GRIP SS Attachment 5 - Privacy 03 2008

0925-XXXX Exp. XX-XXXX

Attachment 5 Privacy

SYSTEMS LISTING

SYSTEM NAME:

Records of Participants in Programs and Respondents in Surveys Used to Evaluate Programs of the Public Health Service, HHS/PHS/NIH/OD.

SECURITY CLASSIFICATION:

None.

SYSTEM LOCATION:

This system of records is an umbrella system comprising separate sets of records located either in the organizations responsible for conducting evaluations or at the sites of programs or activities under evaluation. Locations include Public Health Service (PHS) facilities, or facilities of contractors of the PHS. Write to the appropriate System manager below for a list of current locations.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Individuals covered by this system are those who provide information or opinions that are useful in evaluating programs or activities of the PHS other persons who have participated in or benefited from PHS programs or activities; or other persons included in evaluation studies for purposes of comparison. Such individuals may include (1) participants in research studies; (2) applicants for and recipients of grants, fellowships, traineeships or other awards; (3) employees, experts and consultants; (4) members of advisory committees; (5) other researchers, health care professionals, or individuals who have or are at risk of developing diseases or conditions studied by PHS; (6) persons who provide feedback about the value or usefulness of information they receive about PHS programs, activities or research results; (7) persons who have received Doctorate level degrees from U.S. institutions; (8) persons who have worked or studied at U.S. institutions that receive(d) institutional support from PHS.

CATEGORIES OF RECORDS IN THE SYSTEM:

This umbrella system of records covers a varying number of separate sets of records used in different evaluation studies. The categories of records in each set depend on the type of program being evaluated and the specific purpose of the evaluation. In general, the records contain two types of information: (1) information identifying subject individuals, and (2) information which enables PHS to evaluate its programs and services.

1. Identifying information usually consists of a name and address, but it might also include a patient identification number, grant number, social security number, or other identifying number as appropriate to the particular group included in an evaluation study.

2. Information used for evaluation varies according to the program evaluated. Categories of evaluative information include personal data and medical data on participants in clinical and research programs; personal data, publications, professional achievements and career history of researchers; and opinions and other information received directly from individuals in evaluation surveys and studies of PHS programs.

The system does not include any master list, index or other central means of identifying all individuals whose records are included in the various sets of records covered by the system.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Authority for this system comes from the authorities regarding the establishment of the National Institutes of Health, its general authority to conduct and fund research and to provide training assistance, and its general authority to maintain records in connection with these and its other functions (42 U.S.C. 203, 241, 289l-1 and 44 U.S.C. 3101), and Section 301 and 493 of the Public Health Service Act.

PURPOSE(S):

This system supports evaluation of the policies, programs, organization, methods, materials, activities or services used by PHS in fulfilling its legislated mandate for (1) conduct and support of biomedical research into the causes, prevention and cure of diseases; (2) support for training of research investigators; (3) communication of biomedical information.

This system is not used to make any determination affecting the rights, benefits or privileges of any individual.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING

CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

1. Disclosure may be made to HHS contractors and collaborating researchers, organizations, and State and local officials for the purpose of conducting evaluation studies or collecting, aggregating, processing or analyzing records used in evaluation studies. The recipients are required to protect the confidentiality of such records.

2. Disclosure may be made to organizations deemed qualified by the Secretary to carry out quality assessments, medical audits or utilization review.

3. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.

4. The Department may disclose information from this system of records to the Department of Justice, to court or other tribunal, or to another party before such tribunal, when a) HHS, or any component thereof; or b) any HHS employee in his or her official capacity; or c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or d) the United States or any agency thereof where HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the tribunal, or the other party is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Data may be stored in file folders, bound notebooks, or computer-accessible media (e.g., magnetic tapes, disks, cartridges, CD-ROMs, etc.).

RETRIEVABILITY:

Information is retrieved by name and/or participant identification number within each evaluation study. There is no central collection of records in this system, and no central means of identifying individuals whose records are included in the separate sets of records that are maintained for particular evaluation studies.

SAFEGUARDS:

A variety of safeguards are implemented for the various sets of records in this system according to the sensitivity of the data each set contains. Information already in the public domain, such as titles and dates of publications, is not restricted. However, sensitive information, such as personal or medical history or individually identified opinions, is protected according to its level of sensitivity. Records derived from other systems of records will be safeguarded at a level at least as stringent as that required in the original systems. Minimal safeguards for the protection of information which is not available to the general public include the following:

1. Authorized Users: Regular access to information in a given set of records is limited to PHS or to contractor employees who are conducting, reviewing or contributing to a specific evaluation study. Other access is granted only on a case-by-case basis, consistent with the restrictions required by the Privacy Act (e.g., when disclosure is required by the Freedom of Information Act), as authorized by the system manager or designated responsible official.

2. Physical Safeguards: Records are stored in closed or locked containers, in areas which are not accessible to unauthorized users, and in facilities which are locked when not in use. Records collected in each evaluation project are maintained separately from those of other projects. Sensitive records are not left exposed to unauthorized persons at any time. Sensitive data in machine-readable form may be encrypted.

3. Procedural Safeguards: Access to records is controlled by responsible employees and is granted only to authorized individuals whose identities are properly verified. Data stored in mainframe computers is accessed only through the use of keywords known only to authorized personnel. When personal computers are used, magnetic media (e.g. diskettes, CD-ROMs, etc.) are protected as under Physical Safeguards. When data is stored within a personal computer (i.e., on a "hard disk"), the machine itself is treated as though it were a record, or records, under Physical Safeguards. Contracts for operation of this system of records require protection of the records in accordance with these safeguards; PHS project and contracting officers monitor contractor compliance.

These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.

RETENTION AND DISPOSAL:

Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1 - "Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 1100-C-2. Refer to the NIH Manual Chapter for specific disposition instructions.

SYSTEM MANAGER(S) AND ADDRESS(ES):

See Appendix I.

Policy coordination for this system is provided by: Acting Director, Office of Reports and Analysis, Office of Extramural Research, Office of the Director (OD), Building 1, Room 252, 1 Center Drive, Bethesda, MD 20892.

NOTIFICATION PROCEDURE:

To determine if a record exists, write to the official of the organization responsible for the evaluation, as listed in Appendix II. If you are not certain which component of PHS was responsible for the evaluation study, or if you believe there are records about you in several components of PHS, write to: NIH Privacy Act Officer, 6011 Executive Boulevard, Room 601, Bethesda, MD 20892-7669.

Requesters must provide the following information:

1. Full name, and name(s) used while studying or employed;

2. Name and location of the evaluation study or other PHS program in which the requester participated or the institution at which the requester was a student or employee, if applicable;

3. Approximate dates of participation, matriculation or employment, if applicable.

The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.

An individual who requests notification of or access to a medical record shall, at the time the request is made, designate in writing, a responsible representative, who may be a physician, other health professional, or other responsible individual, who will be willing to review the record and inform the subject individual of its contents at the representative's discretion.

A parent or guardian who requests notification of, or access to, a child's or incompetent person's medical record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child or incompetent person as well as his or her own identity.

RECORD ACCESS PROCEDURE:

Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request listings of accountable disclosures that have been made of their records, if any.

CONTESTING RECORD PROCEDURE:

Write to the official specified under Notification Procedures above, and reasonably identify the record and specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).

RECORD SOURCE CATEGORIES:

Information contained in these records is obtained directly from individual participants; from systems of records 09-25-0036, "Extramural Awards and Chartered Advisory Committees (IMPAC 2), Contract Information (DCIS), and Cooperative Agreement Information, HHS/NIH;" NSF-6, "Doctorate Record File," NSF-43, "Doctorate Work History File" (previously entitled NSF-43, "Roster and Survey of Doctorate Holders in The United States" and other records maintained by the operating programs of NIH; the National Academy of Sciences, professional associations such as the AAMC and ADA, and other contractors; grantees or collaborating researchers; or publicly available sources such as bibliographies.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:

None.

Appendix I: System Managers

Office of Reports and Analysis, Office of Extramural Research, Office of the Director (OD), Rockledge II, Room 6212, 6701 Rockledge Drive, Bethesda, MD 20892.

Director, Office of Human Resource Management, Office of the Director (OD), Building 1, Room B160, 1 Center Drive, Bethesda, MD 20892.

Program Analyst, Office of Science and Technology, PSR, National Heart, Lung and Blood Institute (NHLBI), Building 31, Room 5A03, 31 Center Drive, Bethesda, MD 20892-2482.

Associate Director for Health Information Programs Development, National Library of Medicine (NLM), Building 38, Room 2S20, 8600 Rockville Pike, Bethesda, MD 20894.

Associate Director for Science Policy and Legislation, National Eye Institute (NEI), Building 31, Room 6A25, 31 Center Drive, Bethesda, MD 20892-2510.

Public Health Educator, Office of Cancer Communications, National Cancer Institute (NCI), Building 31, Room 10A03, 31 Center Drive, Bethesda, MD 20892.

Chief, Office of Planning, Analysis, National Institute on Aging (NIA), Building 31, Room 5C05, 31 Center Drive, Bethesda, MD 20892.

Associate Director for Science Policy, Analysis, and Communication, National Institute of Child Health and Human Development (NICHD), Building 31, Room 2A18, 31 Center Drive, Bethesda, MD 20892.

Chief, Science Policy and Planning Branch, National Institute on Deafness and Other Communication Disorders (NIDCD), Building 31, Room 3C27, 31 Center Drive, Bethesda, MD 20892-2320.

Evaluation Officer, Office of Science Policy and Analysis, National Institute of Dental and Craniofacial Research (NIDCR), Building 31, Room 5B55, 31 Center Drive, Bethesda, MD 20892-2190.

Program Analyst, Office of Program Planning and Evaluation, National Institute of Environmental Health Sciences (NIEHS), P.O. Box 12233, Research Triangle Park, NC 27709.

Chief, Office of Program Analysis and Evaluation, National Institute of General Medical Sciences (NIGMS), Natcher Building, Room 2AS55F, 45 Center Drive, Bethesda, MD 20892.

Director, Division of Advanced Studies and Policy Analyses, Fogarty International Center (FIC), Building 16, Room 202, 16 Center Drive, Bethesda, MD 20892-6705.

Information Officer, Center for Scientific Review (CSR), Rockledge II, Room 6160, 6701 Rockledge Drive, Bethesda, MD 20892.

Director, Office of Science Policy and Public Liaison, National Center for Research Resources (NCRR), Rockledge II, Room 5046, 6701 Rockledge Drive, Bethesda, MD 20892.

Chief, Office of Planning, Analysis and Evaluation, National Institute of Nursing Research (NINR), Building 31, Room 5B09, 31 Center Drive, Bethesda, MD 20892.

Policy Analyst, Division of Policy and Education, Office of Research Integrity, U.S. Public Health Service, 5515 Security Lane, Suite 700, Rockwall II Building, Rockville, MD 20852.

Contract Officer, National Institute of Mental Health (NIMH), 6001 Executive Boulevard, Room 6107, Bethesda, MD 20892.

Program Evaluation Team, Office of Scientific Affairs, National Institute on Alcohol Abuse and Alcoholism (NIAAA), Willco Building, Room 409, 6000 Executive Boulevard, Bethesda, MD 20892-7003.

Evaluation Officer, Office of Science Policy and Operations, National Center for Complementary and Alternative Medicine (NCCAM), Democracy Plaza II, Room 401, 6707 Democracy Boulevard, Bethesda, MD 20892-5475.

Privacy Act Coordinator, National Institute of Biomedical Imaging and Bioengineering (NIBIB), Building 31, Room 1B37, 31 Center Drive, Bethesda, MD 20892-2077.

Privacy Act Coordinator, National Center on Minority Health and Health Disparities (NCMHD), Democracy Plaza II, Room 800, 6707 Democracy Boulevard, Bethesda, MD 20892-5465.

Appendix II: Notification and Access Officials

Acting Director, Office of Reports and Analysis, Office of Extramural Research, Office of the Director (OD), Building 1, Room 252, 1 Center Drive, Bethesda, MD 20892.

Director, Office of Human Resources Management, Office of the Director (OD), Building 1, Room B160, 1 Center Drive, Bethesda, MD 20892.

Privacy Act Coordinator, National Heart, Lung, and Blood Institute (NHLBI), Building 31, Room 5A33, 31 Center Drive, Bethesda, MD 20892.

Assistant Director for Planning and Evaluation, National Library of Medicine (NLM), Building 38, Room 2S18, 8600 Rockville Pike, Bethesda, MD 20894.

Program Evaluation Team, Office of Scientific Affairs, National Institute on Alcohol Abuse and Alcoholism (NIAAA), Willco Building, Room 409, 6000 Executive Boulevard, Bethesda, MD 20892-7003.

Contract Officer, National Institute of Mental Health (NIMH), 6001 Executive Boulevard, Room 6107, Bethesda, MD 20892.

Executive Officer, National Eye Institute (NEI), Building 31, Room 6A03, 31 Center Drive, Bethesda, MD 20892-2510.

Director, Division of Advanced Studies and Policy Analysis, Fogarty International Center (FIC), Building 16, Room 202, 16 Center Drive, Bethesda, MD 20892-6705.

Information Officer, Center for Scientific Review (CSR), Rockledge II, Room 6160, 6701 Rockledge Drive, Bethesda, MD 20892.

Director, Office of Science Policy and Public Liaison, National Center for Research Resources (NCRR), Rockledge II, Room 5046, 6701 Rockledge Drive, Bethesda, MD 20892.

Privacy Act Coordinator, National Cancer Institute (NCI), Building 31, Room 10A30, 31 Center Drive, Bethesda, MD 20892.