Notification
of New System of Records
Federal
Register: November 3, 2003
(Volume 68, Number 212)
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Health Resources and Services Administration
Privacy Act of 1974; New System
of Records
ACTION: Notification of new system of
records.
SUMMARY:
In accordance with the requirements of
the Privacy Act, the Health Resources
and Services Administration (HRSA) is
publishing notice of a proposal to add
a new system of records. The Smallpox
Vaccine Injury Compensation Act of 2003
(``the Act''), amended title II of the
Public Health Service Act (42 U.S.C. 202
et seq.) to provide benefits and other
compensation for certain individuals with
injuries resulting from the administration
of smallpox countermeasures or as a result
of vaccinia contracted through accidental
vaccinia inoculation. The Act directs
the Secretary, HHS, to establish administrative
procedures to compensate certain individuals
who sustained a covered injury as the
direct result of the administration of
smallpox vaccine, and certain individuals
who sustained a covered injury as a direct
result of accidental vaccinia inoculation
through contact with the foregoing persons
or with individuals accidently inoculated
by them. This system of records is required
to comply with the implementation directives
of the Act, Public Law 108-20. The records
will be used for the Smallpox Vaccine
Injury Compensation Program's (SVICP)
planning, implementation, payment, evaluation,
monitoring, and document storage purposes.
DATES:
HRSA invites interested parties to submit
comments on the proposed New System of
Records on or before December 15, 2003.
As of the date of the publication of this
Notice, HRSA has sent a Report of New
System of Records to Congress and to the
Office of Management and Budget (OMB).
The New System of Records will be effective
40 days from the date submitted to OMB
unless HRSA receives comments that would
result in a contrary determination.
ADDRESSES:
Please address comments to Health Resources
and Services Administration (HRSA) Privacy
Act Officer, 5600 Fishers Lane, Room 14A-
20, Rockville, Maryland 20857; telephone
(301) 443-3780. This is not a toll-free
number. Comments received will be available
for inspection at this same address from
9 a.m. to 3 p.m., Monday through Friday.
FOR
FURTHER INFORMATION CONTACT:
Director, Office of Special Programs,
Health Resources and Services Administration,
5600 Fishers Lane, Room 16C-17, Rockville,
Maryland 20857; telephone (301) 443-3300.
This is not a toll-free number.
SUPPLEMENTARY
INFORMATION: The Health Resources
and Services Administration (HRSA) proposes
to establish a new system of records:
``The Smallpox Vaccine Injury Compensation
Program, HHS/HRSA/OSP.'' The Act authorizes
the creation of a Smallpox Vaccine Injury
Compensation Program (``the Program'')
by directing the Secretary, HHS, to establish
administrative procedures designed to
provide benefits and other compensation
to certain individuals who sustained a
covered injury as the direct result of
the administration of smallpox countermeasures,
and certain individuals who sustained
a covered injury as a direct result of
accidental vaccinia inoculation through
contact with the foregoing persons or
with individuals accidently inoculated
by them. The Secretary will issue regulations
implementing the Program. Individuals
eligible to be considered for benefits
and other compensation are: 1. (a) Health
care workers, law enforcement officers,
firefighters, security personnel, emergency
medical personnel, other public safety
personnel, or support personnel for such
occupational specialties; (b) Who are
or will be functioning in a role identified
in a State, local, or HHS smallpox emergency
response plan approved by the Secretary;
(c) Who have volunteered for, and been
selected to be members of, a smallpox
emergency response plan prior to the time
at which the Secretary publicly announces
that an active case of smallpox has been
identified either within or outside of
the United States; (d) To whom a smallpox
vaccine is administered pursuant to such
an approved plan during the effective
period of the Declaration Regarding Administration
of Smallpox Countermeasures (``the Declaration'')
issued by the Secretary, HHS, on January
24, 2003, and published in the Federal
Register on January 28, 2003 (68 FR 4212);
and (e) Who sustain a covered injury,
disability, illness, condition, or death
as a direct result of receiving a covered
countermeasure, including the smallpox
vaccine, during the effective period of
the Declaration; or 2. Certain individuals
who sustain a covered injury, disability,
illness, condition, or death as a direct
result of vaccinia contracted through
contact with one or more of the individuals
described above or through contact with
individuals accidently inoculated by those
individuals, during the specified time
frame. Subject to certain provisions,
the Act authorizes benefits and other
compensatory payments, generally secondary
to other available coverage, for the following:
(1) Reasonable and appropriate medical
items and services to treat a covered
injury. (2) Lost employment income incurred
as a result of a covered injury beyond
the first five days of work missed unless
the loss of employment extends beyond
nine days, to a maximum of $50,000 for
any given year with a limited exception
for persons with a permanent and total
disability, through the age of 65. (3)
Death payment to survivors in circumstances
in which death is determined to have resulted
from a covered injury. This system of
records is required to comply with the
implementation directive set forth in
the Act. It will be used for Program planning,
implementation, payment, evaluation, monitoring,
and document storage purposes. HRSA permits
disclosure of the records to third parties
pursuant to the following routine uses:
The first routine use permits disclosure
to a congressional office to allow subject
individuals to obtain assistance from
their representatives in Congress, if
they wish to do so. The second routine
use allows disclosure to Federal, State
or local Government entities or to private
entities for the purpose of their providing
information relevant to medical or legal
documentation required for determinations
of eligibility or payment. The third routine
use allows disclosure of records to contractors
engaged by the Department who need access
to the records in order to assist the
Department, e.g., expert consultants providing
advice on requesters' eligibility for
benefits and/or compensation. The fourth
routine use allows disclosure of records
to individuals and/or entities as necessary
for the purposes of obtaining financial
advice and providing benefits and other
compensation to requesters approved for
payment under the Program. The fifth routine
use allows disclosure to a Federal agency
administering aspects of the Program under
a Memorandum of Agreement or assisting
in the accomplishment of a Departmental
function related to the purposes of the
Program. The sixth routine use allows
disclosure of records to the Department
of Justice or a court, in the event of
litigation. The seventh routine use allows
disclosure to the appropriate Federal,
State or local agency in the event of
a violation of law. The eighth routine
use allows disclosure of records for certain
medical research purposes. The following
notice is written in the present tense,
rather than the future tense, in order
to avoid the unnecessary expenditure of
public funds to republish the notice after
the system becomes effective.
Dated:
October 28, 2003.
Elizabeth
M. Duke, Administrator, Health Resources
and Services Administration.
09-15-0065 SYSTEM NAME:
Smallpox Vaccine Injury Compensation Program,
HHS/HRSA/OSP.
SECURITY
CLASSIFICATION: None.
SYSTEM
LOCATION: Office of Special Programs,
Health Resources and Services Administration,
4350 East-West Highway, 10th Floor, Bethesda,
Maryland 20814.
CATEGORIES
OF INDIVIDUALS COVERED BY THE SYSTEM:
Individuals covered by the system are
requesters and/or their representatives
filing for benefits and other compensation
under the Smallpox Vaccine Injury Compensation
Program.
CATEGORIES
OF RECORDS IN THE SYSTEM: Records
consist of documents that may include
general or congressional correspondence,
requests, case number assignment, HHS
responses, medical and legal documentation,
employment documentation, documentation
concerning services or benefits available
from the United States or any third party
(including any State or local governmental
entity, private insurance carrier, or
employer), payment information, and other
related case processing documents.
AUTHORITY
FOR MAINTENANCE OF THE SYSTEM:
Management of the system is authorized
by Pub. L. 108-20, the Smallpox Emergency
Personnel Protection Act of 2003, enacted
April 30, 2003 (42 U.S.C. 239 et seq.).
PURPOSE(S): The purpose of the system
is to provide for benefits and other compensatory
payments to certain individuals who sustained
a covered injury as the direct result
of the administration of smallpox countermeasures,
and certain individuals who sustained
a covered injury as a direct result of
accidental vaccinia inoculation through
contact with the foregoing persons or
with individuals accidently inoculated
by them, during a specified time period.
ROUTINE
USES OF RECORDS MAINTAINED IN THE SYSTEM,
INCLUDING CATEGORIES OF USERS AND THE
PURPOSES OF SUCH USES:
1.
Disclosure may be made to a congressional
office from the record of a subject individual,
in response to an inquiry from the congressional
office made at the written request of
that individual or his/her representative.
2.
Disclosure may be made to Federal, State
or local Government entities or to private
entities for the purpose of their providing
information relevant to medical or legal
documentation required for determinations
of eligibility or payment, provided that
such disclosure is compatible with the
purpose for which the records were collected.
3.
Disclosure of records may be made to contractors
engaged by the Department who need access
to the records in order to assist the
Department, e.g., expert consultants providing
advice on requesters' eligibility for
benefits and/or compensation. All such
individuals shall be required to maintain
Privacy Act safeguards with respect to
such records and return all records to
HRSA.
4.
Disclosure of records may be made to individuals
and/or entities as necessary for the purposes
of obtaining financial advice and providing
benefits and other compensation to requestors
approved for payment under the Program.
All individuals and/or entities permitted
disclosure for this use shall be required
to maintain Privacy Act safeguards with
respect to such records and return all
records to HRSA.
5.
Disclosure of records may be made to a
Federal agency administering aspects of
the Program, as authorized by a Memorandum
of Agreement between the Secretary and
the head of the Federal agency, or to
another Federal agency assisting in the
accomplishment of a Departmental function
relating to the purposes of this system
of records, provided that such disclosure
is compatible with the purposes for which
the records are collected.
6.
Disclosure of records may be made in the
event of litigation where the defendant
is: (a) The Department, any component
of the Department, or any employee of
the Department in his or her official
capacity; (b) The United States where
the Department determines that the action,
if successful, is likely to affect directly
the operation of the Department or any
of its components; or (c) Any Department
employee in his or her individual capacity
where the Department of Justice (DoJ)
has agreed to represent such employee,
for example, in defending an action against
the Department in connection with such
individual, disclosure may be made to
DoJ to enable DoJ to present an effective
defense, provided that such disclosure
is compatible with the purpose for which
the records were collected.
7.
Disclosure may be made in the event that
a system of records maintained by this
agency to carry out its functions indicates
a violation or potential violation of
law, whether civil, criminal, or regulatory
in nature, and whether arising by general
statute or particular program statute,
regulation, rule, or order issued pursuant
thereto, the relevant records in the system
of records may be referred to the appropriate
agency, whether Federal, State or local,
charged with the responsibility of investigating
or prosecuting such violation, or charged
with enforcing or implementing the statute,
rule, regulation or order issued pursuant
thereto, provided that such disclosure
is compatible with the purpose for which
the records were collected.
8.
A record may be disclosed for a medical
research purpose, only when the Department
has determined:
(a) That the use or disclosure does not
violate legal or policy limitations under
which the record was provided, collected,
or obtained;
(b)
That the research purpose is consistent
with the purpose for which the Program
was formed;
(c)
That the proposed research is scientifically
sound in its methods and analyses and
is likely to answer the proposed research
question;
(d)
That the information sought is not available
from any other source; and
(e)
That the record made available for medical
research is redacted of all personal identifiers
regarding injured individuals, health
care practitioners and employers that
are not essential for the accomplishment
of the approved research purpose.
(f)
The recipient must:
(1)
Establish strict limitations acceptable
to the Department concerning the receipt
and use of any patient-identifiable data;
(2)
Establish reasonable administrative, technical,
and physical safeguards and/or protocols
acceptable to the Department to protect
the confidentiality of the data and to
prevent the unauthorized use or disclosure
of the record;
(3)
Remove or destroy the information that
identifies an individual at the earliest
time at which removal or destruction can
be accomplished consistent with the purpose
of the research project; and
(4)
Make no further use or disclosure of the
record except when required by law.
(a)
Further, the Department must secure and
approve a written statement attesting
to the recipient's understanding of, and
agreement to abide by, these conditions
of disclosure. Violation of these provisions
is subject to penalties set forth under
5 U.S.C. 552a(i)(3) and any other applicable
Federal law.
POLICIES
AND PRACTICES FOR STORING, RETRIEVING,
ACCESSING, RETAINING AND DISPOSING OF
RECORDS IN THE SYSTEM: STORAGE:
Records are maintained in file folders,
on computer hard drives and/or disk packs,
or in electronic media storage.
RETRIEVABILITY:
Retrievability is by name of the requester,
and by case number assigned based on the
order in which a request form is filed.
SAFEGUARDS:
1.
Assign Responsibility for Security: Responsibility
is assigned to a management official knowledgeable
in the nature of the information and process
supported by the Smallpox Vaccine Injury
Compensation Program (SVICP) request and
in the management, personnel, operational,
and technical controls used to protect
it.
2.
Perform Risk Assessment: A risk assessment
is to be conducted in conjunction with
the development of, and prior to the approval
of, the system design and will ensure
that vulnerabilities, risks, and other
security concerns are identified and addressed
in the system design and throughout the
life cycle of the project. This is consistent
with the HHS Automated Information Systems
Security Program Handbook (in particular
Chapters V and X).
3.
Develop SVICP Request Security Plan: Plan
for the adequate security of the SVICP
request, taking into account the security
of all systems in which the request will
operate. SVICP request security plans
shall address request rules, training
on use of the system, personnel security,
contingency planning, technical controls,
information sharing, and public access
controls.
4.
Review SVICP Request Controls: Perform
an independent review or audit of the
SVICP request security control in accordance
with applicable Federal requirements and/or
guidelines.
5.
Authorize Processing: Ensure that a management
official authorizes, in writing, confirmation
that the security plan as implemented
adequately secures the SVICP request.
The SVICP request must be authorized prior
to operating and reauthorized in accordance
with applicable Federal requirements and/or
guidelines.
6.
Implementation Guidelines: DHHS Chapter
45-13 and supplementary Chapter PHS.hf:
45-13 of the General Administration Manual;
the DHHS Automated Information Systems
Security Program Handbook; and Appendix
III to OMB Circular No. A-130; Appendix
I, ``Federal Agency Responsibilities for
Maintaining Records About Individuals.''
RETENTION
AND DISPOSAL: Records will be
retained and disposed of in accordance
with the Records Control Schedule of the
Health Resources and Services Administration.
SYSTEM MANAGER(S) AND ADDRESS: Director,
Office of Special Programs, Health Resources
and Services Administration, 5600 Fishers
Lane, Room 16C-17, Rockville, Maryland
20857, or the Director's designee.
NOTIFICATION
PROCEDURE: Requests must be made
to the System Manager. Requests by mail:
Requests for information and/or access
to records received by mail must contain
information providing the identity of
the writer, and a reasonable description
of the record desired, and whom it concerns.
Written requests must contain the name
and address of the requester, his/her
date of birth and his/her signature for
comparison purposes. Requests must be
notarized to verify the identity of the
requester, or the requester must certify
that (s)he is the individual who (s)he
claims to be and that (s)he understands
that to knowingly and willfully request
or acquire a record pertaining to another
individual under false pretenses is a
criminal offense under the Privacy Act
subject to a $5,000 fine (45 CFR 5b.5(b)(2)(ii)).
Requests in person or by telephone, electronic
mail or facsimile cannot be honored.
RECORD
ACCESS PROCEDURES: Record access
procedures are the same as notification
procedures. Requesters should also provide
a reasonable description of the contents
of the record being sought. A parent or
guardian who requests notification of,
or access to, a minor's/incompetent person's
medical record shall designate a family
physician or other health professional
(other than a family member) to whom the
record, if any, will be sent. The parent
or guardian must verify relationship to
the minor/ incompetent person as well
as his/her own identity. Records will
be mailed only to the requester=s address
that is on file, unless a different address
is demonstrated by official documentation.
CONTESTING
RECORDS PROCEDURES: To contest
a record in the system, contact the System
Manager at the address specified above
and reasonably identify the record, specify
the information being contested, and state
the corrective action sought and the reason(s)
for requesting the correction, along with
supporting documentation to show how the
record is inaccurate, incomplete, untimely,
or irrelevant.
RECORD
SOURCE CATEGORIES: Sources of
records include, but are not limited to,
requesters and/ or their representatives
under the Smallpox Vaccine Injury Compensation
Program, and any other sources of information
or documentation submitted by any other
person or entity for inclusion in a request
for the purpose of determining medical
or legal eligibility for, or amount of
benefits and/or compensation under, the
Program (e.g., Federal, State, or local
government or private health care entities
participating in the administration of
covered countermeasures under the Declaration).
SYSTEMS
EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT: None. |