Notice2021-27041
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
December 14, 2021
Issuing agencies
National Aeronautics and Space Administration
Abstract
Pursuant to the provisions of the Privacy Act of 1974, the National Aeronautics and Space Administration is issuing public notice of its proposal to alter a previously noticed system of records NASA Health Information Management System/NASA 10HIMS. This adds a retention schedule and revises NASA standard routine uses, as set forth below under the caption SUPPLEMENTARY INFORMATION.
Full Text
<html>
<head>
<title>Federal Register, Volume 86 Issue 237 (Tuesday, December 14, 2021)</title>
</head>
<body><pre>
[Federal Register Volume 86, Number 237 (Tuesday, December 14, 2021)]
[Notices]
[Pages 71097-71099]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2021-27041]
-----------------------------------------------------------------------
NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
[NOTICE: (21-084)]
Privacy Act of 1974; System of Records
AGENCY: National Aeronautics and Space Administration (NASA).
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: Pursuant to the provisions of the Privacy Act of 1974, the
National Aeronautics and Space Administration is issuing public notice
of its proposal to alter a previously noticed system of records NASA
Health Information Management System/NASA 10HIMS. This adds a retention
schedule and revises NASA standard routine uses, as set forth below
under the caption SUPPLEMENTARY INFORMATION.
DATES: Submit comments within 30 calendar days from the date of this
publication. The changes will take effect at the end of that period, if
no adverse comments are received.
ADDRESSES: Patti F. Stockman, Privacy Act Officer, Office of the Chief
Information Officer, National Aeronautics and Space Administration
Headquarters, Washington, DC 20546-0001, (202) 358-4787, <a href="/cdn-cgi/l/email-protection#9ed0dfcddfb3cedfd1f8f8f7fdfbecdef0ffedffb0f9f1e8"><span class="__cf_email__" data-cfemail="622c2331234f32232d04040b010710220c0311034c050d14">[email protected]</span></a>.
FOR FURTHER INFORMATION CONTACT: NASA Privacy Act Officer, Patti F.
Stockman, (202) 358-4787, <a href="/cdn-cgi/l/email-protection#8ec0cfddcfa3decfc1e8e8e7edebfccee0effdefa0e9e1f8"><span class="__cf_email__" data-cfemail="f9b7b8aab8d4a9b8b69f9f909a9c8bb997988a98d79e968f">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION: This notice adds a retention schedule that
covers individual health records under Policies and Practices for
Retention and Disposal of Records. It also revises Standard Routine Use
5 to clarify conditions under which NASA will release records to a
legal body for a proceeding involving NASA.
Cheryl Parker,
Federal Register Liaison Officer.
SYSTEM NAME AND NUMBER:
Health Information Management System, NASA 10HIMS.
SECURITY CLASSIFICATION:
None.
SYSTEM LOCATION:
Records of Medical Clinics/Units and Environmental Health Offices
are maintained at:
Mary W. Jackson NASA Headquarters, National Aeronautics and Space
Administration (NASA), Washington, DC 20546-0001;
Ames Research Center (NASA), Moffett Field, CA 94035-1000;
Armstrong Flight Research Center (NASA), PO Box 273, Edwards, CA
93523-0273;
John H. Glenn Research Center at Lewis Field (NASA), 21000
Brookpark Road, Cleveland, OH 44135-3191;
Goddard Space Flight Center (NASA), Greenbelt, MD 20771-0001;
Lyndon B. Johnson Space Center (NASA), Houston, TX 77058-3696;
John F. Kennedy Space Center (NASA), Kennedy Space Center, FL
32899-0001;
Langley Research Center, (NASA), Hampton, VA 23681-2199;
George C. Marshall Space Flight Center (NASA), Marshall Space
Flight Center, AL 35812-0001;
John C. Stennis Space Center (NASA), Stennis Space Center, MS
39529-6000;
Michoud Assembly Facility (NASA), PO Box 29300, New Orleans, LA
70189; and
Wallops Flight Facility (NASA), Wallops Island, VA 23337.
Electronic records are also hosted at:
CORITY Chicago Data Center, 341 Haynes Drive, in Wood Dale,
Illinois 60191;
Salesforce Government Cloud in Ashburn, Virginia; and
Salesforce Disaster Recovery Center in Elk Grove Village, Illinois.
SYSTEM AND SUBSYSTEM MANAGER(S):
Chief Health and Medical Officer at NASA Headquarters (see System
Location above for address).
Subsystem Managers:
Director Health and Medical Systems, Occupational Health at NASA
Headquarters (see System Location above for address);
Chief, Space Medicine Division at NASA Johnson Space Center (see
System Location above for address);
Occupational Health Contracting Officer Representatives at NASA
Ames Research Center, (see System Location above for address);
NASA Armstrong Flight Research Center (see System Location above
for address);
NASA Goddard Space Flight Center (see System Location above for
address);
NASA Kennedy Space Center (see System Location above for address);
NASA Langley Research Center (see System Location above for
address);
NASA Glenn Research Center (see System Location above for address);
NASA Marshall Space Flight Center (see System Location above for
address);
NASA Jet Propulsion Laboratory (see System Location above for
address);
NASA Stennis Space Center (see System Location above for address);
Michoud Assembly Facility (NASA) (see System Location above for
address); and
[[Page 71098]]
Wallops Flight Facility (NASA) (see System Location above for
address).
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
5 U.S.C. 7901--Health service programs;
51 U.S.C. 20113 (a)--Powers of the Administration in performance of
functions to make and promulgate rules and regulations;
44 U.S.C. 3101--Records management by agency heads; general duties;
42 CFR part 2--Confidentiality of substance use disorder patient
records.
PURPOSE(S) OF THE SYSTEM:
In order to ensure a healthy environment and workforce, information
in this system of records is maintained on anyone receiving (1) exams
for general wellness, (2) occupational clearances or determination of
fitness for duty, (3) behavioral health assistance, (4) workplace
surveillance for potential human exposure within NASA to communicable
diseases and hazards such as noise and chemical exposure, repetitive
motion, and (5) first aid or medical care for onsite illness or
injuries through a NASA clinic outreach.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
This system contains information on (1) NASA employees and
applicants; (2) employees from other agencies and military detailees
working at NASA; (3) active or retired astronauts and active astronaut
family members; (4) other space flight personnel on temporary or
extended duty at NASA; (5) contractor personnel; (6) Space Flight
Participants and those engaged in commercial use of NASA facilities,
(7) civil service and contractor family members; and (8) visitors to
NASA Centers who use clinics or ambulance services for emergency or
first-aid treatment.
CATEGORIES OF RECORDS IN THE SYSTEM:
Records in this system contain demographic data and private health
information:
(1) Wellness records including but not limited to exams provided
for continuing healthcare, documentation of immunizations and other
outreach records.
(2) Fitness for duty and/or exposure exams/surveillance including
but not limited to ergonomics, hazardous materials, radiation, noise,
communicable diseases and other applicable longitudinal surveillance.
(3) Qualification records including the use of offsite or onsite
exams to determine suitability for duties.
(4) Behavioral health and employee assistance records.
(5) Records of first aid, contingency response, or emergency care,
including ambulance transportation.
RECORD SOURCE CATEGORIES:
The information in this system of records is obtained from
individuals themselves, physicians, and previous medical records of
individuals.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
Any disclosures of information will be compatible with the purpose
for which the Agency collected the information. Under the following
routine uses that are unique to this system of records, information in
this system may be disclosed:
(1) to external medical professionals and independent entities to
support internal and external reviews for purposes of medical quality
assurance; (2) to private or other government health care providers for
consultation, referral, or mission medical contingency support; (3) to
the Office of Personnel Management, Occupational Safety and Health
Administration, and other Federal or State agencies as required in
accordance with the Federal agency's special program responsibilities;
(4) to insurers for referrals or reimbursement; (5) to employers of
non-NASA personnel in support of the Mission Critical Space Systems
Personnel Reliability Program; (6) to international partners for
mission support and continuity of care for their employees pursuant to
NASA Space Act agreements; (7) to non-NASA personnel performing
research, studies, or other activities through arrangements or
agreements with NASA; (8) to the public of pre-space flight information
having mission impact concerning an individual crewmember, limited to
the crewmember's name and the fact that a medical condition exists; (9)
to the public, limited to the crewmember's name and the fact that a
medical condition exists, if a flight crewmember is, for medical
reasons, unable to perform a scheduled public event following a space
flight mission/landing; (10) to the public to advise of medical
conditions arising from accidents, consistent with NASA regulations;
and (12) in accordance with standard routine uses as set forth here.
In addition, the following routine uses of information contained in
SORs are standard for many NASA systems and are compatible with the
purpose for which the Agency collected the information.
Standard Routine Use No. 1--In the event this system of records
indicates a violation or potential violation of law, whether civil,
criminal, or regulatory in nature, and whether arising by general
statute or particular program statute, or by regulation, rule or order
issued pursuant thereto, the relevant records in the SOR may be
referred to the appropriate agency, whether Federal, State, local or
foreign, charged with the responsibility of investigating or
prosecuting such violation or charged with enforcing or implementing
the statute, or rule, regulation or order issued pursuant thereto.
Standard Routine Use No. 2--A record from this SOR may be disclosed
to a Federal, State, or local agency maintaining civil, criminal, or
other relevant enforcement information or other pertinent information,
such as current licenses, if necessary to obtain information relevant
to an agency decision concerning the hiring or retention of an
employee, the issuance of a security clearance, the letting of a
contract, or the issuance of a license, grant, or other benefit.
Standard Routine Use No. 3-- A record from this SOR may be
disclosed to a Federal agency, in response to its request, in
connection with the hiring or retention of an employee, the issuance of
a security clearance, the reporting of an investigation of an employee,
the letting of a contract, or the issuance of a license, grant, or
other benefit by the requesting agency, to the extent that the
information is relevant and necessary to the requesting agency's
decision on the matter.
Standard Routine Use No. 4--A record from this system may be
disclosed to the Department of Justice including United States Attorney
Offices, or other federal agency conducting litigation or in
proceedings before any court, adjudicative or administrative body, when
the record is relevant or necessary to the litigation or the agency has
an interest in such litigation when (a) the Agency, or any component
thereof; or (b) any employee of the Agency in his or her official
capacity; or (c) any employee of the Agency in his or her individual
capacity where the Department of Justice or the Agency has agreed to
represent the employee; or (d) the United States, where the Agency
determines that litigation is likely to affect the Agency or any of its
components, is a party to litigation or has an interest in such
litigation, and the use of such records by the Department of Justice or
the Agency is deemed by the Agency to be relevant and necessary to the
litigation.
[[Page 71099]]
Standard Routine Use No. 5--A record from this SOR may be disclosed
in an appropriate proceeding before a court, grand jury, or
administrative or adjudicative body, when NASA determines that the
records are relevant to the proceeding; or in an appropriate proceeding
before an administrative or adjudicative body when the adjudicator
determines the records to be relevant to the proceeding.
Standard Routine Use No. 6--A record from this SOR may be disclosed
to appropriate agencies, entities, and persons when (1) NASA suspects
or has confirmed that there has been a breach of the system of records;
(2) NASA has determined that as a result of the suspected or confirmed
breach there is a risk of harm to individuals, NASA (including its
information systems, programs, and operations), the Federal Government,
or national security; and (3) the disclosure made to such agencies,
entities, and persons is reasonably necessary to assist in connection
with NASA's efforts to respond to the suspected or confirmed breach or
to prevent, minimize, or remedy such harm.
Standard Routine Use No. 7--A record from this system may be
disclosed to contractors, grantees, experts, consultants, students, and
others performing or working on a contract, service, grant, cooperative
agreement, or other assignment for the federal government, when
necessary to accomplish an Agency function related to this system of
records.
Standard Routine Use No. 8--A record from this system may be
disclosed to a Member of Congress or staff acting upon the Member's
behalf when the Member or staff requests the information on behalf of,
and at the request of, the individual who is the subject of the record.
Standard Routine Use No. 9--A record from this system may be
disclosed to another Federal agency or Federal entity, when NASA
determines that information from this system of records is reasonably
necessary to assist the recipient agency or entity in (1) responding to
a suspected or confirmed breach or (2) preventing, minimizing, or
remedying the risk of harm to individuals, the recipient agency or
entity (including its information systems, programs, and operations),
the Federal Government, or national security, resulting from a
suspected or confirmed breach.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records are stored in multiple formats including paper, digital,
micrographic, photographic, and as medical recordings such as
electrocardiograph tapes, x-rays and strip charts.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrieved from the system by the individual's name,
date of birth, or unique assigned Numbers.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records are maintained in Agency files and destroyed in accordance
with NASA Records Retention Schedule 1, Items 126 and 127, and NASA
Records Retention Schedule 8, Item 57.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Records are maintained on secure NASA servers and protected in
accordance with all Federal standards and those established in NASA
regulations at 14 CFR 1212.605. Additionally, server and data
management environments employ infrastructure encryption technologies
both in data transmission and at rest on servers. Electronic messages
sent within and outside of the Agency that convey sensitive data are
encrypted and transmitted by staff via pre-approved electronic
encryption systems as required by NASA policy. Approved security plans
are in place for information systems containing the records in
accordance with the Federal Information Security Management Act of 2014
(FISMA) and OMB Circular A-130, Management of Federal Information
Resources. Only authorized personnel requiring information in the
official discharge of their duties are authorized access to records
through approved access or authentication methods. Access to electronic
records is achieved only from workstations within the NASA Intranet, or
remotely via a secure Virtual Private Network (VPN) connection
requiring two-factor token authentication using NASA-issued computers
or via employee PIV badge authentication from NASA-issued computers.
The CORITY Chicago Data Center and Salesforce Government Cloud and
Disaster Recovery Center maintain documentation and verification of
commensurate safeguards in accordance with FISMA, NASA Procedural
Requirements (NPR) 2810.1A, and NASA ITS-HBK-2810.02-05. Non-electronic
records are secured in locked rooms or files.
RECORD ACCESS PROCEDURES:
In accordance with 14 CFR part 1212, Privacy Act--NASA Regulations,
information may be obtained by contacting in person or in writing the
system or subsystem manager listed above at the location where the
records are created and/or maintained. Requests must contain the
identifying data concerning the requester, e.g., first, middle and last
name; date of birth; description and time periods of the records
desired. NASA Regulations also address contesting contents and
appealing initial determinations regarding records access.
CONTESTING RECORD PROCEDURES:
In accordance with 14 CFR part 1212, Privacy Act--NASA Regulations,
information may be obtained by contacting in person or in writing the
system or subsystem manager listed above at the location where the
records are created and/or maintained. Requests must contain the
identifying data concerning the requester, e.g., first, middle and last
name; date of birth; description and time periods of the records
desired. NASA Regulations also address contesting contents and
appealing initial determinations regarding records access.
NOTIFICATION PROCEDURES:
In accordance with 14 CFR part 1212, Privacy Act--NASA Regulations,
information may be obtained by contacting in person or in writing the
system or subsystem manager listed above at the location where the
records are created and/or maintained. Requests must contain the
identifying data concerning the requester, e.g., first, middle and last
name; date of birth; description and time periods of the records
desired. NASA Regulations also address contesting contents and
appealing initial determinations regarding records access.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
2020-27051, 85 FR 79224, pp. 79224-79227.
[FR Doc. 2021-27041 Filed 12-13-21; 8:45 am]
BILLING CODE 7510-13-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on December 14, 2021.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.