Skip Navigation
[Federal Register: September 6, 2002 (Volume 67, Number 173)]
[Notices]
[Page 57011-57014]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr06se02-72]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of Civil Rights
Privacy Act of 1974; New System of Records
AGENCY: Office for Civil Rights, HHS.
ACTION: Notification of a New System of Records (SOR).
-----------------------------------------------------------------------
SUMMARY: In accordance with the requirements of the Privacy Act, the
Office for Civil Rights (OCR) is publishing notice of a new system of
records (SOR) called the ``Program information Management System
(PIMS), HHS/OS/OCR (09-90-0052).'' We are giving notice of the routine
uses for this new system.
EFFECTIVE DATES: OCR invites interested parties to submit comments on
the proposed internal and routine uses on or before October 7, 2002.
OCR has sent a Report of a New System of Records to the Congress and to
the Office of Management and Budget (OMB) on August 6, 2002. The system
of records
[[Page 57012]]
will be effective 40 days from the date submitted to OMB unless OCR
receives comments which would result in a contrary determination.
ADDRESSES: The public should address comments to: Larry Velez, Program,
Policy and Training Division, Office for Civil Rights, Department of
Health and Human Services, Room 553E, Hubert H. Humphrey Building, 200
Independence Avenue SW., Washington, DC 20201. Comments also may be
sent via e-mail to OCRmail@hhs.gov. Comments received will be through
Friday from 9 a.m. - 3 p.m., eastern standard time.
FOR FURTHER INFORMATION CONTACT: Claudia Schlosberg, Acting Director,
Program, Policy and Training Division, Office for Civil Rights,
Department of Health and Human Services, Room 553E, Hubert H. Humphrey
Building, 200 Independence Avenue SW., Washington, DC 20201. Telephone
number: (202) 619-3197.
SUPPLEMENTARY INFORMATION: The Office for Civil Rights (OCR) is
responsible for enforcing Title VI of the Civil Rights Act of 1964,
section 504 of the Rehabilitation Act of 1973, the Age Discrimination
Act of 1975 and other statutes which prohibit discrimination by
programs or entities that receive Federal financial assistance.
Additionally, OCR has jurisdiction over Federally conducted programs in
cases involving disability-based discrimination under section 504 of
the Rehabilitation Act, over state and local public entities in cases
involving disability-based discrimination under Title II of the
Americans with Disabilities Act and certain health plans, health
clearinghouses and health care providers with respect to enforcement of
medical privacy obligations under the Health Insurance Portability and
Accountability Act (HIPAA).
Currently, OCR maintains two system of records: the ``Case
Information Management System (CIMS), HHS/OS/OCR (09-90-0050),'' and
the ``Complaint File and Log, HHS/OS/OCR (09-90-0051).'' CIMS also
includes the Case Activity Tracking System (CATS) which was created to
use newer computer technology (i.e., moved CIMS off a mainframe
computer onto a local area network environment), but continued to
collect and store the same information as in CIMS.
CMS is used to track complaints and compliance review activity. The
Complaint File and Log consists primarily of paper files, complaint
allegations, information gathered during complaint investigations or
reviews, letters of findings and correspondence relating to
investigations. The Complaint File and Log was exempted from the
notification, access, correction and amendment provisions of the
Privacy Act under subsection (k)(2) concerning records compiled for law
enforcement purposes. 49 FR 14107 (April 10, 1984).
OCR proposes to establish a new system of records: ``Program
Information Management System (PIMS), HHS/OS/OCR (09-90-0052).'' PIMS
will be used for OCR staff and will consist of an electronic repository
of information and documents, and supplementary paper document files.
PIMS effectively combines and replaces OCR's two existing systems of
records, (CIMS and the Complaint File and Log), into a single
integrated system with enhanced electronic storage, retrieval and
tracking capacities. While the types of information collected and
stored in PIMS will be the same as the information collected in CIMS
and the Complaint File and Log, PIMS will allow OCR to manage more
effectively the information that it does collect.
The PIMS system will allow OCR to integrate all of OCR's various
business processes, including all its compliance activities, to allow
for real time access and results reporting and other varied information
management needs. PIMS will provide: (1) A single, central, electronic,
repository of all OCR documents and information including investigative
files, correspondence, administrative records, policy and procedure
manuals and other documents and information developed or maintained by
OCR; (2) easy, robust capability to search all the information in OCR's
repository; (3) better quality control at the front end with simplified
data entry and stronger data validation; (4) tools to help staff work
on and manage their casework, and (5) supplementary document files. The
system will have the capacity to generate reports concerning the status
of all current and closed complaints, reviews and correspondence, and
will allow OCR to track outreach, training and other activities and to
locate and retrieve information in order to manage more efficiently its
work and report results. In addition, PIMS, consistent with its
predecessor management information systems, will allow for the tracking
of work assignments to employees to facilitate workload balancing,
timely response to complaints and completion of reviews, and outreach
and public education initiatives focused on organizations and
individuals.
OCR investigative files maintained in PIMS either as paper records
or electronic documents are records compiled for law enforcement
purposes. In the course of investigations, OCR often has a need to
obtain confidential information involving individuals other than the
complainant. In these cases, it is necessary for OCR to preserve the
confidentiality of this information to avoid unwarranted invasions of
personal privacy and to assure recipients of Federal financial
assistance that such information provided to OCR will be kept
confidential. This assurance is often central to resolving disputes
concerning access by OCR to the recipients's records, and is necessary
to facilitate prompt and effective completion of the investigations.
Unrestricted disclosure of confidential information in OCR files
can impede ongoing investigations, invade personal privacy of
individuals, reveal the identities of confidential sources, of
otherwise impair the ability of OCR to conduct investigations. For
these reasons, the Department is exempting all investigative files from
the notification, access, correction and amendment provisions under
subsection (k)(2) of the Privacy Act.
The PIMS system will conform to applicable law and policy governing
the privacy and security of Federal automated information systems.
These include, but are not limited to: The Privacy Act of 1984,
Computer Security Act of 1987, the Paperwork Reduction Act of 1995, the
Clinger-Cohen Act of 1996, and OMB Circular A-130, Appendix, III,
``Security of Federal Automated Information Resources.'' OCR has
prepared a system security plan as required by OMB Circular A-130,
Appendix III. This plan conforms fully to guidance issued by the
National Institute for Standards and Technology (NIST) in NIST Special
Publication 800-18, ``Guide for Developing Security Plans for
Information Technology Systems.'' The plan includes conduct of a risk
assessment that addresses the confidentiality and integrity of the
data.
Only authorized users whose official duties require the use of such
information will have regular access to the records in this system.
Records may be disclosed to student volunteers, individuals working
under a personal services contract, and other individuals performing
functions for the Department, but technically not having the status of
agency employees, if they need access to the records in order to
perform their assigned agency functions.
The routine uses proposed for this system are compatabile with the
stated purpose of the system. The first routine use proposed for this
system, permitting disclosure to a congressional office,
[[Page 57013]]
allows subject individuals to obtain assistance from their
representatives in Congress, should they so desire. Such disclosure
would be made only pursuant to the request of the individual. The
second routine use allows disclosure to the Department of Justice or a
court in the event of litigation. The third routine use allows referral
to the appropriate agency, in the event that a System of Records
maintained by this agency to carry out its functions indicates a
violation or potential violation of law. The fourth routine use allows
disclosure of records to contractors for the purpose of processing or
refining records in the system.
The following notice is written in the present, rather than future
tense, in order to avoid the unnecessary expenditure of public funds to
republish the notice after the system has become effective.
Dated: August 30, 2002.
Richard M. Campanelli,
Director, Office for Civil Rights.
09-90-0052
System Name:
Program Information Management System (PIMS), HHS/OS/OCR.
Security Classification:
None.
System Location:
The automated portion of the system is maintained at OCR
Headquarters. Paper files are maintained in headquarters and regional
offices as noted in Appendix I.
Categories of Individuals Covered by the System:
Covered individuals include persons who file complaints alleging
discrimination or violation of their rights under the statutes
identified below (Authority for Maintenance) and covered entities
(e.g., service providers) that are individuals and not organization or
institutions, investigated by OCR as a result of complaints filed or
through reviews conducted by OCR. Covered individuals also include
persons who submit correspondence to OCR related to other compliance
activities, (e.g., outreach and public education) and other
correspondence unrelated to a complaint or review and requiring
response by OCR. In addition, OCR employees who use the system to
record the status of their work are covered.
Categories of Records in the System:
The system encompasses a variety of records having to do with
complaints, reviews, and correspondence. The complaint files and log
include complaint allegations, information gathered during the
complaint investigation, findings and results of the investigation, and
correspondence relating to the investigation, as well as status
information for all complaints. This component of PIMS is being
exempted from the notification, access, correction and amendment
provisions of the Privacy Act (see below: Systems Exempted From Certain
Provisions of the Act). Equivalent types of information are maintained
for reviews and correspondence activities--namely information gathered,
findings, results, correspondence and status.
Authority for Maintenance of the System:
Title VI of the 1964 Civil Rights Act; sections 533, 542, 794, 855,
1947 and 1908 of the Public Health Service Act; sections 504 and 508 of
the Rehabilitation Act of 1973: Title II of the Americans with
Disabilities Act of 1990; the Age Discrimination Act of 1975; the Equal
Employment Opportunity Provisions of the Public Telecommunications
Financing Act of 1978; Title VI and Title XVI of the Public Health
Service Act (the ``community services of obligation'' of facilities
funded under the Act); Title IX of the 1972 Education Amendments;
section 407 of the Drug Abuse Office and Treatment Act; section 321 of
the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment,
and Rehabilitation Act of 1970; section 508 of the Social Security Act,
the Family Violence Prevention and Services Act; Low-Income Home Energy
Assistance Act of 1981; Section 1808 of the Small Business Job
Protection Act of 1996; and the Health Insurance Portability and
Accountability Act of 1996 (HIPAA).
PURPOSE(S):
PIMS will be used by OCR staff and will consist of an electronic
repository of information and documents, and supplementary paper
document files. PIMS effectively combines and replaces OCR's two
existing systems of records, the ``Case Information Management System
(CIMS), HHS/OS/OCR, 09-90-0050,'' and the ``Complaint File and Log,
HHS/OS/OCR 09-00-0051,'' into a single integrated system with enhanced
electronic storage, retrieval and tracking capacities. While the types
of information collected and stored in PIMS will be the same as the
information collected in CIMS and the Complaint File and Log, PIMS will
allow OCR to manage more effectively the information that it does
collect. The system is designed to allow OCR to integrate all of OCR's
various business processes, including all its compliance activities, to
allow for real time access and results reporting and other varied
information management needs. PIMS will provide: (1) A single, central,
electronic, repository of all significant OCR documents and
information, including investigative files, correspondence,
administrative records, policy and procedure manuals and other
documents and information developed or maintained by OCR; (2) easy,
robust capability to search all the information in OCR's repository;
(3) better quality control at the front end with simplified data entry
and stronger data validation; (4) tools to help staff work on and
manage their casework, and (5) supplementary papaer document files. The
system will have the capacity to generate reports concerning the status
of all current and closed complaints, reviews and correspondence, and
will allow OCR to track outreach, training and other activities and to
locate and retrieve information in order to manage more efficiently its
work and report results. In addition, PIMS, consistent with its
predecessor management information systems, will allow for the tracking
of work assignments to employees to facilitate workload balancing,
timely response to complaints and completion of review, and outreach
and public education initiatives focused on organizations and
individuals.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OR USERS AND THE PURPOSES OF SUCH USES:
The routine uses proposed for this system are compatible with the
stated purpose of the system. The first routine use proposed for this
system, permitting disclosure to a congressional office, allows subject
individuals to obtain assistance from their representatives in
Congress, should they so desire. Such disclosure would be made only
pursuant to the request of the individual. The second routine use
allows disclosure to the Department of Justice or a court in the event
of litigation. The third routine use allows referral to the appropriate
agency, in the event that a System of Records maintained by this agency
to carry out its functions indicates a violation or potential violation
of law. The fourth routine use allows disclosure of records to
contractors for the purpose of processing or refining records in the
system.
[[Page 57014]]
POLICIES AND PRACTICES FOR STRONG, RETRIEVING, ACCESSING, RETAINING,
AND DISPOSING OF RECORDS IN THE SYSTEM:
Storage:
Automated records are maintained on magnetic disc and tape back-up.
Paper records are kept in file folders.
Retrievability:
Records are indexed by transaction number, but may be retrieved by
name, street address, and other complainant or covered entity
characteristic (such as type of entity, city, state and type of service
provided) by OCR staff engaged in compliance activities.
Safeguards:
The PIMS system will conform to applicable law and policy governing
the privacy and security of Federal automated information systems.
These include but are not limited to: the Privacy Act of 1984, Computer
Security Act of 1987, the Paperwork Reduction Act of 1995, the Clinger-
Cohen Act of 1996, and OMB Circular A-130, Appendix III, ``Security of
Federal Automated Information Resources.'' OCR has prepared a system
security plan as required by OMB Circular A-130, Appendix III. This
plan conforms fully to guidance issued by the National Institute for
Standards and Technology (NIST) in NIST Special Publication 800-18,
``Guide for Developing Security Plans for Information Technology
Systems.'' The plan includes conduct of a risk assessment that
addresses the confidentiality and integrity of the data.
Only authorized users have access to the information in the system.
Categories of users include: OCR investigators, regional and
headquarters managers, team leaders, OCR budget and Government
Performance and Results Act planning staff, program and policy staff,
and data analysts. Specific access to structured around need and is
determined by the person's role in the organization. Access is managed
through the use of electronic access control lists, which regulate the
ability to read, change and delete information in the system. Each OCR
user has read access to designated information in the system, with the
ability to modify only their own submissions or those of others within
their region or group. Data identified as confidential is so designated
and only specified individuals are granted access. The system maintains
an audit trail of all actions against the data base.
All electronic data is stored on servers maintained in locked
facilities with computerized access control allowing access to only
those support personnel with a demonstrated need for access. A data
base is kept of all individuals granted security cart access to the
room, and all visitors are escorted while in the room. The server
facility has appropriate environmental security controls, including
measures to mitigate damage to automated information system resources
caused by fire, electricity, water and inadequate climate controls.
Access control to servers, individual computers and databases
includes a required user log-on with a password, inactivity lockout to
systems based on a specified period of time, legal notices and security
warnings at log-on, and remote access security that allows user access
for remote users (e.g., while on government travel) under the same
terms and conditions as for users within the office. System
administrators have appropriate security clearance.
Printed materials are filed in secure cabinets in secure Federal
buildings with access based on need as described above for the
automated component of the PIMS system.
Retention and Disposal:
Documents related to complaints and reviews are retained at OCR for
two years from the date the complaint is closed and then are archived
at the National Archives and Records Administration for 15 years.
Correspondence is retained for one year following the end of the fiscal
year in which processed.
System Manager(s) and Address:
PIMS Project Manager, Resource Management Division, Office for
Civil Rights, 200 Independence Ave. SW., Room 509F, Washington, DC
20201.
Notification Procedure:
Contact System Manager (above). Include name and address of
complainant, and name of the recipient against which the allegation was
filed. The Department is exempting all investigative records from this
provision (see below: Records Exempted).
Record Access Procedure:
Same as notification procedures. Requesters should also reasonably
specify the record contents being sought. Request should be made to the
system manager (above). The Department is exempting all investigative
records from this provision (see below: Records Exempted).
Contesting Record Procedure:
Contact the official(s) at the address specified under System
Manager, and reasonably identify the record and specify the information
to be contested and corrective action sought with supporting
justification. (These procedures are in accordance with Department
Regulations (45 CFR 5b.7) Federal Register, October 8, 1975, page
47411.) The Department is exempting all investigative records from this
provision (see below: Records Exempted).
Record Source Categories:
Information is provided by complainants and covered entities.
Records Exempted from Certain Provisions of the Act:
OCR investigative records maintained in PIMS, either as paper
records or electronic documents are records complied for law
enforcement purposes and will be exempt under subsection (k)(2) from
the notification, access, correction and amendment provisions of the
Privacy Act.
Appendix Number 1--System Locations:
This system is located at HHS offices in the following cities.
Headquarters, PIMS Project Manager, Resource Management Division,
Office for Civil Rights, 200 Independence Ave. SW., Room 509F,
Washington, DC 20201.
Region I, Regional Manager, OCR/HHS, J.F. Kennedy Federal Building--
Room 1875, Boston, Massachusetts 02203.
Region II, Regional Manager, OCR/HHS, 26 Federal Plaza--Suite 3312,
New York, NY 10278.
Region III, Regional Manager, OCR/HHS, 150 S. Independence Mall
West, Suite 372, Public Ledger Building, Philadelphia, PA 19106.
Region IV, Regional Manager, OCR/HHS, Atlanta Federal Center, Suite
3B70, 67 Forsyth Street, SW., Atlanta, GA 30303.
Region V, Regional Manager, OCR/HHS, 233 N. Michigan Ave, Suite 240,
Chicago, IL 60601.
Region VI, Regional Manager, OCR/HHS, 1301 Young Street, Suite 1169,
Dallas, TX 75202.
Region VII, Regional Manager, OCR/HHS, 601 E. 12th Street--Room 248,
Kansas City, MO 64106.
Region VIII, Regional Manager, OCR/HHS, Federal Office Building,
1961 Stout Street--Room 1185, Denver, CO 80294.
Region IX, Regional Manager, OCR/HHS, 50 United Nations Plaza--Room
322, San Francisco, CA 94102.
Region X, Regional Manager, OCR/HHS, 2201 Sixth Avenue--Suite 900,
Seattle, WA 98121.
[FR Doc. 02-22602 Filed 9-5-02; 8:45 am]
BILLING CODE 4153-01-M