2013-15596. Privacy Act; Implementation

ACTION:

Final rule.

SUMMARY:

The Department of Health and Human Services (HHS or Department), through the National Institutes of Health (NIH), is exempting a system of records from certain requirements of the Privacy Act to protect the integrity of NIH research misconduct proceedings and to protect the identity of confidential sources in such proceedings.

DATES:

Effective Date: This rule is effective July 31, 2013.

FOR FURTHER INFORMATION CONTACT:

Jerry Moore, NIH Regulations Officer, Office of Management Assessment, Division of Management Support, 6011 Executive Boulevard, Suite 601, MSC 7669, Rockville, MD 20852-7669; telephone [phone]; fax [phone]; email [e-mail].

SUPPLEMENTARY INFORMATION:

HHS/NIH is exempting a system of records, 09-25-0223, “NIH Records Related to Research Misconduct Proceedings, HHS/NIH,” under subsections (k)(2) and (k)(5) of the Privacy Act (5 U.S.C. 552a) from notification, access, accounting, and amendment provisions of the Privacy Act.

This system of records is part of NIH's implementation of its responsibilities under the Public Health Service (PHS) Policies on Research Misconduct, 42 CFR Part 93, and applies to alleged or actual research misconduct involving research in the NIH Intramural Research Program (IRP): (1) Carried out in NIH facilities by any person; (2) funded by the NIH IRP in any location; or (3) undertaken by an NIH employee or trainee as part of his or her official NIH duties or NIH training activities, regardless of location. Subject to NIH IRP policy, a person who, at the time of the alleged or actual research misconduct, was employed by, was an agent of, or was affiliated by contract, agreement, or other arrangement with NIH is covered by the system.

The term “research misconduct” is defined at 42 CFR 93.103 to mean “fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results.” The general policy of the PHS Policies on Research Misconduct is that “[r]esearch misconduct involving PHS support is contrary to the interests of the PHS and the Federal government and to the health and safety of the public, to the integrity of research, and to the conservation of public funds” 42 CFR 93.100(a).

Under the Privacy Act, individuals have a right of access to information pertaining to them that is contained in a system of records. At the same time, the Privacy Act permits certain types of systems to be exempt from some of the Privacy Act requirements. For example, section (k)(2) of the Privacy Act allows Agency heads to exempt from certain Privacy Act provisions a system of records containing investigatory material compiled for law enforcement purposes. This exemption's effect on the record access provision is qualified in that if the maintenance of the material results in the denial of any right, privilege, or benefit that the individual would otherwise be entitled to by federal law, the individual must be granted access to the material except to the extent that the access would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence. In addition, section (k)(5) of the Privacy Act permits an Agency to exempt investigatory material from certain Privacy Act provisions where such material is compiled solely for the purpose of determining suitability, eligibility, or qualifications for federal civilian employment, military service, federal contracts, or access to classified information. This exemption is also limited as it will be applied only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise of confidentiality.

The NIH may take administrative action in response to a research misconduct proceeding and, where there is a reasonable indication that a civil or criminal fraud may have taken place, will refer the matter to the appropriate investigative body. As such, the NIH's records related to research misconduct proceedings are compiled for law enforcement purposes, and the subsection (k)(2) exemption is applicable to this system of records. Moreover, where records related to research misconduct proceedings are compiled solely for the purpose of making determinations as to the suitability for appointment as special government employees or eligibility for federal contracts from PHS agencies, the subsection (k)(5) exemption is applicable.

On August 28, 2012, HHS/NIH published a System of Records Notice (SORN) for this system (77 FR 52043). On the same date, HHS/NIH also published a proposed rule (77 FR 51954) and, anticipating no significant adverse comment, a direct final rule (77 FR 51933) to exempt this system of records under subsections (k)(2) and (k)(5) of the Privacy Act from the notification, access, accounting, and amendment provisions of the Privacy Act. The comment period was open through November 13, 2012. The Agency received two comments during the rulemaking comment period. One comment, which questioned the privacy interest of scientists who receive grant money and are accused of misconduct, appears to have misunderstood the scope and applicability of the exceptions. The system of records in question pertains to research misconduct proceedings involving the NIH IRP. Thus, NIH grant funding to extramural scientists is unlikely to be involved. Moreover, the exception would not interfere with the public disclosure of findings of research misconduct by HHS' Office of Research Integrity (ORI) on behalf of the agency, including findings that may involve NIH IRP scientists or trainees found to have committed research misconduct. The other comment expressed a general concern about a loss of privacy and appeared to seek a reconsideration of the agency's approach, which was construed as sufficiently adverse to merit withdrawal of the direct final rule on January 10, 2013. HHS/NIH now publishes this final rule under the standard notice and comment rulemaking process.

After considering the comments, HHS/NIH believes the exemptions at issue are necessary to fulfill the Agency's responsibilities for addressing research misconduct. The exemptions are essential for NIH to protect the confidentiality of sources who provide information relevant to a research misconduct proceeding and to guard against the premature disclosure of research misconduct records that might obstruct or compromise proceedings. The exemptions will thereby enable the NIH to maintain the integrity and effectiveness of research misconduct proceedings.

Failure to adopt the exemptions would jeopardize the integrity and effectiveness of the NIH's research misconduct proceedings. The NIH's new system of records is modeled after the system of records maintained by the ORI, entitled “HHS Records Related to Research Misconduct Proceedings, HHS/OS/ORI” System No. 09-37-0021 (59 FR 36717, July 19, 1994; revised most recently at 74 FR 44847, August 31, 2009). The ORI has exempted these records under subsections (k)(2) and (k)(5) of the Privacy Act from the notification, access, accounting, and amendment provisions of the Privacy Act to ensure that these records will not be disclosed inappropriately (59 FR 36717, July 19, 1994). Likewise, HHS/NIH believes that exempting the new NIH system from the same Privacy Act provisions is essential to ensure that material in the NIH's files related to research misconduct proceedings is not disclosed inappropriately.

Subject to its obligations under the PHS Policies on Research Misconduct, 42 CFR Part 93, and other applicable law, HHS/NIH is therefore exempting this system under subsections (k)(2) and (k)(5) of the Privacy Act from the notification, access, and amendment provisions of the Act (subsections (c)(3), (d)(1) to (d)(4), (e)(4)(G) and (e)(4)(H), and (f)). The specific rationales for applying each of the exemptions are as follows:

• Subsection (c)(3). An exemption from the requirement to provide an accounting of disclosures is needed during the pendency of a research misconduct proceeding. Release of an accounting of disclosures to an individual who is the subject of a pending research misconduct assessment, inquiry, or investigation could prematurely reveal the nature and scope of the assessment, inquiry, or investigation and could result in the altering or destruction of evidence, improper influencing of witnesses, and other evasive actions that could impede or compromise the proceeding.
• Subsection (d)(1). An exemption from the access requirement is needed both during and after a research misconduct proceeding to avoid revealing the identity of any source who was expressly promised confidentiality. Only material that would reveal a confidential source will be exempt from access. Protecting the identity of a source is necessary when the source is unwilling to report possible research misconduct because of fear of retaliation (e.g., from an employer or coworkers).
• Subsections (d)(2) through (d)(4). An exemption from the amendment provisions is necessary while one or more related research misconduct proceedings is pending. Allowing amendment of investigative records in a pending proceeding could interfere with that proceeding. Even after that proceeding is concluded, an amendment could interfere with other pending or prospective research misconduct proceedings or could significantly delay inquiries or investigations in an attempt to resolve questions of accuracy, relevance, timeliness, and completeness.
• Subsection (e)(4)(G) and (e)(4)(H). An exemption from the Privacy Act notification provisions is necessary during the pendency of a research misconduct proceeding because notifying an individual who is the subject of an assessment, inquiry, or investigation of the fact of such proceedings could prematurely reveal the nature and scope of the proceedings and result in the altering or destruction of evidence, improper influencing of witnesses, and other evasive actions that could impede or compromise the proceeding. This exemption does not alter NIH's obligations to provide notice to the respondent in a research misconduct proceeding as described in the PHS Policies on Research Misconduct, 42 CFR Part 93.
• Subsection (f). An exemption from the requirement to establish procedures for notification, access to records, amendment of records, or appeals of denials of access to records is appropriate because the procedures would serve no purpose in light of the other exemptions, to the extent that those exemptions apply.

To avoid the unnecessary application of the exemptions, the NIH will give case-by-case consideration to requests for notification, access, and amendment submitted to the NIH Agency Intramural Research Integrity Officer (System Manager) or NIH Privacy Act Officer. Except for information that would reveal the identity of a source who was expressly promised confidentiality, the access exemption will not prohibit HHS/NIH from granting respondents' access requests consistent with the PHS Policies on Research Misconduct, 42 CFR part 93, including in those cases in which a finding of research misconduct has become final and an administrative action has been imposed. The request submission process is described in the SORN previously published for this system (77 FR 52043) and available online at http://www.gpo.gov/​fdsys/​pkg/​FR-2012-08-28/​pdf/​2012-20884.pdf.

Analysis of Impacts

HHS/NIH has examined the impacts of the final rule under Executive Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4). Executive Orders 12866 and 13563 direct Agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity). The Agency believes that this final rule is not a significant regulatory action under Executive Order 12866.

The Regulatory Flexibility Act requires Agencies to analyze regulatory options that would minimize any significant impact of a rule on small entities. Because the final rule imposes no duties or obligations on small entities, the Agency certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that Agencies prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current threshold after adjustment for inflation is $136 million, using the most current (2010) Implicit Price Deflator for the Gross Domestic Product. HHS/NIH does not expect this final rule to result in any 1-year expenditure that would meet or exceed this amount.

List of Subjects in 45 CFR Part 5b

• Privacy

For the reasons set out in the preamble, the Department of Health and Human Services is amending 45 CFR part 5b Subtitle A to read as follows:

PART 5b—PRIVACY ACT REGULATIONS

1. The authority citation for 45 CFR part 5b continues to read as follows:

Authority: 5 U.S.C. 301, 5 U.S.C. 552a.

2. Section 5b.11 is amended by adding paragraph (b)(2)(vii)(D) to read as follows:

§ 5b.11

Exempt systems.

* * * * *

(b) * * *

(2) * * *

(vii) * * *

(D) NIH Records Related to Research Misconduct Proceedings, HHS/NIH, 09-25-0223.

* * * * *

Dated: June 14, 2013.

Kathleen Sebelius,

Secretary of Health and Human Services.