02-22516. Privacy Act, Exempt Record System

AGENCY:

Office of the Secretary, HHS.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Office for Civil Rights (OCR) of the Department of Health and Human Services is implementing a new System of Records (SOR) called the “Program Information Management System (PIMS), HHS/OS/OCR (09-90-0052).” PIMS effectively combines, and ultimately will replace, OCR's two existing systems of records, the “Case Information Management System (CIMS), HHS/OS/OCR (09-90-0050),” and the “Complaint File and Log, HHS/OS/OCR (09-90-0051),” to create a single, integrated system with enhanced electronic storage, retrieval and tracking capacities. The Department proposes to exempt the investigative records in PIMS from certain provisions of the Privacy Act, 5 U.S.C. 552a. The exemption is authorized by subsection (k)(2) of the Privacy Act, which applies to investigative materials compiled for law enforcement purposes. Unrestricted disclosure of confidential information in OCR files can impede ongoing investigations, invade the personal privacy of individuals, reveal the identities of confidential sources, or otherwise impair the ability of the Office for Civil Rights to conduct investigations. For these reasons, the Complaint File and Log system was exempted from the notification, access, correction and amendment provisions of the Privacy Act under subsection (k)(2) concerning records compiled for law enforcement purposes. 49 FR 14107 (April 10, 1984). Therefore, in this proposed rule, we merely extend this important exemption to OCR's new SOR.

OCR is authorized to gather information for civil and administrative law enforcement purposes pursuant to a number of statutes that prohibit discrimination based on race, color, national origin, disability, age, and, in some instances, sex and religion by recipients of Federal financial assistance, and, in certain instances, by public entities and the Department's federally conducted programs. OCR is also responsible for enforcement of medical records privacy protections under the Health Insurance Portability and Accountability Act (HIPAA). In order to maintain the integrity of the OCR investigative process and to assure that OCR will be able to obtain access to complete and accurate information, the Department proposes to exempt the investigative records in PIMS, under subsection (k)(2), from the notification, access, correction and amendment provisions of the Privacy Act, specifically subsections (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I) and (f). The Department is requesting public comments on the proposed exemption.

DATES:

To assure consideration, public comments must be delivered to the address provided below by no later than 5 p.m. on October 3, 2002.

ADDRESSES:

The public should address comments to: Larry Velez, Program, Policy and Training Division, Office for Civil Rights, Department of Health and Human Services, Room 509F, Hubert H. Humphrey Building, 200 Independence Avenue, SW., Washington, DC 20201. Comments also may be sent via e-mail to [e-mail]. Comments received will be available for review at this location, by appointment, during regular business hours, Monday through Friday from 9 a.m.-3 p.m., eastern standard time.

FOR FURTHER INFORMATION CONTACT:

Claudia Schlosberg, Acting Director, Program, Policy and Training Division, Office for Civil Rights, Department of Health and Human Services, Room 503F, Hubert Humphrey Building, 200 Independence Avenue SW., Washington, DC, 20201, telephone [phone]. (TTY No. 1-800-537-7697).

SUPPLEMENTARY INFORMATION:

The Office for Civil Rights (OCR) is responsible for enforcing Title VI of the Civil Rights Act of 1964, Section 504 of the Rehabilitation Act of 1973, the Age Discrimination Act of 1975, and other statutes which prohibit discrimination by programs or entities that receive Federal financial assistance. Additionally, OCR has jurisdiction over Federally conducted programs in cases involving disability-based discrimination under Section 504 of the Rehabilitation Act, over state and local public entities in cases involving disability-based discrimination under Title II of the Americans with Disabilities Act, and certain health plans, health clearinghouses and health care providers with respect to enforcement of health care privacy obligations under the Health Insurance Portability and Accountability Act (HIPAA).

OCR is implementing a new System of Records (SOR) called the “Program Information Management System (PIMS), HHS/OS/OCR (09-90-0052),” but in doing so seeks both to ensure personal privacy as well as its ability to conduct proper, unimpaired investigations. PIMS effectively combines and replaces OCR's two existing systems of records, the “Case Information Management System (CIMS), HHS/OS/OCR (09-90-0050),” and the “Complaint File and Log, HHS/OS/OCR (09-90-0051),” into a single, integrated system with enhanced electronic storage, retrieval and tracking capacities. While the types of information collected and stored in PIMS will be the same as the information collected in CIMS and the Complaint File and Log, PIMS will allow OCR to manage more effectively the information it does collect.

Under the Privacy Act, individuals generally have a right to access to information pertaining to them in government files. However, the Act permits agencies, by regulation, to exempt from the general access provision records which are “investigative material compiled for law enforcement purposes,” 5 U.S.C. 552a(k)(2). This exemption is qualified in that if the material results in the denial of any right, privilege, or benefit to the individual, the individual will have access to the material (except to the extent necessary to protect confidential sources).

OCR investigative files are records compiled for law enforcement purposes. In the course of investigations, OCR often has a need to obtain confidential information involving individuals other than the complainant. In these cases, it is necessary for OCR to preserve the confidentiality of the information to avoid unwarranted invasions of personal privacy and to assure recipients of Federal financial assistance that such information provided to OCR will be kept confidential. This assurance is often central to resolving disputes concerning access by OCR to the recipient's records, and is necessary to facilitate prompt and effective completion of investigations.

Unrestricted disclosure of confidential information in OCR files can impede ongoing investigations, invade the personal privacy of individuals, reveal the identities of confidential sources, or otherwise impair the ability of the Office for Civil Rights to conduct investigations. For these reasons, the Complaint File and Log system was exempted from the notification, access, correction and amendment provisions of the Privacy Act under subsection (k)(2) concerning records compiled for law enforcement purposes. 49 FR 14107 (April 10, 1984).

PIMS, OCR's new System of Records, will consist of an electronic repository of information and documents, and supplementary paper document files. Like its predecessor, PIMS will include records compiled for law enforcement purposes such as complaint allegations, information gathered during complaint investigations or reviews, letters of findings and correspondence relating to investigations. The Department therefore is proposing an amendment to the agency's Privacy Act regulation at 45 CFR 5b.11 to ensure that OCR's investigative records remain exempt from the requirements of subsections (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I) and (f) of the Privacy Act pursuant to the provisions of subsection (k)(2), both during the period of transition to the new SOR and when the new SOR becomes effective.

As required by Executive Order 12866, it has been determined that this proposed rule is not a significant regulatory action, and therefore, does not require a regulatory impact analysis. The regulation will not have a substantial direct effect on the States, on the relationship between the Federal Government and the States, or on the distribution of power and responsibilities among the various levels of government. Therefore, it is determined that this proposed rule does not have federalism implications under Executive Order 13132. Pursuant to the requirements of the Regulatory Flexibility Act, 5 U.S.C. 601-612, it is hereby certified that this rule will not significantly affect a substantial number of small entities. The proposed rule imposes no duties or obligations on small entities. In accordance with the provisions of the Paperwork Reduction Act of 1995, it has been determined that this proposed rule would not impose new record keeping, application, reporting, or other types of information collection requirements.

List of Subjects in 45 CFR Part 5b

• Privacy

For reasons set out in the preamble, the Department's Privacy Act Regulations, Part 5b of 45 CFR Subtitle A, is proposed to be amended as follows:

PART 5b—PRIVACY ACT REGULATIONS

1. The authority citation for part 5b continues to read as follows:

Authority: 5 U.S.C. 301, 5 U.S.C. 552a.

2. Section 5b.11 is amended by adding paragraph (b)(2)(ii)(G) to read as follows:

§ 5b.11

Exempt systems.

* * * * *

(b) * * *

(2) * * *

(ii) * * *

(G) Investigative materials compiled for law enforcement purposes for the Program Information Management System, HHS/OS/OCR are exempt under (k)(2) of the Privacy Act.

* * * * *

Dated: August 29, 2002.

Richard M. Campanelli,

Director, Office for Civil Rights.

Dated: August 29, 2002.

Tommy G. Thompson,

Secretary.