E6-13389. Privacy Act of 1974; Report of a Revised System of Records

AGENCY:

Office of the Assistant Secretary for Administration and Management, Program Support Center, HHS.

ACTION:

Notice of a Modified or Altered System of Records.

SUMMARY:

Notice is hereby given that the Office of the Assistant Secretary for Administration and Management, Program Support Center, HHS, is proposing to amend its existing System of Records (SOR) entitled, “PSC Parking Program and PSC Transhare Program Records, No. 09-40-0013.” This amendment will change the name of the system and incorporate the activities of the PSC security and personal identification verification services into the existing SOR and provide for a more effective application of services. We have provided background information about the amended system in the SUPPLEMENTARY INFORMATION section below.

DATES:

Effective Date: PSC filed a revised system report with the Chairman of the Committee on Government Reform and Oversight of the House of Representatives, the Chairman of the Committee on Homeland Security and Governmental Affairs of the Senate, and the Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget (OMB), on August 9, 2006. To ensure that all parties have adequate time in which to comment, the revised system notice is effective 30 days after the date of publication, unless HHS receives comments which would result in a contrary determination, or 40 days from the date it was submitted to OMB and the Congress, whichever is later.

ADDRESSES:

Mail public comments to Mr. Don Deering, Chief, Security Services Branch, Physical Security Branch, Room 4B-44, 5600 Fishers Lane, Rockville, MD 20857. Telephone [phone]. This is not a toll-free number. Comments will be available for public inspection and copying at the above location, by appointment only, during regular business hours, Monday through Friday from 9 a.m.-3 p.m., eastern time zone.

FOR FURTHER INFORMATION CONTACT:

Mr. Don Deering, Chief, Security Services Branch, Physical Security Branch, Room 4B-44, 5600 Fishers Lane, Rockville, MD 20857. Telephone [phone].

SUPPLEMENTARY INFORMATION:

In 1999, PSC established a system of records (SOR), “PSC Parking Program and PSC Transhare Program Records, HHS/PSC/AOS.” Under the authority of The Federal Property and Administrative Services Act of 1949, as amended; and Pub. L. 101-509 section 629, as amended (5 U.S.C. 7905, “Programs to encourage commuting by means other than single-occupancy motor vehicles”). Notice of this system was published in the Federal Register July 14, 1999 (64 FR 37990). This amendment will incorporate the activities of the PSC security and personal identification verification services into the existing SOR and provide for a more effective application of services.

The SOR contains records relating to the administration of the parking permit system, PSC Transhare Program, PSC Security Services, and the PSC badging issuance for the Parklawn Building and HHS facilities. The records include information such as name; date of birth; place of birth; height; weight; gender; hair color and eye color; fingerprints; pay plan; grade level; employing organization; building and room; duty hours and location; name of supervisor; home address; office telephone number; background investigation type, Social Security Number; assigned parking space number; vehicle information, i.e., tag number and State; make and model of car; physician's statement in support of handicapped parking assignments and query to supervisors in support of handicapped parking assignments, where applicable; Transhare commuter card number; mode of transportation; commuter cost; name of personnel security representative (PSR).

I. Description of the Modified or Altered System of Records

A. Statutory and Regulatory Basis for SOR

The maintenance of the system is authorized by the Federal Property and Administrative Services Act of 1949, as amended, Pub. L. 101-509, section 629, as amended (5 U.S.C. 7905, “Programs to encourage commuting by means other than single-occupancy motor vehicles”), Executive Order 12958, the Privacy Act of 1974 (5 U.S.C. 552a(e)(10)), Pub. L. 90-620, as amended (44 U.S.C. Chapters 21 and 23), 5 U.S.C. 301, 40 U.S.C. 121(c) as implemented by 41 CFR part 102-74 subpart C, and 41 CFR section 102-74.375. The above Executive Order, Statutes, and Regulations address the security of records maintained by Federal agencies, Public Buildings, Property, Conduct on Federal Property, commuter programs, and Physical Protection and Building Security.

B. Collection and Maintenance of Data in the System

For purposes of the SOR, the system contains information related to the administration of the parking permit system, PSC Transhare Program, PSC Security Services, and the PSC badging issuance for the Parklawn Building and HHS facilities. The records include information such as name; date of birth; place of birth; height; weight; gender; hair color and eye color; fingerprints; pay plan; grade level; employing organization; building and room; duty hours and location; name of supervisor; home address; office telephone number; background investigation type, Social Security Numbers; assigned parking space number; vehicle information, i.e., tag number and State; make and model of car; physician's statement in support of handicapped parking assignments and query to supervisors in support of handicapped parking assignments, where applicable; Transhare commuter card number; mode of transportation; commuter cost; name of personnel security representative (PSR).

II. Agency Policies, Procedures, and Restrictions on the Routine Use

A. The Privacy Act permits us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such disclosure of data is known as a “routine use.” The Government will only release PSC Parking, Transhare, Security Services, and Badge Issuance information that can be associated with an individual as provided for under “Section III.” Both identifiable and non-identifiable data may be disclosed under a routine use. We will only collect the minimum personal data necessary to achieve the purpose of this system.

III. Routine Use Disclosures of Data in the System

A. The Privacy Act allows us to disclose information without an individual's consent if the information is to be used for a purpose that is compatible with the purposes for which the information was collected. Any such disclosure of data is known as a “routine use.” The Government will only release PSC Parking, Transhare, Security Services, and Badge Issuance information that can be associated with an individual as provided for under Section III. Both identifiable and non-identifiable data may be disclosed under a routine use. We will only collect the minimum personal data necessary to achieve the purpose of this system.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses: These records or information from these records may be used:

1. To disclose pertinent information to appropriate city, county, State and Federal law enforcement agencies responsible for investigating, prosecuting, enforcing, or implementing statutes, rules, regulations or orders, when HHS becomes aware of evidence of a potential violation of civil or criminal law.

2. To disclose information to a congressional office from the record of an individual in response to a verified inquiry from that congressional office made at the written request of that individual.

3. To disclose information to the Department of Justice, a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS where it is authorized to do so) has agreed to represent the employee; or (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records are collected.

4. When HHS contemplates contracting with a private firm for the purpose of collating, analyzing, aggregating, or otherwise refining records in this system, relevant records will be disclosed to such a contractor. The contractor will be required to maintain Privacy Act safeguards with respect to such records. These safeguards are explained in the section entitled “Safeguards.”

5. To disclose information to officials of labor organizations recognized under 5 U.S.C. Chapter 71 when relevant and necessary to their duties of exclusive representation, concerning personnel policies, practices, and matters affecting working conditions.

6. Disclosure may be made to organizations deemed qualified by the Secretary to carry out quality assessments or utilization review.

IV. Safeguards

PSC has safeguards in place for authorized users and monitors such users to ensure against unauthorized use.

1. Authorized Users: Data on computer files is accessed by authorized users who are PSC employees and who are responsible for implementing the program.

2. Physical Safeguards: Rooms where records are stored are locked when not in use. During regular business hours, rooms are unlocked but are controlled by on-site personnel.

3. Procedural and Technical Safeguards: A password is required to access the terminal, and a data set name controls the release of data to only authorized users. All users of personal information in connection with the performance of their jobs (see Authorized Users above) protect information from public view and from unauthorized personnel entering an unsupervised office.

4. Contractor Guidelines: A contractor who is given records under routine use 4 must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent unauthorized persons from gaining access to the records, and return the records to the System Manager immediately upon completion of the work specified in the contract. Contractor compliance is assured through inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records are instructed to make no disclosure of the records except as authorized by the System Manager and as stated in the contract.

This system will conform to all applicable Federal laws and regulations and Federal, HHS, and PSC policies and standards as they relate to information security and data privacy. These laws and regulations may apply but are not limited to: The Privacy Act of 1974; the Federal Information Security Management Act of 2002; the Computer Fraud and Abuse Act of 1986; the E-Government Act of 2002, and the corresponding implementing regulations. OMB Circular A-130, Management of Federal Resources, Appendix III, Security of Federal Automated Information Resources also applies. Federal, HHS, and PSC policies and standards include but are not limited to: All pertinent National Institute of Standards and Technology publications and the HHS Information Systems Program Handbook.

V. Effects of the Proposed System of Records on Individual Rights

PSC proposes to revise this system in accordance with the principles and requirements of the Privacy Act and will collect, use, and disseminate information only as prescribed therein. Data in this system will be subject to the authorized releases in accordance with the routine uses identified in this system of records.

PSC will take precautionary measures to minimize the risks of unauthorized access to the records and the potential harm to individual privacy or other personal or property rights of patients whose data are maintained in this system. PSC will collect only that information necessary to perform the system's functions. In addition, PSC will make disclosure from the proposed system only with consent of the subject individual, or his/her legal representative, or in accordance with an applicable exception provision of the Privacy Act. PSC, therefore, does not anticipate an unfavorable effect on individual privacy as a result of information relating to individuals.

Dated: August 8, 2006.

J.P. VanLandingham,

Deputy Assistant Secretary for Program Support.

SYSTEM NO. 09-40-0013

SYSTEM NAME:

PSC Parking Program, PSC Transhare Program Records, PSC Security Services, and PSC Employee and Contractors Identification Badge Issuances, HHS/PSC/AOS.

SECURITY CLASSIFICATION:

None.

SYSTEM LOCATION:

Division of Property Management, Administrative Operations Service, Program Support Center, Room 4B-44 and 5B-07, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Current HHS employees and others who use Parklawn Building parking facilities; HHS employees who apply for and participate in the PSC Transhare Program; HHS employees and contractors, who submit information for personnel security clearances, and employees, contractors, retirees, and individuals seeking access to HHS facilities.

CATEGORIES OF RECORDS IN THE SYSTEM:

This system contains records relating to the administration of the parking permit system, PSC Transhare Program, PSC Security Services, and the PSC badging issuance for the Parklawn Building and HHS facilities. The records include information such as name; date of birth; place of birth; height; weight; gender; hair color and eye color; fingerprints; pay plan; grade level; employing organization; building and room; duty hours and location; name of supervisor; home address; office telephone number; background investigation type, Social Security Numbers; assigned parking space number; vehicle information, i.e., tag number and State; make and model of car; physician's statement in support of handicapped parking assignments and query to supervisors in support of handicapped parking assignments, where applicable; Transhare commuter card number; mode of transportation; commuter cost; name of personnel security representative (PSR).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

The maintenance of the system is authorized by the Federal Property and Administrative Services Act of 1949, as amended, Pub. L. 101-509, section 629, as amended (5 U.S.C. 7905, “Programs to encourage commuting by means other than single-occupancy motor vehicles”), Executive Order 12958, the Privacy Act of 1974 (5 U.S.C. 552a(e)(10)), Pub. L. 90-620, as amended (44 U.S.C. Chapters 21 and 23), 5 U.S.C. 301, 40 U.S.C. 121(c) as implemented by 41 CFR part 102-74 subpart C, and 41 CFR section 102-74.375. The above Executive Order, Statutes, and Regulations address the security of records maintained by Federal agencies, Public Buildings, Property, Conduct on Federal Property, commuter programs, and Physical Protection and Building Security.

PURPOSE(S):

These records are used to:

1. Administer the parking program at the Parklawn Building complex.

2. Manage the PSC Transhare Program, including receipt and processing of Employee applications and coordination of the fare media distribution to employees.

3. Monitor the use of funds used to support the PSC Transhare Program.

4. Issue Identification Badges and perform background investigations for Federal Employees and Contractors as described by HSPD-12 and FIPS-201 supported by the PSC for Parklawn Building complex and other HHS facilities.

5. Administer the PSC Personnel Security and Ethics Programs.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

These records or information from these records may be used:

1. To disclose pertinent information to appropriate city, county, State and Federal law enforcement agencies responsible for investigating, prosecuting, enforcing, or implementing statutes, rules, regulations or orders, when HHS becomes aware of evidence of a potential violation of civil or criminal law.

2. To disclose information to a congressional office from the record of an individual in response to a verified inquiry from that congressional office made at the written request of that individual.

3. To disclose information to the Department of Justice, a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS where it is authorized to do so) has agreed to represent the employee; or (d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case HHS determines that such disclosure is compatible with the purpose for which the records are collected.

4. When HHS contemplates contracting with a private firm for the purpose of collating, analyzing, aggregating, or otherwise refining records in this system, relevant records will be disclosed to such a contractor. The contractor will be required to maintain Privacy Act safeguards with respect to such records. These safeguards are explained in the section entitled “Safeguards.”

5. To disclose information to officials of labor organizations recognized under 5 U.S.C. Chapter 71 when relevant and necessary to their duties of exclusive representation, concerning personnel policies, practices, and matters affecting working conditions.

6. Disclosure may be made to organizations deemed qualified by the Secretary to carry out quality assessments or utilization review. Policies and practices for storing, retrieving, accessing, retaining and disposing of records in the system:

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

These records are maintained in file folders, cabinets, on disks and in an automated data base.

RETRIEVABILITY:

These records are retrieved by the name, Social Security Number, parking space number, permit number, address, vehicle information and PSC Transhare commuter card number of the individuals on whom they are maintained, and Biometric Data.

SAFEGUARDS:

1. Authorized Users: Data on computer files is accessed by authorized users who are PSC employees and who are responsible for implementing the program.

2. Physical Safeguards: Rooms where records are stored are locked when not in use. During regular business hours, rooms are unlocked but are controlled by on-site personnel.

3. Procedural and Technical Safeguards: A password is required to access the terminal, and a data set name controls the release of data to only authorized users. All users of personal information in connection with the performance of their jobs (see Authorized Users above) protect information from public view and from unauthorized personnel entering an unsupervised office.

4. Contractor Guidelines: A contractor who is given records under routine use 4 must maintain the records in a secured area, allow only those individuals immediately involved in the processing of the records to have access to them, prevent unauthorized persons from gaining access to the records, and return the records to the System Manager immediately upon completion of the work specified in the contract. Contractor compliance is assured through inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records are instructed to make no disclosure of the records except as authorized by the System Manager and as stated in the contract.

RETENTION AND DISPOSAL:

Parking records are maintained for varying periods of time, in accordance with NARA General Records Schedule 11 number 4a. (parking permits). Disposal of manual records is by shredding; electronic data is erased. PSC Transhare records are retained for a maximum of two years following the last month of an employee's participation in the PSC Transhare Program. Paper copies are destroyed by shredding. Computer files are destroyed by deleting the record from the file. Identification Badge records are maintained in accordance with NARA General Records Schedule 11 number 4a. Personnel Security records are retained for a maximum of 15 years. Disposal of manual records is by shredding: electronic data is erased. Disposal of manual records is by shredding; electronic data is erased.

SYSTEM MANAGER(S) AND ADDRESS:

Safety and Security Specialist, Physical Security Branch, Division of Property Management, Administrative Operation Service, PSC, Room 4B-44, 5600 Fishers Lane, Rockville, MD 20857.

NOTIFICATION PROCEDURES:

Same as Access Procedures. The requester is required to specify reasonably the contents of the records being sought.

RECORD ACCESS PROCEDURES:

To determine whether information about themselves is contained in this system, the subject individual should contact the System Manager at the above address. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be. Individuals must provide the following information for their records to be located and identified: (a) Full name, (b) Social Security Number, (furnishing the Social Security Number is voluntary, but it may make searching for a record easier and prevent delay), (c) parking space number (if appropriate); (d) vehicle license number (if appropriate) and (e) for the PSC Transhare Program, the requester must provide the commuter card number and the dates of participation in the Program. The requester must also understand that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a fine. An individual who is the subject of records maintained in this records system may also request an accounting of disclosures that have been made of his or her records.

REQUESTS BY TELEPHONE:

Since positive identification of the caller cannot be established, telephone requests are not honored.

CONTESTING RECORD PROCEDURES:

Contact the System Manager specified above and reasonably identify the record, specify the information to be contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant.

RECORD SOURCE CATEGORIES:

Records are developed from information supplied by applicants and, for handicapped parking assignments, by physicians and supervisors.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:

None.