09-25-0099 SYSTEMS LISTING
SYSTEM NAME:
Clinical Research: Patient Medical Records, HHS/NIH/CC.
SECURITY CLASSIFICATION:
None.
SYSTEM LOCATION:
Medical Record Department, Clinical Center, Building 10, Room 1N208, 10 Center Drive, Bethesda, MD 20892-1192 and at private organizations under contract. Write to the system manager for a list of current locations.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Registered Clinical Center patients. Some individuals not registered as patients but seen in Clinical Center for diagnostic tests.
CATEGORIES OF RECORDS IN THE SYSTEM:
Medical treatment records.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
42 U.S.C. 241, 248: "Research and Investigation," and "Hospitals, Medical Examinations, and Medical Care."
PURPOSE(S):
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:
b). PHS may disclose information to State or local public health departments, to assist in the notification of the subject individual's sexual and/or needle-sharing partner(s), or in the verification that the subject individual has notified such sexual or needle-sharing partner(s).
POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
Records are stored in file folders and/or on microfiche, and on computer tapes.
RETRIEVABILITY:
Records are retrieved by unit number and patient name.
SAFEGUARDS:
Measures to prevent unauthorized disclosures are implemented as appropriate for each location and for the particular records maintained in each project. Each site implements personnel, physical, and procedural safeguards such as the following:
Contractor compliance is assured through inclusion of Privacy Act requirements in contract clauses, and through monitoring by contract and project officers. Contractors who maintain records in this system are instructed to make no disclosure of the records except as authorized by the System Manager.
These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.
RETENTION AND DISPOSAL:
Records are retained and disposed of under the authority of the NIH Records Control Schedule contained in NIH Manual Chapter 1743, Appendix 1 - "Keeping and Destroying Records" (HHS Records Management Manual, Appendix B-361), item 3000-E-22, which allows records to be kept until no longer needed for scientific reference. Refer to the NIH Manual Chapter for specific disposition instructions.
SYSTEM MANAGER(S) AND ADDRESS(ES):
Director, Medical Record Department, Clinical Center (CC), Building 10, Room 1N208, 10 Center Drive, Bethesda, MD 20892-1192.
NOTIFICATION PROCEDURE:
To determine if a record exists, write to the System Manager at the above address. The requester must provide tangible proof of identity, such as a driver's license. If no identification papers are available, the requester must verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Act, subject to a five thousand dollar fine.
An individual who requests notification of or access to a medical/dental record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. The representative may be a physician, or other health professional, or other responsible individual. The subject individual will be granted direct access unless it is determined that such access is likely to have an adverse effect on him or her. In that case, the medical/dental record will be sent to the designated representative. The individual will be informed in writing if the record is sent to the representative.
A parent or guardian who requests notification of or access to a child's/incompetent person's record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. The parent or guardian must verify relationship to the child/incompetent person as well as his/her own identity.
RECORD ACCESS PROCEDURE:
Same as Notification Procedures. Requesters should also reasonably identify the specific reports and related dates pertaining to the information to be released. There may be a fee for reproducing more than 20 pages of material. Individuals may also request listings of accountable disclosures that have been made of their records, if any.
CONTESTING RECORD PROCEDURE:
Contact the System Manager and reasonably identify the record and specify the information to be contested, and state the corrective action sought and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant. The right to contest records is limited to information which is incomplete, irrelevant, incorrect, or untimely (obsolete).
RECORD SOURCE CATEGORIES:
Referring physicians, other medical facilities (with patient's consent), patients, relatives of patients.
SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:
None.