2023-19875. Privacy Act of 1974; System of Records

AGENCY:

Office of Human Services Emergency Preparedness and Response (OHSEPR), Administration for Children & Families (ACF), Department of Health and Human Services (HHS).

ACTION:

Notice of a modified system of records.

SUMMARY:

The Department of Health and Human Services (HHS) is modifying a system of records maintained by the Administration for Children & Families (ACF), 09–80–0327 ORR Repatriation Program Records, to reflect the change ownership of the repatriation program that was transferred to ACF's Office of Human Services Emergency Preparedness and Response (OHSEPR), and to broaden the scope of the system of records to include functionally similar records that OHSEPR uses to identify, assess, and address immediate unmet human services ( i.e., social services) needs of survivors of federally-declared disasters in the United States. To reflect the transfer and broadened scope, HHS is changing the name of the system of records to OHSEPR Repatriation and Disaster Human Services Case Management Records.

DATES:

This modified system of records is applicable September 14, 2023, subject to a 30-day period to comment on the new and revised routine uses. Submit any comments by October 16, 2023. The new and revised routine uses will become effective on October 16, 2023 unless the Department receives comments that would persuade us to modify the notice.

ADDRESSES:

The public should address written comments on the proposed system of records to Anita Alford, Senior Official for Privacy, Administration for Children & Families by email, to [e-mail].

FOR FURTHER INFORMATION CONTACT:

General questions about the system of records may be submitted to the OHSEPR Deputy Director, Byron R. Mason, by telephone at (202) 365–8110 or by email to [e-mail].

SUPPLEMENTARY INFORMATION:

HHS established system of records 09–80–0327 in 2016 to cover records about temporary assistance provided to repatriated U.S. citizens and their dependents under ACF's repatriation program, to meet the individuals' human service's needs. At that time, the repatriation program was administered by ACF's Office of Refugee Resettlement (ORR). In 2018, ACF transferred responsibility for the repatriation program to ACF's Office of Human Services Emergency Preparedness and Response (OHSEPR) that also administers ACF's disaster assistance program. Because the records used for both programs are functionally similar ( i.e., they are case files documenting services provided to meet the individuals' human service's needs), HHS is broadening the scope of system of records 09–80–0327 to include disaster assistance program records. The modifications include:

• Changing the name of the system of records to refer to OHSEPR instead of ORR and to reflect the expanded scope of the system of records.
• Updating the System Location and System Manager(s) sections to provide address and contact information for OHSEPR instead of ORR, and to add service provider and contractor locations to the System Location section.
• Revising the Authorities section to add authorities for the disaster assistance program, and to add a Social Security Number (SSN) collection authority that applies to the repatriation program only.
• Adding descriptions of disaster assistance program records throughout the SORN.
• Revising the Purpose(s) section to describe the primary purpose for repatriation program records used as “making eligibility determinations before temporary assistance is provided;” to add, as an additional secondary purpose for the use of repatriation program records, “providing training and technical assistance to State human services departments and local services providers;” to add purposes for disaster program records use; and to add a note at the end of the section stating that records of repatriation assistance to particular individuals are referred from this system of records to a separate system of records for debt management and collection purposes.
• Revising the Categories of Records section to describe the categories of records maintained for the repatriation program as case files containing correspondence, and to summarize the data elements contained in those records instead of listing them; to add categories of records maintained for the disaster assistance program; and to include a note explaining that records OHSEPR maintains as a result of providing disaster assistance services on behalf of another HHS component or another agency are not covered by this SORN.
• Specifying, in the Record Source Categories section the sources that apply to the repatriation program or both programs.
• Adding and revising routine uses, and removing unnecessary routine uses, as follows. A note has been added, stating that a routine use applies to both the repatriation program and the disaster assistance programs unless worded to apply to only one of those programs.

Revised routine uses:

○ Routine use 1, Disclosure to Contractors, Grantees, and Other Agents (4 in the existing SORN), has been revised to add “(including another federal agency acting as a service provider),” “other agencies,” and “OHSEPR” and will now apply to the disaster assistance program too.

○ Routine use 2, Disclosure to Department of State (1 in the existing SORN), has been revised to add “to repatriates” to correct a typographical error.

○ Routine use 4, Disclosure to Service Provider (3 in the existing SORN), has been revised to add “for eligible repatriates” and to change “services” to “assistance.”

○ Routine use 5 (4 in the existing SORN), is now titled Disclosure to Agency for Temporary Assistance (instead of Disclosure to Agency for Temporary Services), and the word “services” in the text of the routine use has been changed to “assistance.”

○ Routine use 6, Disclosure for Law Enforcement Purposes (5 in the existing SORN), will now apply to the disaster assistance program too.

○ Routine use 7, Disclosure for Administrative Claim, Complaint, and Appeal (13 in the existing SORN), has been revised to add “about a repatriation assistance recipient.”

○ Routine use 8 (15 in the existing SORN), is now titled Disclosure in Connection with Settlement Discussions (instead of Disclosure in Connection with Litigation), and it has been revised to be limited to settlement discussions to avoid duplicating a litigation-related routine use and to add “about a repatriation assistance recipient.”

○ Routine use 12, Disclosure for Private Relief Legislation (8 in the existing SORN), has been revised to add “about a repatriation assistance recipient.”

○ Routine use 13, Disclosure to Congressional Office (9 in the existing SORN), will now apply to the disaster assistance program too.

○ Routine use 14, Disclosure to Department of Justice or in Proceedings (10 in the existing SORN), has been revised to omit redundant wording that repeated part of the definition of a routine use ( i.e., “provided that the disclosure is compatible with the purpose for which the records were collected”), and will now apply to the disaster assistance program too.

○ Routine use 15, Disclosure to the National Archives and Records Administration (11 in the existing SORN), has been revised to add “conducted pursuant to 44 U.S.C. 2904 and 2906” and will now apply to the disaster assistance program too.

○ Routine uses 16 and 17, Disclosure in the Event of a Security Breach Experienced by HHS, and Disclosure to Assist Another Agency Experiencing a Breach (16 and 18 in the existing SORN), which were added to the SORN in February 2018, will now apply to the disaster assistance program too.

○ Routine use 18, Disclosure for Cybersecurity Monitoring Purposes (17 in the existing SORN), will now apply to the disaster assistance program too.

New routine uses:

○ Routine uses 9 and 10, Disclosure to Ensure Continuity of Disaster Assistance Services and Disclosure to Locate Missing Children or Reunite Families, have been added for the disaster assistance program.

○ Routine use 11, Disclosure to Combat Fraud, Waste, and Abuse, has been added for both the repatriation program and the disaster assistance program.

Deleted routine uses:

○ Routine uses formerly numbered as 6, 7, and 14, Disclosure Incident to Requesting Information; Disclosure for Employee Retention, Security, Contract, or Other Benefit; and Disclosure to the Office of Personnel Management, were determined to be unnecessary and are now omitted, because such disclosures are not made from this system of records.

• Removing the section titled Disclosure to Consumer Reporting Agencies, because such disclosures are not made by ACF/OHSEPR from this system of records. Such disclosures are made by HHS' Program Support Center from the system of records that covers records used for debt management and collection purposes.
• Revising the Storage section to describe the storage media as hard copy files, electronic storage media, and cloud/network storage, instead of stating that the records are stored on a grantee's computer network and safe/file cabinet.
• Revising the Retrieval section to add that disaster assistance case records are retrieved by the individual's name or case file number.
• Revising the Retention section to cite the disposition schedule and retention periods applicable to records about disaster survivors.
• Revising the Safeguards section to describe the particular administrative, technical, and physical safeguards used to prevent unauthorized access to the records, instead of simply stating that safeguards conform to the HHS Information Security Program; and to mention “grantees” in addition to contractors.

• Updating the procedures for making access, correction, and notification requests no longer require requests to include the subject individual's social security number, and to now state that requests should identify either the repatriation program or the applicable disaster, to assist OHSEPR in locating the records.

Because this modification includes significant changes, HHS provided advance notice of the modified system of records to the Office of Management and Budget and Congress as required by 5 U.S.C. 552a(r) and OMB Circular A–108.

Natalie N. Grant,

Director, Office of Human Services Emergency Preparedness and Response.

SYSTEM NAME AND NUMBER:

OHSEPR Repatriation and Disaster Human Services Case Management Records, 09–80–0389.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

The address of the agency component responsible for this system of records is Administration for Children & Families (ACF), Office of Human Services Emergency Preparedness and Response (OHSEPR), 330 C Street SW—4th Floor, Washington, DC 20201.

On behalf of ACF, a grantee located in Baltimore MD stores ACF's repatriation program records in a cloud-based system. A contractor and subcontractor located in Washington, DC manage ACF's disaster assistance database housed on an ACF server.

SYSTEM MANAGER(S):

The System Manager is: OHSEPR Repatriation Specialist, HHS, ACF, Office of Human Services Emergency Preparedness and Response (OHSEPR), 330 C Street SW—4th Floor, Washington, DC 20201; [e-mail].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Authority to maintain repatriation assistance records:42 U.S.C. 1313 (Assistance for United States citizens returned from foreign countries) and 24 U.S.C. 321–329 (Hospitalization of mentally ill nationals returned from foreign countries).

Authority to collect Social Security Number (SSN) (applicable to the repatriation program only):31 U.S.C. 7701(c) requires an agency to collect the taxpayer identifying number of individuals “doing business with a federal agency,” one example of which is being “in a relationship with the agency that may give rise to a receivable due to that agency.” Receiving temporary assistance—which is defined in 42 U.S.C. 1313(c) as money payments, medical care, temporary lodging, transportation, and other goods and services necessary for the health or welfare of individuals—and is provided to repatriates in the form of a service loan repayable to the U.S. Government, fits that example and therefore qualifies as “doing business with a Federal agency.” For purposes of 31 U.S.C. 7701(c), the taxpayer identifying number is the individual's social security number (SSN).

Authority to maintain disaster assistance records: Statement of Organization, Functions, and Delegations of Authority, 71 FR 71549 (Dec. 11, 2006); E.O. 12656, 53 FR 47491 (Nov. 18, 1988), reprinted in42 U.S.C. 5195.

PURPOSE(S) OF THE SYSTEM:

The purpose of the system of records is to enable OHSEPR to provide assistance in an efficient and expeditious manner to repatriated U.S. citizens and their dependents and to disaster survivors. Specifically:

• Records for the repatriation program are used by OHSEPR for the primary purposes of making eligibility determinations before temporary assistance is provided to U.S. citizens and their dependents who are without available resources in the U.S. upon their arrival from abroad and for up to 90 days after their arrival, not exceeding 90 days as may be provided in regulations of the Secretary of HHS and supporting repayment of assistance allocable to individual recipients. Temporary assistance may include money payments, medical care, temporary billeting, transportation, and other goods and services necessary for the health or welfare of individuals (including guidance, counseling, and other welfare services). All temporary assistance provided under the repatriation program and allocable to individual recipients is repayable to the Federal Government. OHSEPR may use the records for the secondary purpose of providing training and technical assistance to State human services departments and local services providers, in addition to creating aggregate datasets to use in monitoring and assessing the effectiveness of the repatriation program.
• Records for the disaster assistance program are used by OHSEPR for the primary purpose of identifying, assessing, and addressing immediate, unmet disaster-caused human services needs of survivors of federally declared disasters. Disaster assistance may include conducting intake assessments and referrals, providing outreach and triage, developing a Disaster Survivor Recovery Plan, and connecting the disaster survivor to resources that are locally available. OHSEPR may use the records for the secondary purposes of creating aggregate datasets to use in providing financial assistance to State or local government agencies or qualified private organizations assisting survivors, building local disaster case management capacity through the provision of training and technical assistance to States, Tribes, Territories, and local governments, and monitoring and assessing the effectiveness of the disaster assistance program.

Note:

OHSEPR will refer records from this system of records about temporary assistance allocable to individuals receiving repatriation assistance that is repayable to the Federal Government, to the Program Support Center within the Office of the Assistant Secretary for Administration for debt management and collection purposes. Records used for debt management and collection purposes are maintained under SORN 09–40–0012, Debt Management and Collection Records, and may be used and disclosed for the purposes described in that SORN.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The categories of individuals covered by this system are:

• U.S. citizens and their dependents who are receiving temporary assistance and are identified by the Department of State as having returned or been brought from a foreign country to the U.S. because of destitution, illness, war, threat of war, or a similar crisis.

• Survivors of disasters who reside within a jurisdiction included in federally declared disaster or emergency and apply for disaster assistance under an HHS authority ( e.g., not under a Federal Emergency Management Agency (FEMA) authority).

CATEGORIES OF RECORDS IN THE SYSTEM:

The categories of records are:

• Case files containing correspondence about repatriated U.S. citizens and their dependents receiving temporary assistance. Information about a repatriate may include full name, current mailing address, social security number, passport number, date and place of birth, dependents, and information about any medical care, temporary billeting, transportation, or other goods and services ( e.g., food, clothing) necessary for the health or welfare of the individual (including guidance, counseling, and other welfare services) that was furnished to the individual.

• Case files about disaster survivors who apply for disaster assistance under an HHS ( e.g., not FEMA) authority. (Note that these files are separate and apart from those maintained in performing Immediate Disaster Case Management (IDCM) pursuant to a Mission Assignment agreement with FEMA.) The files include intake assessment records, resource referral lists, case notes, status reports, and recovery plans. Information about a disaster survivor may include disaster number, full name, current mailing address, date of birth, transitional housing location type, transitional housing mailing address, damaged dwelling mailing address, damaged county, location at time of registration, phone numbers, email addresses, homeowners insurance coverage details (including flood coverage), details on health care coverage, household size, household composition and member ages, details on damage to real and personal property, degree of total damage incurred, self-reported income, assistance sought, assistance received, source of assistance, persons residing in a dwelling, Federal disaster assistance referral status, and status of access and functional, and/or emergency needs.

Note that this system of records does not include the following records:

• Records of immediate disaster case management services that OHSEPR provides on behalf of another component of HHS or another agency. For example, pursuant to an interagency agreement, OHSEPR provides immediate disaster case management (IDCM) services on behalf of the Department of Homeland Security, FEMA (DHS/FEMA), under mission assignments from DHS/FEMA. Records of those services are covered under a FEMA SORN; currently, DHS/FEMA–008 Disaster Recovery Assistance Files System of Records.
• Disaster response records maintained by another component of HHS, such as the records maintained by the Office of the Assistant Secretary for Preparedness and Response (ASPR) under SORNs 09–90–0039 National Disaster Claims Processing System, and 09–90–0040 National Disaster Medical System (NDMS) Disaster Medical Information Suite (DMIS).

RECORD SOURCE CATEGORIES:

Information in repatriation program records is received directly from the subject individual ( i.e., client) or from a member of the client's or client's family or household, or a relative or representative of the client, or may be provided by other governmental entities ( e.g., Federal, State, local, or Tribal agencies) and local service providers, international agencies, foreign governments, employers, health care institutions, and public information sources.

Information in disaster assistance program records is received directly from the subject individual ( i.e., client) or from a member of the client's or client's family or household, or a relative or representative of the client, or may be provided by other governmental entities ( e.g., Federal, State, local, or Tribal agencies) and social service organizations.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to other disclosures permitted under 5 U.S.C. 552a(b)(1) and (2) and (4) through (11), OHSEPR may disclose a record about an individual from this system of records to parties outside HHS as provided in these routine uses, which are published pursuant to 5 U.S.C. 552a(b)(3). A routine use applies to both the repatriation program and the disaster assistance program, unless worded to apply to only one of those programs. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible, including but not limited to ensuring that the purpose of the disclosure is compatible with the purpose for which the information was collected.

1. Disclosure to Contractors, Grantees, and Other Agents. Records may be disclosed to contractors (including another Federal agency acting as a service provider), grantees, consultants, volunteers, or other agents of OHSEPR who are assisting OHSEPR with the accomplishment of an OHSEPR function relating to the purposes of this system of records and need to have access to the records in order to provide the assistance.

2. Disclosure to Department of State. Records about a repatriation assistance applicant may be disclosed to the Department of State in connection with determinations of eligibility, referral, planning, and provision of temporary assistance of or to repatriates in cases referred to HHS.

3. Disclosure to States. Records about a repatriation assistance applicant may be disclosed to the States in connection with coordination and/or provision of temporary services for eligible repatriates.

4. Disclosure to Service Provider. Records about a repatriation assistance applicant may be disclosed to providers of services ( e.g., community-based organizations, hospitals) and to local State institutions ( e.g., courts and social service agencies) that assist in coordination and/or the provision of temporary assistance for eligible repatriates.

5. Disclosure to Agency for Temporary Assistance. Records about a repatriation assistance applicant may be disclosed to other Federal agencies and nongovernmental agencies for planning or provision of temporary assistance to eligible repatriates. Federal agencies include but are not limited to Department of State, Department of Defense, Department of Justice, Department of Homeland Security, Department of Housing and Urban Development, Federal Emergency Management Agency, Department of Agriculture, and United States Department of Transportation. Nongovernmental agencies include but are not limited to American Red Cross and Salvation Army.

6. Disclosure for Law Enforcement Purposes. Records may be disclosed to the appropriate Federal, State, local, Tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

7. Disclosure for Administrative Claim, Complaint, and Appeal. Records about a repatriation assistance recipient may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

8. Disclosure in Connection with Settlement Discussions. Records about a repatriation assistance recipient may be disclosed in connection with settlement discussions regarding claims by or against HHS, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions.

9. Disclosure to Ensure Continuity of Disaster Assistance Services. Records about a disaster assistance applicant may be disclosed to DHS/FEMA pursuant to an interagency sharing and access agreement and to the State, local, Tribal, or Territorial departments of human services to ensure continuity of services for each disaster survivor.

10. Disclosure to Locate Missing Children or Reunite Families. Records about a disaster assistance applicant may be disclosed to a Federal or State law enforcement authority, Federal or State agency, or private organization authorized to investigate, coordinate, or locate missing children and/or reunite families.

11. Disclosure to Combat Fraud, Waste, and Abuse. Records may be disclosed to another Federal agency, or instrumentality of any governmental jurisdiction, within or under the control of the United States (including the-State or local governmental agency) that administers or has the authority to investigate potential fraud, waste, or abuse in federally funded programs when reasonably necessary by HHS to prevent, deter, discover, detect, investigate, or sue with respect to defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.

12. Disclosure for Private Relief Legislation. Records about a repatriation assistance recipient may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular A–19.

13. Disclosure to Congressional Office. Records may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of the individual.

14. Disclosure to Department of Justice or in Proceedings. Records may be disclosed to the Department of Justice (DOJ), or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:

• HHS, or any component thereof; or
• Any employee of HHS in his or her official capacity; or
• Any employee of HHS in his or her individual capacity where DOJ or HHS has agreed to represent the employee; or
• The United States, if HHS determines that the litigation is likely to affect HHS or any of its components,

is a party to the litigation or has an interest in the litigation and the use of the records by DOJ or HHS is deemed by HHS to be relevant and necessary to the litigation.

15. Disclosure to the National Archives and Records Administration. Records may be disclosed to representatives of the National Archives and Records Administration (NARA) in records management inspections conducted pursuant to 44 U.S.C. 2904 and 2906.

16. Disclosure in the Event of a Security Breach Experienced by HHS. Records may be disclosed to appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records; (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the agency (including its information systems, programs and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS' efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

17. Disclosure to Assist Another Agency Experiencing a Breach. Records may be disclosed to another Federal agency or Federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

18. Disclosure for Cybersecurity Monitoring Purposes. Records may be disclosed to the DHS if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors internet traffic to and from Federal Government computer networks to prevent a variety of types of cybersecurity incidents.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are stored in hard copy files, electronic storage media, and cloud/network storage.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Disaster assistance case records are retrieved by the individual's name or case file number. Repatriate case records are retrieved by the individual's name, case file number, or social security number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records about individuals receiving repatriation assistance are retained and disposed of in accordance with NARA-approved disposition schedule N1–292–93–1, as follows:

• Files are transferred to a Federal records center one year after termination of collection efforts and are destroyed five years after termination of collection efforts.

Records about disaster survivors are disposed of in accordance with NARA-approved disposition schedule DAA–0292–2019–0001, as follows:

• Database intake assessment records: Cut off at the end of the calendar year, following the end of a disaster mission; Destroy 10 years after cutoff.
• Resource referral list: Cut off at the end of the calendar year, following the end of a disaster mission; Destroy 10 years after cutoff.
• Disaster Survivor Recovery Plans: Cut off at the end of the calendar year, following the end of a disaster mission; Destroy 3 years after cutoff.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Safeguards conform to the HHS Information Security and Privacy Program, https://www.hhs.gov/​ocio/​securityprivacy/​index.html. Information is safeguarded in accordance with applicable laws, rules and policies, including the HHS Information Technology Security Program Handbook, the E-Government Act of 2002 that includes the Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. 3541–3549, as amended by the Federal Information Security Modernization act of 2014, 44 U.S.C. 3551–3558, all pertinent National Institutes of Standards and Technology (NIST) publications; and OMB Circular A–130, Managing Information as a Strategic Resource. Records are protected from unauthorized access through appropriate administrative, physical, and technical safeguards. These safeguards include requiring contractors and grantees to maintain confidentiality throughout the case management process by assuring that client records are kept in a safe, secure environment within contractor or grantee facilities. All direct contractor or grantee staff are required to sign a confidentiality agreement and to receive training on security, privacy, and confidentiality policies and procedures, including methods of protecting client confidentiality. Client records are filed according to OHSEPR protocols and access to records is controlled through log-in/out processes for both computer and paper files.

Case managers, should they need to use paper records into the field, will take only those records needed to complete field activities, and all paper files will be kept in a locking file box while in transport and kept in a controlled facility when not being directly used for case management functions. Records in electronic format are accessible only to authorized users using two-factor authentication and password protection through a secured system protected by encryption, firewalls, and intrusion detection systems that require additional encryption for records stored on removable media. Records that become eligible for destruction are disposed of in alignment with the destruction methods prescribed by the NIST Special Publication (SP) 800–88. The associated information technology (IT) system(s) receive Authority to Operate (ATO) under the guidance of NIST SP 800–37.

RECORD ACCESS PROCEDURES:

Individuals seeking access to records about them in this system of records must submit a written access request to the System Manager identified in the “System Manager(s)” section of this SORN, in accordance with the Department's Privacy Act implementation regulations in 45 CFR. The request must contain the requester's full name, address, telephone number and/or email address, date and place of birth, and signature, and should identify the repatriation program or the applicable disaster, or otherwise provide enough information to enable OHSEPR to locate the requested records.

So that HHS may verify the requester's identity, the requester's signature must be notarized or the request must include the requester's written certification that the requester is the individual who the requester claims to be and that the requester understands that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a fine of up to $5,000.

You may request that a copy of the record be sent to you, or you may request an appointment to review the record in person (including with a person of your choosing, if you provide written authorization for agency personnel to discuss the record in that person's presence). You may also request an accounting of disclosures that have been made of the record, if any.

CONTESTING RECORDS PROCEDURES:

Individuals seeking to amend records about them in this system of records must submit a written amendment request to the System Manager identified in the “System Manager(s)” section of this SORN, in accordance with the Department's Privacy Act implementation regulations in 45 CFR. The request must contain the same information required for an access request. The request must include verification of the requester's identity in the same manner required for an access request; must reasonably identify the record and specify the information contested, the corrective action sought, and the reasons for requesting the correction; and should include supporting information to show how the record is factually inaccurate, incomplete, untimely, or irrelevant.

NOTIFICATION PROCEDURES:

Individuals who wish to know if this system contains records about them should submit a written notification request to the System Manager identified in the “System Manager(s)” section of this SORN, in accordance with the Department's Privacy Act implementation regulations in 45 CFR. The request must contain the same information required for an access request and must include verification of the requester's identity in the same manner required for an access request.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

81 FR 46687 (July 18, 2016), 83 FR 6591 (Feb. 14, 2018).