Draft SORN, "“Millennium Cohort Study, N06500-1"

BILLING CODE: 5001-06

DEPARTMENT OF DEFENSE

Department of the Navy

[Docket ID: DoD-2023-Department of Navy]

Privacy Act of 1974; System of Records

AGENCY: Department of Navy, DoD

ACTION: Notice of a modified system of records.

SUMMARY: In accordance with the Privacy Act of 1974, the Department of Defense (DoD) is modifying and reissuing a current system of records titled, “Millennium Cohort Study, N06500-1. This system of records was originally established by the Department of Navy to collect and maintain records on service members and veterans who have, or have not, deployed overseas so that various longitudinal health and research studies may be conducted over a 67-year period. This system of records notice (SORN) is being updated to change the system name, expand the “Purpose” section, and to incorporate the DoD standard routine uses and support additional information sharing of these records outside of the DoD. The DoD is also modifying various other sections within the SORN to improve clarity or update information that has changed.

DATES: This system of records is effective upon publication; however, comments on the Routine Uses will be accepted on or before [INSERT DATE 30 DAYS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER]. The Routine Uses are effective at the close of the comment period.

ADDRESSES: You may submit comments, identified by docket number and title, by either of the following methods:

* Federal Rulemaking Portal: https://www.regulations.gov. Follow the instructions for submitting comments.

* Mail: Department of Defense, Office of the Assistant to the Secretary of Defense for Privacy, Civil Liberties, and Transparency, Regulatory Directorate, 4800 Mark Center Drive, Attn: Mailbox 24, Suite 08D09, Alexandria, VA 22350-1700.

Instructions: All submissions received must include the agency name and docket number for this Federal Register document. The general policy for comments and other submissions from members of the public is to make these submissions available for public viewing on the Internet at https://www.regulations.gov as they are received without change, including any personal identifiers or contact information.

FOR FURTHER INFORMATION CONTACT: Mr. Gregory M. Cason, Director (Acting), Department of the Navy FOIA/Privacy Act Program Office, 2000 Navy Pentagon Washington DC 20350-2000, (202) 685-6533.

SUPPLEMENTARY INFORMATION:

I. Background

The Millennium Cohort Program (MCP) is a DoD program of research supported by the Defense Health Agency, Department of Veterans Affairs, and Military Community and Family Policy including three major research efforts: The Millennium Cohort Study (MCS), Family Cohort Study (FCS); and Millennium Cohort Study of Adolescent Resilience (SOAR). The overarching goal of the MCP is to evaluate the impact of military service, including deployments and other occupational exposures, on the long-term health and wellbeing of service members, veterans, and their families. MCS was initiated in 2001 prior to the events of 9/11 and the subsequent large-scale military operations, including Operation Enduring Freedom and Operation Iraqi Freedom. Participants of MCS are enrolled while serving in the military and then surveyed every 3 to 5 years over their life course (i.e., through 2068), both during service and after military separation. Since the first panel of service members was enrolled in 2001, additional panels were enrolled in 2004, 2007, 2011, and 2020. There are over 260,000 study volunteers participating in these five panels, representing all service branches and components, making it the largest and longest ongoing prospective cohort study of U.S. military personnel. Over the past 20 years, the study has conducted extensive longitudinal research evaluating the effects of deployments and other aspects of military service on service members and their families.

The FCS was launched in 2011 as a component of the Millennium Cohort program of research and it is currently the only ongoing DoD study of the health and relationship well-being of military families. FCS comprises data from both service personnel and their married partners. Participants volunteer to complete a self-report survey every three years for up to 21 years. Because the influence of military life can be long-lasting, spouses are followed even if their service member partner separates from service or their marital relationship changes. In 2011, FCS enrolled one panel of almost 10,000 spouses, and in 2020 enrolled another panel of over 18,000 spouses. Analyzing dyadic data from both spouses and service members, FCS seeks to understand the impact of military life on the health and well-being of military family members, as well as their relationship adjustment. The study further evaluates the role of family life on service members’ readiness, retention, recovery, and resilience.

SOAR is a research study of military-connected adolescents and their parents utilizing online survey data merged with medical data and other military and civilian records for those participants who volunteer to join the study. The study enrolls military-connected adolescents (11–17 years old) of parents already enrolled in the MCS of service members and veterans, representing all armed service branches and active duty, Reserve, and National Guard components. This study will assist the Department of Defense in outlining future strategic goals for programs and services to address the needs of military-connected adolescents and their families, as well as provide data to better understand the health and well-being of the next generation of potential service members.

Subject to public comment, the DoD proposes to update this SORN to change the system name from “Millennium Cohort Study” to “Millennium Cohort Program Records,” expand the Purpose section to clarify the scope of the collection, and to incorporate the DoD standard routine uses (routine uses A through I) and to change an existing routine use disclosure outside DoD related to the purpose of this system of records. Additionally, the following sections of this SORN are modified as follows: (1) to the System Section to reflect the locations in which the system may reside; (2) to the System Manager section to update the contact information; (3) to the Authority for Maintenance section to update citations and add additional authorities; (4) to the Categories of Individuals section to expand the individuals covered; (5) to the Categories of Records section to clarify how the records relate to the revised Category of Individuals; (6) to the Record Sources section to add and update sources; (7) to the Record Retrieval section to clarify means of storage, as well as identifying personal identifiers that may be used for retrieval purposes; (8) to the Record Access Procedures section to reflect the need for individuals to identify the appropriate DoD office or component to which their request should be directed; (9) to the Contesting Records Procedures section to update the appropriate citation for contesting records; and (10) to the Notification Procedures section to update the appropriate citation for notification.

DoD SORNs have been published in the Federal Register and are available from the address in FOR FURTHER INFORMATION CONTACT or at the Office of the Assistant to the Secretary for Defense for Privacy, Civil Liberties, and Transparency (OATSD(PCLT)) website at https://dpcld.defense.gov/privacy.

II. Privacy Act

Under the Privacy Act, a “system of records” is a group of records under the control of an agency from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular assigned to the individual. In the Privacy Act, an individual is defined as a U.S. citizen or lawful permanent resident.

In accordance with 5 U.S.C. 552a(r) and Office of Management and Budget (OMB) Circular No. A-108, OATSD(PCLT) has provided a report of this system of records to the OMB and to Congress.

Dated:

Aaron T. Siegel,

Alternate OSD Federal Register

Liaison Officer, Department of Defense.

System name and number: Millennium Cohort Program Records, N06500-1

SECURITY CLASSIFICATION: Unclassified.

SYSTEM LOCATION: Naval Health Research Center, Deployment Health Research Department, 140 Sylvester Road, San Diego, CA 92106-3521.

SYSTEM MANAGER(S): The system managers for this system are as follows:

A. Policy Official: Commanding Officer, Naval Health Research Center, 140 Sylvester Rd, San Diego, CA 92106-3521; (619) 553-8428.

B. Record Holder: Principal Investigator(s), The Millennium Cohort Program, Naval Health Research Center, Deployment Health Research Department, 140 Sylvester Rd, San Diego, CA 92106-3521, [email protected], DSN 553-7465.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 10 U.S.C. 113, Secretary of Defense; 10 U.S.C. 136, Under Secretary of Defense for Personnel and Readiness; 10 U.S.C. 1782, Surveys of Military Families; 10 U.S.C. 2358, Research and Development Projects; Public Law 105-261, Strom Thurmond National Defense Authorization Act for Fiscal Year 1999, Section 743; and E.O. 9397 (SSN), as amended.

Purpose(s) of the system:

1. To develop a long-term profile of health change among current and former members of the Armed Forces, especially in relation to individual deployment experience.

2. To better define the nature of risk factors for the development of post-war illness among U.S. military personnel.

3. To assess the impact of military service, including deployments, on the health and well-being of the family.

4. To examine the relationships between the family members and the Service member.

5. To assess the associations of military service on the health and well-being of military families (including children and non-spousal partners), and to compare the adjusted probabilities of new onset diseases and conditions among military spouses.

6. To assess the impact of military-connected academic achievement and educational/career aspirations as major outcomes among adolescent children of Service members and veterans.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM: The initial MCS study population is a probability-based, cross-sectional sample of U.S. Armed Forces personnel (active-duty Army, Navy, Marine Corps, Coast Guard, Air Force, and Reserve/National Guard, and veterans), as of October 2000, that will be followed prospectively by postal or web surveys every 3 years over at least a 67-year period.  This initial sample comprised of 77,047 service members including individuals who have been deployed to Southwest Asia, Bosnia, or Kosovo since August 1997.  In October 2004 and October 2007, samples of 31,110 and 43,440, respectively, of new Armed Forces personnel were added to the Cohort.  In May 2011, a sample of 50,052 new Armed Forces personnel was added to the MCS.  These individuals will be followed until at least the year 2068, even if they retire or separate.  The FCS will also evaluate families of service members where spouses complete a survey about themselves and their children.  In May 2011, a sample of 9,872 spouses of Armed Forces personnel were added to the FCS and will be followed until at least 2032. In August 2021, 58,609 new Armed Forces personnel were added to the MCS and 18,223 spouses of Armed Forces personnel were added to the FCS. SOAR enrollment is ongoing, but approximately 5,000 adolescents and 9,000 parents are expected to enroll. The MCS and FCS expect to enroll new participants into their respective studies approximately every six (6) years.

CATEGORIES OF RECORDS IN THE SYSTEM:

For each Cohort study group listed, the system of records is likely to include personal information such as, name, Social Security number (SSN), DoD ID number, date of birth, gender, race and ethnic, a randomly generated subject identification number (SID).

Millennium Cohort Study: Includes current service members and veterans.

Military information such as date and type of enlistment/appointment; employment status (i.e., rank/specific job code/branch of service); duty position; organization and previous assignments; deployment dates and locations; number of deployments; dates in and out of theater; separation date and reason; Unit Identification Code (UIC); military pay grade; military rank; length of military service; active-duty status and status of duty (civilian, enlisted, officer, etc.); current military status; service branch; home of record; Overseas Housing Allowance (OHA); Family Separation for Housing-Overseas Housing Allowance (FSH-OHA); decompress date and location; civilian occupational categories; military occupational categories; occupational category for enlisted and officer; imminent danger pay; hardship duty pay; or combat zone tax exclusion benefits; military experiences and exposures; feelings about military service.

Information concerning mental, emotional, and physical health issues and behaviors such as: smoking and drinking behaviors; utilization of Defense Health Agency (DHA) and the Department of Veterans Affairs (DVA) healthcare (e.g., in-patient, out-patient, pharmacy, test results, vaccinations, diagnoses, and procedures); receipt of DVA benefits; results from laboratory assays and genetic screenings and tests; drug testing results; physical functioning ability; information specific to women’s health; mental health diagnoses or issues; and reports of physical or sexual abuse.

Educational and training information for service members.

Law enforcement information may include illicit substance use; incarcerations; firearms possession and storage.

Employment and economic information for service members such as government benefits (e.g., unemployment, food stamps, disability) and income.

Tracking information such as mortality data, postal and email addresses.

Family Cohort Study: Includes service members/veterans, spouses, and child dependents.

Military information for service member and spouse such as career experiences, assessments, trainings, pay trajectory information, deployment history documentation, benefits and program utilization, residential history, and dependent information.

Healthcare, counseling, and education information for service members/veterans, spouses, and child dependents such as utilization of the Defense Health Agency and Department of Veterans Affairs (DVA) healthcare (e.g., in-patient, out-patient, pharmacy, test results, vaccinations, diagnoses, and procedures) and services.

Non-medical assessments, treatment programs, and service use information for service members/veterans, spouses, and child dependents related to issues such as military transitions, family needs, substance use, suicide prevention, sexual assault, and family violence.

Educational and training information for service members/veterans, spouses, and child dependents such as degree seeking, certifications, scholarships, and other specialty programs.

Law Enforcement information for service members/veterans and spouses to include both military and non-military reports and investigations.

Employment and economic information for service members/veterans and spouses such as government benefits (e.g., unemployment, food stamps, disability) and income.

Tracking information for service members/veterans and spouses such as mortality data, postal and email addresses.

Millennium Cohort Study of Adolescent Resilience: Includes service members/veterans, parents of focal child, and focal children.

Military information for service members such as career experiences, assessments, trainings, pay trajectory information, deployment history documentation, benefits and program utilization, residential history, and dependent information.

Healthcare, counseling, and education information for service members/veterans, parents of focal child, and focal children such as utilization of the Defense Health Agency and Department of Veterans Affairs (DVA) healthcare (e.g., in-patient, out-patient, pharmacy, test results, vaccinations, diagnoses, and procedures) and services.

Non-medical assessments, treatment programs, and service use information for service members/veterans, parents of focal child, and focal children related to issues such as military transitions, family needs, substance use, suicide prevention, sexual assault, and family violence.

Educational and training information for service members/veterans, parents of focal child, and focal children such as degree seeking, certifications, scholarships, and other specialty programs.

Law Enforcement information for service members/veterans, parents of focal child, and focal children to include both military and non-military reports and investigations.

Employment and economic information for service members/veterans, parents of focal child, and focal children such as government benefits (e.g., unemployment, food stamps, disability) and income.

Tracking information for service members/veterans, parents of focal child, and focal children such as mortality data, postal and email addresses.

RECORD SOURCE CATEGORIES: Records and information stored in this system of records are obtained from:

A. The individual, surveys, interviews, educational and financial certificates records, military transition and veteran records; substance abuse and law enforcement systems;

B. Health assessments, patient management systems (including lab, pharmacy, and medical records, and serum and biospecimens); mortality, suicide, and state and territorial cancer registries and records such as the National Death Index (NDI) and Virtual Pooled Registry;

C. DHA and DoD databases, such as: Corporate Executive Information Systems; Defense Manpower Data Center (DMDC); Defense Enrollment Eligibility Reporting System (DEERS); Civilian Health and Medical Program of the Uniformed Services; Army Medical Surveillance Activity (AMSA); Joint Theater Trauma Registry (JTTR); Individual Longitudinal Exposure Record (ILER); Defense Occupational and Environmental Health Readiness System (DOEHRS), or other DHA and DoD systems documenting information within the categories of records to be included in this system as described above;

D. Other Federal agencies such as, but not limited to: the Department of Veterans Affairs, United States Census Bureau; the United States Department of Agriculture; the Department of Labor; the Department of Education; and the National Institute for Occupational Safety and Health (NIOSH);

E. State, non-governmental, and commercially available records or databases, such as TransUnion and LexisNexis.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES: In addition to those disclosures generally permitted under 5 U.S.C.552a(b) of the Privacy Act of 1974, as amended, all or a portion of the records or information contained herein may specifically be disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

A. To contractors, grantees, experts, consultants, students, and others performing or working on a contract, service, grant, cooperative agreement, or other assignment for the Federal Government when necessary to accomplish an agency function related to this system of records.

B. To the appropriate Federal, State, local, territorial, tribal, foreign, or international law enforcement authority or other appropriate entity where a record, either alone or in conjunction with other information, indicates a violation or potential violation of law, whether criminal, civil, or regulatory in nature.

C. To any component of the Department of Justice for the purpose of representing the DoD, or its components, officers, employees, or members in pending or potential litigation to which the record is pertinent.

D. In an appropriate proceeding before a court, grand jury, or administrative or adjudicative body or official, when the DoD or other Agency representing the DoD determines that the records are relevant and necessary to the proceeding; or in an appropriate proceeding before an administrative or adjudicative body when the adjudicator determines the records to be relevant to the proceeding.

E. To the National Archives and Records Administration for the purpose of records management inspections conducted under the authority of 44 U.S.C. 2904 and 2906.

F. To a Member of Congress or staff acting upon the Member’s behalf when the Member or staff requests the information on behalf of, and at the request of, the individual who is the subject of the record.

G. To appropriate agencies, entities, and persons when (1) the DoD suspects or confirms a breach of the system of records; (2) the DoD determines as a result of the suspected or confirmed breach there is a risk of harm to individuals, the DoD (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the DoD’s efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

H. To another Federal agency or Federal entity, when the DoD determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

I. To another Federal, State or local agency for the purpose of comparing to the agency’s system of records or to non-Federal records, in coordination with an Office of Inspector General in conducting an audit, investigation, inspection, evaluation, or some other review as authorized by the Inspector General Act of 1987, as amended.

J. To such recipients under such circumstances and procedures as are mandated by Federal statute or treaty.

K. To the DVA, the Department of Health and Human Services (HHS), and the Centers for Disease Control and Prevention (CDC), for use in scientific, medical and other analysis regarding health outcomes research associated with military service.

NOTE 1: All disclosures to the DVA and HHS/CDC must have prior approval of the Naval Health Research Center (NHRC) Institutional Review Board (IRB) and a Memorandum of Understanding must be entered into to ensure the rights and obligations of the signatories are clear. Access to data 1) is permitted on a need-to-know basis only; 2) must adhere to the rule of minimization in that only information necessary to accomplish the purpose for which the disclosure is being made is releasable; 3) must adhere to the privacy and security requirements applicable to protected health information under 45 CFR Parts 160 and 164, Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security and Breach Notification Rules, 4) must adhere to privacy requirements applicable to personally identifiable information under the Privacy Act of 1974 in accordance with DoD guidance; and 5) must follow strict guidelines established in the Memorandum of Understanding.

NOTE 2: This system of records contains protected health information (PHI). The DoD’s implementation of HIPAA Rule compliance is prescribed in DoD Manual 6025.18, “Implementation of the Health Information Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs.” Additional requirements on the use and disclosure of PHI are detailed in the Manual.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS: Records may be stored electronically or on paper in secure facilities in a locked drawer behind a locked door.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS: Records may be retrieved primarily by individual’s name, SSN, DoD ID number, and/ or the individual’s subject identification number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Electronic records and signed original paper consent forms are permanent records and are transferred to the nearest Federal Records Center (FRC) when 5 years old and then transferred to National Archives and Records Administration (NARA) when 20 years old. Temporary supporting records (to include paper records) are transferred to the nearest FRC when 5 years old and destroyed when 10 years old. Temporary non-record files (to include paper records or to include paper copies of the surveys) will be destroyed when 5 years old or on completion/termination of project.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS: The PII collected for this project consists of the minimum necessary to accomplish the study goals. Strict procedures are in place to minimize loss of confidentiality. Although personal identifiers are retained to ensure proper linkage, they are protected in such a way that no individual is identified in any report. Records and computer files are maintained securely in accordance with current DoD regulations. In addition, a Data Management System (DMS) has been put in place for the MCP staff who utilize data for research and surveillance purposes and applies to all data that is defined as PII and PHI as well as those that are not defined as such.

The main objective of the DMS is to ensure confidentiality by restricting and monitoring access to data. All data utilized by MCP is and will be maintained and managed within the DMS.

As a DoD organization, NHRC as the DMS owner and MCP must have appropriate administrative, technical, and physical safeguards to protect the privacy of PII/PHI and to mitigate any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications, or other requirements. MCP must design policies and procedures for its data management process, taking into account the size of and the types of activities that relate to PII/PHI undertaken by the department, to ensure compliance, and implement updates after a change to a DHA policy occurs. MCP must maintain procedures for its data management process in written or electronic form (DoDM 6025.18 § 7.3.). Procedures of the DMS are maintained in this written guide and a temporary tracking process utilizing fillable PDF forms, until the electronic database version of the DMS has been finalized.

Per DoD guidance (DODM 6025.18 § 5.5.), written accounting of PII/PHI disclosures and access to the data must include:

a) The date which data is accessed

b) Name of the person or entity who accesses the data

c) Name of the protocol or other research activity

d) Description of the research protocol, including the purpose of the research and the criteria for selecting particular records

e) Brief description of the data provided, including the variables and time period covered

f) Brief statement of purpose for needing to access the data

g) If data was accessed multiple times, provide accountability for each time the data was accessed

All MCP data, including but not limited to survey data, data extracted or received from DHA and DoD sources, and data from non-DHA and DoD agencies or institutions, are stored and analyzed on access-controlled folders on a secure NHRC network drive only accessible by approved MCP staff. Until the electronic database system is fully operational, a data request tracking form (DRT) will be used to capture the required accounting information outlined above. Once the DRT is approved by the Department Head and reviewed by the NHRC Privacy Officer or Deputy Privacy Officer, a folder will be created on the secure MCP network space for each data request. The data manager will extract data as outlined in the DRT and upload into the data folder to be accessed by the research team listed on the DRT. All data analyses and outputs shall be captured in the designated data folder to maintain a record from data request to final data output.

As indicated, access to areas where records are maintained is limited to authorized personnel. Access control devices protect areas during working hours and intrusion alarm devices during non-duty hours. Access to data is provided on a need-to-know basis only. Paper records are kept in locked file cabinets. Data is stored on a secure server. All supplied sensitive information is transmitted via encrypted Secure Sockets Layer (SSL) technology. Randomly generated subject identification numbers are used as the primary identifier instead of the individual’s names. Electronic records can only be accessed by authorized personnel with Common Access Cards (CAC) in conjunction with a personal identification number.

RECORD ACCESS PROCEDURES: Individuals seeking access to their records should address written inquiries to the Principal Investigator, The Millennium Cohort Program, Naval Health Research Center, Deployment Health Research Department, 140 Sylvester Rd, San Diego, CA 92106-3521,[email protected]. Signed written requests should contain the name and number of this system of records notice along with full name, last four of SSN, DoD ID number, date of birth, email address, phone number, or mailing address, and SID (if known). In addition, the requester must provide either a notarized statement or an unsworn declaration made in accordance with 28 U.S.C. 1746, in the appropriate format:

If executed outside the United States: “I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). (Signature).”

If executed within the United States, its territories, possessions, or commonwealths: “I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date). (Signature).”

CONTESTING RECORD PROCEDURES: The DoD rules for accessing records, contesting contents, and appealing initial Component determinations are contained in 32 CFR part 310, or may be obtained from the system manager.

NOTIFICATION PROCEDURES: Individuals seeking to determine whether information about themselves is contained in this system of records should follow the instructions for Record Access Procedures above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM: None.

HISTORY: June 16, 2003, 68 FR 35664; November 14, 2014, 79 FR 68225.

1