Privacy Act of 1974; System of Records Notice

AGENCY:

Office of the Secretary (OS), Department of Health and Human Services (HHS).

ACTION:

Notice to alter two Privacy Act systems of records.

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, as amended (5 U.S.C. 552a), the Department of Health and Human Services (HHS) is updating an existing, department-wide system of records, System No. 09-90-0024, titled “Unified Financial Management System” (UFMS), which covers accounts payable records and accounts receivable records retrieved by personal identifier; and is transferring one routine use (pertaining to administrative wage garnishment) to a related system of records, System No. 09-40-0012, titled “Debt Management and Collection System.”

System No. 09-90-0024, “Unified Financial Management System,” was established prior to 1979 (see 44 FR 58149). The System of Records Notice (SORN) was last revised and republished in full in 2005 (see 70 FR 38145). This Notice proposes to change the name to “HHS Financial Management System Records;” update records locations and System Manager contact information; narrow the scope of the SORN by excluding certain descriptions and routine uses pertaining to collection of overdue and delinquent federal debts, which are currently covered in, or are now proposed to be covered in, the SORN for System No. 09-40-0012 “Debt Management and Collection System;” add several new routine uses, combine and revise certain existing routine uses, and delete unnecessary routine uses; and update the safeguards, record retention procedures, and record source descriptions. The changes are more fully explained in the Supplementary Information section of this Notice.

DATES:

The altered system notice is effective immediately, with the exception of the routine uses that are proposed to be added, revised, or transferred. The new, revised, and transferred routine uses will be effective 30 days after publication, unless HHS receives comments that warrant a revision to this Notice.

ADDRESSES:

Send public comments by mail to: Sara Hall, Chief Information Security Officer, 200 Independence Ave. SW., Room #326E, Washington, DC 20201, or by email to: sara.hall@hhs.gov. Comments will be available for public inspection and copying at the above location.

FOR FURTHER INFORMATION CONTACT:

Sara Hall, Chief Information Security Officer, 200 Independence Ave. SW., Room #326E, Washington, DC 20201, sara.hall@hhs.gov.

SUPPLEMENTARY INFORMATION:

I. Updates to System No. 09-90-0024

Since the last republication of the Unified Financial Management System SORN in 2005, the System Manager contact information has changed, and some of the records locations have changed. In reviewing the SORN for other updates to make, HHS determined that the name and scope should be changed to reflect that the system of records is not limited to records associated with a particular information technology (IT) system known as the Unified Financial Management System (UFMS), because HHS uses multiple IT systems for financial management purposes, the IT system names may change, and certain supporting records are not maintained in the IT systems, but are maintained in hard copy only. The system of records currently excludes salary and wage payment records processed in a payroll system; HHS determined that certain descriptions and routine uses pertaining to collection of overdue and delinquent federal debts should also be excluded from this SORN, to avoid (to the extent possible) duplicating System No. 09-40-0012 “Debt Management and Collection System.” (System No. 09-40-0012 is a subset of this system of records; it covers records pertaining to debt collection functions, and also utilizes the central accounting system known as UFMS.) The safeguards, record retention procedures, and record source descriptions have also been updated.

The remaining changes affect the routine uses:

• Routine uses 3 and 13 through 17 are being added; they will authorize disclosures pertaining to law violations, private relief legislation, audits, insurance and similar matters, cybersecurity monitoring, and security breach response.
• The following routine uses are being revised:

○ Routine use 1, authorizing disclosures to Treasury to effect payments, has been revised to include “verifying payment eligibility,” and to authorize disclosures under any future “Do Not Pay” computer matching agreement entered into with Treasury that requires data from this system of records.

○ The word “written” has been added to routine use 2 (pertaining to disclosures to Members of Congress).

○ Former routine uses 4 and 5 (pertaining to disclosures to obtain information relevant to an HHS decision and to provide information relevant to another agency's decision) are now combined at number 5.

○ The litigation routine use (formerly 8, now 7) has been reworded.

○ Former routine uses 16 and 17 (pertaining to disclosures to contractors and other individuals not having the status of agency employees) are now combined at number 12.

• The following routine uses are being deleted:

○ The routine use formerly numbered as 3 (pertaining to disclosures to the U.S. Department of Justice to obtain its advice regarding information required to be provided under the Freedom of Information Act) has been deleted as unnecessary, because HHS' Office of General Counsel provides such advice with respect to specific records, and because another routine use authorizes disclosures to DOJ in the event of litigation.

○ The routine uses formerly numbered as 11, 12, and 13, the last portion of the routine use formerly numbered as 14 (now 10), and the routine uses formerly numbered as 19, 20, and 21 have been deleted as duplicating another UFMS routine use, or as duplicating debt collection-related routine uses previously published for System No. 09-40-0012, “Debt Management and Collection System” (Debt). Specifically:

UFMS routine use 11a. through c. duplicated Debt routine use 11;

UFMS routine use 11d. duplicated Debt routine uses 5, 7, and 10;

UFMS routine use 11e. duplicated Debt routine use 10;

UFMS routine use 11f. duplicated Debt routine use 3;

UFMS routine use 11g. duplicated Debt routine use 16;

UFMS routine use 12 duplicated Debt routine use 10;

UFMS routine use 13 duplicated Debt routine use “Special Disclosures to Consumer Reporting Agencies;”

the last portion of UFMS routine use 14 duplicated Debt routine use 13;

UFMS routine use 19 duplicated the UFMS routine use “Disclosure to Consumer Reporting Agencies”;

UFMS routine use 20 duplicated Debt routine use 14; and

UFMS routine use 21 duplicated Debt routine use 15.

○ The routine use formerly numbered as 18, pertaining to computer matching of a list of debtors against a list of federal employees, has been deleted because such matching programs are not currently conducted or contemplated.

○ The routine use formerly numbered as 22, pertaining to administrative wage garnishment, has been deleted because it is being transferred to System No. 09-40-0012 as routine use 18.

II. Routine Use Revised and Transferred to System No. 09-40-0012

The routine use pertaining to administrative wage garnishment, appearing in the current UFMS SORN as number 22, is being deleted from the UFMS SORN and included in revised form as routine uses 18 in the SORN previously published for System No. 09-40-0012, “Debt Management and Collection System.” The revised wording will more accurately describe the data elements disclosed to a debtor's employer for administrative wage garnishment purposes.

III. The Privacy Act

The Privacy Act (5 U.S.C. 552a) governs the means by which the U.S. Government collects, maintains, and uses information about individuals in a system of records. A “system of records” is a group of any records under the control of a federal agency from which information about an individual is retrieved by the individual's name or other personal identifier. The Privacy Act requires each agency to publish in the Federal Register a system of records notice (SORN) identifying and describing each system of records the agency maintains, including the purposes for which the agency uses information about individuals in the system, the routine uses for which the agency discloses such information outside the agency, and how individual record subjects can exercise their rights under the Privacy Act (e.g., to seek access to their records in the system).

Routine Use Added to System No. 09-40-0012

The following routine use 18 is added to the System of Records Notice (SORN) for System No. 09-40-0012, titled “Debt Management and Collection System,” which was last published December 11, 1998 at 63 FR 68596:

18. If HHS decides to administratively garnish wages of a delinquent debtor under the wage garnishment provision in 31 U.S.C. 3720D, a record from the system may be disclosed to the debtor's employer. This disclosure will take the form of a wage garnishment order directing that the employer pay a portion of the employee/debtor's wages to the federal government. Disclosure of records is limited to the debtor's name, alias name, and Social Security Number, creditor agency name and contact information, and debt amount due as of a certain date.

SYSTEM NUMBER:

09-90-0024.

SYSTEM NAME:

HHS Financial Management System Records.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Servers for the electronic systems are located in Bethesda, Maryland (primary facility) and Sterling, Virginia (backup facility). Beginning approximately December 2015, the primary hosting locations will be Austin, Texas, and Bethesda, Maryland, and the backup locations will be Colorado Springs, Colorado and Sterling, Virginia.

Source documents used to enter data into the electronic systems, and supporting records providing additional background information, are maintained in finance offices and/or in the relevant administrative and/or program office(s), or by a designated claims officer apart from the finance office. See Appendix 1 for finance office locations.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Records pertain to individuals who receive or are entitled to a payment from HHS, and individuals who pay or owe money to HHS. Individuals receiving payments include, but are not limited to, members of the public who have established a claim against HHS, such as under the Federal Tort Claims Act; HHS employees who receive award payments, reimbursements for official travel and training expenses, subsidies for mass transit expenses, and similar payments; HHS grantees, contractors and consultants; Fellows; and recipients of HHS loans and scholarships. Individuals owing monies include, but are not limited to, individuals who have been overpaid and who owe HHS a refund, and individuals who have received goods or services from HHS for which there is a charge or fee (e.g., Freedom of Information Act requesters).

CATEGORIES OF RECORDS IN THE SYSTEM:

The records consist of accounts payable records and accounts receivable records pertaining to individual payees/obligees and individual payors/obligors, excluding payroll records and records used to collect and manage delinquent federal debts, which are covered in separate systems of records. The records contain the individual's name, identification number/Social Security Number (SSN) or EIN/TIN, mailing address, email address, phone number, purpose of payment or request for payment, bank account and routing numbers, accounting classification, and the amount paid. Accounts receivable records pertaining to an overpayment or outstanding charge, fee, loan, grant, or scholarship will also include the amount of the indebtedness, the repayment status, and the amount to be collected.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

31 U.S.C. 3512, 3711, 3716, 3721, 1321 note; E.O. 13520.

PURPOSE(S):

Relevant HHS personnel use the records on a need-to-know basis to process and track payments made and monies owed to or by individuals and HHS, and to ensure that payments by HHS are based on an official commitment and obligation of government funds. When an individual is required to repay funds that have been advanced to him (e.g., as a loan or scholarship), records are used to establish a receivable record and to track repayment status. In the event of an overpayment to an individual, records are used to establish a receivable record for recovery of the amount claimed. Records of payments and uncollectible debts are also used to develop reports of taxable income to the Internal Revenue Service (IRS) and applicable state and local taxing officials.

Records in this system of records that pertain to overdue and delinquent federal debts are also used for debt collection purposes, as described in the SORN published for System of Records No. 09-40-0012 “Debt Management and Collection System.”

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

Records from this system of records may be disclosed to the following parties outside HHS, without the individual's consent, for these purposes:

1. Records will be routinely disclosed to the Treasury Department for purposes of verifying payment eligibility using Treasury's “Do Not Pay” (DNP) system and effecting payments. Records may also be disclosed to Treasury pursuant to a DNP computer matching agreement between HHS and Treasury for purposes authorized by 31 U.S.C. 3321 note and E.O. 13520, if the matching program requires data from this system of records.

2. Records may be disclosed to Members of Congress concerning a federal financial assistance program in order for Members to make informed opinions on programs and/or activities impacting legislative decisions. Also, disclosure may be made to a Congressional office from an individual's record in response to a written inquiry from the congressional office made at the written request of the individual in order to be responsive to the constituency.

3. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate public authority, whether federal, foreign, state, local, tribal, or otherwise, responsible for enforcing, investigating, or prosecuting the violation or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to the enforcement, regulatory, investigative, or prosecutorial responsibility of the receiving entity.

4. A record from this system may be disclosed to a federal, foreign, state, local, tribal or other public authority of the fact that this system of records contains information relevant to the hiring or retention of an employee, the issuance or retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for further information if it so chooses. HHS will not make an initial disclosure unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another federal agency for criminal, civil, administrative, personnel, or regulatory action.

5. Where federal agencies having the power to subpoena other federal agencies' records, such as the Internal Revenue Service (IRS) or the U.S. Commission on Civil Rights, issue a subpoena to HHS for records in this system of records, HHS will make such records available; provided, however, that in each case, HHS determines that the disclosure is compatible with the purpose for which the records were collected.

6. Information may be disclosed to a labor organization recognized under E.O. 11491 or 5 U.S.C. Chapter 71, when a contract between a component of the Department and the labor organization provides that the agency will disclose personal records when relevant and necessary to the organization's duties of exclusive representation concerning civilian personnel policies, practices, and matters affecting working conditions.

7. A record may be disclosed to the Department of Justice (DOJ) or to a court or other tribunal when:

a. HHS, or any component thereof;

b. any HHS employee in his/her official capacity;

c. any HHS employee in his/her individual capacity where DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or

d. the United States Government,

8. A record about a loan applicant or potential contractor or grantee may be disclosed from the system of records to credit reporting agencies to obtain a credit report in order to determine the individual's creditworthiness and ability to repay debts to the federal government.

9. When an individual applies for a loan under a loan program as to which the Office of Management and Budget (OMB) has made a determination under I.R.C. 6103(a)(3), a record about his/her application may be disclosed to the Treasury Department to find out whether he/she has a delinquent tax account, for the sole purpose of determining the individual's creditworthiness.

10. Information from this system of records is used to report, to the Internal Revenue Service and applicable state and local governments, items considered to be income to an individual; for example, certain travel-related payments to employees, and all payments made to individuals not treated as employees (e.g., fees to consultants and experts).

11. A record may be disclosed to banks enrolled in the Treasury Credit Card Network to collect a payment or debt by credit card when the individual has given his/her credit card number for this purpose.

12. Information may be disclosed to federal agencies and Department contractors, grantees, consultants, or volunteers who have been engaged by HHS to assist in accomplishment of an HHS function relating to the purposes of the system of records and that need to have access to the records in order to assist HHS in performing the activity. Any contractor will be required to comply with the requirements of the Privacy Act of 1974.

13. Information may be disclosed to the Office of Management and Budget (OMB) at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular A-19.

14. Information may be disclosed to a public or professional auditing organization for the purpose of conducting financial or compliance audits.

15. Information may be disclosed to insurance companies and parties such as common carriers and warehousemen in the course of settling an employee's claim against the Department for lost or damaged property.

16. Information from this system may become available to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors Internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.

17. Information may be disclosed to appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.

Records may also be disclosed to parties outside HHS, without the individual's consent, for any of the purposes authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(b)(12). See System of Records No. 09-40-0012 “Debt Management and Collection System” for additional routine use disclosures that may be made from that system, with respect to records of federal debts from this system that are used for debt management and collection purposes.

DISCLOSURE TO CONSUMER REPORTING AGENCIES:

Disclosure pursuant to 5 U.S.C. 552a(b)(12): Disclosure may be made from this system to “consumer reporting agencies” as defined in 31 U.S.C. 3701(a)(3), reflecting that an individual is responsible for a claim (whether current or overdue), in order to aid in the collection of the claim, typically by providing an incentive to the individual to repay the claim or debt timely, by making it part of the individual's credit record. Disclosure of records is limited to the individual's name, address, Social Security Number, and other information necessary to establish the individual's identity; the amount, status and history of the claim; and the agency or program under which the claim arose. The disclosure will be made only after the procedural requirements of 31 U.S.C. 3711(e) have been followed.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, AND DISPOSING OF RECORDS IN THE SYSTEM—

STORAGE:

Electronic records are stored on computer disc pack and magnetic tape at central computer sites. Hard copy documents are stored in paper file folders.

RETRIEVABILITY:

Records are retrieved by an individual's name, Social Security Number (SSN) or Taxpayer Identification Number (TIN); and/or by document or batch identifier.

SAFEGUARDS:

• Physical Safeguards: Hard-copy records and electronic storage media are secured during nonbusiness hours in locked file cabinets or locked storage areas, in buildings protected by cameras and security guards.
• Procedural Safeguards: Authorized users are limited to employees and officials who are directly responsible for programmatic or fiscal activity, including administrative personnel, financial management personnel, computer personnel, and managers who have responsibilities for implementing HHS-funded programs. User access is restricted based on role and is controlled by unique user name and password. Passwords are required to be complex and to be changed at least every 60 days. Users protect information from the view of unauthorized persons entering the workspace while the records are in use.
• Technical Safeguards: Electronic records are secured with password protection and encryption. The electronic system is secured with firewalls and intrusion detection systems.

RETENTION AND DISPOSAL:

Records are retained and disposed of in accordance with General Records Schedule (GRS) 1.1, Financial Management and Reporting Records, which provides for records to be retained for six years after final payment or cancellation, or longer if required for business use.

SYSTEM MANAGER(S) AND ADDRESS(ES):

The System Manager for the overall system of records is the HHS Assistant Secretary for Financial Resources, 200 Independence Avenue SW.—Room 514G, Washington, DC 20201.

The System Manager for records pertaining to a particular component of HHS is the Finance Officer in the relevant finance office listed in Appendix 1.

NOTIFICATION PROCEDURE:

An individual who wishes to know if this system contains records about him or her may make a notification request. The request must be made in writing or in person and must be addressed to the relevant System Manager. The individual must show proof of identity and must provide his or her name and Social Security Number, purpose of payment or collection (travel, grant, etc.), and, if possible, the agency accounting classification.

RECORD ACCESS PROCEDURE:

Same as notification procedure. To request access to his or her record, the individual must clearly specify the record contents being sought. The individual may also request an accounting of disclosures that have been made of his or her records, if any.

CONTESTING RECORD PROCEDURE:

Same as notification procedure. To contest information about him or her, the individual must reasonably identify the record; specify the information being contested, the corrective action sought, and the reasons for requesting the correction; and provide supporting justification showing how the record is inaccurate, incomplete, untimely, or irrelevant.

RECORD SOURCE CATEGORIES:

Information is obtained directly from individual record subjects; from contractors, private companies, or other government agencies; and from documents submitted to or received from a budget, accounting, travel, training, or other program office.

SYSTEM EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:

None.

Appendix 1—HHS Finance Office Locations

Centers for Disease Control and Prevention (CDC), and Agency for Toxic Substances and Disease Registry (ATSDR)

University Park, Columbia Building, 2900 Woodcock Boulevard, Atlanta, GA 30341

Centers for Medicare & Medicaid Services (CMS)

Centers for Medicare & Medicaid Services, 7500 Security Boulevard, Baltimore, MD 21244

Food and Drug Administration District Offices (FDA)

Food and Drug Administration, FDA, Atlanta District Office, 60 Eighth Street NE., Atlanta, GA 30309

Food and Drug Administration, FDA, New England District Office, One Montvale Avenue, Stoneham, MA 02180

Food and Drug Administration, FDA, New Jersey District Office, 10 Waterview Boulevard, 3rd Floor, Parsippany, NJ 07054

Food and Drug Administration, FDA, Philadelphia District Office, Room 900, U.S. Customhouse, 2nd and Chestnut Streets, Philadelphia, PA 19106

Food and Drug Administration, FDA, Baltimore District Office, 6000 Metro Drive, Suite 101, Baltimore, MD 21215

Food and Drug Administration, FDA, San Juan District Office, 466 Fernandez Juncos Avenue, San Juan, PR 00901-3223

Food and Drug Administration, FDA, Chicago District Office, 550 W. Jackson Boulevard, Suite 1500 South, Chicago, IL 606601

Food and Drug Administration, FDA, Cincinnati District Office, 6751 Steger Drive, Cincinnati, OH 45237-3097

Food and Drug Administration, FDA, Minneapolis District Office, 250 Marquette Avenue, Suite 600, Minneapolis, MN 55401

Food and Drug Administration, FDA, Dallas District Office, 4040 N. Central Expressway, Suite 300, Dallas, TX 75204

Food and Drug Administration, FDA, Southwest Import District, 4040 N. Central Expressway, Suite 300, Dallas, TX 75204

Food and Drug Administration, FDA, New Orleans District Office, 6600 Plaza Drive, Suite 400, New Orleans, LA 70127

Food and Drug Administration, FDA, Kansas City District Office, 8050 Marshall Drive, Suite 205, Lenexa, KS 66214

Food and Drug Administration, FDA, Denver District Office, 6th Avenue & Kipling St., Building 20, Denver Federal Center, Denver, CO 80225-0087

Food and Drug Administration, FDA, Florida District Office, 555 Winderly Place, Suite 200, Maitland, FL 32751

Food and Drug Administration, FDA, San Francisco District Office, 1431 Harbor Bay Parkway, Alameda, CA 94502-7096

Food and Drug Administration, FDA, Los Angeles District Office, 19701 Fairchild, Irvine, CA 92612-2506

Food and Drug Administration, FDA, New York District Office, 158-15 Liberty Avenue, Jamaica, NY 11433-1034

Food and Drug Administration, FDA, Seattle District Office, 22215 26th Ave SE., Suite 210, Bothell, WA 98021

Food and Drug Administration, FDA, Headquarters Office, 10903 New Hampshire Avenue, Silver Spring, MD 20993

Indian Health Service (IHS)

Alaska Area Indian Health Service, 4141 Ambassador Drive, Anchorage, AK 99508-5928

Albuquerque Area Indian Health Service, 5300 Homestead Road NE., Albuquerque, NM 87109-1311

Bemidji Area Indian Health Service, 522 Minnesota Avenue NW., Room 119, Bemidji, MN 56601

Billings Area Indian Health Service, 2900 4th Avenue North, Billings, MT 59101

California Area Indian Health Service, 650 Capitol Mall, Suite 7-100, Sacramento, CA 95814

Great Plains Area IHS, Federal Building, 115 Fourth Avenue, Southeast, Aberdeen, SD 57401

Nashville Area Indian Health Service, 711 Stewarts Ferry Pike, Nashville, TN 37214-2634

Navajo Area Indian Health Service, P.O. Box 9020, Window Rock, AZ 86515-9020

Oklahoma City Area Indian Health Service, 701 Market Dr., Oklahoma City, OK 73114

Phoenix Area Indian Health Service, Two Renaissance Square, 40 North Central Avenue, Phoenix, AZ 85004-4424

Portland Area Indian Health Service, 1414 NW Northrup Street, Suite 800, Portland, OR 97209

Tucson Area Indian Health Service, 7900 S.J. Stock Road, Tucson, AZ 85746-7012

National Institutes of Health (NIH)

National Institutes of Health (NIH), Office of the Director (OD), Office of Management (OM), Office of Financial Management (OFM), 2115 East Jefferson Street, Rockville, MD 20892-8500

Program Support Center (PSC)

Program Support Center (PSC) Division of Fiscal Operations, 5600 Fishers Lane, Room 16-05, Rockville, MD 20857

PSC serves as the finance center for these HHS components:

1. Office of the Secretary (OS)

2. Administration for Children and Families (ACF)

3. Administration for Community Living (ACL)

4. Agency for Healthcare Research and Quality (AHRQ)

5. Health Resources and Services Administration (HRSA)

6. Office of Inspector General (OIG)

7. Substance Abuse and Mental Health Services Administration (SAMHSA)