Privacy Act: Systems of records,
[Federal Register: December 10, 1999 (Volume 64, Number 237)]
[Notices]
[Page 69274-69277]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr10de99-74]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Health Resources and Services Administration
Privacy Act of 1974; New System of Records
AGENCY: Health Resources and Services Administration, HHS.
ACTION: Notification of New System of Records.
SUMMARY: In accordance with the requirements of the Privacy Act, the Health Resources and Services Administration (HRSA) is publishing notice of a proposal to add a new system of records. The Ricky Ray Hemophilia Relief Fund Act of 1998 (``the Act'')
[[Page 69275]]
established the Ricky Ray Hemophilia Relief Program which is designed to compensate certain individuals with blood-clotting disorders, such as hemophilia, who were infected with HIV through the use of plasma derivatives administered between July 1, 1982 and December 31, 1987. The Act will also compensate certain individuals who acquired HIV through contact with the foregoing persons. This system of records is required to comply with the implementation directives of Public Law 105-369, the Ricky Ray Hemophilia Relief Fund Act of 1998. The records will be used for Program planning, implementation, evaluation, monitoring, and documentation storage purposes.
DATES: HRSA invites interested parties to submit comments on the proposed New System of Records on or before January 19, 2000. HRSA has sent a Report of New System of Records to Congress and to the Office of Management and Budget (OMB) on November 24, 1999. The New System of Records will be effective 40 days from the date submitted to OMB unless HRSA receives comments which would result in a contrary determination.
ADDRESSES: Please address comments to Health Resources and Services Administration (HRSA) Privacy Act Officer, 5600 Fishers Lane, Room 14A- 20, Rockville; Maryland 20857; telephone (301) 443-3780. Comments received will be available for inspection at this same address from 9 a.m. to 3 p.m., Monday through Friday. This is not a toll-free number.
FOR FURTHER INFORMATION CONTACT: Program Manager, Ricky Ray Program Office, Bureau of Health Professions, Room 8-05, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857; telephone (301) 443-2330. This is not a toll-free number.
SUPPLEMENTARY INFORMATION: The Health Resources and Services Administration (HRSA) proposes to establish a new system of records: 09-15-0061: ``Ricky Ray Hemophilia Relief Fund Act of 1998, HHS/HRSA/ BHPr''. The Ricky Ray Hemophilia Relief Fund Act of 1998 (the ``Act'') established the Ricky Ray Hemophilia Program (the ``Program'') which is designed to compensate any individual who has an HIV infection where the individual:
(a) Has any form of a blood clotting disorder, such as hemophilia, and was treated with antihemophilic factor (a plasma derivative) between July 1, 1982, and December 31, 1987;
(b) Is the lawful spouse of the individual described above;
(c) Is the former spouse of the individual described in paragraph (a) who was the lawful spouse of such individual between July 1, 1982, and December 31, 1987, and who can assert with reasonable medical certainty that there was a transmission of the HIV from the individual described in paragraph (a); or
(d) Acquired the HIV infection through perinatal transmission from a parent who is an individual described in paragraphs (a), (b), or (c).
Subject to the availability of appropriations, the Program will provide payments of $100,000 to the estimated 7,200 people suffering from blood clotting disorders, such as hemophilia, or survivors of such individuals, who were infected with the HIV virus as a result of using plasma derivatives between July 1982 and December 1987. This compensation is intended to help offset the past and future expense of medical treatment for HIV. The Federal Register notice, published March 24, 1999 (64 FR 14251), announces procedures for filing Notices of Intent to File Petitions for payment under the law which was enacted on November 12, 1998. No funds have been appropriated either for the payment of awards to petitioners or for the administrative costs to HHS for operating this new program. Nevertheless, the Act states states that HHS shall establish procedures to implement the Act within 120 days of its enactment. This system of records is required to comply with the implementation directive. It will be used for program planning, implementation, evaluation, monitoring, and documentation storage purposes. The Notice of Intent shall include (1) the name of the petitioner, with current address and phone number, and (2) the name, address, and phone number of the petitioner's attorney of record or other representative for the petition, if any. The Notice will be sent to The Ricky Ray Program Office, HRSA/BHPr, and an acknowledgment will be returned to the petitioner reflecting a case number assignment.
HRSA will permit disclosure of the records to third parties pursuant to the following routine uses. The first routine use permits disclosure to a Congressional office to allow subject individuals to obtain assistance from their representatives in Congress, if they so desire. The second routine use allows disclosure to the Department of Justice or a court, in the event of litigation. The third routine use allows disclosure of records to contractors for the purposes of data analysis and record systems processing and refinement. The fourth routine use allows disclosure to contractors, medical personnel and others needed to review, verify and validate petitions.
The following notice is written in the present tense, rather than the future tense, in order to avoid the unnecessary expenditure of public funds to republish the notice after the system becomes effective.
Dated: November 24, 1999. Claude Earl Fox, Administrator. 09-15-0061
SYSTEM NAME:
Ricky Ray Hemophilia Relief Fund Act of 1998, HHS/HRSA/BHPr
SECURITY CLASSIFICATION:
None.
SYSTEM LOCATION:
Ricky Ray Program Office, Bureau of Health Professions, Health Resources and Services Administration, Room 8-05, Parklawn Building, 5600 Fishers Lane, Rockville, Maryland 20857.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Petitioners and/or their representatives (if any) filing for compensation under the Ricky Ray Hemophilia Relief Fund Act of 1998.
CATEGORIES OF RECORDS IN THE SYSTEM:
Records consist of documents which may include general or Congressional correspondence, Notice of Intent to File a Petition, case number assignment, HHS responses, medical and legal documentation, payment information, and other related case processing documents.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
The authority for management of the system is governed by Pub. L. 105-369, Ricky Ray Hemophilia Relief Fund Act of 1998, enacted November 12, 1998 (42 U.S.C. 300c-22) which provides for compassionate payments with regard to certain individuals with blood-clotting disorders, such as hemophilia, who contracted human immunodeficiency virus (HIV) due to contaminated antihemophilic factor within specified time periods.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:
-
Disclosure may be made to a Congressional office from the record of an individual petitioner, in response to an inquiry from the Congressional office made at the request of the petitioner.
-
In the event of litigation where the defendant is:
[[Page 69276]]
(a) The Department, any component of the Department, or any employee of the Department in his or her official capacity;
(b) The United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or
(c) Any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example in defending against a claim based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, the Department may disclose such records as it deems desirable or necessary to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
-
HRSA may disclose records to Department contractors and subcontractors for the purposes of conducting data analysis for program evaluations, compiling managerial and statistical reports, and record systems processing and refinement.
-
HRSA may contract with expert consultants for the purpose of obtaining advice on petitioner's eligibility for compensation.
Relevant records may be disclosed to such consultants. The consultants shall be required to maintain Privacy Act safeguards with respect to such records and return all records to HRSA.
-
In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, rule, regulation or order issued pursuant thereto, provided that such disclosure is compatible with the purpose for which records were collected.
POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING AND DISPOSING OF RECORDS IN THE SYSTEM: STORAGE:
Records are maintained in file folders, on computer hard drives and/or disk packs.
RETRIEVABILITY:
Retrievability will be by case number and/or name of petitioner.
SAFEGUARDS:
-
Assign Responsibility for Security: Assign responsibility for security to a management official knowledgeable in the nature of the information and process supported by the application and in the management, personnel, operational, and technical controls used to protect it.
-
Perform Risk Assessment: A risk assessment shall be conducted in conjunction with the development of and prior to the approval of the system design and shall ensure that vulnerabilities, risks, and other security concerns are identified and addressed in the system design and throughout the life cycle of the project. This shall be consistent with the HHS Automated Information Systems Security Program Handbook (in particular Chapters V and X).
-
Develop Application Security Plan: Plan for the adequate security of the application, taking into account the security of all systems in which the application will operate. Application security plans shall address application rules, training on use of the system, personnel security, contingency planning, technical controls, information sharing, and public access controls.
-
Review Application Controls: Perform an independent review or audit of the security control in the application at least every 3 years.
-
Authorize Processing: Ensure that a management official authorizes in writing confirming that its security plan as implemented adequately secures the application. The application must be authorized prior to operating and reauthorized at least every 3 years thereafter. Management authorization implies accepting the risk of each system used by the application.
-
Implementation Guidelines: DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual; the DHHS Automated Information Systems Security Program Handbook; and Appendix III to OMB Circular No. A-130; Appendix I, ``Federal Agency Responsibilities for Maintaining Records About Individuals.''
RETENTION AND DISPOSAL:
Records will be retained for 6 years after the program is closed, and then destroyed.
SYSTEM MANAGER(S) AND ADDRESS:
Program Manager, Ricky Ray Program Office, Bureau of Health Professions, Health Resources and Services Administration, Parklawn Building, Room 8-05, 5600 Fishers Lane, Rockville, MD 20857.
NOTIFICATION PROCEDURE:
Requests must be made to the System Manager.
Requests in person: An individual who appears at the site where records are stored seeking access to or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of identification such as driver's license, passport, voter registration card, or union card. Identification with a current photograph is preferred but not required. Additional identification may be requested when there is a request for access to records which contain an apparent discrepancy between information contained in the records and that provided by the individual requesting access to the records. No verification of identity shall be required where the record is one which is required to be disclosed under the Freedom of Information Act.
Requests by mail: Requests for information and/or access to records received by mail must contain information providing the identity of the writer and a reasonable description of the record desired. Written requests must contain the name and address of the requester, his/her date of birth and his/her signature for comparison purposes.
Requests by telephone: Since positive identification of the caller cannot be established, telephone requests are not honored.
RECORD ACCESS PROCEDURES:
Same as notification procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosures that may have been made of their records, if any.
CONTESTING RECORDS PROCEDURES:
Contact the System Manager at the address specified above and reasonably identify the record, specify the information being contested, and state the corrective action and the reason(s) for requesting the correction, along with supporting justification to show how the record is inaccurate, incomplete, untimely, or irrelevant.
[[Page 69277]]
RECORD SOURCE CATEGORIES:
Petitioners and/or their representatives under the Ricky Ray Hemophilia Relief Fund Act of 1998.
SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:
None.
[FR Doc. 99-31696Filed12-9-99; 8:45 am]
BILLING CODE 4160-15-P
