systems.

* * * * *

(d) Records in the following Food and Drug Administration Privacy Act Records Systems are exempt under 5 U.S.C. 552a(k)(2) and (k)(5) from the provisions enumerated in paragraph (a)(1) through paragraph (a)(3) of this section: FDA Records Related to Research Misconduct Proceedings, HHS/FDA/OC, 09-10-0020.

Title 45

PART 5b—PRIVACY ACT REGULATIONS

3. The authority citation for 45 CFR part 5b continues to read as follows:

Authority: 5 U.S.C. 301, 5 U.S.C. 552a.

4. Section 5b.11 is amended by adding paragraph (b)(2)(vii)(C) to read as follows:

§ 5b.11

Exempt systems.

* * * * *

(b) * * *

(2) * * *

(vii) * * *

(C) FDA Records Related to Research Misconduct Proceedings, HHS/FDA/OC, 09-10-0020.

* * * * *

Dated: June 14, 2013.

Kathleen Sebelius,

Secretary of Health and Human Services.