01-9033. Privacy Act of 1974; Annual Publication of Systems of Records

AGENCY:

Agency for Healthcare Research and Quality, HHS.

ACTION:

Annual Publication of HHS Privacy Act System Notices.

SUMMARY:

The Agency for Agency for Healthcare Research and Quality (AHRQ) has conducted a comprehensive review of all Privacy Act systems of records and is publishing a Table of Contents of active systems and a comprehensive publication of all its active systems consolidating minor changes in accordance with the Office of Management and Budget Circular No. A-130, Appendix I, Federal Agency Responsibilities for Maintaining Records About Individuals.

SUPPLEMENTARY INFORMATION:

AHRQ has completed the annual review of its systems notices and has determined that minor changes are needed. AHRQ has consolidated such minor changes to make a comprehensive publication of all of its system notices. Published below are: (1) A Table of Contents which lists all active systems of records in AHRQ, and (2) a complete text of all notices consolidating minor changes which affect the public's right or need to know, such as changes in the system location of records, the designation and address of system managers, clarification of system name, records retention and disposal, and minor editorial changes.

Dated: March 29, 2001.

John M. Eisenberg,

Director.

Table of Contents

09-35-0001 Agency Management Information System/Grants (AMIS/GRANTS and CONTRACTS), HHS/AHRQ/OM.

09-35-0002 Agency for Healthcare Research and Quality, Medical Expenditure Panel Survey (MEPS) and National Medical Expenditure Survey 2 (NMES 2), HHS/AHRQ/CCFS.

09-35-0001

System Name:

Agency Management Information System/Grants (AMIS/GRANTS) and CONTRACTS), HHS/AHRQ/OM. The “Agency Management Information System/Grants and Contracts (AMIS/GRANTS and CONTRACTS), HHS/AHRQ/OM” was previously named the “Agency for Healthcare Research and Quality Grants Information and Tracking System with Contracts Component (GIAnT), HHS/AHRQ/OM”.

Security Classification:

None.

System Location:

Agency for Healthcare Research and Quality, Office of Management, Executive Office Center, Suite 601, 2101 E. Jefferson Street, Rockville, Maryland 20852.

Program Support Center, Office of Management, Division of Acquisition Management, Parklawn building, Room 5C-10, 5600 Fishers Lane, Rockville, Maryland 20857.

For a list of contractors, please write to the system manager at the address listed below.

Inactive records will be stored at: Washington National Records Center, 4205 Suitland Road, Suitland, Maryland 20746-8001.

Categories of Individuals Covered by the System:

Research training and career development grant applicants and principal investigators, research training grant program directors, and research fellowship recipients; peer and other special reviewers; contract project directors and other contractor key personnel.

Categories of Records in the System:

Research grant, research training grant, research career development, research fellowship, and contract files, including applications, proposals, award notices, and summary comments of peer reviewers.

Authority for Maintenance of the System:

AHRQ grants and contract administration authorities: secs. 902, 922, 924, 926 Public Health Service (PHS) Act (42 U.S.C. 299a, 299c-1, 299c-3, 299c-5); Sec. 1142 of the Social Security Act (42 U.S.C. 1320b-12) and sec. 487 PHS Act (42 U.S.C. 288) (National Research Service Awards).

Purposes(s):

The information in this system is used to facilitate day-to-day grants and contracts management operations and for purposes of review, analysis, planning and policy formulation by AHRQ staff members and by other components of DHHS which conduct research. AHRQ also may refer these records to the appropriate office in the Department for the purpose of monitoring payback; if necessary, debt collection; and investigation of alleged scientific misconduct.

Routine Uses of Records Maintained in the System, Including Categories of Users and the Purpose of Such Uses:

1. Disclosure may be made to a congressional office from the records of an individual in response to an inquiry from the congressional office made at the request of the individual.

2. The Department may disclose information from this system of records to the Department of Justice, to a court or other tribunal, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose of which the records were collected.

3. AHRQ may disclose information about an individual grant or contract applicant or fellowship applicant to credit reporting agencies to obtain a credit report in order to determine his/her credit worthiness.

4. Disclosure may be made to the National Technical Information Service (NTIS), U.S. Department of Commerce, to contribute to the Smithsonian Science Information Exchange, for dissemination of scientific and fiscal information on funded awards (abstracts and relevant administrative and financial data.)

5. Disclosure may be made to qualified experts, not within the definition of Department employees, for opinions, as a part of the grant application review award process.

6. Disclosure may be made to an AHRQ grantee or contractor for the purposes of (a) carrying out research, or (b) providing services relating to grant review, or for carrying out quality assessment, program evaluation, and/or management reviews. They will be required by written agreement to maintain Privacy Act safeguards with respect to such records.

7. Disclosure may be made to a Federal Agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit of the requesting agency, to the extent that the record is relevant and necessary to the requesting agency's decision on the matter.

8. Where Federal agencies having power to subpoena other Federal agencies' records, such as the Internal Revenue Service or the Civil Rights Commission, issue a subpoena to the Department for records in this system of records, the Department will make such records available.

9. Disclosure may be made to the cognizant Audit Agency for auditing.

10. In the event that a system of records maintained by the Department indicates a violation of potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by statute or by regulation, rule or order issued pursuant thereto, the relevant records in system of records may be referred for purposes of litigation, as a routine use, to the appropriate agency, whether Federal (e.g., the Department of Justice), or State (e.g., the State's Attorney General's Office) charged with the responsibility of investigating or processing such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.

11. Disclosure may be made to the grants/contractor institution in connection with performance or administration under the terms and condition of the award, or in connection with problems that might arise in performance or administration if an award is made on a grant/contract proposal.

Disclosure to Consumer Reporting Agencies:

Disclosure pursuant to 5 U.S.C. 552a(b)(12): Disclosure may be made from this system to “consumer reporting agencies” as defined in the Fair Credit Reporting Act (15 U.S.C. 1681ff. or the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a)(3)). The purpose of this disclosure is to aid in the collection of outstanding debts owed to the Federal Government; typically, to provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records. Disclosure of records is limited to the individual's name, address, Social Security number, and other information necessary to establish the individual's identity; the amount, status, and history of the claim; and the agency program under which the claim arose. This disclosure will be made only after the procedural prerequisites of 31 U.S.C. 3711 have been followed.

Policies and Practices for Storing, Retrieving, Accessing,Retaining, and Disposing of Records in the System:

Storage:

Records are stored on hard disks with magnetic tape backup was well as in manual files (file folders).

Retrievability:

Electronic records are retrievable by key data fields such as investigator name, application, grant or contract number. Paper records are retrievable by name of principal investigator and/or grant/contract number.

Safeguards:

1. Authorized users: All AHRQ staff who work with grants or contracts have access to the system. Level of access will be granted by the System Manager. Only staff members of the Division of Grants Management and Division of Contracts Management have regular access to their Division's paper grant and contract files. Limited access to official grant and contract files is granted to other AHRQ and DHHS staff with need-to-know about AHRQ research projects, only with authorization of the responsible Division Director.

2. Physical safeguards: File servers and database servers are maintained in areas secured by combination lock. Data is backed up from hard drive to magnetic tape daily. Paper records are secured in locked file cabinets in locked offices. All file cabinet and computer equipment is maintained under general building security.

3. Procedural safeguards: Access to electronic records by non-AHRQ personnel is through the Systems Manager only. DHHS staff may inspect AHRQ grant and contract records on a need-to-know basis only, with the approval of the responsible of the responsible Division Director. Visitors are not left unattended in the office containing the files. Offices are locked when not in use. Grant and contract records are either transmitted in sealed envelopes or are hand-carried.

4. Technical safeguards: Initial electronic access is through the AHRQ local area network which is controlled by password. Subsequent level of security exist for access to the Agency Management Information System/Grants and contracts (AMIS/GRANTS and CONTRACTS) system itself and, within the system, individual users are granted appropriate levels of access (read on, read/write) depending upon individual need. Levels of access are granted by the System Manager.

Retention and Disposal:

Electronic records containing portions of information from the paper applications and proposal of unfunded grant and contract applications will be retained and accessible at AHRQ for ten years. The complete paper applications and proposals of unfunded grants and contracts will be retired to the Federal Records Retention Center after one year and subsequently disposed of in accordance with the records retention schedule. Electronic records containing portions of information from the paper applications of funded grants or contracts will be retained and made accessible at AHRQ for fifteen years following final payment. Paper records of funded grant applications and contracts and their respective files are retained at AHRQ for one year beyond the termination date of the grant or until after the final report is received, whichever is sooner. They are then retired to the Federal Records Center and disposed of twelve years after final payment in accordance with the National Archives and Records Administration General Records Schedule. The pertinent records retention control schedule may be obtained by writing a System Manager at the following address.

System Manager(s) and Address:

For administrative information: AMIS/GRANTS and CONTRACTS Policy-Coordinating Official/Administrator, 301-594-1439

For grants information: Director, Division of Grants Management, 301-594-1447

For contracts information: Director, Division of Contracts Management, 301-594-1445

All System Managers are located at the following address: Office of Management, AHRQ, Executive Officer Center, Suite 601, 2101 E. Jefferson Street, Rockville, Maryland 20852.

Notification Procedure:

To determine if a record exists, write to the System Manager at the above address. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be. The requester should specify name or number of grant/contract. The requester must also sign a statement indicating an understanding that the knowing and willful request for acquisition of information from a protected record pertaining to an individual under false pretense is a criminal offense under the Act, punishable by a five thousand dollar fine.

Record Access Procedures:

Same as notification procedures. Requester should also reasonably specify the record contents being sought. Positive identification of the requester as above is required. Subject individuals may also request an accounting of disclosures that have been made of their record, if any.

Contesting Record Procedures:

Contact the official at the address specified under the System Manager subheading above and reasonably identify the record, specify the information being contested, and state the corrective action sought and reason(s) for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record Source Categories:

Grant applications, contractor project directors, reports and correspondence from the research community, and statement from grant review committees; consumer reporting agencies; DHHS System of Records 09-25-0036, Extramural Awards: IMPAC (Grant/Contract/Cooperative Agreement Information), HHS/NIH/DRG.

Systems Exempted from Certain Provisions of the Act:

None.

09-35-0002

System Name:

Medical Expenditure Panel Survey (MEPS) and National Medical Expenditure Survey 2 (NMES 2), HHS/AHRQ/CCFS.

Security Classification:

None.

System Location:

Center for Cost and Financing Studies, AHRQ, Executive Office Center, Suite 500, 2101 E. Jefferson Street, Rockville, Maryland 20852-4993.

Categories of Individuals Covered by the System:

(1) Individuals and members of households selected by probability sampling techniques to be representative of the civilian noninstitutionalized population of the United States; health care providers, staff responding on behalf of health insurers and the employers of members of sampled households; (2) residents and next-of-kin of such residents of nursing and personal care homes, selected by probability sampling techniques to be representative of residents of such homes, and facilities and the staff responding on behalf of such facilities.

Categories of Records in the System:

Records containing information on: (1) The incidence of illness and accidental injuries, prevalence of diseases and impairments, the extent of disability, the use, expenditures and sources of payment for health care services, and other characteristics of individuals obtained in household interviews (demographic and socioeconomic characteristics such as age, martial status, education, occupation and family income) and the names, telephone numbers and addresses of the responding staffs of health care providers, health insurers, and employers; (2) the utilization of long-term care, nursing home care, care in personal care homes through data on residents (demographic and social characteristics, health status and charges and sources of payment for care); through data facility characteristics (general characteristics, certification, services offered and corresponding expenses), and through data on next-of-kin or representative of residents (demographic and social characteristics, health status, and expenditures for health care of residents); and (3) Medicare claims records of members of sampled households and of sampled residents of nursing and personal care homes.

Authority for Maintenance of the System:

Section 913 and 306 of the Public Health Service (PHS) Act (42 U.S.C. 299b-2 and 242k(b)). Sections 924(c) and 308(d) of the PHS Act (42 U.S.C. 299c-3(c) and 242m(d)) provide authority for additional restrictions on identifiable information about individuals.

Purposes:

The data are used in aggregated form for statistical and health services research purposes respecting analysis and evaluation of health care costs, and the accessibility, planning, organization, distribution, technology, utilization, quality, and financing of health services and systems.

Routine Uses of Records Maintained in the System, Including Categories of Users and the Purposes of Such Uses:

The Department has contracted with private firms for the purpose of collecting, analyzing, aggregating, or otherwise refining records in this system. Relevant records are collected by and/or disclosed to such contractors. The contractors are required to maintain Privacy Act safeguards with respect to such records.

Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of Records in the System:

Storage:

File folders, magnetic tapes, CD ROM and secure network servers.

Retrievability:

Information can be retrieved by respondent name and address. However, this information is not stored in routinely used analytic files.

Safeguards:

AHRQ and its contractors implement personnel, physical, and procedural safeguards as follows:

1. Authorized users: Access is limited to persons authorized and needing to use the records, including project directors, contract officers, interviewers, health care researchers and analysts, statisticians, statistical clerks and data entry staff on the staffs of AHRQ and the MEPS contractors.

2. Physical safeguards: The hard-copy records are stored in locked safes, locked files, and locked offices when not in use. Computer terminals used to process identifiable data are located in secured areas and are accessible only to authorized users. Automated backup files are stored in locked, fire proof safes.

3. Procedural safeguards: All employees of AHRQ and contractor personnel with access to AHRQ records are required, as a condition of employment, to sign an affidavit binding them to nondisclosure of individually identifiable information. Periodic training sessions are conducted to reinforce the statutorily-based confidentiality restrictions. Actual identifiers are maintained in separate files linked only if there is a specific need as authorized by the System Manager. Data stored in computers both at AHRQ and the contractor sites are accessed through the use of passwords/keywords unique to each user and changed at least every 45 days. An automated audit trail will be maintained. Contractors who maintain records in this system are instructed to make no further disclosure of the records other than those requested by AHRQ/CCFS. Privacy Act requirements and the restrictions of 42 U.S.C. 242m(d) are specifically included in contracts for survey, research and data processing activities related to this system. The DHHS project directors, contract officers and project officers oversee compliance with these requirements.

4. These safeguards are in accordance with chapter 45-13, “Safeguarding Records Contained in Systems of Records,” of the HHS General Administration Manual, supplementary chapter PHS hf. 45-13; Part 6, “ADP Systems Security,” of the HHS ADP Systems Manual, and the National Bureau of Standards Federal Information Processing Standards (FIPS Pub. 41 and FIPS Pub. 31).

Retention and Disposal:

Hard-copy records will be burned or shredded following verification that such data were correctly entered into a machine readable format.

System Manager(s) and Address:

Director, Division of Survey Operations, CCFS/AHRQ, Executive Office Center, Suite 501, 2101 East Jefferson Street, Rockville, Maryland 20852.

Notification Procedure:

To determine if a record exists, write to the System Manager, giving your full name and address.

Record Access Procedures:

The system is exempt from the requirements of the Privacy Act; however, a subject individual may be granted access to his/her records at the System's Manager's discretion. Positive identification is required from anyone seeking access.

Contesting Record Procedures:

If access has been granted and some information is being contested, contact the System Manager and reasonably identify the record, specify the contested information, and state the corrective action sought, with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record Source Categories:

Respondents in the survey samples including: Members of households, physicians, hospitals, health insurers, employers, staff of nursing and personal care homes, the next-of-kin of residents of such homes and facilities, and Systems 09-70-0005, Medicare Bill File (Statistics), HHS/HCFA/BDMS.

Systems Exempted from Certain Provisions of the Act:

With respect to this system of records, exemption has been granted from the requirements contained in subsections 552a(c)(3), (d)(1) through (4) and (e)(4) (G) and (H), in accordance with the provisions of subsection 552a(k)(4) of the Privacy Act of 1974. This system has been exempted because it contains only records which are required by statue to be maintained and used solely as statistical records.