Privacy Act of 1974; System of Records Notice

AGENCY:

Office of Minority Health (OMH), Office of the Assistant Secretary for Health (OASH), Office of the Secretary (OS), Department of Health and Human Services (HHS).

ACTION:

Notice to establish a new Privacy Act system of records notice (SORN).

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, the Office of Minority Health, Office of the Assistant Secretary for Health, Office of the Secretary of Health and Human Services (HHS/OS/OASH/OMH) is establishing a new system of records, “Think Cultural Health,” to support its Think Cultural Health Web site Program. The system will provide educational information, training, best practices, and tools to health professionals as one initiative to help them accomplish cultural competency in accordance with national Culturally and Linguistically Appropriate Services (CLAS) Standards. The CLAS standards were originally promulgated by OMH in 2001 and are being revised and enhanced in order to guide health and health care organizations in the provision of culturally and linguistically appropriate services that will improve the health care of all Americans.

The system will maintain registration and training records containing personally identifiable information (PII) about individual health professionals who are registrants/users of the Think Cultural Health Web site. The program and the system of records are more thoroughly described in the Supplementary Information section and System of Records Notice (SORN) below.

DATES:

Effective Dates: Effective 30 days after publication. Written comments should be submitted on or before the effective date. HHS/OS/OASH/OMH may publish an amended SORN in light of any comments received.

ADDRESSES:

The public should address written comments to Mr. Guadalupe Pacheco, Senior Health Advisor to the Director, Office of Minority Health, by mail or email, at 1101 Wootton Parkway, Suite 600, Rockville, MD 20852 or guadalupe.pacheco@hhs.gov.

FOR FURTHER INFORMATION CONTACT:

Mr. Guadalupe Pacheco, Senior Health Advisor to the Director, Office of Minority Health, 1101 Wootton Parkway, Suite 600, Rockville, MD 20852. He can be reached by telephone at (240) 453-6174 or via email at guadalupe.pacheco@hhs.gov.

SUPPLEMENTARY INFORMATION:

I. The Think Cultural Health Web Site Program

The Think Cultural Health Web site Program was created in recognition of the effectiveness of on-line distance learning. It supports the HHS/OS/OASH/OMH in complying with the cultural competency requirements of the Affordable Care Act of 2010 (Pub. L. 111-148), as well as the HHS Action Plan to Reduce Racial and Ethnic Health Disparities, the National Stakeholder Strategy for Achieving Health Equity, Healthy People 2020, the Secretary's Strategic Plan priorities, and the Assistant Secretary for Health's Public Health Quality Agenda. The program will use a Web site to post information such as cultural competency, language access and health disparities articles, and notices of health disparities conferences for viewing by any visitors to the site. Other resources, consisting of training and newsletters, will be available through the Web site to health professionals who register to use those resources. The Think Cultural Health system will not collect PII about visitors, but will collect PII about registrants/users. Use of the resources offered on the site is voluntary, but registration information is required to determine if the site is used by variety of health professionals, representing different disciplines, skill sets, and demographic locations. The provision of data concerning the registrant's gender and race is optional. Additionally, training and test records are needed for reports to accrediting bodies.

II. The Privacy Act

The Privacy Act (5 U.S.C. 552a) governs the means by which the United States Government collects, maintains, and uses PII in a system of records. A “system of records” is a group of any records under the control of a Federal agency from which information about individuals is retrieved by name or other personal identifier. The Privacy Act requires each agency to publish in the Federal Register a SORN identifying and describing each system of records the agency maintains, including the purposes for which the agency uses PII in the system, the routine uses for which the agency discloses such information outside the agency, and how individual record subjects can exercise their rights under the Privacy Act (e.g., to determine if the system contains information about them).

SYSTEM NUMBER:

09-90-1202

SYSTEM NAME:

Think Cultural Health

SECURITY CLASSIFICATION:

Unclassified

SYSTEM LOCATION:

Servers: The servers hosting the system will be housed at Equinix Data Center 2, Ashburn, VA. Portals: This system will be accessed via the Internet at www.ThinkCulturalHealth.hhs.gov. System Software: System software is maintained by Astute Technology in Reston, Virginia.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The system will contain PII about individual health professionals who register to receive a monthly newsletter distributed via email through the site or to take training offered on the site.

CATEGORIES OF RECORDS IN THE SYSTEM:

The system will contain the following categories of records and PII data elements:

• Newsletter registration records and E-learning registration records, including registrant's first and last name, email address, User ID number, user name, street address, degree, certificate type, gender, age, race/ethnicity, practice setting, level of seniority, primary role, years in profession, notification information, and current and future contact information.
• E-learning training and test records, including registrant's first and last name, evaluation data, pretest and posttest scores, and E-learning registration information.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

The statutory authority for maintenance of the system is Section 5307 of the Affordable Care Act of 2010, Public Law 111-148, codified at 42 U.S.C. 293e and 42 U.S.C. 296e-1.

PURPOSE(S) OF THE SYSTEM:

HHS/OS/OASH/OMH personnel will use PII in the system, on a “need to know” basis, for the following purposes:

• To identify individuals who request to receive the Think Cultural Health newsletter;
• To identify individuals who enroll in the Think Cultural Health E-learning program and receive continuing education credits;
• To report the fulfillment of continuing education credits to the accrediting bodies; and
• To evaluate statistics showing how, where, and by whom the program is utilized; for HHS research, marketing, and quality improvement purposes directed at ensuring the site is used by individuals representing a variety of skills and backgrounds.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

The system may disclose records containing PII to parties outside HHS for the following routine uses:

1. Certain E-learning test records, consisting of the registrant's name, evaluation data, pretest and posttest scores, and registration information, will be disclosed to accrediting bodies (such as Cine-Med and Indian Health Services), for their use in reporting continuing education credits for health professionals who complete all or part of the training program.

2. Records may be disclosed to agency contractors, consultants, or HHS grantees who have been engaged by the agency to assist in accomplishment of an HHS function relating to the purposes of this system of records and who need to have access to the records in order to assist HHS.

3. Records may be disclosed to the Department of Justice (DOJ), a court, or an adjudicatory body when:

• The agency or any component thereof; or
• Any employee of the agency in his or her official capacity, or
• Any employee of the agency in his or her individual capacity where DOJ has agreed to represent the employee, or
• The United States Government,

is a party to litigation or has an interest in such litigation and, by careful review, HHS determines that the records are both relevant and necessary to the litigation and that the use of such records by the DOJ, court, or adjudicatory body is compatible with the purpose for which the agency collected the records.

4. Records may be disclosed to another Federal agency or an instrumentality of any governmental jurisdiction within or under the control of the United States (including any State or local governmental agency) that administers, or that has the authority to investigate potential fraud, waste, or abuse in federally funded programs, when disclosure is deemed reasonably necessary by HHS to prevent, deter, discover, detect, investigate, examine, prosecute, sue with respect to, defend against, correct, remedy, or otherwise combat fraud, waste or abuse in such programs.

5. Records may be disclosed to appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department's efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, when the information disclosed is relevant and necessary for that assistance.

6. Records may become accessible to U.S. Department of Homeland Security (DHS) cyber security personnel, if captured in an intrusion detection system used by HHS and DHS pursuant to the Einstein 2 program. Under Einstein 2, DHS uses intrusion detection systems to monitor Internet traffic to and from federal computer networks to prevent malicious computer code from reaching the networks. According to DHS' Privacy Impact Assessment for Einstein 2 (available on the DHS Cybersecurity privacy Web site, http://www.dhs.gov/files/publications/editorial_0514.shtm#4 ), only PII that is directly related to a malicious code security incident is captured and accessible to DHS, and DHS does not access any captured PII; however, accessibility alone may constitute a disclosure under the Privacy Act.

The system may also disclose PII data for any of the uses authorized directly in the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(11).

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM

STORAGE:

Information will be collected via email, web form, or telephone. Electronic records are stored in databases on magnetic tape, on magnetic disk and in secure electronic files at the contractor's location (Astute Technology, Reston, VA), the data center (Equinix, Ashburn, VA) and at the tape storage facility (GRM, Capital Heights, MD).

RETRIEVABILITY:

Registration and training records will be retrieved by registrant/user name, email address, or User ID number.

SAFEGUARDS:

Access to the records in the Think Cultural Health database will be limited to agency contractors, consultants, or HHS grantees who have been engaged by the agency to assist in accomplishment of an HHS function utilizing password security, encryption, firewalls and secured operating system.

RETENTION AND DISPOSAL:

Information about newsletter recipients will be maintained until requested to be removed by the individual on whom the information is maintained. Information about training registrants will be maintained for a minimum of six years after the contract is no longer funded.

SYSTEM MANAGER AND ADDRESS:

Guadalupe Pacheco, Senior Health Advisor to the Director, Office of Minority Health, 1101 Wootton Parkway, Suite 600, Rockville, MD 20852.

NOTIFICATION PROCEDURE:

Individuals wishing to know if this system contains records about them should write to the System Manager and include the email address used for registration.

RECORD ACCESS PROCEDURE:

Individuals seeking access to records about them in this system should follow the same instructions indicated under “Notification Procedure” and indicate the record(s) to which access is sought (e.g., newsletter registration, E-learning registration, or training record).

CONTESTING RECORD PROCEDURES:

Individuals seeking to contest the content of information about them in this system should follow the same instructions indicated under “Notification Procedure.” The request should reasonably identify the record, specify the information contested, state the corrective action sought, and provide the reasons for the correction, with supporting justification.

RECORD SOURCE CATEGORIES:

All information will be collected directly from the Web site registrants/users themselves when they complete one or more than one of the following information collection forms:

• Center for Linguistic and Cultural Competency in Health Care (CLCCHC) Registration Form
• A Physician's Practical Guide to Culturally Competent Care Registration Form
• Culturally Competent Nursing Care: A Cornerstone of Caring Registration Form
• Cultural Competency Curriculum for Disaster Preparedness and Crisis Response Registration Form
• Health Care Language Services Implementation Guide Registration Form

EXEMPTIONS CLAIMED FOR THIS SYSTEM:

None