Privacy Act; Implementation

<RULE> DEPARTMENT OF HEALTH AND HUMAN SERVICES <CFR>45 CFR Part 5b</CFR> <DEPDOC>[Docket Number NIH-2022-0002]</DEPDOC> <RIN>RIN 0925-AA69</RIN> <SUBJECT>Privacy Act; Implementation</SUBJECT> <HD SOURCE="HED">AGENCY:</HD> National Institutes of Health (NIH), Department of Health and Human Services (HHS). <HD SOURCE="HED">ACTION:</HD> Final rule. <SUM> <HD SOURCE="HED">SUMMARY:</HD> The Department of Health and Human Services (HHS or Department) is issuing this final rule to make effective the exemptions that were previously proposed for a new Privacy Act system of records, “NIH Police Records,” maintained by the National Institutes of Health (NIH), from certain requirements of the Act. The new system of records covers criminal and non-criminal law enforcement investigatory material maintained by the NIH Division of Police, a component of NIH which performs criminal law enforcement as its principal function. The exemptions are necessary and appropriate to protect the integrity of law enforcement proceedings and records compiled during the course of NIH Division of Police activities, prevent disclosure of investigative techniques, and protect the identity of confidential sources involved in those activities. </SUM> <EFFDATE> <HD SOURCE="HED">DATES:</HD> This final rule is effective February 18, 2025. </EFFDATE> <FURINF> <HD SOURCE="HED">FOR FURTHER INFORMATION CONTACT:</HD> Dustin Close, Office of Management Assessment, National Institutes of Health, 6705 Rockledge Drive, Suite 601, Bethesda, Maryland 20892, telephone 301-402-6469, email <E T="03">privacy@mail.nih.gov.</E> </FURINF> <SUPLINF> <HD SOURCE="HED">SUPPLEMENTARY INFORMATION:</HD> <HD SOURCE="HD1">I. Introduction</HD> HHS/NIH published a Notice of Proposed Rulemaking (NPRM) in the <E T="04">Federal Register</E> on June 7, 2024 (89 FR 48536), seeking notice and comment concerning proposed exemptions for a new system of records with respect to certain materials maintained by the NIH Division of Police. These proposals were made in accordance with the Privacy Act of 1974 (Privacy Act) and the Office of Management and Budget (OMB) Circular A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act. This new system of records was described in a System of Records Notice (SORN) that was published in the <E T="04">Federal Register</E> (89 FR 48654) on the same day for notice and comment. A 60-day comment period was provided for both the NPRM and the SORN. The public comment period for both the NPRM and the SORN expired on August 6, 2024. One comment was received in response to the NPRM, and no comments were received in response to the SORN. The comment received in response to the NPRM supported the rulemaking action. HHS/NIH made no changes to the exemptions that were proposed in the NPRM or to the SORN in response to the public comment received. The NPRM, as published on June 7, 2024 (89 FR 48654), provided for the SORN to be effective upon publication of this final rule. Therefore, the SORN, as published on June 7, 2024 (89 FR 48654), is now effective. <HD SOURCE="HD1">II. Background on the NIH Police Division and New System of Records 09-25-0224</HD> The NIH Division of Police, organizationally located within the Office of Research Services (ORS), Office of the Director, NIH, was established in 1968 to provide an immediate and primary law enforcement program for the NIH and derives its authority from Memorandum from the Assistant Secretary for Administration, Office of the Secretary (OS), to the Director, NIH, June 13, 1968, entitled: Delegation of Authority to Assist in Controlling Violations of Law at Certain HEW [Department of Health, Education, and Welfare] Facilities Located in Montgomery County, Maryland; 40 U.S.C. 1315 (Law enforcement authority of Secretary of Homeland Security for protection of public property; a Department of Homeland Security (DHS) delegation of authority to HHS/NIH; and an NIH delegation of authority to the NIH Division of Police); General Administrative Delegation of Authority Number 08, Control of Violations of Law at Certain NIH Facilities (Sept. 1, 2020). Based on that establishing authority, the Division of Police performs criminal law enforcement as its principal function. However, the Division of Police conducts criminal, civil, administrative, and regulatory law enforcement investigations. The NIH Division of Police is directly responsible for the provision of daily law enforcement and criminal and civil investigative activities required to protect the life, safety, and property of NIH employees, contractors, patients, and visitors at NIH. To perform these responsibilities, the NIH Division of Police compiles and maintains records of complaints of incidents, inquiries, investigative findings, arrest records, and court dispositions which are retrieved by personal identifiers and therefore constitute a “system of records” as defined by the Privacy Act at 5 U.S.C. 552a(a)(5). The primary purposes for which the records are used are to: (1) record incidents of crime, civil disturbance, and traffic accidents on the NIH enclave, and the investigation of such incidents; (2) maintain information essential to the protection of life, safety, and property at NIH; (3) provide official records of law enforcement investigative efforts for use in administrative, criminal and/or civil proceedings; and (4) document criminal and civil law enforcement investigations. <HD SOURCE="HD1">III. Eligible Records and Exemptions</HD> The new system of records includes both criminal and non-criminal ( <E T="03">e.g.,</E> civil, administrative, regulatory) law enforcement investigatory records which will be retrieved by subject individuals' personal identifiers. Such records are eligible to be exempted from certain Privacy Act requirements, as follows: • Subsection (j)(2) of the Privacy Act (5 U.S.C. 552a(j)(2)) allows an agency head to exempt from certain Privacy Act provisions a system of records maintained by the agency or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws. • Subsection (k)(2) of the Act (5 U.S.C. 552a(k)(2)) allows an agency head to exempt from certain Privacy Act provisions a system of records containing investigatory material compiled for law enforcement purposes, other than material within the scope of subsection (j)(2) (for example, material compiled for a civil, administrative, or regulatory law enforcement purpose, or material compiled for a criminal law enforcement purpose by an agency component that does not perform criminal law enforcement as its principal function). This exemption's effect on the subject individual's access rights is qualified in that if any individual is denied any right, privilege, or benefit to or for which the individual otherwise would be entitled by Federal law, or for which the individual would otherwise be eligible, as a result of the maintenance of the system of records, the individual must be provided the requested materials except to the extent that disclosure would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence. HHS/NIH is establishing the following exemptions for the records: • Based on 5 U.S.C. 552a(k)(2), HHS/NIH is exempting non-criminal ( <E T="03">e.g.,</E> civil, administrative, regulatory) law enforcement investigatory material in System No. 09-25-0224 from the requirements in subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Privacy Act, which require the agency to provide an accounting of disclosures; provide notification, access, and amendment rights; maintain only relevant and necessary information authorized by a statute or Executive order; establish and describe procedures whereby an individual can be notified if a system of records contains information pertaining to that individual and how to gain access to pertinent records; identify categories of record sources; and promulgate rules regarding these procedures. The effect of this exemption on a subject individual's access rights will be to permit withholding the records during an ongoing investigation, but limited as required by subsection (k)(2) to information that would reveal the identity of a source who was expressly promised confidentiality in cases in which maintenance of the records results in denial of a Federal right, privilege, or benefit to or for which the individual would otherwise be entitled or eligible. • Based on subsection 5 U.S.C. 552a(j)(2), HHS/NIH is exempting criminal law enforcement investigatory material in System No. 09-25-0224 from the same requirements identified above, and from these additional subsections: ○ (c)(4), requiring the agency to inform disclosure recipients of corrections and notations of dispute affecting disclosed records; ○ (e)(2) and (3), requiring the agency to collect information directly from the subject individual to the greatest extent practicable and to provide a Privacy Act notice to the individual at the time of collection; ○ (e)(5), requiring the agency to maintain records used in agency determinations with sufficient accuracy, relevance, timeliness, and completeness to ensure fairness to individuals; ○ (e)(8), requiring the agency to attempt to notify an individual when a record about the individual is disclosed under compulsory legal process; and ○ (g), subjecting the agency to civil action and civil remedies for noncompliance with access, amendment, and accuracy, relevance, timeliness, and completeness requirements, and for noncompliance that adversely affects an individual. Notwithstanding the establishment of these exemptions, individual record subjects may submit accounting, access, notification, and amendment ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Preview showing 10k of 29k characters. Full document text is stored and available for version comparison. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━