01-20478. Privacy Act of 1974; Addition of New Routine Use to an Existing System of Records

AGENCY:

Department of Health and Human Services (HHS), Centers for Disease Control and Prevention (CDC).

ACTION:

Notification of the Addition of a New Routine Use.

SUMMARY:

In accordance with the requirements of the Privacy Act, the Centers for Disease Control and Prevention (CDC) is publishing notice of a proposal to add a new routine use to an existing National Institute for Occupational Safety and Health (NIOSH) system of records, 09-20-0147, “Occupational Health Epidemiological Studies. HHS/CDC/NIOSH.” The purpose of the new routine use is to contribute dose reconstructions, and supporting information for cancer-related claimants to the Department of Labor (DOL), which will enable DOL to determine award of benefits under the Energy Employees Occupational Illness Compensation Program Act of 2000.

DATES:

CDC invites interested parties to submit comments on the proposed routine use on or before September 14, 2001. The CDC will adopt the new routine use without further notice 30 days after the date of publication, unless CDC receives comments which would result in a contrary determination.

ADDRESSES:

Comments should be addressed to the Centers for Disease Control and Prevention (CDC) Privacy Act Officer at the address listed below. Comments received will be available for inspection from 8:30 a.m. to 4 p.m. Monday through Friday in the CDC Executive Park Facility, Building 22 Executive Park Drive, Room 2238, Atlanta, Georgia.

FOR FURTHER INFORMATION CONTACT:

Betsey S. Dunaway, Privacy Act Officer, Centers for Disease Control and Prevention, 1600 Clifton Road NE, Executive Park Facility, Building 22, Room 2238, Mailstop E-11, Atlanta, Georgia 30333, [phone]. This is not a toll-free number.

SUPPLEMENTARY INFORMATION:

CDC proposes to add a new routine use to an existing system of records within its National Institute for Occupational Safety and Health (NIOSH): 09-20-0147, “Occupational Health Epidemiological Studies. HHS/CDC/NIOSH.” The new routine use, i.e., disclosure of epidemiologic and related data to the Department of Labor (DOL), is compatible with the NIOSH system purpose to evaluate the mortality, morbidity, and prevention of occupationally related diseases. This routine use is compatible in that it will permit NIOSH to participate with the DOL by contributing dose reconstructions, and supporting information for cancer-related claimants to DOL, which enable DOL to determine award of benefits under the Energy Employees Occupational Illness Compensation Program Act of 2000 (EEOICPA), hereinafter “the Act” or EEOICPA, Public Law 106-398.

In the EEOICPA, Congress recognized the fact that since World War II, Federal nuclear activities have been explicitly recognized under Federal law as activities that are ultra-hazardous. Nuclear weapons production and testing have involved unique dangers, including potential catastrophic nuclear accidents that private insurance carriers have not covered. It is further recognized that recurring exposures to radioactive substances and beryllium, even in small amounts, can cause medical harm. Since the inception of the nuclear weapons program and for several decades afterwards, a large number of nuclear weapons workers at sites of the Department of Energy and at sites of vendors who supplied the Cold War effort were put at risk.

Because of this, Congress established the “Energy Employees Occupational Illness Compensation Program.” The purpose of the program is to provide for timely, equitable, and adequate compensation of covered employees and, where applicable, survivors of such employees, who incurred illnesses during the performance of their duties for the Department of Energy and certain of its contractors and subcontractors. The Department of Labor is the federal agency with lead responsibility and is to administer the program. Within HHS, NIOSH's Office of Compensation Analysis and Support (OCAS) has responsibility under the Act to prepare individual dose reconstructions for specified cancer-related claims.

Providing the Department of Labor with dose reconstruction reports based on employment, work history, exposure monitoring, and medical-related information about an EEOICPA claimant is consistent with the purpose(s) for which the records within this NIOSH Privacy Act system were collected. Pertinent information and records used to develop individual dose reconstruction from the NIOSH system of records are acquired from two NIOSH program efforts. NIOSH's Health-Related Energy Research Branch (HERB) has been given access to the Department of Energy's system of records to collect information, records, and data for the purpose(s) of evaluating the mortality and morbidity of occupationally related diseases to determine the cause and prevention of occupationally related diseases (Memorandum of Understanding with Department of Energy (DOE), 56 FR 9701, March 7, 1991 renewed 1995 as part of DOE's Radiation Research Program; routine use formalizing data exchange between DOE and HHS added to Privacy Act system of Records DOE-10, “ Worker Advocacy Records”). Additionally, through its research program, NIOSH acquires vital status information, death certificates, and records from the National Death Index and from State Vital Registrars. NIOSH (OCAS) will receive additional records and information during the dose reconstruction process for cancer-related claimants from DOE's existing system of records. This will include employment histories of claimants, production process and work history information, exposure and dosimetry monitoring data, safety and accident reports, and pertinent excerpts from employee medical records.

Claimants will also individually supply information to NIOSH, OCAS consisting of personal records, relevant information from claimants' physicians, affidavits, claimant interview summaries, and/or cancer type diagnosis from the DOL claims form. The claimant information will be augmented by that acquired from DOE and used by NIOSH or its contractors for the purpose of performing dose reconstructions for covered employees with cancer: (1) Who were not monitored for exposure to radiation at a Department of Energy facility or an atomic weapons employer facility, (2) who were monitored inadequately for exposure to radiation at such facility, or (3) whose records of exposure to radiation at such facility are missing or incomplete.

This routine use amendment will enable NIOSH to provide the Department of Labor the information needed to determine, with regard to each covered employee with cancer, whether the cancer was at least as likely as not related to employment at a facility specified in the EEOICPA. The disclosures will also supply the Department of Labor with supporting information needed to defend its determinations under the Act in administrative appeals by claimants. Provision of information from NIOSH's system of records to the Department of Labor is, therefore, consistent with the intent of Congress as represented in the Act.

Provision of this information to the Department of Labor will significantly decrease the administrative cost and effort required to implement the Act. Without this routine use and disclosure, the Department of Health and Human Services would be forced to require each claimant for whom it performs a dose reconstruction, to provide written consent for the Labor Department to obtain access to the claimant's employment, dosimetry, and medical-related information. The Department of Health and Human Services would spend resources and time unnecessarily in transmitting each written consent to the Department of Labor and following up on each request for data. A routine use permitting disclosure of such information to Labor Department personnel would be cost effective, eliminate these inefficiencies, and be claimant friendly.

Permitting the Department of Labor to receive and use the information /data would not result in the unauthorized release of private information contained in the records. Information received by the Department of Labor will be maintained in a secure manner in the Department of Labor system of records DOL/ESA-49 (Office of Workers'Compensation Programs, Energy Employees Occupational Illness Compensation Program Act File). Access will be limited to Labor

Department employees whose official duties require access to the records. Files and automated systems are maintained under supervision of DOL personnel during normal working hours. Only authorized personnel with the appropriate password may handle, retrieve, or disclose any information contained therein. Access to electronic records is controlled by password.

We have also made editorial changes throughout the system notice to enhance clarity and specificity and to accommodate normal updating changes.

Dated: August 9, 2001.

James D. Seligman,

Associate Director for Program Services, Centers for Disease Control and Prevention.

[09-20-0147]

System name:

Occupational Health Epidemiological Studies. HHS/CDC/NIOSH.

Security classification:

None.

System location:

Division of Surveillance, Hazard Evaluation, and Field Studies (DSHEFS), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, OH 45226.

Division of Respiratory Disease Studies (DRDS), National Institute for Occupational Safety and Health (NIOSH), 1095 Willowdale Road, Morgantown, WV 20505-2888.

Pittsburgh Research Laboratory, NIOSH, 626 Cochrans Mill Road, Pittsburgh, PA 15236.

Spokane Research Laboratory, NIOSH, 315 E. Montgomery Avenue, Spokane, WA 99207.

Office of Compensation Analysis and Support (OCAS), NIOSH, Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, Ohio 45226.

and

Federal Records Center, 3150 Bertwynn Drive, Dayton, OH 45439.

Data are also occasionally located at contractor sites as studies are developed, data collected, and reports written. A list of contractor sites where individually identifiable data are currently located is available upon request to the system manager.

Also, occasionally data may be located at the facilities of collaborating researchers where analyses are performed, data collected and reports written. A list of these facilities is available upon request to the system manager. Data may be located only at those facilities that have an adequate data security program and the collaborating researcher must return the data to NIOSH or destroy individual identifiers at the conclusion of the project.

Categories of individuals covered by the system:

Working population exposed to physical and/or chemical agents or other workplace hazards that may damage the human body in any way. Some examples are: (1) Organic carcinogens; (2) inorganic carcinogens; (3) mucosal or dermal irritants; (4) fibrogenic materials; (5) acute toxic agents including sensitizing agents; (6) neurotoxic agents; (7) mutagenic (male and female) and teratogenic agents; (8) bio-accumulating non-carcinogen agents; and (9) chronic vascular disease-causing agents. Also included are those individuals in the general population who have been selected as control groups. Workers employed by the Department of Energy and its predecessor agencies and their contractors are also included.

Categories of records in the system:

Physical exams, sputum cytology results, questionnaires, urine test records, X-rays, medical history, pulmonary function test records, medical disability forms, blood test records, hearing test results, smoking history, occupational histories, previous and current employment records, union membership records, driver's license data, demographic information, exposure history information and test results are examples of the records in this system. The specific types of records collected and maintained are determined by the needs of the individual study.

Authority for maintenance of the system:

Public Health Service Act, section 301, “Research and Investigation” (42 U.S.C. 241); Occupational Safety and Health Act, section 20, “Research and Related Activities” (29 U.S.C. 669); the Federal Mine Safety and Health Act of 1977, section 501, “Research” (30 U.S.C. 951); and the Energy Employees Occupational Illness Compensation Program Act of 2000 (EEOICPA) (Pub. L. 106-398, 114 Stat. 1654, 1654A-1231, October 30, 2000).

Purpose(s):

Studies carried out under this system are to evaluate mortality and morbidity of occupationally related diseases and injuries, to determine their causes, and to lead toward prevention of occupationally related diseases and injuries in the future.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.

Portions of records (name, Social Security number if known, date of birth, and last known address) may be disclosed to one or more of the sources selected from those listed in Appendix I, as applicable. This may be done for obtaining a determination regarding an individual's health status and last known address. If the sources determine that the individual is dead, NIOSH may obtain death certificates, which state the cause of death, from the appropriate Federal, State or local agency. If the individual is alive, NIOSH may obtain information on health status from disease registries or on last known address in order to contact the individual for a health study or to inform him or her of health findings. This information on health status enables NIOSH to evaluate whether excess occupationally related mortality or morbidity is occurring.

In the event of litigation where the defendant is: (a) The Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Department of Justice has agreed to represent such employee, for example, in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected. Records may also be disclosed when deemed desirable or necessary, to the Department of Justice, to enable that Department to effectively represent the Department of Health and Human Services and the Department of Labor in litigation involving the Energy Employees Occupational Illness Compensation Program Act of 2000 (EEOICPA).

Records subject to the Privacy Act are disclosed to private firms for data entry, scientific support services, nosology coding, computer systems analysis and computer programming services. The contractors promptly return data entry records after the contracted work is completed. The contractors are required to maintain Privacy Act safeguards.

Certain diseases or exposures may be reported to State and/or local health departments where the State has a legally constituted reporting program for communicable diseases and which provides for the confidentiality of the information.

In the event of litigation initiated at the request of NIOSH, the Institute may disclose such records as it deems desirable or necessary to the Department of Justice and to the Department of Labor, Office of the Solicitor, where appropriate, to enable the Departments to effectively represent the Institute, provided such disclosure is compatible with the purpose for which the records were collected. The only types of litigative proceedings that NIOSH is authorized to request are: (1) Enforcement of a subpoena issued to an employer to provide relevant information; and (2) administrative search warrants to obtain access to places of employment and relevant information therein and related contempt citations against an employer for failure to comply with a warrant obtained by the Institute; and (3) injunctive relief against employers or mine operators to obtain access to relevant information.

Disclosure may be made to NIOSH collaborating researchers (NIOSH contractors, grantees, cooperative agreement holders, or other Federal or State scientists) in order to accomplish the research purpose for which the records are collected. The collaborating researchers must agree in writing to comply with the confidentiality provisions of the Privacy Act and NIOSH must have determined that the researchers' data security procedures will protect confidentiality.

Disclosure of epidemiologic study records pertaining to uranium workers may be made to the Department of Justice to be used in determining eligibility for compensation payments to the uranium workers or their survivors.

Records may be disclosed by CDC in connection with public health activities to the Social Security Administration for sources of locating information to accomplish the research or program purposes for which the records were collected.

Disclosure of dose reconstructions, epidemiologic study records and employment and medical information pertaining to Department of Energy employees and other cancer-related claimants covered under the Energy Employees Occupational Illness Compensation Program Act may be made to the Department of Labor to be used in determining eligibility for compensation payments to such claimants and in defending its determinations under the Act.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:

Manager files, card files, computer tapes/disks and printouts, microfilm, microfiche, and other files as appropriate.

Retrievability:

Name, assigned number, plant name, and year tested are some of the indices used to retrieve records from these systems. Other retrieval methods are utilized as individual research dictates.

Safeguards:

1. Authorized Users: A database software security package is utilized to control unauthorized access to the system. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff or contractors, as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected.

2. Physical Safeguards: Hard copy records are kept in locked cabinets in locked rooms. Guard service in buildings provides screening of visitors. The limited access, secured computer room contains fire extinguishers and an overhead sprinkler system. Computer terminals and automated records are located in secured areas. Electronic anti-intrusion devices are in operation at the Federal Records Center.

3. Procedural Safeguards: Data sets are password protected and/or encrypted. Protection for computerized records both on the mainframe and the CIO Local Area Network (LAN) includes programmed verification of valid user identification code and password prior to logging on to the system, mandatory password changes, limited log-ins, virus protection, and user rights/file attribute restrictions. Password protection imposes user name and password log-in requirements to prevent unauthorized access. Each user name is assigned limited access rights to files and directories at varying levels to control file sharing. There are routine daily backup procedures and Vault Management System for secure off-site storage is available for backup tapes. Additional safeguards may be built into the program by the system analyst as warranted by the sensitivity of the data.

Employees and contractor staff who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either government or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts, and the Project Director, contract officers and project officers oversee compliance with these requirements. Upon completion of the contract, all data will be either returned to CDC or destroyed, as specified by the contract.

4. Implementation Guidelines: The safeguards outlined above are developed in accordance with Chapter 45-13, “Safeguarding Records Contained in Systems of Records,” of the HHS General Administration Manual; and Part 6, “Automated Information System Security,” of the HHS Information Resources Management Manual. FRC safeguards are in compliance with GSA Federal Property Management Regulations, Subchapter B—Archives and Records. Data maintained in CDC Atlanta's Processing Center are in compliance with OMB Circular A-130, Appendix III. Security is provided for information collection, processing, transmission, storage, and dissemination in general support systems and major applications. The CIO LANs operate under the current CDC approved version of Novell Netware, and are in compliance with “CDC & ATSDR Security Standards for Novell File Servers.”

Retention and disposal:

Records are maintained in agency for three years after the close of the study. Records transferred to the Federal Records Center when no longer needed for evaluation and analysis are destroyed 75 years for epidemiologic studies, unless needed for further study. Records from health hazard evaluations will be retained at least 20 years, and then disposed of in accordance with the CDC Records Control Schedule. Disposal methods include erasing computer tapes and burning or shredding paper materials.

System manager(s) and address:

Program Management Officer, Division of Surveillance, Hazard Evaluations, and Field Studies (DSHEFS), National Institute for Occupational Safety and Health (NIOSH), Robert A. Taft Laboratories, Rm. 40A, MS R12, 4676 Columbia Parkway, Cincinnati, OH 45226.

Director, Division of Respiratory Disease Studies (DRDS), National Institute for Occupational Safety and Health (NIOSH), Bldg. ALOSH, Rm. H-2920, MS H2900, 1095 Willowdale Road, Morgantown, WV 26505.

Director, Pittsburgh Research Laboratory, NIOSH, 626 Cochrans Mill Road, Pittsburgh, PA 15236.

Director, Spokane Research Laboratory, NIOSH, 315 E. Montgomery Avenue, Spokane, WA 99207.

Director, Office of Compensation and Support (OCAS), NIOSH, Robert A. Taft Laboratories, 4676 Columbia Parkway, Cincinnati, OH 45226.

Policy coordination is provided by: Director, National Institute for Occupational Safety and Health (NIOSH), Bldg. HHH, Rm. 715H, MS P-12, 200 Independence Avenue, SW, Washington, DC 20201.

Notification procedure:

An individual may learn if a record exists about himself or herself by contacting the system manager at the above address. Requesters in person must provide driver's license or other positive identification. Individuals who do not appear in person must either: (1) Submit a notarized request to verify their identity; or (2) certify that they are the individuals they claim to be and that they understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act subject to a $5,000 fine.

An individual who requests notification of or access to medical records shall, at the time the request is made, designate in writing a responsible representative who is willing to review the record and inform the subject individual of its contents at the representative's discretion. A subject individual will be granted direct access to a medical record if the system manager determines direct access is not likely to have adverse effect on the subject individual.

The following information must be provided when requesting notification: (1) Full name; (2) the approximate date and place of the study, if known; and (3) nature of the questionnaire or study in which the requester participated.

Record access procedures:

Same as notification procedures. Requesters should also reasonably specify the record contents being sought. An accounting of disclosures that have been made of the record, if any, may be requested.

Contesting record procedures:

Contact the official at the address specified under System Manager above, reasonably identify the record and specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories:

Vital status information is obtained from Federal, State and local governments and other available sources selected from those listed in Appendix I. Information is obtained directly from the individual and employer records, whenever possible.

Systems exempted from certain provisions of the act:

None.

Appendix I—Potential Sources for Determination of Health Status, Vital Status and/or Last Known Address

Military records

Appropriate State Motor Vehicle Registration Departments

Appropriate State Driver's License Departments

Appropriate State Government Division of: Assistance Payments (Welfare), Social Services, Medical Services, Food Stamp Program, Child Support, Board of Corrections, Aging, Indian Affairs, Worker's Compensation, Disability Insurance

Retail Credit Association follow-up

Veterans Administration files

Appropriate employee union or association records

Appropriate company pension or employment records

Company group insurance records

Appropriate State Vital Statistics Offices

Life insurance companies

Railroad Retirement Board

Area nursing homes

Area Indian Trading Posts

Mailing List Correction Cards (U.S. Postal Service)

Letters and telephone conversations with former employees of the same establishment as cohort member

Appropriate local newspaper (obituaries)

Social Security Administration

Internal Revenue Service

National Death Index

Health Care Finance Administration

Pension Benefit Guarantee Corporation

State Disease Registries