2014-19935. Privacy Act of 1974; System of Records

AGENCY:

Defense Health Agency, DoD.

ACTION:

Notice to add a new System of Records.

SUMMARY:

The Defense Health Agency proposes to add a new system of records, EDHA 01, entitled “Freedom of Information Act/Privacy Act Requests and Administrative Appeal Records” to its inventory of record systems subject to the Privacy Act of 1974, as amended. This system will be used to process access requests and administrative appeals under FOIA; to process access and amendment requests and administrative appeals under the Privacy Act; for litigation regarding agency action on such requests and administrative appeals; and to assist the DHA in carrying out any other responsibility under FOIA or the Privacy Act.

DATES:

Comments will be accepted on or before September 22, 2014. This proposed action will be effective the day following the end of the comment period unless comments are received which result in a contrary determination.

ADDRESSES:

You may submit comments, identified by docket number and title, by any of the following methods:

* Federal Rulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.

* Mail: Federal Docket Management System Office, 4800 Mark Center Drive, East Tower, 2nd Floor, Suite 02G09, Alexandria, VA 22350-3100.

Instructions: All submissions received must include the agency name and docket number for this Federal Register document. The general policy for comments and other submissions from members of the public is to make these submissions available for public viewing on the Internet at http://www.regulations.gov as they are received without change, including any personal identifiers or contact information.

FOR FURTHER INFORMATION CONTACT:

Ms. Linda S. Thomas, Chief, Defense Health Agency Privacy and Civil Liberties Office, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101, or by phone at [phone].

SUPPLEMENTARY INFORMATION:

The Defense Health Agency notices for systems of records subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended, have been published in the Federal Register and are available from the address in FOR FURTHER INFORMATION CONTACT or at the Defense Privacy and Civil Liberties Office Web site at http://dpclo.defense.gov/​.

The proposed system report, as required by 5 U.S.C. 552a(r) of the Privacy Act of 1974, as amended, was submitted on (July 28, 2014), to the House Committee on Oversight and Government Reform, the Senate Committee on Governmental Affairs, and the Office of Management and Budget (OMB) pursuant to paragraph 4c of Appendix I to OMB Circular No. A-130, “Federal Agency Responsibilities for Maintaining Records About Individuals,” dated February 8, 1996 (February 20, 1996, 61 FR 6427).

Dated: August 19, 2014.

Aaron Siegel,

Alternate OSD Federal Register Liaison Officer, Department of Defense.

EDHA 01

System name:

Freedom of Information Act/Privacy Act Requests and Administrative Appeal Records

System location:

Defense Health Agency Privacy and Civil Liberties Office, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101.

Categories of individuals covered by the system:

Individuals who submitted a request or administrative appeal under the Freedom of Information Act(FOIA) or the Privacy Act of 1974, as amended (Privacy Act), to the Defense Health Agency (DHA); individuals whose FOIA or Privacy Act request or administrative appeal was referred to DHA from another agency; individuals who are the subject of a DHA FOIA or Privacy Act request or administrative appeal; and attorneys representing an individual in connection with a DHA FOIA or Privacy Act request or administrative appeal.

Categories of records in the system:

Individual's name, address, contact phone number, fax number, job title, email, case number, FOIA tracking number, Social Security Number (SSN) and/or Department of Defense Identification Number (DoD ID Number).

FOIA or Privacy Act request or administrative appeal: records regarding the request or appeal, including responses, correspondence, supporting documentation; and, in some instances, copies of the requested records or records subject to the administrative appeal.

Authority for maintenance of the system:

5 U.S.C. 301, Departmental Regulations; 5 U.S.C. 552, Freedom of Information Act; 5 U.S.C. 552a, Privacy Act of 1974, as amended; and E.O. 9397 (SSN), as amended.

Purpose(s):

To process access requests and administrative appeals under FOIA; to process access and amendment requests and administrative appeals under the Privacy Act; for litigation regarding agency action on such requests and administrative appeals; and to assist the DHA in carrying out any other responsibility under FOIA or the Privacy Act.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, as amended, records in this system of records may specifically be disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

To other federal, state, and local agencies when it is necessary to coordinate responses or denials.

The DoD Blanket Routine Uses may also apply to this system of records.

Note 1:

This system of records may contain individually identifiable health information. The DoD Health Information Privacy Regulation (DoD 6025.18-R) or any successor DoD issuances issued pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and 45 CFR Parts 160 and 164, Health and Human Services, General Administrative Requirements and Security & Privacy, respectively, applies to most such health information. DoD 6025.18-R or a successor issuance may place additional procedural requirements on the uses and disclosures of such information beyond those found in the Privacy Act of 1974, as amended, or mentioned in this system of records notice.

Note 2:

Except as provided under 42 U.S.C. 290dd-2, records of identity, diagnosis, prognosis or treatment information of any patient maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States, will be treated as confidential and disclosed only for the purposes and under the circumstances expressly authorized under 42 U.S.C. 290dd-2.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:

Paper records and/or electronic storage media.

Retrievability:

By the name of requesters and appellants; the case numbers assigned to requests and administrative appeals; the name of individuals who are the subject of a request or administrative appeal; and the name of attorneys representing a requester, appellant, or subject of a request or administrative appeal.

Safeguards:

Physical security: Records are maintained in access-controlled facilities. Physical entry is restricted by use of locks, guards, and administrative procedures to officials that require access to perform their official duties consistent with the purpose of the collection of the information. All personnel whose official duties require access to the information are trained in the proper safeguarding and use of the information.

Technical security: The system provides two-factor authentication including Common Access Card (CAC) and user ID/passwords. The records in electronic format are maintained on a secure system and, within DHA, transmitted only through a secure network. Records in electronic format transmitted outside DHA's secure network are encrypted in transit. Access to personal information in electronic format is restricted to those who require the data in the performance of their official duties.

Retention and disposal:

Privacy Act Request/Action Records: a. Correspondence and supporting documents granting access to all the requested records: Destroy 2 years after date of reply. b. Responses to requests for nonexistent records, requesters who provide inadequate descriptions and to those who fail to pay agency reproduction fees: Destroy 2 years after date of reply. c. Responses denying access to all or part of the records requested: Destroy 5 years after date of reply.

FOIA Request/Action Records: Destroy 2 years after date of reply if all records subject to the request were released; destroy 6 years after date of reply if records subject to the request were denied in full, or in part, or if not released for any other reason.

System manager(s) and address:

Chief, FOIA Service Center, Defense Health Agency Privacy and Civil Liberties Office, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101.

Notification procedure:

Individuals seeking to determine whether information about themselves is contained in this system of records should address written inquiries to the Chief, FOIA Service Center, Defense Health Agency Privacy and Civil Liberties Office, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101.

Written inquiries should contain the subject individual's full name, current address, telephone number, FOIA tracking number, if known, and signature.

If requesting information about a minor or legally incompetent person, the request must be made by the custodial parent, legal guardian, or party acting in loco parentis of such individual. Written proof of that status may be required before the existence of any information will be confirmed.

Record access procedures:

Individuals seeking access to information about themselves contained in this system of records should address written inquiries to the Chief, FOIA Service Center, Defense Health Agency Privacy and Civil Liberties Office, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101.

Written inquiries should contain the subject individual's full name, current address, telephone number, a description of the records sought, FOIA tracking number, if known, and signature.

If requesting records about a minor or legally incompetent person, the request must be made by the custodial parent, legal guardian, or party acting in loco parentis of such individual. Written proof of that status may be required before any records will be provided.

Contesting record procedures:

The Office of the Secretary of Defense (OSD) rules for accessing records, for contesting contents and appealing initial agency determinations are published in OSD Administrative Instruction 81, 32 CFR Part 311, or may be obtained from the DHA Privacy and Civil Liberties Office.

Record source categories:

Data is provided by the record subject; staff and computer software when handling FOIA/Privacy Act requests and administrative appeals; individuals who file requests and administrative appeals pursuant to FOIA and the Privacy Act; agency records searched in the process of responding to FOIA and Privacy Act requests and appeals; and other agencies that refer FOIA or Privacy Act requests or administrative appeals to DHA or consult with DHA regarding the handling of particular requests.

Exemptions claimed for the system:

None.