POLICY

It is the policy of NCI-Frederick to protect the privacy of all employees to the fullest extent possible while nonetheless permitting the exchange of information required to fulfill the administrative and program responsibilities of the facility. NCI-Frederick will collect the minimum information required to accomplish a specified function and will make every effort to collect this information directly from the subject individual. Each individual has the right to access his or her information and request corrections or amendments to the information. Otherwise, access to the information will be position- or task-based so that employees have access only to the minimum information required to perform their jobs. These employees will receive appropriate training to understand and fulfill their duties and obligations with respect to privacy and confidentiality.

DEFINITION

Personal information means any item, collection, or grouping of information that is maintained by NCI-Frederick or an NCI-Frederick contractor about an individual. As specified by Health and Human Services (HHS), this information includes the individual's education, financial transactions, medical history, and criminal or employment history and also contains the individual's name, identifying number, symbol, or other unique identifier assigned to the individual, such as a fingerprint, voice print, or photograph.

PROCEDURE

Only relevant information required to accomplish specific facility functions will be collected, and to the greatest extent possible, this information will be collected directly from the subject individual.

The individual providing the information will be informed of the authority for providing the information, the principal purpose for maintaining the information, the routine uses of the information, and the effect of not providing the requested information.

Hard-copy documents and electronic records will be maintained in accordance with chapter 45-13 of the HHS General Administration Manual , ?Safeguarding Records Contained in Systems of Records,? and the HHS Information Security Program Policy and Handbook .

RESPONSIBILITY

All NCI-Frederick government and contractor employees who obtain, maintain, or use personal information must comply with all implementing procedures established.

REFERENCES

The Privacy Act of 1974 5 U.S.C. § 552a, as amended

Health and Human Services, General Administration Manual, chapter 45-13, ?Safeguarding Records Contained in Systems of Records?

HHS Information Security Program Policy and Handbook