Privacy Act Statement

PRE-DECISIONAL DRAFT – NOT FOR DISTRIBUTION

PRIVACY ACT STATEMENT (Living Donor Registration Form)

This Statement is provided pursuant to 5 U.S.C. § 552a(e)(3) (the Privacy Act): The Health Resources and Service Administration (HRSA) Scientific Registry of Transplant Recipients (SRTR) includes a registry of living organ donors. One objective of the registry is to collect longitudinal data on the health outcomes of living organ donors and a control group of potential donors who did not donate to better understand the long-term health effects of living organ donation. Transplant programs may provide information on candidates for living organ donation at the time of their evaluation, including social security number, contact information, demographic information, and health information. Data collection is voluntary: potential living donors are not required to provide any of the above information to become a living organ donor. Failing to provide this information will not adversely affect individuals in any way.

The solicitation of this information is authorized by section 371A of the National Organ Transplant Act, as amended (42 U.S.C. §273a and §274b).

In addition to other disclosures authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(1) and (2) and (b)(4) through (11), records about an individual may be disclosed from this system of records without the individual's prior written consent. These routine uses are listed below and outlined in HRSA System of Record Notice 09–15–0055 (see https://www.federalregister.gov/documents/2022/08/01/2022-16344/privacy-act-of-1974-system-of-records).

1. Departmental contractors and/or their subcontractors who have been engaged by the Department to assist in accomplishment of a Departmental function relating to the purposes for this system of records and who require access to the records to assist the Department.

2. HRSA, independently and through its contractor(s), may disclose records regarding potential living organ donors to members of the OPTN Board of Directors, OPTN Committees, and OPTN Review Boards. Such disclosures will be shared only on a need to know basis in order for members of the OPTN Board of Directors, Committees, and Review Boards to do the work required of them for the operation of the OPTN relating to the purposes of this system of records, including matching donor organs with recipients, monitoring compliance of member organizations with Federal laws and regulations and OPTN bylaws and policies and for risks to the health of patients or for the public safety and transplantation-related public health surveillance. Generally, such information is not shared in a patient-identified or identifiable manner.

3. HRSA, independently and through its contractor(s), may disclose records regarding potential living organ donors, to transplant centers, histocompatibility laboratories, organ procurement organizations, and other public health agencies such as Surveillance Epidemiology and End Results Program registries, State registries, and State health agencies, for purposes including: matching donor organs with recipients, monitoring compliance of member organizations with federal laws and regulations and OPTN requirements, reviewing and reporting periodically to the public on the status of organ donation and transplantation in the United States, and transplantation-related public health surveillance. These records consist of Social Security numbers, other patient identification information, and pertinent medical information.

4. HRSA may disclose records to the Department of Justice (DOJ) or to a court or other tribunal in litigation involving, as a defendant, (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to affect directly the operation of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the DOJ has agreed to represent such employee, for example, in defending a claim against the Public Health Service in connection with such individual, for the purpose of enabling DOJ to present an effective defense.

5. HRSA may disclose records to DOJ or to a court or other tribunal in the event of pending or potential litigation involving the Department or the United States as a plaintiff, intervenor, or amicus, or involving the contractor for the OPTN or the SRTR as a defendant in connection with its role as a contractor for the OPTN or the SRTR, or involving the OPTN.

6. HRSA may disclose records to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of that individual.

7. A record may be disclosed for a research purpose, when the Department, independently or through its contractor(s):

   1. has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;

   2. has determined that a bona fide research/analysis purpose exists;

   3. has required the data recipient to: (1) establish strict limitations concerning the receipt and use of patient-identified or center-identified data; (2) establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; (3) remove, destroy, or return the information that identifies the individual or center at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the data recipient has presented adequate justification of a research or health nature for retaining such information; and (4) make no further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law;

   4. has determined that other applicable safeguards or protocols will be followed; and

   5. has secured a written statement attesting to the data recipient's understanding of, and willingness to abide by, these provisions.

8. Records may be disclosed to appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records, (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the federal government, or national security, and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS' efforts to respond to the suspected or confirmed breach or to prevent, minimize or remedy such harm.

9. Records may be disclosed to another federal agency or federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the federal government, or national security, resulting from a suspected or confirmed breach.

10. A record may be disclosed to physicians or other health care professionals providing clinical treatment to such individuals, for clinical purposes, when the Department, independently or through its contractor(s):

    1. has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;

    2. has required the data recipient to: (1) establish strict limitations concerning the receipt and use of patient-identified or center-identified data; (2) establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; (3) remove, destroy, or return the information that identifies the individual or center at the earliest time at which removal or destruction can be accomplished consistent with the clinical purpose of the project, unless the data recipient has presented adequate justification of a research or health nature for retaining such information; (4) make no further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law; and (5) require any business associates of the data recipient to which the data recipient is authorized to disclose the record and does disclose the record, whether in original or derivative form, and to prohibit such a business associate from making any further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law; and

    3. has secured a written statement from the data recipient attesting to the data recipient's understanding of, and willingness to abide by these provisions.

For the purposes of this Privacy Act Statement, “potential living donor” covers donor candidates with information submitted in the Living Donor Registration Form, Reasons Did Not Donate Form, or Potential Living Donor Follow-Up Form; this includes those who both chose to donate or chose not to donate.

PRIVACY ACT STATEMENT (Reasons Did Not Donate Form)

This Statement is provided pursuant to 5 U.S.C. § 552a(e)(3) (the Privacy Act): The Health Resources and Service Administration (HRSA) Scientific Registry of Transplant Recipients (SRTR) includes a registry of living organ donors. One objective of the registry is to collect longitudinal data on the health outcomes of living organ donors and a control group of potential donors who did not donate to better understand the long-term health effects of living organ donation. This form reports whether the potential living organ donor chose to donate as well as reasons for non-donation. Data collection is voluntary: potential living donors are not required to provide any of the information to become a living organ donor. Failing to provide this information will not adversely affect individuals in any way. The solicitation of this information is authorized by section 371A of the National Organ Transplant Act, as amended (42 U.S.C. §273a and §274b).

In addition to other disclosures authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(1) and (2) and (b)(4) through (11), records about an individual may be disclosed from this system of records without the individual's prior written consent. These routine uses are listed below and outlined in HRSA System of Record Notice 09–15–0055 (see https://www.federalregister.gov/documents/2022/08/01/2022-16344/privacy-act-of-1974-system-of-records).

1. Departmental contractors and/or their subcontractors who have been engaged by the Department to assist in accomplishment of a Departmental function relating to the purposes for this system of records and who require access to the records to assist the Department.

2. HRSA, independently and through its contractor(s), may disclose records regarding potential living organ donors to members of the OPTN Board of Directors, OPTN Committees, and OPTN Review Boards. Such disclosures will be shared only on a need to know basis in order for members of the OPTN Board of Directors, Committees, and Review Boards to do the work required of them for the operation of the OPTN relating to the purposes of this system of records, including matching donor organs with recipients, monitoring compliance of member organizations with Federal laws and regulations and OPTN bylaws and policies and for risks to the health of patients or for the public safety and transplantation-related public health surveillance. Generally, such information is not shared in a patient-identified or identifiable manner.

3. HRSA, independently and through its contractor(s), may disclose records regarding potential living organ donors, to transplant centers, histocompatibility laboratories, organ procurement organizations, and other public health agencies such as Surveillance Epidemiology and End Results Program registries, State registries, and State health agencies, for purposes including: matching donor organs with recipients, monitoring compliance of member organizations with federal laws and regulations and OPTN requirements, reviewing and reporting periodically to the public on the status of organ donation and transplantation in the United States, and transplantation-related public health surveillance. These records consist of Social Security numbers, other patient identification information, and pertinent medical information.

4. HRSA may disclose records to the Department of Justice (DOJ) or to a court or other tribunal in litigation involving, as a defendant, (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to affect directly the operation of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the DOJ has agreed to represent such employee, for example, in defending a claim against the Public Health Service in connection with such individual, for the purpose of enabling DOJ to present an effective defense.

5. HRSA may disclose records to DOJ or to a court or other tribunal in the event of pending or potential litigation involving the Department or the United States as a plaintiff, intervenor, or amicus, or involving the contractor for the OPTN or the SRTR as a defendant in connection with its role as a contractor for the OPTN or the SRTR, or involving the OPTN.

6. HRSA may disclose records to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of that individual.

7. A record may be disclosed for a research purpose, when the Department, independently or through its contractor(s):

   1. has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;

   2. has determined that a bona fide research/analysis purpose exists;

   3. has required the data recipient to: (1) establish strict limitations concerning the receipt and use of patient-identified or center-identified data; (2) establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; (3) remove, destroy, or return the information that identifies the individual or center at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the data recipient has presented adequate justification of a research or health nature for retaining such information; and (4) make no further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law;

   4. has determined that other applicable safeguards or protocols will be followed; and

   5. has secured a written statement attesting to the data recipient's understanding of, and willingness to abide by, these provisions.

8. Records may be disclosed to appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records, (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the federal government, or national security, and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS' efforts to respond to the suspected or confirmed breach or to prevent, minimize or remedy such harm.

9. Records may be disclosed to another federal agency or federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the federal government, or national security, resulting from a suspected or confirmed breach.

10. A record may be disclosed to physicians or other health care professionals providing clinical treatment to such individuals, for clinical purposes, when the Department, independently or through its contractor(s):

    1. has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;

    2. has required the data recipient to: (1) establish strict limitations concerning the receipt and use of patient-identified or center-identified data; (2) establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; (3) remove, destroy, or return the information that identifies the individual or center at the earliest time at which removal or destruction can be accomplished consistent with the clinical purpose of the project, unless the data recipient has presented adequate justification of a research or health nature for retaining such information; (4) make no further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law; and (5) require any business associates of the data recipient to which the data recipient is authorized to disclose the record and does disclose the record, whether in original or derivative form, and to prohibit such a business associate from making any further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law; and

    3. has secured a written statement from the data recipient attesting to the data recipient's understanding of, and willingness to abide by these provisions.

For the purposes of this Privacy Act Statement, “potential living donor” covers donor candidates with information submitted in the Living Donor Registration Form, Reasons Did Not Donate Form, or Potential Living Donor Follow-Up Form; this includes those who both chose to donate or chose not to donate.

PRIVACY ACT STATEMENT (Potential Living Donor Follow-Up Form)

This Statement is provided pursuant to 5 U.S.C. § 552a(e)(3) (the Privacy Act): The Health Resources and Service Administration (HRSA) Scientific Registry of Transplant Recipients (SRTR) includes a registry of living organ donors. One objective of the registry is to collect longitudinal data on the health outcomes of living organ donors and a control group of potential donors who did not donate to better understand the long-term health effects of living organ donation. This form collects contact information as well as information outcomes from both living organ donors and candidates who did not go on to donate. Data collection is voluntary: potential living donors are not required to provide any of the information to become a living organ donor. Failing to provide this information will not adversely affect individuals in any way. The solicitation of this information is authorized by section 371A of the National Organ Transplant Act, as amended (42 U.S.C. §273a and §274b).

In addition to other disclosures authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(1) and (2) and (b)(4) through (11), records about an individual may be disclosed from this system of records without the individual's prior written consent. These routine uses are listed below and outlined in HRSA System of Record Notice 09–15–0055 (see https://www.federalregister.gov/documents/2022/08/01/2022-16344/privacy-act-of-1974-system-of-records).

1. Departmental contractors and/or their subcontractors who have been engaged by the Department to assist in accomplishment of a Departmental function relating to the purposes for this system of records and who require access to the records to assist the Department.

2. HRSA, independently and through its contractor(s), may disclose records regarding potential living organ donors to members of the OPTN Board of Directors, OPTN Committees, and OPTN Review Boards. Such disclosures will be shared only on a need to know basis in order for members of the OPTN Board of Directors, Committees, and Review Boards to do the work required of them for the operation of the OPTN relating to the purposes of this system of records, including matching donor organs with recipients, monitoring compliance of member organizations with Federal laws and regulations and OPTN bylaws and policies and for risks to the health of patients or for the public safety and transplantation-related public health surveillance. Generally, such information is not shared in a patient-identified or identifiable manner.

3. HRSA, independently and through its contractor(s), may disclose records regarding potential living organ donors, to transplant centers, histocompatibility laboratories, organ procurement organizations, and other public health agencies such as Surveillance Epidemiology and End Results Program registries, State registries, and State health agencies, for purposes including: matching donor organs with recipients, monitoring compliance of member organizations with federal laws and regulations and OPTN requirements, reviewing and reporting periodically to the public on the status of organ donation and transplantation in the United States, and transplantation-related public health surveillance. These records consist of Social Security numbers, other patient identification information, and pertinent medical information.

4. HRSA may disclose records to the Department of Justice (DOJ) or to a court or other tribunal in litigation involving, as a defendant, (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to affect directly the operation of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the DOJ has agreed to represent such employee, for example, in defending a claim against the Public Health Service in connection with such individual, for the purpose of enabling DOJ to present an effective defense.

5. HRSA may disclose records to DOJ or to a court or other tribunal in the event of pending or potential litigation involving the Department or the United States as a plaintiff, intervenor, or amicus, or involving the contractor for the OPTN or the SRTR as a defendant in connection with its role as a contractor for the OPTN or the SRTR, or involving the OPTN.

6. HRSA may disclose records to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of that individual.

7. A record may be disclosed for a research purpose, when the Department, independently or through its contractor(s):

   1. has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;

   2. has determined that a bona fide research/analysis purpose exists;

   3. has required the data recipient to: (1) establish strict limitations concerning the receipt and use of patient-identified or center-identified data; (2) establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; (3) remove, destroy, or return the information that identifies the individual or center at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the data recipient has presented adequate justification of a research or health nature for retaining such information; and (4) make no further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law;

   4. has determined that other applicable safeguards or protocols will be followed; and

   5. has secured a written statement attesting to the data recipient's understanding of, and willingness to abide by, these provisions.

8. Records may be disclosed to appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records, (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the federal government, or national security, and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS' efforts to respond to the suspected or confirmed breach or to prevent, minimize or remedy such harm.

9. Records may be disclosed to another federal agency or federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the federal government, or national security, resulting from a suspected or confirmed breach.

10. A record may be disclosed to physicians or other health care professionals providing clinical treatment to such individuals, for clinical purposes, when the Department, independently or through its contractor(s):

    1. has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;

    2. has required the data recipient to: (1) establish strict limitations concerning the receipt and use of patient-identified or center-identified data; (2) establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; (3) remove, destroy, or return the information that identifies the individual or center at the earliest time at which removal or destruction can be accomplished consistent with the clinical purpose of the project, unless the data recipient has presented adequate justification of a research or health nature for retaining such information; (4) make no further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law; and (5) require any business associates of the data recipient to which the data recipient is authorized to disclose the record and does disclose the record, whether in original or derivative form, and to prohibit such a business associate from making any further use or disclosure of the record except as authorized by HRSA or its contractor(s) or when required by law; and

    3. has secured a written statement from the data recipient attesting to the data recipient's understanding of, and willingness to abide by these provisions.

For the purposes of this Privacy Act Statement, “potential living donor” covers donor candidates with information submitted in the Living Donor Registration Form, Reasons Did Not Donate Form, or Potential Living Donor Follow-Up Form; this includes those who both chose to donate or chose not to donate.