Notice2023-19875
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 14, 2023
Effective
October 16, 2023
Issuing agencies
Health and Human Services DepartmentChildren and Families Administration
Abstract
The Department of Health and Human Services (HHS) is modifying a system of records maintained by the Administration for Children & Families (ACF), 09-80-0327 ORR Repatriation Program Records, to reflect the change ownership of the repatriation program that was transferred to ACF's Office of Human Services Emergency Preparedness and Response (OHSEPR), and to broaden the scope of the system of records to include functionally similar records that OHSEPR uses to identify, assess, and address immediate unmet human services (i.e., social services) needs of survivors of federally-declared disasters in the United States. To reflect the transfer and broadened scope, HHS is changing the name of the system of records to OHSEPR Repatriation and Disaster Human Services Case Management Records.
Full Text
<html>
<head>
<title>Federal Register, Volume 88 Issue 177 (Thursday, September 14, 2023)</title>
</head>
<body><pre>
[Federal Register Volume 88, Number 177 (Thursday, September 14, 2023)]
[Notices]
[Pages 63109-63114]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2023-19875]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Administration for Children & Families
Privacy Act of 1974; System of Records
AGENCY: Office of Human Services Emergency Preparedness and Response
(OHSEPR), Administration for Children & Families (ACF), Department of
Health and Human Services (HHS).
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: The Department of Health and Human Services (HHS) is modifying
a system of records maintained by the Administration for Children &
Families (ACF), 09-80-0327 ORR Repatriation Program Records, to reflect
the change ownership of the repatriation program that was transferred
to ACF's Office of Human Services Emergency Preparedness and Response
(OHSEPR), and to broaden the scope of the system of records to include
functionally similar records that OHSEPR uses to identify, assess, and
address immediate unmet human services (i.e., social services) needs of
survivors of federally-declared disasters in the United States. To
reflect the transfer and broadened scope, HHS is changing the name of
the system of records to OHSEPR Repatriation and Disaster Human
Services Case Management Records.
DATES: This modified system of records is applicable September 14,
2023, subject to a 30-day period to comment on the new and revised
routine uses. Submit any comments by October 16, 2023. The new and
revised routine uses will become effective on October 16, 2023 unless
the Department receives comments that would persuade us to modify the
notice.
ADDRESSES: The public should address written comments on the proposed
system of records to Anita Alford, Senior Official for Privacy,
Administration for Children & Families by email, to
<a href="/cdn-cgi/l/email-protection#84c5eaedf0e5aac5e8e2ebf6e0c4e5e7e2aaececf7aae3ebf2"><span class="__cf_email__" data-cfemail="f3b29d9a8792ddb29f959c8197b3929095dd9b9b80dd949c85">[email protected]</span></a>.
FOR FURTHER INFORMATION CONTACT: General questions about the system of
records may be submitted to the OHSEPR Deputy Director, Byron R. Mason,
by telephone at (202) 365-8110 or by email to <a href="/cdn-cgi/l/email-protection#e1a398938e8fcfac80928e8fa1808287cf898992cf868e97"><span class="__cf_email__" data-cfemail="8ccef5fee3e2a2c1edffe3e2ccedefeaa2e4e4ffa2ebe3fa">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION: HHS established system of records 09-80-0327
in 2016 to cover records about temporary assistance provided to
repatriated U.S. citizens and their dependents under ACF's repatriation
program, to meet the individuals' human service's needs. At that time,
the repatriation program was administered by ACF's Office of Refugee
Resettlement (ORR). In 2018, ACF transferred responsibility for the
repatriation program to ACF's Office of Human Services Emergency
Preparedness and Response (OHSEPR) that also administers ACF's disaster
assistance program. Because the records used for both programs are
functionally similar (i.e., they are case files documenting services
provided to meet the individuals' human service's needs), HHS is
broadening the scope of system of records 09-80-0327 to include
[[Page 63110]]
disaster assistance program records. The modifications include:
<bullet> Changing the name of the system of records to refer to
OHSEPR instead of ORR and to reflect the expanded scope of the system
of records.
<bullet> Updating the System Location and System Manager(s)
sections to provide address and contact information for OHSEPR instead
of ORR, and to add service provider and contractor locations to the
System Location section.
<bullet> Revising the Authorities section to add authorities for
the disaster assistance program, and to add a Social Security Number
(SSN) collection authority that applies to the repatriation program
only.
<bullet> Adding descriptions of disaster assistance program records
throughout the SORN.
<bullet> Revising the Purpose(s) section to describe the primary
purpose for repatriation program records used as ``making eligibility
determinations before temporary assistance is provided;'' to add, as an
additional secondary purpose for the use of repatriation program
records, ``providing training and technical assistance to State human
services departments and local services providers;'' to add purposes
for disaster program records use; and to add a note at the end of the
section stating that records of repatriation assistance to particular
individuals are referred from this system of records to a separate
system of records for debt management and collection purposes.
<bullet> Revising the Categories of Records section to describe the
categories of records maintained for the repatriation program as case
files containing correspondence, and to summarize the data elements
contained in those records instead of listing them; to add categories
of records maintained for the disaster assistance program; and to
include a note explaining that records OHSEPR maintains as a result of
providing disaster assistance services on behalf of another HHS
component or another agency are not covered by this SORN.
<bullet> Specifying, in the Record Source Categories section the
sources that apply to the repatriation program or both programs.
<bullet> Adding and revising routine uses, and removing unnecessary
routine uses, as follows. A note has been added, stating that a routine
use applies to both the repatriation program and the disaster
assistance programs unless worded to apply to only one of those
programs.
Revised routine uses:
[cir] Routine use 1, Disclosure to Contractors, Grantees, and Other
Agents (4 in the existing SORN), has been revised to add ``(including
another federal agency acting as a service provider),'' ``other
agencies,'' and ``OHSEPR'' and will now apply to the disaster
assistance program too.
[cir] Routine use 2, Disclosure to Department of State (1 in the
existing SORN), has been revised to add ``to repatriates'' to correct a
typographical error.
[cir] Routine use 4, Disclosure to Service Provider (3 in the
existing SORN), has been revised to add ``for eligible repatriates''
and to change ``services'' to ``assistance.''
[cir] Routine use 5 (4 in the existing SORN), is now titled
Disclosure to Agency for Temporary Assistance (instead of Disclosure to
Agency for Temporary Services), and the word ``services'' in the text
of the routine use has been changed to ``assistance.''
[cir] Routine use 6, Disclosure for Law Enforcement Purposes (5 in
the existing SORN), will now apply to the disaster assistance program
too.
[cir] Routine use 7, Disclosure for Administrative Claim,
Complaint, and Appeal (13 in the existing SORN), has been revised to
add ``about a repatriation assistance recipient.''
[cir] Routine use 8 (15 in the existing SORN), is now titled
Disclosure in Connection with Settlement Discussions (instead of
Disclosure in Connection with Litigation), and it has been revised to
be limited to settlement discussions to avoid duplicating a litigation-
related routine use and to add ``about a repatriation assistance
recipient.''
[cir] Routine use 12, Disclosure for Private Relief Legislation (8
in the existing SORN), has been revised to add ``about a repatriation
assistance recipient.''
[cir] Routine use 13, Disclosure to Congressional Office (9 in the
existing SORN), will now apply to the disaster assistance program too.
[cir] Routine use 14, Disclosure to Department of Justice or in
Proceedings (10 in the existing SORN), has been revised to omit
redundant wording that repeated part of the definition of a routine use
(i.e., ``provided that the disclosure is compatible with the purpose
for which the records were collected''), and will now apply to the
disaster assistance program too.
[cir] Routine use 15, Disclosure to the National Archives and
Records Administration (11 in the existing SORN), has been revised to
add ``conducted pursuant to 44 U.S.C. 2904 and 2906'' and will now
apply to the disaster assistance program too.
[cir] Routine uses 16 and 17, Disclosure in the Event of a Security
Breach Experienced by HHS, and Disclosure to Assist Another Agency
Experiencing a Breach (16 and 18 in the existing SORN), which were
added to the SORN in February 2018, will now apply to the disaster
assistance program too.
[cir] Routine use 18, Disclosure for Cybersecurity Monitoring
Purposes (17 in the existing SORN), will now apply to the disaster
assistance program too.
New routine uses:
[cir] Routine uses 9 and 10, Disclosure to Ensure Continuity of
Disaster Assistance Services and Disclosure to Locate Missing Children
or Reunite Families, have been added for the disaster assistance
program.
[cir] Routine use 11, Disclosure to Combat Fraud, Waste, and Abuse,
has been added for both the repatriation program and the disaster
assistance program.
Deleted routine uses:
[cir] Routine uses formerly numbered as 6, 7, and 14, Disclosure
Incident to Requesting Information; Disclosure for Employee Retention,
Security, Contract, or Other Benefit; and Disclosure to the Office of
Personnel Management, were determined to be unnecessary and are now
omitted, because such disclosures are not made from this system of
records.
<bullet> Removing the section titled Disclosure to Consumer
Reporting Agencies, because such disclosures are not made by ACF/OHSEPR
from this system of records. Such disclosures are made by HHS' Program
Support Center from the system of records that covers records used for
debt management and collection purposes.
<bullet> Revising the Storage section to describe the storage media
as hard copy files, electronic storage media, and cloud/network
storage, instead of stating that the records are stored on a grantee's
computer network and safe/file cabinet.
<bullet> Revising the Retrieval section to add that disaster
assistance case records are retrieved by the individual's name or case
file number.
<bullet> Revising the Retention section to cite the disposition
schedule and retention periods applicable to records about disaster
survivors.
<bullet> Revising the Safeguards section to describe the particular
administrative, technical, and physical safeguards used to prevent
unauthorized access to the records, instead of simply stating that
safeguards conform to the HHS Information Security Program; and to
mention ``grantees'' in addition to contractors.
<bullet> Updating the procedures for making access, correction, and
notification
[[Page 63111]]
requests no longer require requests to include the subject individual's
social security number, and to now state that requests should identify
either the repatriation program or the applicable disaster, to assist
OHSEPR in locating the records.
Because this modification includes significant changes, HHS
provided advance notice of the modified system of records to the Office
of Management and Budget and Congress as required by 5 U.S.C. 552a(r)
and OMB Circular A-108.
Natalie N. Grant,
Director, Office of Human Services Emergency Preparedness and Response.
SYSTEM NAME AND NUMBER:
OHSEPR Repatriation and Disaster Human Services Case Management
Records, 09-80-0389.
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
The address of the agency component responsible for this system of
records is Administration for Children & Families (ACF), Office of
Human Services Emergency Preparedness and Response (OHSEPR), 330 C
Street SW--4th Floor, Washington, DC 20201.
On behalf of ACF, a grantee located in Baltimore MD stores ACF's
repatriation program records in a cloud-based system. A contractor and
subcontractor located in Washington, DC manage ACF's disaster
assistance database housed on an ACF server.
SYSTEM MANAGER(S):
The System Manager is: OHSEPR Repatriation Specialist, HHS, ACF,
Office of Human Services Emergency Preparedness and Response (OHSEPR),
330 C Street SW--4th Floor, Washington, DC 20201; <a href="/cdn-cgi/l/email-protection#0847405b4d585a48696b6e2660607b266f677e"><span class="__cf_email__" data-cfemail="26696e7563767466474540084e4e5508414950">[email protected]</span></a>.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Authority to maintain repatriation assistance records: 42 U.S.C.
1313 (Assistance for United States citizens returned from foreign
countries) and 24 U.S.C. 321-329 (Hospitalization of mentally ill
nationals returned from foreign countries).
Authority to collect Social Security Number (SSN) (applicable to
the repatriation program only): 31 U.S.C. 7701(c) requires an agency to
collect the taxpayer identifying number of individuals ``doing business
with a federal agency,'' one example of which is being ``in a
relationship with the agency that may give rise to a receivable due to
that agency.'' Receiving temporary assistance--which is defined in 42
U.S.C. 1313(c) as money payments, medical care, temporary lodging,
transportation, and other goods and services necessary for the health
or welfare of individuals--and is provided to repatriates in the form
of a service loan repayable to the U.S. Government, fits that example
and therefore qualifies as ``doing business with a Federal agency.''
For purposes of 31 U.S.C. 7701(c), the taxpayer identifying number is
the individual's social security number (SSN).
Authority to maintain disaster assistance records: Statement of
Organization, Functions, and Delegations of Authority, 71 FR 71549
(Dec. 11, 2006); E.O. 12656, 53 FR 47491 (Nov. 18, 1988), reprinted in
42 U.S.C. 5195.
PURPOSE(S) OF THE SYSTEM:
The purpose of the system of records is to enable OHSEPR to provide
assistance in an efficient and expeditious manner to repatriated U.S.
citizens and their dependents and to disaster survivors. Specifically:
<bullet> Records for the repatriation program are used by OHSEPR
for the primary purposes of making eligibility determinations before
temporary assistance is provided to U.S. citizens and their dependents
who are without available resources in the U.S. upon their arrival from
abroad and for up to 90 days after their arrival, not exceeding 90 days
as may be provided in regulations of the Secretary of HHS and
supporting repayment of assistance allocable to individual recipients.
Temporary assistance may include money payments, medical care,
temporary billeting, transportation, and other goods and services
necessary for the health or welfare of individuals (including guidance,
counseling, and other welfare services). All temporary assistance
provided under the repatriation program and allocable to individual
recipients is repayable to the Federal Government. OHSEPR may use the
records for the secondary purpose of providing training and technical
assistance to State human services departments and local services
providers, in addition to creating aggregate datasets to use in
monitoring and assessing the effectiveness of the repatriation program.
<bullet> Records for the disaster assistance program are used by
OHSEPR for the primary purpose of identifying, assessing, and
addressing immediate, unmet disaster-caused human services needs of
survivors of federally declared disasters. Disaster assistance may
include conducting intake assessments and referrals, providing outreach
and triage, developing a Disaster Survivor Recovery Plan, and
connecting the disaster survivor to resources that are locally
available. OHSEPR may use the records for the secondary purposes of
creating aggregate datasets to use in providing financial assistance to
State or local government agencies or qualified private organizations
assisting survivors, building local disaster case management capacity
through the provision of training and technical assistance to States,
Tribes, Territories, and local governments, and monitoring and
assessing the effectiveness of the disaster assistance program.
Note: OHSEPR will refer records from this system of records
about temporary assistance allocable to individuals receiving
repatriation assistance that is repayable to the Federal Government,
to the Program Support Center within the Office of the Assistant
Secretary for Administration for debt management and collection
purposes. Records used for debt management and collection purposes
are maintained under SORN 09-40-0012, Debt Management and Collection
Records, and may be used and disclosed for the purposes described in
that SORN.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
The categories of individuals covered by this system are:
<bullet> U.S. citizens and their dependents who are receiving
temporary assistance and are identified by the Department of State as
having returned or been brought from a foreign country to the U.S.
because of destitution, illness, war, threat of war, or a similar
crisis.
<bullet> Survivors of disasters who reside within a jurisdiction
included in federally declared disaster or emergency and apply for
disaster assistance under an HHS authority (e.g., not under a Federal
Emergency Management Agency (FEMA) authority).
CATEGORIES OF RECORDS IN THE SYSTEM:
The categories of records are:
<bullet> Case files containing correspondence about repatriated
U.S. citizens and their dependents receiving temporary assistance.
Information about a repatriate may include full name, current mailing
address, social security number, passport number, date and place of
birth, dependents, and information about any medical care, temporary
billeting, transportation, or other goods and services (e.g., food,
clothing) necessary for the health or welfare of the individual
(including guidance, counseling, and other welfare services) that was
furnished to the individual.
<bullet> Case files about disaster survivors who apply for disaster
assistance under
[[Page 63112]]
an HHS (e.g., not FEMA) authority. (Note that these files are separate
and apart from those maintained in performing Immediate Disaster Case
Management (IDCM) pursuant to a Mission Assignment agreement with
FEMA.) The files include intake assessment records, resource referral
lists, case notes, status reports, and recovery plans. Information
about a disaster survivor may include disaster number, full name,
current mailing address, date of birth, transitional housing location
type, transitional housing mailing address, damaged dwelling mailing
address, damaged county, location at time of registration, phone
numbers, email addresses, homeowners insurance coverage details
(including flood coverage), details on health care coverage, household
size, household composition and member ages, details on damage to real
and personal property, degree of total damage incurred, self-reported
income, assistance sought, assistance received, source of assistance,
persons residing in a dwelling, Federal disaster assistance referral
status, and status of access and functional, and/or emergency needs.
Note that this system of records does not include the following
records:
<bullet> Records of immediate disaster case management services
that OHSEPR provides on behalf of another component of HHS or another
agency. For example, pursuant to an interagency agreement, OHSEPR
provides immediate disaster case management (IDCM) services on behalf
of the Department of Homeland Security, FEMA (DHS/FEMA), under mission
assignments from DHS/FEMA. Records of those services are covered under
a FEMA SORN; currently, DHS/FEMA-008 Disaster Recovery Assistance Files
System of Records.
<bullet> Disaster response records maintained by another component
of HHS, such as the records maintained by the Office of the Assistant
Secretary for Preparedness and Response (ASPR) under SORNs 09-90-0039
National Disaster Claims Processing System, and 09-90-0040 National
Disaster Medical System (NDMS) Disaster Medical Information Suite
(DMIS).
RECORD SOURCE CATEGORIES:
Information in repatriation program records is received directly
from the subject individual (i.e., client) or from a member of the
client's or client's family or household, or a relative or
representative of the client, or may be provided by other governmental
entities (e.g., Federal, State, local, or Tribal agencies) and local
service providers, international agencies, foreign governments,
employers, health care institutions, and public information sources.
Information in disaster assistance program records is received
directly from the subject individual (i.e., client) or from a member of
the client's or client's family or household, or a relative or
representative of the client, or may be provided by other governmental
entities (e.g., Federal, State, local, or Tribal agencies) and social
service organizations.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
In addition to other disclosures permitted under 5 U.S.C.
552a(b)(1) and (2) and (4) through (11), OHSEPR may disclose a record
about an individual from this system of records to parties outside HHS
as provided in these routine uses, which are published pursuant to 5
U.S.C. 552a(b)(3). A routine use applies to both the repatriation
program and the disaster assistance program, unless worded to apply to
only one of those programs. Each proposed disclosure of information
under these routine uses will be evaluated to ensure that the
disclosure is legally permissible, including but not limited to
ensuring that the purpose of the disclosure is compatible with the
purpose for which the information was collected.
1. Disclosure to Contractors, Grantees, and Other Agents. Records
may be disclosed to contractors (including another Federal agency
acting as a service provider), grantees, consultants, volunteers, or
other agents of OHSEPR who are assisting OHSEPR with the accomplishment
of an OHSEPR function relating to the purposes of this system of
records and need to have access to the records in order to provide the
assistance.
2. Disclosure to Department of State. Records about a repatriation
assistance applicant may be disclosed to the Department of State in
connection with determinations of eligibility, referral, planning, and
provision of temporary assistance of or to repatriates in cases
referred to HHS.
3. Disclosure to States. Records about a repatriation assistance
applicant may be disclosed to the States in connection with
coordination and/or provision of temporary services for eligible
repatriates.
4. Disclosure to Service Provider. Records about a repatriation
assistance applicant may be disclosed to providers of services (e.g.,
community-based organizations, hospitals) and to local State
institutions (e.g., courts and social service agencies) that assist in
coordination and/or the provision of temporary assistance for eligible
repatriates.
5. Disclosure to Agency for Temporary Assistance. Records about a
repatriation assistance applicant may be disclosed to other Federal
agencies and nongovernmental agencies for planning or provision of
temporary assistance to eligible repatriates. Federal agencies include
but are not limited to Department of State, Department of Defense,
Department of Justice, Department of Homeland Security, Department of
Housing and Urban Development, Federal Emergency Management Agency,
Department of Agriculture, and United States Department of
Transportation. Nongovernmental agencies include but are not limited to
American Red Cross and Salvation Army.
6. Disclosure for Law Enforcement Purposes. Records may be
disclosed to the appropriate Federal, State, local, Tribal, or foreign
agency responsible for investigating, prosecuting, enforcing, or
implementing a statute, rule, regulation, or order, if the information
is relevant to a violation or potential violation of civil or criminal
law or regulation within the jurisdiction of the receiving entity.
7. Disclosure for Administrative Claim, Complaint, and Appeal.
Records about a repatriation assistance recipient may be disclosed to
an authorized appeal grievance examiner, formal complaints examiner,
equal employment opportunity investigator, arbitrator or other person
properly engaged in investigation or settlement of an administrative
grievance, complaint, claim, or appeal filed by an employee, but only
to the extent that the information is relevant and necessary to the
proceeding. Agencies that may obtain information under this routine use
include, but are not limited to, the Office of Personnel Management,
Office of Special Counsel, Merit Systems Protection Board, Federal
Labor Relations Authority, Equal Employment Opportunity Commission, and
Office of Government Ethics.
8. Disclosure in Connection with Settlement Discussions. Records
about a repatriation assistance recipient may be disclosed in
connection with settlement discussions regarding claims by or against
HHS, including public filing with a court, to the extent that
disclosure of the information is relevant and necessary to the
litigation or discussions.
9. Disclosure to Ensure Continuity of Disaster Assistance Services.
Records about a disaster assistance applicant
[[Page 63113]]
may be disclosed to DHS/FEMA pursuant to an interagency sharing and
access agreement and to the State, local, Tribal, or Territorial
departments of human services to ensure continuity of services for each
disaster survivor.
10. Disclosure to Locate Missing Children or Reunite Families.
Records about a disaster assistance applicant may be disclosed to a
Federal or State law enforcement authority, Federal or State agency, or
private organization authorized to investigate, coordinate, or locate
missing children and/or reunite families.
11. Disclosure to Combat Fraud, Waste, and Abuse. Records may be
disclosed to another Federal agency, or instrumentality of any
governmental jurisdiction, within or under the control of the United
States (including the-State or local governmental agency) that
administers or has the authority to investigate potential fraud, waste,
or abuse in federally funded programs when reasonably necessary by HHS
to prevent, deter, discover, detect, investigate, or sue with respect
to defend against, correct, remedy, or otherwise combat fraud, waste or
abuse in such programs.
12. Disclosure for Private Relief Legislation. Records about a
repatriation assistance recipient may be disclosed to the Office of
Management and Budget at any stage in the legislative coordination and
clearance process in connection with private relief legislation as set
forth in OMB Circular A-19.
13. Disclosure to Congressional Office. Records may be disclosed to
a congressional office from the record of an individual in response to
a written inquiry from the congressional office made at the written
request of the individual.
14. Disclosure to Department of Justice or in Proceedings. Records
may be disclosed to the Department of Justice (DOJ), or in a proceeding
before a court, adjudicative body, or other administrative body before
which HHS is authorized to appear, when:
<bullet> HHS, or any component thereof; or
<bullet> Any employee of HHS in his or her official capacity; or
<bullet> Any employee of HHS in his or her individual capacity
where DOJ or HHS has agreed to represent the employee; or
<bullet> The United States, if HHS determines that the litigation
is likely to affect HHS or any of its components,
is a party to the litigation or has an interest in the litigation
and the use of the records by DOJ or HHS is deemed by HHS to be
relevant and necessary to the litigation.
15. Disclosure to the National Archives and Records Administration.
Records may be disclosed to representatives of the National Archives
and Records Administration (NARA) in records management inspections
conducted pursuant to 44 U.S.C. 2904 and 2906.
16. Disclosure in the Event of a Security Breach Experienced by
HHS. Records may be disclosed to appropriate agencies, entities, and
persons when (1) HHS suspects or has confirmed that there has been a
breach of the system of records; (2) HHS has determined that as a
result of the suspected or confirmed breach there is a risk of harm to
individuals, the agency (including its information systems, programs
and operations), the Federal Government, or national security; and (3)
the disclosure made to such agencies, entities, and persons is
reasonably necessary to assist in connection with HHS' efforts to
respond to the suspected or confirmed breach or to prevent, minimize,
or remedy such harm.
17. Disclosure to Assist Another Agency Experiencing a Breach.
Records may be disclosed to another Federal agency or Federal entity,
when HHS determines that information from this system of records is
reasonably necessary to assist the recipient agency or entity in (1)
responding to a suspected or confirmed breach or (2) preventing,
minimizing, or remedying the risk of harm to individuals, the recipient
agency or entity (including its information systems, programs, and
operations), the Federal Government, or national security, resulting
from a suspected or confirmed breach.
18. Disclosure for Cybersecurity Monitoring Purposes. Records may
be disclosed to the DHS if captured in an intrusion detection system
used by HHS and DHS pursuant to a DHS cybersecurity program that
monitors internet traffic to and from Federal Government computer
networks to prevent a variety of types of cybersecurity incidents.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records are stored in hard copy files, electronic storage media,
and cloud/network storage.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Disaster assistance case records are retrieved by the individual's
name or case file number. Repatriate case records are retrieved by the
individual's name, case file number, or social security number.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records about individuals receiving repatriation assistance are
retained and disposed of in accordance with NARA-approved disposition
schedule N1-292-93-1, as follows:
<bullet> Files are transferred to a Federal records center one year
after termination of collection efforts and are destroyed five years
after termination of collection efforts.
Records about disaster survivors are disposed of in accordance with
NARA-approved disposition schedule DAA-0292-2019-0001, as follows:
<bullet> Database intake assessment records: Cut off at the end of
the calendar year, following the end of a disaster mission; Destroy 10
years after cutoff.
<bullet> Resource referral list: Cut off at the end of the calendar
year, following the end of a disaster mission; Destroy 10 years after
cutoff.
<bullet> Disaster Survivor Recovery Plans: Cut off at the end of
the calendar year, following the end of a disaster mission; Destroy 3
years after cutoff.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Safeguards conform to the HHS Information Security and Privacy
Program, <a href="https://www.hhs.gov/ocio/securityprivacy/index.html">https://www.hhs.gov/ocio/securityprivacy/index.html</a>.
Information is safeguarded in accordance with applicable laws, rules
and policies, including the HHS Information Technology Security Program
Handbook, the E-Government Act of 2002 that includes the Federal
Information Security Management Act of 2002 (FISMA), 44 U.S.C. 3541-
3549, as amended by the Federal Information Security Modernization act
of 2014, 44 U.S.C. 3551-3558, all pertinent National Institutes of
Standards and Technology (NIST) publications; and OMB Circular A-130,
Managing Information as a Strategic Resource. Records are protected
from unauthorized access through appropriate administrative, physical,
and technical safeguards. These safeguards include requiring
contractors and grantees to maintain confidentiality throughout the
case management process by assuring that client records are kept in a
safe, secure environment within contractor or grantee facilities. All
direct contractor or grantee staff are required to sign a
confidentiality agreement and to receive training on security, privacy,
and confidentiality policies and procedures, including methods of
protecting client confidentiality. Client records are filed according
to OHSEPR protocols and access to records is controlled through
[[Page 63114]]
log-in/out processes for both computer and paper files.
Case managers, should they need to use paper records into the
field, will take only those records needed to complete field
activities, and all paper files will be kept in a locking file box
while in transport and kept in a controlled facility when not being
directly used for case management functions. Records in electronic
format are accessible only to authorized users using two-factor
authentication and password protection through a secured system
protected by encryption, firewalls, and intrusion detection systems
that require additional encryption for records stored on removable
media. Records that become eligible for destruction are disposed of in
alignment with the destruction methods prescribed by the NIST Special
Publication (SP) 800-88. The associated information technology (IT)
system(s) receive Authority to Operate (ATO) under the guidance of NIST
SP 800-37.
RECORD ACCESS PROCEDURES:
Individuals seeking access to records about them in this system of
records must submit a written access request to the System Manager
identified in the ``System Manager(s)'' section of this SORN, in
accordance with the Department's Privacy Act implementation regulations
in 45 CFR. The request must contain the requester's full name, address,
telephone number and/or email address, date and place of birth, and
signature, and should identify the repatriation program or the
applicable disaster, or otherwise provide enough information to enable
OHSEPR to locate the requested records.
So that HHS may verify the requester's identity, the requester's
signature must be notarized or the request must include the requester's
written certification that the requester is the individual who the
requester claims to be and that the requester understands that the
knowing and willful request for or acquisition of a record pertaining
to an individual under false pretenses is a criminal offense subject to
a fine of up to $5,000.
You may request that a copy of the record be sent to you, or you
may request an appointment to review the record in person (including
with a person of your choosing, if you provide written authorization
for agency personnel to discuss the record in that person's presence).
You may also request an accounting of disclosures that have been made
of the record, if any.
CONTESTING RECORDS PROCEDURES:
Individuals seeking to amend records about them in this system of
records must submit a written amendment request to the System Manager
identified in the ``System Manager(s)'' section of this SORN, in
accordance with the Department's Privacy Act implementation regulations
in 45 CFR. The request must contain the same information required for
an access request. The request must include verification of the
requester's identity in the same manner required for an access request;
must reasonably identify the record and specify the information
contested, the corrective action sought, and the reasons for requesting
the correction; and should include supporting information to show how
the record is factually inaccurate, incomplete, untimely, or
irrelevant.
NOTIFICATION PROCEDURES:
Individuals who wish to know if this system contains records about
them should submit a written notification request to the System Manager
identified in the ``System Manager(s)'' section of this SORN, in
accordance with the Department's Privacy Act implementation regulations
in 45 CFR. The request must contain the same information required for
an access request and must include verification of the requester's
identity in the same manner required for an access request.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
81 FR 46687 (July 18, 2016), 83 FR 6591 (Feb. 14, 2018).
[FR Doc. 2023-19875 Filed 9-13-23; 8:45 am]
BILLING CODE 4184-01-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on September 14, 2023.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.