Privacy Act of 1974; system of records

AGENCY:

Defense Health Agency, DoD.

ACTION:

Notice to alter a system of records.

SUMMARY:

The Defense Health Agency is proposing to alter an existing system of records, EDHA 08, entitled “Health Affairs Survey and Study Data Base”, in its inventory of record systems subject to the Privacy Act of 1974, as amended. This system will be used to collect, assemble, interpret, analyze, report and publish survey and study findings and results for the purpose of improving the quality of DoD health care and the health status, welfare, and well-being of the DoD beneficiary population. Uses of identifiable data include primary analysis; secondary analysis; non-response analysis; and cross-mapping analysis. Results will only be reported in the aggregate.

DATES:

Comments will be accepted on or before August 27, 2014. This proposed action will be effective the date following the end of the comment period unless comments are received which result in a contrary determination.

ADDRESSES:

You may submit comments, identified by docket number and title, by any of the following methods:

• Federal Rulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.
• Mail: Federal Docket Management System Office, 4800 Mark Center Drive, East Tower, 2nd Floor, Suite 02G09, Alexandria, VA 22350-3100.

Instructions: All submissions received must include the agency name and docket number for this Federal Register document. The general policy for comments and other submissions from members of the public is to make these submissions available for public viewing on the Internet at http://www.regulations.gov as they are received without change, including any personal identifiers or contact information.

FOR FURTHER INFORMATION CONTACT:

Ms. Linda S. Thomas, Chief, Defense Health Agency Privacy and Civil Liberties Office, Defense Health Agency, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101, or by phone at (703) 681-7500.

SUPPLEMENTARY INFORMATION:

The Defense Health Agency notices for systems of records subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended, have been published in the Federal Register and are available from the address in FOR FURTHER INFORMATION CONTACT or at the Defense Privacy and Civil Liberties Office Web site at http://dpclo.defense.gov/.

The proposed system report, as required by 5 U.S.C. 552a(r) of the Privacy Act of 1974, as amended, was submitted on July 1, 2014, to the House Committee on Oversight and Government Reform, the Senate Committee on Governmental Affairs, and the Office of Management and Budget (OMB) pursuant to paragraph 4c of Appendix I to OMB Circular No. A-130, “Federal Agency Responsibilities for Maintaining Records About Individuals,” dated February 8, 1996 (February 20, 1996, 61 FR 6427).

EDHA 08

System name:

Health Affairs Survey and Study Data Base (November 18, 2013, 78 FR 69076).

Changes:

System name:

Delete entry and replace with “Defense Health Agency Survey and Study Data Base.”

System location:

Delete entry and replace with “Defense Health Cost Assessment and Program Evaluation Division, Defense Health Agency, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101.”

Categories of individuals covered by the system:

Delete entry and replace with “Uniformed services beneficiaries enrolled in the Defense Eligibility Enrollment Reporting System (DEERS) who are eligible for medical and dental health care; veterans and their dependents; individuals who submit Medicare and/or Medicaid claims and are linked to DoD health care; DoD civilian employees and contractor personnel.”

Categories of records in the system:

Delete entry and replace with “Records in the system include name, address, sponsor and dependents' Social Security Number (SSN) and/or DoD Identification (DoD ID) number, family member prefix, demographics categories that include age, sex, date of birth, telephone number, email address, and military rank/civilian grade level, rank group (officer, enlisted, or civilian), patient identifier, and beneficiary category.

Personal health information and clinical encounter data regarding interactions with health care systems, such as diagnoses, procedures, treatments, services, and benefits; self-reported health and health related response datasets such as surveys and focus groups; health care administrative data, such as inpatient, dental, outpatient, and pharmacy utilization rates; budgetary and managerial cost accounting data, such as claims processing, direct and purchased care workload, and costs; contingency tracking system data such as deployment status; and health plan eligibility and enrollment data.”

Authority for maintenance of the system:

Delete entry and replace with “10 U.S.C. 136, Under Secretary of Defense for Personnel and Readiness; 10 U.S.C. 1071 Notes, Annual Beneficiary Survey; 10 U.S.C. Chapter 55, Medical and Dental Care; 42 U.S.C. Chapter 117, Encouraging Good Faith Professional Review Activities; DoDI 6025.13, Medical Quality Assurance (MQA) in the Military Health System (MHS); and E.O. 9397 (SSN), as amended.”

Purpose(s):

Delete entry and replace with “To collect, assemble, interpret, analyze, report and publish survey and study findings and results for the purpose of improving the quality of DoD health care and the health status, welfare, and well-being of the DoD beneficiary population. Uses of identifiable data include primary analysis; secondary analysis; non-response analysis; and cross-mapping analysis. Results will only be reported in the aggregate.”

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

Delete entry and replace with “In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, as amended, these records may specifically be disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

To the Department of Health and Human Services and/or the Department of Veterans Affairs consistent with their statutory administrative responsibilities.

To the Office of Personnel Management for purposes related to DoD Federal employees and/or their health care benefits through DoD.

To local and state governments and agencies for compliance with local laws and regulations governing control of communicable diseases, preventive medicine and safety; child abuse; and other public health and welfare programs.

To academic, nonprofit, and commercial entities for surveys or authorized health research in the interest of the Federal Government and the public, where such releases are consistent with the mission of the Military Health System. When not essential for longitudinal studies, patient identification data shall be deleted from records used for research studies.

The DoD Blanket Routine Uses may apply to this system with the following noted exceptions:

Note 1:

This system of records contains individually identifiable health information. The DoD Health Information Privacy Regulation (DoD 6025.18-R) or any successor DoD issuances implementing the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and 45 CFR Parts 160 and 164, Health and Human Services, General Administrative Requirements and Security & Privacy, respectively, applies to most such health information. DoD 6025.18-R or a successor issuance may place additional procedural requirements on the uses and disclosures of such information beyond those found in the Privacy Act of 1974, as amended, or mentioned in this system of records notice.

Note 2:

Except as provided under 42 U.S.C. 290dd-2, records of identity, diagnosis, prognosis or treatment information of any patient maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research which is conducted, regulated, requested, or directly or indirectly assisted by a department or agency of the United States will be treated as confidential and disclosed only for the purposes and under the circumstances expressly authorized in 42 U.S.C. 290dd-2.”

Retrievability:

Delete entry and replace with “Records may be retrieved by name, DoD ID number or patient identifier, address, beneficiary category, sponsor and dependents SSN, family member prefix, demographic categories, such as age, sex, email address, military rank/civilian grade level, and rank group (officer, enlisted, or civilian).”

Safeguards:

Delete entry and replace with “Media, data and/or records are maintained in a controlled area. The computer system is accessible only to authorized personnel. Entry into these areas is restricted to those personnel with a valid requirement and authorization to enter. Physical entry is restricted by the use of locks, passwords which are changed periodically, and administrative procedures. The system provides two-factor authentication including Common Access Cards or other means such as user ID/passwords. Access to personal information is restricted to those who require the data in the performance of their official duties, and have received proper training relative to the Privacy Act of 1974, as amended, the HIPAA Privacy and Security Rules, and Information Assurance.”

Retention and disposal:

Delete entry and replace with “Hard copy surveys are destroyed after the information contained in survey responses is entered into a computer system.

Annual Beneficiary Survey, Destroy when 5 years old.

Inpatient, Outpatient and other Beneficiary Satisfaction Surveys, Destroy when 5 years old.”

System manager(s) and address:

Delete entry and replace with “Director, Defense Health Cost Assessment and Program Evaluation Division, Defense Health Agency, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101.”

Notification procedure:

Delete entry and replace with “Individuals seeking to determine whether this system contains information about themselves should address written inquiries to the Director, Defense Health Cost Assessment and Program Evaluation Division, Defense Health Agency, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101.

Requests should contain the name and number of this system of records notice, the individual's full name, current address, telephone number, and signature.

If requesting information about a minor or legally incompetent person, the request must be made by the custodial parent, legal guardian, or party acting in loco parentis of such individual. Written proof of that status may be required before the existence of any information will be confirmed.”

Record access procedures:

Delete entry and replace with “Individuals seeking access to information about themselves contained in this system should address written inquiries to the Chief, Freedom of Information Act Service Center, Defense Health Agency Privacy and Civil Liberties Office, 7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101.

Requests should contain the name and number of this system of records notice, the individual's full name, current address, telephone number, and signature.

If requesting records about a minor or legally incompetent person, the request must be made by the custodial parent, legal guardian, or party acting in loco parentis of such individual. Written proof of that status may be required before any records will be provided.”

Contesting record procedures:

Delete entry and replace with “The Office of the Secretary of Defense (OSD) rules for accessing records, for contesting contents, and appealing initial agency determinations are published in OSD Administrative Instruction 81; 32 CFR Part 311; or may be obtained from the system manager.”

Record source categories:

Delete entry and replace with “Individuals, DEERS, the Uniformed Services medical and dental treatment facilities, and facilities contracted by DoD to perform medical care for military members, former members, and dependents.”