Federal & State Lawfederalstatelaw.com
Home/Federal/Federal Register/2023-01145
Notice2023-01145

Notice of Privacy Act of 1974; System of Records

Primary source

Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.

Published
January 23, 2023

Issuing agencies

Health and Human Services Department

Abstract

In accordance with the Privacy Act, the Department of Health and Human Services (HHS) is establishing a new system of records to be maintained by the Office of Infectious Disease and HIV/AIDS Policy within the Office of the Assistant Secretary for Health (OASH/OIDP), System No. 09-90-2101 "HIV Prevention Medication Distribution Records." The new system of records will consist of records about individual patients who participate in the Ending the HIV Epidemic-- Pre-Exposure Prophylaxis Implementation and Distribution Services Program (PrEP Program), which will provide donated HIV prevention medication to patients in the United States who are at substantial risk of acquiring the human immunodeficiency virus (HIV).

Full Text

<html>
<head>
<title>Federal Register, Volume 88 Issue 14 (Monday, January 23, 2023)</title>
</head>
<body><pre>
[Federal Register Volume 88, Number 14 (Monday, January 23, 2023)]
[Notices]
[Pages 3999-4002]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2023-01145]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES


Notice of Privacy Act of 1974; System of Records

AGENCY: Office of Infectious Disease and HIV/AIDS Policy, Office of the 
Assistant Secretary for Health, Office of the Secretary, Department of 
Health and Human Services.

ACTION: Notice of a new system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act, the Department of Health 
and Human Services (HHS) is establishing a new system of records to be 
maintained by the Office of Infectious Disease and HIV/AIDS Policy 
within the Office of the Assistant Secretary for Health (OASH/OIDP), 
System No. 09-90-2101 ``HIV Prevention Medication Distribution 
Records.'' The new system of records will consist of records about 
individual patients who participate in the Ending the HIV Epidemic--
Pre-Exposure Prophylaxis Implementation and Distribution Services 
Program (PrEP Program), which will provide donated HIV prevention 
medication to patients in the United States who are at substantial risk 
of acquiring the human immunodeficiency virus (HIV).

DATES: In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is 
effective upon publication, subject to a 30-day period in which to 
comment on the routine uses, described below. Please submit any 
comments by February 22, 2023.

ADDRESSES: The public should submit comments on the new system of 
records by email to <a href="/cdn-cgi/l/email-protection#bddcd3d393dcdfd8cfdecfd2d0dfd4d8fdd5d5ce93dad2cb"><span class="__cf_email__" data-cfemail="ccada2a2e2adaea9beafbea3a1aea5a98ca4a4bfe2aba3ba">[email&#160;protected]</span></a>.

FOR FURTHER INFORMATION CONTACT: General questions about the system of 
records may be submitted to Ann Abercrombie, OASH/OIDP at (202) 401-
9588, or <a href="/cdn-cgi/l/email-protection#a5c4cbcb8bc4c7c0d7c6d7cac8c7ccc0e5cdcdd68bc2cad3"><span class="__cf_email__" data-cfemail="45242b2b6b2427203726372a28272c20052d2d366b222a33">[email&#160;protected]</span></a>.

SUPPLEMENTARY INFORMATION: Within the U.S. Department of Health and 
Human Services (HHS), the Office of the Assistant Secretary for Health 
(OASH) leads development of agency-wide public health policy 
recommendations and oversees core public health offices, including the 
Office of the Surgeon General and the U.S. Public Health Service 
Commissioned Corps, as well as 10 regional health offices across the 
nation and 10 presidential and secretarial advisory committees. The 
mission of the Office of Infectious Disease and HIV/AIDS Policy (OIDP) 
is to provide strategic leadership and management, while encouraging 
collaboration, coordination, and innovation among federal agencies and 
stakeholders to reduce the burden of infectious diseases, including the 
human immunodeficiency virus (HIV).
    The initiative to End the HIV Epidemic in the U.S. is part of a 
national HIV prevention and control effort to reduce the number of new 
HIV infections by 75% in five years and 90% in 10 years. A key 
component of the initiative is expanding access to HIV prevention 
medication for patients who are at substantial risk of acquiring the 
disease. Pursuant to a donation agreement executed May 8, 2019, a drug 
manufacturer, Gilead Sciences, Inc. (Gilead), donated certain HIV 
prevention medication (emtricitabine/tenofovir disoproxil fumarate and 
emtricitabine/tenofovir alafenamide tablets, collectively referred to 
as ``Product'') to HHS for distribution through the Ending the HIV 
Epidemic--Pre-Exposure Prophylaxis (PrEP) Implementation and 
Distribution Services Program (PrEP Program), which will be 
administered by OASH/OIDP subject to the terms of the donation 
agreement between Gilead and HHS. Under the terms of the donation 
agreement, Gilead will donate Product for up to 200,000 individuals 
each year up to end of 2030 or earlier. The PrEP Program, through a 
contractor engaged by OASH/OIDP, will issue an enrollment card or 
electronic enrollment confirmation, containing a unique identification 
number, to each qualified eligible patient in the United States who 
applies to the program (up to 200,000 individuals per year). This will 
enable the patient to obtain the Product at no cost, either in person 
or by mail, from a participating pharmacy. The contractor will operate 
a mail order pharmacy to acquire the Product from Gilead and dispense 
it to patients who elect to receive the Product by mail. The

[[Page 4000]]

contractor will also engage a subcontractor to serve as a claims 
processor to verify the validity of enrollment identification numbers 
for pharmacies before pharmacies dispense the Product, and to reimburse 
the pharmacies' acquisition costs and taxes. All prescription and 
shipping costs will be 100% covered by OIDP and the Gilead donation. 
However, costs that patients incur for clinic visits and lab tests 
required to remain eligible for the program are not covered by the 
program.
    The mail-order pharmacy and other pharmacies that wish to 
participate in the program must sign an agreement with HHS agreeing 
that they will donate their services (agreeing to be reimbursed only 
for wholesale acquisition cost and taxes for the Product they 
dispense). Participating pharmacies also sign an addendum with the 
claims processor acknowledging that they will receive reimbursement for 
wholesale acquisition cost and taxes only, with no dispensing or other 
fees. The list of participating pharmacies is available on this website 
<a href="https://www.hiv.gov/federal-response/ending-the-hiv-epidemic/prep-pharmacies">https://www.hiv.gov/federal-response/ending-the-hiv-epidemic/prep-pharmacies</a>.
    The claims processor (subcontractor) will have access to enrollment 
identification numbers and the dates the numbers are valid (not other 
information about patients). The contractor will collect and maintain 
all records needed to determine patients' initial and continued 
eligibility for the Program and to operate the mail-order pharmacy. The 
contractor will, for example, obtain twice yearly confirmations of the 
patient's continued eligibility from the patient and the patient's 
prescribing health care provider; and, if the patient elects mail 
order, the contractor will notify the provider to send the prescription 
to the mail-order pharmacy to be filled. The mail-order pharmacy will 
confirm the patient's shipping information and current eligibility for 
the program, using the patient's enrollment identification number.

    Dated: December 6, 2022.
Rucia A. Abercrombie,
Lead Management Analyst, OIDP.

SYSTEM NAME AND NUMBER:
    HIV Prevention Medication Distribution Records, 09-90-2101.

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    The address of the agency component responsible for the system of 
records is the Office of Infectious Disease and HIV/AIDS Policy (OASH/
OIDP), U.S. Department of Health & Human Services, 330 C St. SW--Suite 
L100, Washington, DC 20024. The records will be housed in a contractor-
owned information technology (IT) system.

SYSTEM MANAGER(S):
    Director, Office of Infectious Disease and HIV/AIDS Policy (OASH/
OIDP), Department of Health & Human Services, 330 C St. SW-Suite L100, 
Washington, DC 20201, (202) 795-7697.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Authorization to collect and maintain the records is provided under 
sections 301, 1702, and 1703 of the Public Health Service Act (42 
U.S.C. 241, 300u-1, and 300u-2).

PURPOSE(S) OF THE SYSTEM:
    The records in this system of records will be used to administer 
the Pre-Exposure Prophylaxis (PrEP) Implementation and Distribution 
Services Program (PrEP Program, or Program), the goal of which is to 
distribute donated HIV prevention medication (Product) appropriately to 
qualifying patients in the United States who are at high risk of 
acquiring HIV, in order to reduce transmission of HIV. To administer 
the Program, OASH/OIDP, through a contractor, will use the records for 
these specific purposes:
    <bullet> To determine if patients who apply for enrollment in the 
Program are eligible to receive the Product under the terms of the 
donation agreement between HHS and the drug manufacturer, Gilead 
Sciences, Inc. (Gilead);
    <bullet> To enroll qualified eligible patients in the Program and 
issue an enrollment card or confirmation containing a unique enrollment 
identification number to each enrolled patient, and, thereafter, to 
confirm each patient's continued eligibility to remain enrolled in the 
Program;
    <bullet> To verify the validity of enrollment identification 
numbers, for Product dispensing and cost reimbursement purposes.
    <bullet> To reimburse participating pharmacies' wholesale 
acquisition cost and taxes, for the Product they dispense to patients;
    <bullet> To monitor and audit the Program to prevent, detect, and 
address any program violations, errors, fraud, and improper 
distribution of benefits, to ensure the integrity of the Program; and
    <bullet> To compile statistics for reports and to conduct research 
to evaluate the effectiveness of the Program.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The records will be about patients who apply for Product through 
the PrEP Program.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The records will consist of application records, enrolled patient 
records, and reimbursement records.
    <bullet> Application records will include information needed to 
identify a patient and verify the patient's initial eligibility to be 
enrolled in the Program, to include: patient name, date of birth, 
location, and the last four digits of the patient's Social Security 
Number; name and address of prescribing practitioner and practice 
location; the patient's certification that the patient is not covered 
by a health insurance plan or policy that covers outpatient 
prescription drugs; and the patient's consent to information sharing 
between OASH/OIDP, its contractor, the Product manufacturer, and the 
patient's prescribing health care provider. A patient (or the patient's 
health care provider) can submit an application to the program through 
the Program's online portal or call center hub. Demographic information 
(race, ethnicity, gender identity, and sex assigned at birth) will be 
included in both application records and enrolled patient records, for 
statistical purposes only, to use in government analyses of the data at 
an aggregate level.
    <bullet> Enrolled patient records will include the above 
application information; a unique identifier assigned to the patient by 
the OASH/OIDP contractor (included on the patient's enrollment card or 
enrollment confirmation); twice yearly confirmations of the patient's 
continued eligibility (e.g., negative HIV status based on quarterly HIV 
tests) from the patient's prescribing health care provider; amount of 
Product dispensed to the patient, reported by the participating 
pharmacy; and periodic re-certification(s) from the patient attesting 
that the patient is not covered by a health insurance plan or policy 
that covers outpatient prescription drugs. The records will also 
indicate whether the patient elected to receive Product by mail or was 
issued an enrollment card to use to obtain the Product from the 
participating pharmacy's customary retail inventory.
    <bullet> The claims processor will use the enrollment 
identification number provided by a participating pharmacy to verify 
patient eligibility in the program and to generate a claim number used 
to reimburse the pharmacy's wholesale

[[Page 4001]]

acquisition cost and taxes for the Product dispensed.

RECORD SOURCE CATEGORIES:
    Information in the patient's application records and enrolled 
patient records will be obtained directly from the patient or the 
patient's prescribing health care provider. The OASH/OIDP contractor 
will assign the unique enrollment identification number to the patient 
upon enrollment.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    In addition to other disclosures that may be made without the 
patient's prior, written consent which are authorized directly in the 
Privacy Act at 5 U.S.C. 552a(b)(1)-(b)(2) and (b)(4)-(11), HHS may 
disclose information about a patient from this system of records to 
parties outside the agency pursuant to these routine uses.
    1. Records may be disclosed to agency contractors, consultants, or 
others who have been engaged by the agency to assist in accomplishment 
of an HHS function relating to the purposes of this system of records 
and who need to have access to the records in order to assist HHS. Note 
that this routine use will authorize any such disclosures which are not 
adequately covered by the patient's consent provided on or with the 
enrollment application. Any contractor will be required to comply with 
the requirements of the Privacy Act.
    2. Records may be disclosed to a patient's prescribing healthcare 
provider to verify the patient's initial, or continued, eligibility for 
enrollment. Note that this routine use will authorize any such 
disclosures which are not adequately covered by the patient's consent 
on or with the enrollment application.
    3. Records may be disclosed to Gilead Sciences, Inc., to ensure 
individuals are not actively enrolling in both Gilead's Advancing 
Access program and HHS' Ready, Set, PrEP program simultaneously. Note 
that this routine use will authorize any such disclosures which are not 
adequately covered by the patient's consent on or with the enrollment 
application.
    4. Information may be disclosed to the U.S. Department of Justice 
(DOJ) or to a court or other tribunal in litigation or other 
proceedings, when the agency or any component thereof, or any employee 
of the agency in his or her official capacity, or any employee of the 
agency in his or her individual capacity where DOJ has agreed to 
represent the employee, or the United State Government is a party to 
the proceedings or has an interest in such proceedings and, by careful 
review, HHS determines that the records are both relevant and necessary 
to the proceedings.
    5. Records may be disclosed to a congressional office from the 
record of an individual in response to a written inquiry from the 
congressional office made at the written request of that individual.
    6. Records may be disclosed to representatives of the National 
Archives and Records Administration (NARA) during records management 
inspections conducted pursuant to 44 U.S.C. 2904 and 2906.
    7. Records may be disclosed to appropriate agencies, entities, and 
persons when (1) HHS suspects or has confirmed that there has been a 
breach of the system of records, (2) HHS has determined that as a 
result of the suspected or confirmed breach there is a risk of harm to 
individuals, HHS (including its information systems, programs, and 
operations), the federal government, or national security, and (3) the 
disclosure made to such agencies, entities, and persons is reasonably 
necessary to assist in connection with HHS's efforts to respond to the 
suspected or confirmed breach or to prevent, minimize, or remedy such 
harm.
    8. Records may be disclosed to another federal agency or federal 
entity, when HHS determines that information from this system of 
records is reasonably necessary to assist the recipient agency or 
entity in (1) responding to a suspected or confirmed breach or (2) 
preventing, minimizing, or remedying the risk of harm to individuals, 
the recipient agency or entity (including its information systems, 
programs, and operations), the federal government, or national 
security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    The records will be stored on electronic media.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records will be retrieved by the patient's unique enrollment 
identification number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    OASH is developing a disposition schedule for the records and plans 
to propose a retention period of approximately 10 years for the 
records. Until the schedule has been submitted to and approved by the 
National Archives and Records Administration (NARA), the records will 
be retained indefinitely.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    The records will be safeguarded in accordance with applicable laws, 
rules and policies, including the pertinent National Institutes of 
Standards and Technology (NIST) publications and OMB Circular A-130, 
Managing Information as a Strategic Resource. Records will be protected 
from unauthorized access through appropriate administrative, physical, 
and technical safeguards. Safeguards will conform to the HHS 
Information Security and Privacy Program, <a href="https://www.hhs.gov/ocio/securityprivacy/">https://www.hhs.gov/ocio/securityprivacy/</a>.
    The safeguards will include protecting the facilities where records 
are stored or accessed with security guards, badges and cameras; 
limiting access to electronic databases to authorized users based on 
roles and the principle of least privilege and either two-factor 
authentication or user name and password; using a secured operating 
system protected by encryption, firewalls, and intrusion detection 
systems; using an SSL connection for secure encrypted transmissions; 
requiring encryption for records stored on removable media; and 
training personnel in Privacy Act and information security 
requirements. Records that are eligible for destruction will be 
disposed of using secure destruction methods prescribed by NIST SP 800-
88.

RECORD ACCESS PROCEDURES:
    An individual seeking access to records about him or her in this 
system of records must submit a written access request to the System 
Manager (see above ``System Manager'' section). The request must 
contain the requester's full name, address, and signature. The request 
should also contain the requester's contact information and sufficient 
identifying particulars (such as, the unique identifier from the 
individual's enrollment card or enrollment confirmation) to enable HHS 
to locate the requested records. To verify the requester's identity, 
the signature must be notarized or the request must include the 
requester's written certification that the requester is the individual 
who the requester claims to be and that the requester understands that 
the knowing and willful request for or acquisition of records 
pertaining to an individual under false pretenses is a criminal offense 
subject to a fine of up to $5,000. Requesters may also ask for

[[Page 4002]]

an accounting of disclosures that have been made of records about them, 
if any.

CONTESTING RECORD PROCEDURES:
    An individual seeking to amend a record about him or her in this 
system of records must submit a written amendment request to the System 
Manager (see above ``System Manager'' section), containing the same 
information required for an access request and including verification 
of the requester's identity in the same manner required for an access 
request. In addition, the request must reasonably identify the record 
and specify the information being contested, the corrective action 
sought, and the reasons for requesting the correction; and should 
include supporting information, showing how the record is inaccurate, 
incomplete, untimely, or irrelevant.

NOTIFICATION PROCEDURES:
    An individual who wishes to know if this system of records contains 
records about that individual must submit a written notification 
request to the System Manager (see above ``System Manager'' section). 
The request must contain the same information required for an access 
request and and must include verification of the requester's identity 
in the same manner required for an access request.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    None.

[FR Doc. 2023-01145 Filed 1-20-23; 8:45 am]
BILLING CODE 4150-43-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>
View on FederalRegister.gov →Plain-text source
Indexed from Federal Register on January 23, 2023.

This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.