Privacy Act of 1974; System of Records

AGENCY:

Department of the Air Force, Department of Defense (DoD).

ACTION:

Notice to alter a system of records.

SUMMARY:

The Department of the Air Force proposes to alter a system of records to its inventory of record systems subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended.

DATES:

The proposed action will be effective on January 12, 2012 unless comments are received that would result in a contrary determination.

ADDRESSES:

You may submit comments, identified by docket number and title, by any of the following methods: Federal Rulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.

• Mail: Federal Docket Management System Office, 4800 Mark Center Drive, East Tower, 2nd Floor, Suite 02G09, Alexandria, VA 22350-3100. Instructions: All submissions received must include the agency name and docket number for this Federal Register document. The general policy for comments and other submissions from members of the public is to make these submissions available for public viewing on the Internet at http://www.regulations.gov as they are received without change, including any personal identifiers or contact information.

FOR FURTHER INFORMATION CONTACT:

Mr. Charles J. Shedrick, Department of the Air Force Privacy Office, Air Force Privacy Act Office, Office of Warfighting Integration and Chief Information officer, ATTN: SAF/CIO A6, 1800 Air Force Pentagon, Washington DC 20330-1800, or by phone at (202) 404-6575.

SUPPLEMENTARY INFORMATION:

The Department of the Air Force's notices for systems of records subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended, have been published in the Federal Register and are available from the address in FOR FURTHER INFORMATION CONTACT.

The proposed systems reports, as required by 5 U.S.C. 552a(r) of the Privacy Act, were submitted on December 6, 2011 to the House Committee on Oversight and Government Reform, the Senate Committee on Homeland Security and Governmental Affairs, and the Office of Management and Budget (OMB) pursuant to paragraph 4c of Appendix I to OMB Circular No. A-130, “Federal Agency Responsibilities for Maintaining Records About Individuals,” dated February 8, 1996, (February 20, 1996, 61 FR 6427).

F044 AF SG E

System name:

Medical Record System (June 18, 2010, 75 FR 34709).

Changes:

Change System ID to read “F044 F SG E.”

System name:

Delete entry and replace with “Electronic Medical Records System.”

System location:

Delete entry and replace with “Headquarters, United States Air Force, Surgeon General (HQ USAF/SG), Air Force Medical Service Chief Information Officer's Office (AFMS CIO's office), 5201 Leesburg Pike, Suite 1501, Falls Church, VA 22041-3214.”

Categories of individuals covered by the system:

Delete entry and replace with “Uniformed services medical beneficiaries enrolled in the Defense Enrollment Eligibility Reporting System (DEERS) who receive or have received medical care at one or more of DoD's medical treatment facilities (MTFs), Uniformed Services Treatment Facilities (USTFs), or care provided under TRICARE programs. Uniformed services medical beneficiaries who receive or have received care at one or more dental treatment facilities or other system locations including medical aid stations, Educational and Developmental Intervention Services clinics and Service Medical Commands. Uniformed service members serving in a deployed status and those who receive or received care through the Department of Veterans Affairs (VA).”

Categories of records in the system:

Delete entry and replace with “Full name, Social Security Number (SSN) or Military Service Number, date treatment was provided, name of facility providing treatment, inpatient, outpatient, and ambulatory procedure visit (APV) records of care received in Air Force medical facilities. Documentation includes: Patient's medical history, physical examination, treatment received; supporting documentation, such as laboratory and x-ray reports, cover sheets and summaries of hospitalization, diagnoses, procedures or surgery performed, administrative forms which concern medical conditions, such as Line of Duty Determinations, physical profiles, and medical recommendations for flying duty. Secondary files are maintained, such as patient registers, nominal indices, x-ray and laboratory files. This also includes healthcare unique information on the medical staff and resources (staff, logistics and financial) used to support beneficiary healthcare.”

Authority for maintenance of the system:

Delete entry and replace with “5 U.S.C. 301, Departmental Regulations; 10 U.S.C. Chapter 55, Sections 1071-1097b, Medical and Dental Care; 42 U.S.C. Chapter 117, Sections 11131-11152, Reporting of Information; DoD 6025.18-R, DoD Health Information Privacy Regulation; DoD 6010.8-R, CHAMPUS; DoD Instruction 6015.23, Delivery of Healthcare at Military Treatment Facilities: Foreign Service Care; Third-Party Collection; Beneficiary Counseling and Assistance Coordinators (BCACs); Pub.L. 104-91, Health Insurance Portability and Accountability Act of 1996; and E.O. 9397 (SSN), as amended.”

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

Delete entry and replace with “In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, these records contained therein may specifically be disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

Information from the inpatient, outpatient or Ambulatory Procedure Visit (APV) medical records of DoD beneficiaries may be disclosed to third party payers for the purpose of collecting reasonable inpatient/outpatient/APV hospital care costs incurred on behalf of those beneficiaries. Records are used and reviewed by healthcare providers, clinic managers, disease management care coordinators and other appropriate medical staff in the performance of their duties. Healthcare providers include military and civilian providers assigned to the medical facility where care is being provided, students participating in a training affiliation program with a military medical facility as part of their training program, and approved personnel conducting military studies designed to benchmark or standardized/better future healthcare practices. In addition, records may be disclosed to:

(1) Officials and employees of the Department of Veterans Affairs in the performance of their official duties relating to the adjudication of veterans claims and in providing medical care to Veteran members of the Armed Services or Active Duty members if based on shared services agreements.

(2) Officials and agencies of the Executive Branch of government upon request in the performance of their official duties relating to review of the official qualifications and medical history of applicants and employees who are covered by the record system and for the conduct of research studies.

(3) Private organizations, including educational institutions and individuals for authorized health research in the interest of the Federal government and the medical schools/teaching facilities commissioned to assist in those studies. When not considered mandatory, patient identification data shall be eliminated from records used for research studies.

(4) Officials and employees of the National Research Council in cooperative studies of the National History of Disease of prognosis and of epidemiology. Each study in which the records of members, former members and dependents of members of the Armed Services are used must be approved by the Surgeon General (or designated representative) of the appropriate service. If the study entails all of the Medical Health Service data the concurrence must be obtained from the Surgeon General (or designated representative) of all the services.

(5) Officials and employees of local and state governments and agencies in the performance of their official duties pursuant to the laws and regulations governing local control of communicable diseases, preventive medicine and safety programs, child abuse and other public health and welfare programs.

(6) Authorized surveying bodies for professional certification and accreditations. These surveys may or may not be subject to Internal Review Board (IRB) approval and guidelines. Determination must be documented prior to data release as either approved or exempt by appropriate IRB authority.

(7) The individual's organization or government agency as necessary when required by Federal statute, Executive Order or by treaty.

The DoD `Blanket Routine Uses' published at the beginning of the Air Forces compilation of record system notices apply to this system, except as stipulated in Notes below.

Note:

Records of identity, diagnosis, prognosis or treatment of any client/patient, irrespective of whether or when he/she ceases to be a client/patient, maintained in connection with the performance of any alcohol/drug abuse treatment function conducted, requested, or directly or indirectly assisted by any department or agency of the United States, shall, except as provided herein, be confidential and be disclosed only for the purposes and under the circumstances expressly authorized in 42 U.S.C. 290dd-2. These statutes take precedence over the Privacy Act of 1974 in regard to accessibility of such records except to the individual to whom the record pertains. The DoD `Blanket Routine Uses' do not apply to these types of records.

Note:

This system of records contains individually identifiable health information. The DoD Health Information Privacy Regulation (DoD 6025.18-R) issued pursuant to the Health Insurance Portability and Accountability Act of 1996, applies to most such health information. DoD 6025.18-R may place additional procedural requirements on the uses and disclosures of such information beyond those found in the Privacy Act of 1974 or mentioned in this system of records notice.”

Storage:

Delete entry and replace with “Electronic storage media.”

Retrievability:

Delete entry and replace with “Last name and/or by SSN.”

Safeguards:

Delete entry and replace with “Physical entry is restricted by the use of locks, guards, and is accessible by authorized personnel only. Access to records is limited to person(s) responsible for servicing the record in the performance of their official duties and who are properly screened and cleared for need-to-know. System software uses Primary Key Infrastructure (PKI)/Common Access Card (CAC) authentication to lock out unauthorized access. System software contains authorization/permission partitioning to limit access to appropriate organization level. Automated records with Personally Identifiable Information are controlled and limited as well as tracked via system security logs by authorized personnel with a need-to-know to conduct daily business. Storage of records is all via an encrypted database and maintained on a military network with a current and approved Authority to Operate.”

Retention and disposal:

Delete entry and replace with “Files retention is based on medical need. The current limitation is ten years. After use is determined to be no longer required, electronic records are archived and then deleted from server for active use.”

System manager(s) and address:

Delete entry and replace with “Air Force Medical Support Agency Healthcare Informatics (SG6H), 3515 S. General McMullen, San Antonio, TX 78226-1710.”

Notification procedures:

Delete entry and replace with “Individuals seeking to determine whether information about themselves is contained in this system of records should address written inquiries to Headquarters, United States Air Force, Surgeon General (HQ USAF/SG), Air Force Medical Service Chief Information Officer's Office (AFMS CIO's Office), 5201 Leesburg Pike, Suite 1501, Falls Church, VA 22041-3214.

For verification purposes, individual should provide their full name, SSN, any details which may assist in locating records, and their signature. In addition, the requester must provide a notarized statement or an unsworn declaration made in accordance with 28 U.S.C. 1746, in the following format:

If executed outside the United States:

`I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). (Signature)'.

If executed within the United States, its territories, possessions, or commonwealths: `I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date). (Signature)'.”

Record access procedures:

Delete entry and replace with “Individuals seeking access to information about themselves contained in this system should address written inquiries to the HQDA G-3/5/7-CSF, Director, Zackery Taylor Building, 2530 Crystal Drive, Arlington, VA 22202-0400.

For verification purposes, individual should provide their full name, SSN, any details which may assist in locating records, and their signature. In addition, the requester must provide a notarized statement or an unsworn declaration made in accordance with 28 U.S.C. 1746, in the following format:

If executed outside the United States:

`I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). (Signature)'.

If executed within the United States, its territories, possessions, or commonwealths:

`I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date). (Signature)'.”

F044 F SG E

System name:

Electronic Medical Records System.

System location:

Headquarters, United States Air Force, Surgeon General (HQ USAF/SG), Air Force Medical Service Chief Information Officer's Office (AFMS CIO's office), 5201 Leesburg Pike, Suite 1501, Falls Church, VA 22041-3214.

Categories of individuals covered by the system:

Uniformed services medical beneficiaries enrolled in the Defense Enrollment Eligibility Reporting System (DEERS) who receive or have received medical care at one or more of DoD's medical treatment facilities (MTFs), Uniformed Services Treatment Facilities (USTFs), or care provided under TRICARE programs. Uniformed services medical beneficiaries who receive or have received care at one or more dental treatment facilities or other system locations including medical aid stations, Educational and Developmental Intervention Services clinics and Service Medical Commands. Uniformed service members serving in a deployed status and those who receive or received care through the Department of Veterans Affairs (VA).

Categories of records in the system:

Full name, Social Security Number (SSN), or Military Service Number, date treatment was provided, name of facility providing treatment, inpatient, outpatient, and ambulatory procedure visit (APV) records of care received in Air Force medical facilities. Documentation includes: patient's medical history, physical examination, treatment received, supporting documentation, such as laboratory and x-ray reports, cover sheets and summaries of hospitalization, diagnoses, procedures or surgery performed, administrative forms which concern medical conditions, such as Line of Duty Determinations, physical profiles, and medical recommendations for flying duty. Secondary files are maintained, such as patient registers, nominal indices, x-ray and laboratory files. This also includes healthcare unique information on the medical staff and resources (staff, logistics and financial) used to support beneficiary healthcare.

Authority for maintenance of the system:

5 U.S.C. 301, Departmental Regulations; 10 U.S.C. Chapter 55, Sections 1071-1097b, Medical and Dental Care; 42 U.S.C. Chapter 117, Sections 11131-11152, Reporting of Information; DoD 6025.18-R, DoD Health Information Privacy Regulation; DoD 6010.8-R, CHAMPUS; DoD Instruction 6015.23, Delivery of Healthcare at Military Treatment Facilities: Foreign Service Care; Third-Party Collection; Beneficiary Counseling and Assistance Coordinators (BCACs); Pub. L. 104-91, Health Insurance Portability and Accountability Act of 1996; and E.O. 9397 (SSN), as amended.

Purpose(s):

Used to document, plan, and coordinate the health care of patients; aid in preventative health and communicable disease control programs; determine eligibility and suitability for benefits for various programs; adjudicate claims; evaluate care rendered; teach/compile statistical data; and conduct medical research and studies.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, these records contained therein may specifically be disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

Information from the inpatient, outpatient or Ambulatory Procedure Visit (APV) medical records of DoD beneficiaries may be disclosed to third party payers for the purpose of collecting reasonable inpatient/outpatient/APV hospital care costs incurred on behalf of those beneficiaries. Records are used and reviewed by healthcare providers, clinic managers, disease management care coordinators and other appropriate medical staff in the performance of their duties. Healthcare providers include military and civilian providers assigned to the medical facility where care is being provided, students participating in a training affiliation program with a military medical facility as part of their training program, and approved personnel conducting military studies designed to benchmark or standardized/better future healthcare practices. In addition, records may be disclosed to:

(1) Officials and employees of the Department of Veterans Affairs in the performance of their official duties relating to the adjudication of veterans claims and in providing medical care to Veteran members of the Armed Services or Active Duty members if based on shared services agreements.

(2) Officials and agencies of the Executive Branch of government upon request in the performance of their official duties relating to review of the official qualifications and medical history of applicants and employees who are covered by the record system and for the conduct of research studies.

(3) Private organizations including educational institutions and individuals for authorized health research in the interest of the Federal government and the medical schools/teaching facilities commissioned to assist in those studies. When not considered mandatory, patient identification data shall be eliminated from records used for research studies.

(4) Officials and employees of the National Research Council in cooperative studies of the National History of Disease of prognosis and of epidemiology. Each study in which the records of members, former members and dependents of members of the Armed Services are used must be approved by the Surgeon General (or designated representative) of the appropriate service. If the study entails all of the Medical Health Service data the concurrence must be obtained from the Surgeon General (or designated representative) of all the services.

(5) Officials and employees of local and state governments and agencies in the performance of their official duties pursuant to the laws and regulations governing local control of communicable diseases, preventive medicine and safety programs, child abuse and other public health and welfare programs.

(6) Authorized surveying bodies for professional certification and accreditations. These surveys may or may not be subject to Internal Review Board (IRB) approval and guidelines. Determination must be documented prior to data release as either approved or exempt by appropriate IRB authority.

(7) The individual's organization or government agency as necessary when required by Federal statute, Executive Order or by treaty.

The DoD `Blanket Routine Uses' published at the beginning of the Air Forces compilation of record system notices apply to this system, except as stipulated in Notes below.

Note:

Records of identity, diagnosis, prognosis or treatment of any client/patient, irrespective of whether or when he/she ceases to be a client/patient, maintained in connection with the performance of any alcohol/drug abuse treatment function conducted, requested, or directly or indirectly assisted by any department or agency of the United States, shall, except as provided herein, be confidential and be disclosed only for the purposes and under the circumstances expressly authorized in 42 U.S.C. 290dd-2. These statutes take precedence over the Privacy Act of 1974 in regard to accessibility of such records except to the individual to whom the record pertains. The DoD `Blanket Routine Uses' do not apply to these types of records.

Note:

This system of records contains individually identifiable health information. The DoD Health Information Privacy Regulation (DoD 6025.18-R) issued pursuant to the Health Insurance Portability and Accountability Act of 1996, applies to most such health information. DoD 6025.18-R may place additional procedural requirements on the uses and disclosures of such information beyond those found in the Privacy Act of 1974 or mentioned in this system of records notice.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:

Electronic storage media.

Retrievability:

Last name and/or by SSN.

Safeguards:

Physical entry is restricted by the use of locks, guards, and is accessible by authorized personnel only. Access to records is limited to person(s) responsible for servicing the record in the performance of their official duties and who are properly screened and cleared for need-to-know. System software uses Primary Key Infrastructure (PKI)/Common Access Card (CAC) authentication to lock out unauthorized access. System software contains authorization/permission partitioning to limit access to appropriate organization level. Automated records with Personally Identifiable Information are controlled and limited as well as tracked via system security logs by authorized personnel with a need-to-know to conduct daily business. Storage of records is all via an encrypted database and maintained on a military network with a current and approved Authority to Operate.

Retention and disposal:

Files retention is based on medical need. The current limitation is ten years. After use is determined to be no longer required, electronic records are archived and then deleted from server for active use.

System manager(s) and address:

Air Force Medical Support Agency Healthcare Informatics (SG6H), 3515 S. General McMullen, San Antonio, TX 78226-1710.

Notification procedure:

Individuals seeking to determine whether information about themselves is contained in this system of records should address written inquiries to Headquarters, United States Air Force, Surgeon General (HQ USAF/SG), Air Force Medical Service Chief Information Officer's Office (AFMS CIO's Office), 5201 Leesburg Pike, Suite 1501, Falls Church, VA 22041-3214.

For verification purposes, individual should provide their full name, SSN, any details which may assist in locating records, and their signature. In addition, the requester must provide a notarized statement or an unsworn declaration made in accordance with 28 U.S.C. 1746, in the following format:

If executed outside the United States:

`I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). (Signature)'.

If executed within the United States, its territories, possessions, or commonwealths:

`I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date). (Signature)'.

Record access procedures:

Individuals seeking access to information about themselves contained in this system should address written inquiries to the HQDA G-3/5/7-CSF, Director, Zackery Taylor Building, 2530 Crystal Drive, Arlington, VA 22202-0400.

For verification purposes, individual should provide their full name, SSN, any details which may assist in locating records, and their signature. In addition, the requester must provide a notarized statement or an unsworn declaration made in accordance with 28 U.S.C. 1746, in the following format:

If executed outside the United States:

`I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). (Signature)'.

If executed within the United States, its territories, possessions, or commonwealths:

`I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date). (Signature)'.

Contesting record procedures:

The Air Force rules for accessing records and for contesting contents and appealing initial agency determinations are published in Air Force Instruction 37-132; 32 CFR part 1806b; or may be obtained from the system manager.

Record source categories:

Physicians and other patient care providers, such as nurses, dietitians, and physicians assistants. Administrative forms are completed by appropriate military or civilian officials.

Exemptions claimed for the system:

None.