Attachment A_Pla-Privacy Act

ATTACHMENT A
PRIVACY ACT

(~

Public Health Service

DEPARTMENT OF sHEALTH &.HUMAN SERVICES

,~;:~'z~

National Institutes of Health
Bethesda, Maryland 20892attachment A:

DATE:

June 23, 2009

TO:

Katharine Kripke, Ph.D.
Assistant Director, Vaccine Research Program
Division of AIDS, NIAID

FROM:

NIH Privacy Act Officer

SUBJECT: Applicability of the Privacy Act: Evaluation ofNIAID's HIV Vaccine Research
Education Initiative Survey Instrument and Focus Group
I have reviewed the NIAID submission to OMB entitled "Evaluation ofNIAID's HIV Vaccine
Research Education Initiative" involving the collection of data through focus groups and surveys.
I determined that the Privacy Act will apply to this data collection which includes the collection
of personal characteristics; name, age, gender, ethnicity, race, level of education, mailing address,
email address, telephone number and other personally identifiable information.
The information will be collected from focus group members and survey respondents to allow
survey related materials to be mailed to participants and for follow up purposes. Evaluation data
will be used to refine program strategies and messages so that the effectiveness of the program
can be improved. The identities of individuals will not be released, identifying information will
be stored separately from the survey responses, and all collected information will be analyzed in
the aggregate. Reports based on focus group data will involve information combined across all
respondents without identifying any specific organization or individual.
This data collection is covered by NIH Privacy Act Systems of Record 09-25-0156, "Records of
Participants in Programs and Respondents in Surveys Used to Evaluate Programs ofthe Public
Health Service, HHS/PHS/NIH/OD."
If you have any questions, please contact my office at (301) 496-2832.
/'

~~~.~

KarenM. Pla\
Enclosure

09-25-0156 SYSTEMS LISTING

Page 1 of7

09-25-0156 SYSTEMS LISTING
SYSTEM NAME:
Records of Participants in Programs and Respondents in Surveys Used to Evaluate Programs of the
Public Health Service, HHS/PHSINIH/OD.
SECURITY

CLASSIFICATION:

None.

SYSTEM LOCATION:
This system of records is an umbrella system comprising separate sets of records located either in the
organizations responsible for conducting evaluations or at the sites of programs or activities under
evaluation. Locations include Public Health Service (PHS) facilities, or facilities of contractors of the
PHS. Write to the appropriate System manager below for a list of current locations.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Individuals covered by this system are those who provide information or opinions that are useful in
evaluating programs or activities of the PHS other persons who have participated in or benefitted from
PHS programs or activities; or other persons included in evaluation studies for purposes of comparison.
Such individuals may include (1) participants in research studies; (2) applicants for and recipients of
grants, fellowships, traineeships or other awards; (3) employees, experts and consultants; (4) members
of advisory committees; (5) other researchers, health care professionals, or individuals who have or are
at risk of developing diseases or conditions studied by PHS; (6) persons who provide feedback about the
value or usefulness of information they receive about PHS programs, activities or research results; (7)
persons who have received Doctorate level degrees from U.S. institutions; (8) persons who have worked
or studied at U.S. institutions that receive( d) institutional support from PHS.
CA TEGORIES

OF RECORDS

IN THE SYSTEM:

This umbrella system of records covers a varying number of separate sets of records used in different
evaluation studies. The categories of records in each set depend on the type of program being evaluated
and the specific purpose of the evaluation. In general, the records contain two types of information: (1)
information identifying subject individuals, and (2) information which enables PHS to evaluate its
programs and services.
1. Identifying information usually consists of a name and address, but it might also include a patient
identification number, grant number, social security number, or other identifying number as
appropriate to the particular group included in an evaluation study.
2. Information used for evaluation varies according to the program evaluated. Categories of
evaluative information include personal data and medical data on participants in clinical and
research programs; personal data, publications, professional achievements and career history of
researchers; and opinions and other information received directly from individuals in evaluation
surveys and studies of PHS programs.
The system does not include any master list, index or other central means of identifYing all individuals
whose records are included in the various sets of records covered by the system.

http://oma.od.nih.gov/ms/privacy/pa-files/0156.htm

6/23/2009

Page 2 of7

09-25-0156 SYSTEMS LISTING
AUTHORITY

FOR MAINTENANCE

OF THE SYSTEM:

Authority for this system comes from the authorities regarding the establishment of the National
Institutes of Health, its general authority to conduct and fund research and to provide training assistance,
and its general authority to maintain records in connection with these and its other functions (42 U.S.c.
203,241,2891-1 and 44 U.S.c. 3101), and Section 301 and 493 of the Public Health Service Act.
PURPOSE(S):
This system supports evaluation of the policies, programs, organization, methods, materials, activities or
services used by PHS in fulfilling its legislated mandate for (1) conduct and support of biomedical
research into the causes, prevention and cure of diseases; (2) support for training of research
investigators; (3) communication of biomedical information.

This system is not used to make any determination affecting the rights, benefits or privileges of any
individual.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING
CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:
1. Disclosure may be made to HHS contractors and collaborating researchers, organizations, and
State and local officials for the purpose of conducting evaluation studies or collecting,
aggregating, processing or analyzing records used in evaluation studies. The recipients are
required to protect the confidentiality of such records.
2. Disclosure may be made to organizations deemed qualified by the Secretary to carry out quality
assessments, medical audits or utilization review.
3. Disclosure may be made to a congressional office from the record of an individual in response to
an inquiry from the congressional office made at the request of that individual.
4. The Department may disclose information from this system of records to the Department of
Justice, to court or other tribunal, or to another party before such tribunal, when a) HHS, or any
component thereof; or b) any HHS employee in his or her official capacity; or c) any HHS
employee in his or her individual capacity where the Department of Justice (or HHS, where it is
authorized to do so) has agreed to represent the employee; or d) the United States or any agency
thereof where HHS or any of its components, is a party to litigation or has an interest in such
litigation, and HHS determines that the use of such records by the Department of Justice, the
tribunal, or the other party is relevant and necessary to the litigation and would help in the
effective representation of the governmental party, provided, however, that in each case, HHS
determines that such disclosure is compatible with the purpose for which the records were
collected.
POLICIES AND PRACTICES FOR STORING, RETRIEVING,
AND DISPOSING OF RECORDS IN THE SYSTEM:

ACCESSING,

RETAINING,

STORAGE:
Data may be stored in file folders, bound notebooks, or computer-accessible media (e.g., magnetic tapes,
disks, cartridges, CD-ROMs, etc.).
RETRIEV ABILITY:

http://oma.od.nih.gov/ms/privacy/pa-files/0156.htm

6/23/2009

09-25-0156 SYSTEMS LISTING

Page 3 of7

Information is retrieved by name and/or participant identification number within each evaluation study.
There is no central collection of records in this system, and no central means of identifying individuals
whose records are included in the separate sets of records that are maintained for particular evaluation
studies.
SAFEGUARDS:
A variety of safeguards are implemented for the various sets of records in this system according to the
sensitivity of the data each set contains. Information already in the public domain, such as titles and
dates of publications, is not restricted. However, sensitive information, such as personal or medical
history or individually identified opinions, is protected according to its level of sensitivity. Records
derived from other systems of records will be safeguarded at a level at least as stringent as that required
in the original systems. Minimal safeguards for the protection of information which is not available to
the general public include the following:
1. Authorized Users: Regular access to information in a given set of records is limited to PHS or to
contractor employees who are conducting, reviewing or contributing to a specific evaluation
study. Other access is granted only on a case-by-case basis, consistent with the restrictions
required by the Privacy Act (e.g., when disclosure is required by the Freedom of Information Act),
as authorized by the system manager or designated responsible official.
2. Physical Safeguards: Records are stored in closed or locked containers, in areas which are not
accessible to unauthorized users, and in facilities which are locked when not in use. Records
collected in each evaluation project are maintained separately from those of other projects.
Sensitive records are not left exposed to unauthorized persons at any time. Sensitive data in
machine-readable form may be encrypted.
3. Procedural Safeguards: Access to records is controlled by responsible employees and is granted
only to authorized individuals whose identities are properly verified. Data stored in mainframe
computers is accessed only through the use of keywords known only to authorized personnel.
When personal computers are used, magnetic media (e.g. diskettes, CD-ROMs, etc.) are protected
as under Physical Safeguards. When data is stored within a personal computer (i.e., on a "hard
disk"), the machine itself is treated as though it were a record, or records, under Physical
Safeguards. Contracts for operation of this system of records require protection of the records in
accordance with these safeguards; PHS project and contracting officers monitor contractor
compliance.
These practices are in compliance with the standards of Chapter 45-13 of the HHS General
Administration Manual, "Safeguarding Records Contained in Systems of Records," supplementary
Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.

RETENTION AND DISPOSAL:
_Records are retained and disposed of under the authority of the NIH Records Control Schedule
contained in NIH Manual Chapter J 743_,Appendix 1 - "Keeping and Destroying Records" (HHS
Records Management Manual, Appendix B-361), item 1100-C-2. Refer to the NIH Manual Chapter for
specific disposition instructions.
SYSTEM MANAGER(S) AND ADDRESS(ES):
See Appendix I.

http://oma.od.nih.gov/ms/privacy/pa-files/0156.htm

6/23/2009

09-25-0156 SYSTEMS LISTING

Page 4 of7

Policy coordination for this system is provided by: Acting Director, Office of Reports and Analysis,
Office of Extramural Research, Office of the Director (aD), Building 1, Room 252, 1 Center Drive,
Bethesda, MD 20892.
NOTIFICATION

PROCEDURE:

To determine if a record exists, write to the official of the organization responsible for the evaluation, as
listed in Appendix II. If you are not certain which component of PHS was responsible for the evaluation
study, or if you believe there are records about you in several components of PHS, write to: NIH Privacy
Act Officer, 6011 Executive Boulevard, Room 601, Bethesda, MD 20892-7669.

Requesters must provide the following information:
1. Full name, and name(s) used while studying or employed;
2. Name and location of the evaluation study or other PHS program in which the requester
participated or the institution at which the requester was a student or employee, if applicable;
3. Approximate dates of participation, matriculation or employment, if applicable.
The requester must also verify his or her identity by providing either a notarization of the request or a
written certification that the requester is who he or she claims to be and understands that the knowing
and willful request for acquisition of a record pertaining to an individual under false pretenses is a
criminal offense under the Act, subject to a five thousand dollar fine.
An individual who requests notification of or access to a medical record shall, at the time the request is
made, designate in writing, a responsible representative, who may be a physician, other health
professional, or other responsible individual, who will be willing to review the record and inform the
subject individual of its contents at the representative's discretion.
A parent or guardian who requests notification of, or access to, a child's or incompetent person's medical
record shall designate a family physician or other health professional (other than a family member) to
whom the record, if any, will be sent. The parent or guardian must verify relationship to the child or
incompetent person as well as his or her own identity.
RECORD ACCESS PROCEDURE:
Same as Notification Procedures. Requesters should also reasonably specify the record contents being
sought. Individuals may also request listings of accountable disclosures that have been made of their
records, if any.
CONTESTING RECORD PROCEDURE:
Write to the official specified under Notification Procedures above, and reasonably identify the record
and specify the information being contested, the corrective action sought, and your reasons for
requesting the correction, along with supporting information to show how the record is inaccurate,
incomplete, untimely or irrelevant. The right to contest records is limited to information which is
incomplete, irrelevant, incorrect, or untimely (obsolete).
RECORD SOURCE CATEGORIES:

Information contained in these records is obtained directly from individual participants; from systems of

http://oma.od.nih.gov/ms/privacy/pa-files/0156.htm

6/23/2009

Page 5 of7

09-25-0156 SYSTEMS LISTING

records 09-25-0036, "Extramural Awards and Chartered Advisory Committees (IMPAC 2), Contract
Information (DCIS), and Cooperative Agreement Information, HHSINIH;" NSF-6, "Doctorate Record
File," NSF-43, "Doctorate Work History File" (previously entitled NSF-43, "Roster and Survey of
Doctorate Holders in The United States" and other records maintained by the operating programs of
NIH; the National Academy of Sciences, professional associations such as the AAMC and ADA, and
other contractors; grantees or collaborating researchers; or publicly available sources such as
bibliographies.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:
None.
Appendix I: System Managers
Office of Reports and Analysis, Office of Extramural Research, Office of the Director (OD), Rockledge
II, Room 6212,6701 Rockledge Drive, Bethesda, MD 20892.
Director, Office of Human Resource Management, Office of the Director (OD), Building 1, Room
B160, 1 Center Drive, Bethesda, MD 20892.
Program Analyst, Office of Science and Technology, PSR, National Heart, Lung and Blood Institute
(NHLBI), Building 31, Room 5A03, 31 Center Drive, Bethesda, MD 20892-2482.
Associate Director for Health Information Programs Development, National Library of Medicine
(NLM), Building 38, Room 2S20, 8600 Rockville Pike, Bethesda, MD 20894.

Associate Director for Science Policy and Legislation, National Eye Institute (NEI), Building 31, Room
6A25, 31 Center Drive, Bethesda, MD 20892-2510.
Public Health Educator, Office of Cancer Communications, National Cancer Institute (NCI), Building
31, Room 10A03, 31 Center Drive, Bethesda, MD 20892.
Chief, Office of Planning, Analysis, National Institute on Aging (NIA), Building 31, Room 5C05, 31
Center Drive, Bethesda, MD 20892.

Associate Director for Science Policy, Analysis, and Communication, National Institute of Child Health
and Human Development (NICHD), Building 31, Room 2A18, 31 Center Drive, Bethesda, MD 20892.
Chief, Science Policy and Planning Branch, National Institute on Deafness and Other Communication
Disorders (NIDCD), Building 31, Room 3C27, 31 Center Drive, Bethesda, MD 20892-2320.
Evaluation Officer, Office of Science Policy and Analysis, National Institute of Dental and Craniofacial
Research (NIDCR), Building 31, Room 5B55, 31 Center Drive, Bethesda, MD 20892-2190.
Program Analyst, Office of Program Planning and Evaluation, National Institute of Environmental
Health Sciences (NIEHS), P.O. Box 12233, Research Triangle Park, NC 27709.
Chief, Office of Program Analysis and Evaluation, National Institute of General Medical Sciences
(NIGMS), Natcher Building, Room 2AS55F, 45 Center Drive, Bethesda, MD 20892.

http://oma.od.nih.gov/ms/privacy/pa-

files/O156.htrn

612312009'

09-25-0156 SYSTEMS LISTING

Page 6 of7

Director, Division of Advanced Studies and Policy Analyses, Fogarty International Center (FIC),
Building 16, Room 202, 16 Center Drive, Bethesda, MD 20892-6705.
InfOrIhationOfficer, Center for Scientific Review (CSR), Rockledge II, Room 6160, 6701 Rockledge
Drive, Bethesda, MD 20892.
Director, Office of Science Policy and Public Liaison, National Center for Research Resources (NCRR),
Rockledge II, Room 5046, 6701 Rockledge Drive, Bethesda, MD 20892.
Chief, Office of Planning, Analysis and Evaluation, National Institute of Nursing Research (NINR),
Building 31, Room 5B09, 31 Center Drive, Bethesda, MD 20892.
Policy Analyst, Division of Policy and Education, Office of Research Integrity, U.S. Public Health
Service, 5515 Security Lane, Suite 700, Rockwall II Building, Rockville, MD 20852.
Contract Officer, National Institute of Mental Health (NIMH), 6001 Executive Boulevard, Room 6107,
Bethesda, MD 20892.

Program Evaluation Team, Office of Scientific Affairs, National Institute on Alcohol Abuse and
Alcoholism (NIAAA), Wilko Building, Room 409,6000 Executive Boulevard, Bethesda, MD 208927003.
Evaluation Officer, Office of Science Policy and Operations, National Center for Complementary and
Alternative Medicine (NCCAM), Democracy Plaza II, Room 401,6707 Democracy Boulevard,
Bethesda, MD 20892-5475.
Privacy Act Coordinator, National Institute of Biomedical Imaging and Bioengineering (NIBIB),
Building 31, Room IB37, 31 Center Drive, Bethesda, MD 20892-2077.

Privacy Act Coordinator, National Center on Minority Health and Health Disparities (NCMHD),
Democracy Plaza II, Room 800, 6707Democracy Boulevard, Bethesda, MD 20892-5465.
Appendix II: Notification

and Access Officials

Acting Director, Office of Reports and Analysis, Office of Extramural Research, Office of the Director
(OD), Building 1, Room 252, 1 Center Drive, Bethesda, MD 20892.
Director, Office of Human Resources Management, Office of the Director (OD), Building 1, Room
B160, 1 Center Drive, Bethesda, MD 20892.
Privacy Act Coordinator, National Heart, Lung, and Blood Institute (NHLBI), Building 31, Room 5A33,
31 Center Drive, Bethesda, MD 20892.
Assistant Director for Planning and Evaluation, National Library of Medicine (NLM), Building 38,
Room 2S 18, 8600 Rockville Pike, Bethesda, MD 20894.
Program Evaluation Team, Office of Scientific Affairs, National Institute on Alcohol Abuse and
Alcoholism (NIAAA), Willco Building, Room 409,6000 Executive Boulevard, Bethesda, MD 208927003.

http://oma.od.nih.gov/ms/privacy/pa-files/0156.htm

6/23/2009

Page 7 of7

09-25-0156 SYSTEMS LISTING

Contract Officer, National Institute of Mental Health (NIMH), 6001 Executive Boulevard, Room 6107,
Bethesda, MD 20892.

Executive Officer, National Eye Institute (NEI), Building 31, Room 6A03, 31 Center Drive, Bethesda,
MD 20892-2510.
Director, Division of Advanced Studies and Policy Analysis, Fogarty International Center (FIC),
Building 16, Room 202, 16 Center Drive, Bethesda, MD 20892-6705.
Information Officer, Center for Scientific Review (CSR), Rockledge II, Room 6160, 6701 Rockledge
Drive, Bethesda, MD 20892.

Director, Office of Science Policy and Public Liaison, National Center for Research Resources (NCRR),
Rockledge II, Room 5046, 6701 Rockledge Drive, Bethesda, MD 20892.
Privacy Act Coordinator, National Cancer Institute (NCI), Building 31, Room 10A30, 31 Center Drive,
Bethesda, MD 20892.

....

http://oma.od.nih.gov/ms/privacy/pa-files/0156.htm

6/23/2009