[Federal Register: June 26, 2007 (Volume 72, Number 122)]
[Notices]
[Page 35052-35055]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr26jn07-40]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Assistant Secretary for Preparedness & Response,
Office of Preparedness & Emergency Operations; Privacy Act of 1974;
Report of a New System of Records
AGENCY: Department of Health and Human Services (HHS), Office of the
Assistant Secretary for Preparedness and Response (ASPR), Office of
Preparedness and Emergency (OPEO).
ACTION: Notice of a new System of Records (SOR).
-----------------------------------------------------------------------
SUMMARY: In accordance with the requirements of the Privacy Act of
1974, we are proposing to establish a new system titled, ``The National
Disaster Medical System (NDMS) Patient Treatment and Tracking Records
System,'' System Number 09-90-0040. The primary purpose of the NDMS
Patient Treatment and Tracking Records System is to collect data from
individuals using the medical care capabilities provided by NDMS.
EFFECTIVE DATES: NDMS filed a new SOR report with the Chair of the
House Committee on Oversight and Government Reform; the Chair of the
Senate Committee on Homeland Security and Governmental Affairs; and the
Administrator, Office of Information and Regulatory Affairs, Office of
Management and Budget (OMB) on June 18, 2007. The proposed SOR will be
effective 30 days from the publication of the notice or 40 days from
the date mailed to ensure that all parties have adequate time in which
to comment. However, a request has been submitted to the OMB to grant
HHS a 10 day waiver of the review period due to the impending start of
the hurricane season. We may defer implementation of this system and
retrieve the request for waiver should we receive comments that are
contrary and requires the document to be altered.
ADDRESSES: You may submit comments, identified by one of the following
methods: The Federal e-Rulemaking Portal at http://www.regulations.gov
and following the instructions for submitting comments, or send to the
NDMS Chief Medical Officer, National Disaster Medical System, 330
Independence Avenue, SW., Room G-644, Washington, DC 20201.
FOR FURTHER INFORMATION CONTACT: CAPT Ana Marie Balingit-Wines, Chief
Nurse, NDMS Electronic Medical Records Project Officer, ASPR/OPEO/NDMS,
330 Independence Avenue, SW., Room G-644, Washington, DC 20201. CAPT
Balingit-Wines can be contacted by telephone at 202-205-8088, or e-mail
at anamarie.balingit-wines@hhs.gov for issues related to the SOR.
SUPPLEMENTARY INFORMATION: NDMS operates pursuant to Section 2812 of
the Public Health Service Act (42 U.S.C. 300hh-11), and currently
resides in HHS under ASPR in accordance with the Pandemic and All
Hazards Preparedness Act (PAHPA), Public Law 109-417. With the passage
of PAHPA, ASPR has been designated as the agency responsible for
medical response to include the deployment of NDMS and Field Medical
Station assets as well as the management of the officers of the Public
Health Service Commissioned Corps deployed during a response. ASPR
medical components, in particular NDMS, function in a coordinated
effort with DHS, DoD, and the VA. In a disaster situation, NDMS and
other ASPR components will augment the public health and health care
activities of State and local governments.
The Privacy Act embodies fair information principles in a statutory
framework governing the means by which the United States Government
collects, maintains, uses, and disseminates personally identifiable
information. The Privacy Act applies to information that is maintained
in a SOR, which is a group of any records under the control of an
agency from which information is retrieved by the name of the
individual or by some identifying number, symbol, or other identifying
particular, such as property address, mailing address, assigned to the
individual. As a component of Emergency Support Function (ESF)
8, NDMS has shared medical records with the other agencies and
departments that comprise ESF 8, due to the Function's shared
statutory authority over the collection of medical information. NDMS
has three key functions to which each of the ESF partners contribute
and require the collection of medical information: medical response,
patient evacuation, and definitive medical care.
The medical response function of NDMS is related to the activation
and deployment of NDMS response teams, comprised of medical and
logistical personnel, to assess the health and medical needs of
disaster victims. In response to the overall needs of the patients,
NDMS teams are activated to provide physical and mental health, as well
as evacuation during a public health emergency as cause for activation
as defined in 42 U.S.C. 300hh-11(a)(3)(A).
[[Page 35053]]
The patient evacuation function of NDMS relates to the
establishment of communications, transportation, and a medical
regulating system to evacuate and move patients from a staging center
near a disaster site to patient reception sites known as Federal
Coordinating Centers (FCCs). The DoD and VA have the prime
responsibility for activating and managing the FCCs. In turn, upon
receiving the patients, the FCCs have the authority to arrange for
necessary referrals and admissions or NDMS evacuated patients.
CMS is responsible for establishing and administering the
reimbursement process for health care rendered to patients provided
under the umbrella of NDMS in accordance with Section 2812 of the
Public Health Service Act, 42 U.S.C. 300hh-11, for ``definitive care.''
The SOR for the collection of information for the purpose of
reimbursement has been filed separately and was published on November
23, 2005, under 70 FR 70849. NDMS health care providers, in the course
of providing health care, collect data that identifies the patient's
name, address, contact information, gender, insurance information,
prior medical history, and all treatment information to include, but
not limited to, symptoms, vital signs, diagnosis, and medications
prescribed through the health care continuum. NDMS veterinary
providers, in the course of providing care to animals, may collect
contact information from the animal's owner. The medical records could
also include x-rays, lab results, and providers' comments relative to
their observations about the patient. NDMS has a need for the
collection of information for health care, patient movement, and
tracking, as well as for reimbursement of health care rendered.
The collection of the data as a result of illness or injury from a
disaster or other event mandating the deployment of NDMS medical
personnel is accomplished through a combination of paper and electronic
records. The patient data collected will also be used for tracking the
patient through the continuum. The collection of information during an
event such as a patient evacuation will assist NDMS in quickly tracking
and sending the patient and the medical information from the casualty
collection site to the designated FCC. The system will also allow NDMS
to track how many patients are sent to each FCC along with their
discharge and location status. The information will include but not be
limited to name, address, phone numbers, ethnic background, and other
contact and/or identifying information as well as medical information
including laboratory tests performed, diagnosis, treatment provided,
medications prescribed, referrals, and any treatment advice provided by
the medical professional to the patient. Pursuant to 5 U.S.C.
552a(b)(1), information collected would be disclosed to other
Department of Health and Human Services (HHS) agencies such as the
Centers for Disease Control and Prevention (CDC), the Centers for
Medicare and Medicaid Services (CMS), and the Agency for Health Care
Research and Quality (AHRQ), for the purpose of research, evaluation or
epidemiologic and longitudinal surveillance studies related to health
care, which may impact the care provided to disaster victims.
Information in this system will be disclosed as ``routine uses'' to
the following entities:
1. Emergency Support Function 8 (ESF 8) is a
coordinated effort between the Department of Health and Human Service
(HHS), the Department of Homeland Security (DHS), the Department of
Defense (DoD), and the Department of Veterans Affairs (VA). As such,
the medical treatment and evacuation of patients is a shared
responsibility between these agencies and disclosure of health related
information is necessary to adequately manage the overall care of the
patient.
2. Disclosure to a member of Congress on behalf of a constituent's
inquiry.
3. Disclosure to the Department of Justice (DOJ), court or
adjudicatory body when the agency is involved in litigation or has an
interest in litigation.
4. Disclosure to agency contractors, consultants, or grantees
engaged in the performance of service related to this collection and
who may need to have access to the records in order to perform the
activity.
5. To assist another Federal or State agency, agency of a state
government, an agency established by State law, or its fiscal agent to
assess the location or the status of their beneficiary.
6. Disclosure to family members of a patient about the location or
the status of the patient.
The Privacy Act requires each agency to publish in the Federal
Register a description denoting the type and character of each system
of records that the agency maintains, and the routine uses that are
contained in each system in order to make agency recordkeeping
practices transparent, to notify individuals regarding the uses to
which personally identifiable information is annotated, and to assist
individuals to easily find such files within the agency. NDMS, as a
component of the OPEO, which resides within ASPR, intends to create a
separate and distinct system of records. Below is the description of
the NDMS Patient Treatment and Tracking Records System.
Dated: June 14, 2007.
Kevin Yeskey,
Deputy Assistant Secretary, Office of Preparedness and Emergency
Operations.
SYSTEM NO. 09-90-0040
SYSTEM NAME:
``National Disaster Medical System (NDMS) Patient Treatment and
Tracking,'' HHS/ASPR/OPEO.
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
For a specified period and in accordance with the archiving rules,
the paper records will be resident at NDMS headquarters, located at 409
3rd Street SW., Suite 330, Washington, DC 20024. The electronic copy of
the record will be resident at the data center at the Unisys
Corporation, 11720 Plaza America Drive, Reston, VA 20190.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
The individuals covered by the system are all persons and owners of
animals treated by NDMS medical personnel when the NDMS Disaster
Medical Assistance Teams (DMATs) and Veterinary Medical Assistance
Teams (VMATs) are activated to respond to emergency situations, or as a
response to any other situation for which they are activated.
CATEGORIES OF RECORDS IN THE SYSTEM:
All records pertaining to treatment and movement of patients to
include the following (both in hard copy and electronic format):
Category A: Completed Patient Treatment Record form that includes:
1. NDMS Team Identification.
2. Chart Number.
3. Time and Date Patient seeks treatment.
4. Triage Category and health status.
5. Location where Patient is seen and transferred.
6. Patient Identification--Name, Address, City, State, Zip, Date of
Birth, Phone Number, Employment, Weight, Next of Kin.
7. Complaints/Symptoms.
8. Vital Signs/Treatment Recommended and/or Prescribed.
9. Discharge--Time, Date, Disposition, Recommendations.
10. Patient Authorization--Requires Patient Signature in Front of
Witness and Witness Verification through Signature.
[[Page 35054]]
11. Any potential attachments such as X-rays and laboratory reports
showing test results.
Category B: Veterinarian Treatment Records on animals:
1. Privacy Act Data such as the name, address and telephone contact
information of owners of animals will be maintained to be associated
with the animal patient. However, animal treatment records themselves
are not subject to the Privacy Act protections.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
NDMS Statute, 42 U.S.C. 300hh-11; Title VI of the Civil Rights Act
of 1964; and Section 504 of the Rehabilitation Act of 1973. Records
disposition of this medical SOR is determined under laws governing
federal records through the National Archives, 44 U.S.C. 3303a.
PURPOSE(S):
Medical and demographic information is collected on all patients
seen and/or treated by NDMS or ASPR personnel. This SOR will also
provide the location, time, and date the patient was transported during
an evacuation. The information collected will include but not be
limited to the patient's (1) Medical treatment history, (2) their pre-
existing conditions, (3) their described symptoms, (4) any medical
opinion rendered by an attending medical professional(s), (5)
medications that were prescribed, or (6) any other medical advice
provided. The collection of data contained in medical records provides
a mechanism by which teams can have the ability to conduct medical
quality assurance and establish a quality improvement process (QIP).
Through QIP, teams can analyze and judge their performance on a
specific deployment and if necessary enable them to better plan for
future deployments. These patient records are also important sources of
information to be used for research projects related to the prevention
of disease or disability as a result of a disaster. Most importantly,
these patient records document medical treatment rendered, especially
if questions of liability arise about the treatment or the subsequent
condition of the patient while he/she is under the care of NDMS.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTENM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b) of the Privacy Act, all or a portion of the records or
information contained in this system may be disclosed outside HHS as a
routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:
1. ESF 8 is a coordinated effort between HHS, DHS, DoD,
and the VA. As such, the medical treatment and movement of patients is
a shared responsibility between the ESF 8 partnership
agencies. The medical and demographic information collected during the
treatment of a patient is shared with the partners to ensure that
patients treated through NDMS receive the maximum level of health care
possible.
2. Disclosure to a member of Congress or a Congressional staff
member in response to an inquiry from the Congressional office made at
the behest of the constituent about whom the record is maintained.
3. Disclosure to the Department of Justice (DOJ), court, or
adjudicatory body when the following situations arise:
a. The agency or any component thereof, or
b. Any employee of the agency whether in his/her official or
individual capacity, where DOJ has agreed to represent the employee, or
c. The United States government is a party to litigation or has an
interest in such litigation and after careful review, the agency deems
that the records requested are relevant and necessary to the litigation
and that the use of such records by DOJ, court, or adjudicatory body is
compliant with the purpose for which the agency collected the records.
4. Disclosure to agency contractors, consultants, or grantees who
have been engaged by the agency to assist in the performance of a
service related to this collection and who need to have access to the
records in order to perform the activity.
5. To assist another Federal and/or State agency, agency of a state
government, an agency established by State law, or its fiscal agent:
a. To establish the benefit entitlement of the patient.
b. To establish the relationship between the existing state benefit
and the benefit funded in whole or part with Federal funds, such as the
one associated with the NDMS definitive care.
c. To collaborate with the state and state agencies on behalf of
family members regarding the current location and placement of their
evacuated family member or patient population.
6. Disclosure to family members of a patient about the location or
the status of the patient.
Policies and Practices for Storing, Retrieving, Accessing, Retaining,
and Disposing of Records in the System:
Category A: Patient Care Forms or other Medical Records:
Records in this system will be retained in accordance with the
records disposition authority approved by the National Archives and
Records Administration (NARA) for the Office of Public Health and
Emergency Preparedness (OPHEP) in compliance with N1-468-07-1. The
Pandemic and All Hazards Preparedness Act (Pub. L. 109-417),
established the ASPR to serve in a similar capacity as OPHEP for
medical disaster response. The records disposition authority used for
these records will N1-468-07-1.
Disposition authority:
Patient Care Forms or other Medical Records regulated under the
Health Insurance Portability and Accountability Act (HIPAA), created by
the Federal Medical Station(s) or by any component of HHS/ASPR during a
response to an event while caring for victims of that event.
Disposition: Cutoff is at the end of the response activity by the
Federal Medical Station(s) for a particular event. Retire to the
Washington National Records Center 2 years after cutoff. Destroy 75
years after cutoff. This disposition instruction is media neutral; it
applies regardless of media or format of the records.
Category B--The information collected on animals and their owners
will not be destroyed until NARA approves a disposition schedule for
those records.
Storage:
Paper records from this system are stored in the NDMS headquarters
at 409 3rd Street, SW., Suite 330, Washington, DC 20024. The electronic
database or server where information is entered and stored is
maintained at the HHS data center located at Unisys Corporation, 11720
Plaza America Drive, Reston, VA 20190. During deployments, NDMS stores
the records securely in their deployed location, the electronic data is
stored in a secured server, and all procedures required for protection
of Privacy Act documents are implemented as identified in
``Safeguards'' section below.
Retrievability:
NDMS Patient Treatment and Tracking Records in electronic and paper
copy are organized by event, location, and date of treatment. Data from
the records are stored in an electronic database enabling data from the
records to be retrievable by name and other demographic information
provided by the patient (or for veterinary records, by pet owner), as
well as by location of treatment, diagnosis, and other data fields
within the database.
[[Page 35055]]
Safeguards:
NDMS has safeguards in place for authorized users and monitors such
users to ensure against unauthorized use. Personnel having access to
the system have been trained in the Privacy Act and information
security requirements for both paper copies and electronically stored
information. Information in this system is safeguarded in accordance
with applicable laws, rules and policies, including the HHS Information
Technology Security Program Handbook, all pertinent National Institutes
of Standards and Technology publications and OMB Circular A-130,
Management of Federal resources. All records are protected from
unauthorized access through appropriate administrative, physical, and
technical safeguards. These safeguards include restricting access to
authorized personnel who have a need-to-know, using physical locks in
the office environment, and the process of authentication using user
IDs and passwords function as protection identification features. HHS
file areas are locked after normal duty hours and the facilities are
protected from the outside by security personnel.
SYSTEM MANAGER AND ADDRESS:
The NDMS Chief Medical Officer located at 409 3rd Street, SW.,
Washington, DC 20024. Mailing address: 330 Independence Avenue, SW.,
Room G-644, Washington, DC 20201.
NOTIFICATION PROCEDURES:
Requests for Privacy Act protected information generally are
governed by HHS regulations found at 45 CFR, Part 5b. They must be made
in writing and clearly marked as a ``Privacy Act Request'' on the
envelope and letter. Inquiries regarding this SOR should be addressed
to the System Manager. Inquiries related to patient medical records
should include the full name of the individual, the appropriate
personal identification, and the current address, and should be sent to
the Chief Medical Officer, NDMS, 330 Independence Avenue, SW., Room G-
644, Washington, DC 20201. The name of the requester, the nature of the
record sought, and the verification of identify must be clearly
indicated, as required by HHS regulations at 45 CFR 5b.5. Requests may
also be sent to: HHS Privacy Act Officer 200 Independence Avenue, SW.,
Washington, DC 20201.
RECORD ACCESS PROCEDURES:
Same as Notification Procedure above.
CONTESTING RECORD PROCEDURES:
Same as the Notification Procedure above. The letter should state
clearly and concisely what information you are contesting, the reasons
for contesting it, and the proposed amendment to the information that
you seek pursuant to HHS Privacy Act regulations, 45 CFR 5b.7.
RECORD SOURCE CATEGORIES:
Sources for providing data for NDMS Patient Treatment Records will
only be provided by patients, medical personnel treating the patients
or by accessing their personal health records (PHR). In the case of
minors or other individuals unable to explain symptoms, information may
be sought from a parent or guardian. For animals, information will be
gathered by NDMS veterinary personnel and/or owners or caretakers of
animals.
EXEMPTIONS CLAIMED FOR THE SYSTEM:
None.
[FR Doc. 07-3097 Filed 6-25-07; 8:45 am]
BILLING CODE 4150-37-M