Agency Information Collection Activities: Proposed Collection; Public Comment Request; Information Collection Request Title: SAMHSA Data Security Requirements for Accessing Confidential Data (OMB No. 0930-0396)

Issuing agencies

Abstract

Substance Abuse and Mental Health Services (SAMHSA), within the Department of Health and Human Services, has submitted the following information collection requirement to the Office of Management and Budget (OMB) for review and clearance under the Paperwork Reduction Act of 1995. This is the first notice for public comment. SAMHSA will forward the proposed Data Security Requirements for Accessing Confidential Data information collection to the OMB for clearance simultaneously with the publication of the second notice, following the expiration of this first notice. The full submission may be found at: http://www.reginfo.gov/public/do/PRAMain.

Full Text

<html>
<head>
<title>Federal Register, Volume 91 Issue 202 (Wednesday, October 21, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 202 (Wednesday, October 21, 2026)]
[Notices]
[Pages 66572-66573]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-21486]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Substance Abuse and Mental Health Services


Agency Information Collection Activities: Proposed Collection; 
Public Comment Request; Information Collection Request Title: SAMHSA 
Data Security Requirements for Accessing Confidential Data (OMB No. 
0930-0396)

AGENCY: Substance Abuse and Mental Health Services Administration; 
Center for Behavioral Health Statistics and Quality.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: Substance Abuse and Mental Health Services (SAMHSA), within 
the Department of Health and Human Services, has submitted the 
following information collection requirement to the Office of 
Management and Budget (OMB) for review and clearance under the 
Paperwork Reduction Act of 1995. This is the first notice for public 
comment. SAMHSA will forward the proposed Data Security Requirements 
for Accessing Confidential Data information collection to the OMB for 
clearance simultaneously with the publication of the second notice, 
following the expiration of this first notice. The full submission may 
be found at: <a href="http://www.reginfo.gov/public/do/PRAMain">http://www.reginfo.gov/public/do/PRAMain</a>.

DATES: Written comments should be received by November 20, 2026.

ADDRESSES: Written comments and recommendations for the proposed 
information collection should be sent within 30 days of publication of 
this notice to <a href="http://www.reginfo.gov/public/do/PRAMain">www.reginfo.gov/public/do/PRAMain</a>. Find this particular 
information collection by selecting ``Currently under 30-day Review--
Open for Public Comments'' or by using the search function.

FOR FURTHER INFORMATION CONTACT: SAMHSA Reports Clearance Officer, Room 
15E-57A, 5600 Fishers Lane, Rockville, MD 20857 OR email to 
<a href="/cdn-cgi/l/email-protection#bbe8dad6d3c8dacbc9dafbc8dad6d3c8da95d3d3c895dcd4cd"><span class="__cf_email__" data-cfemail="c390a2aeabb0a2b3b1a283b0a2aeabb0a2edababb0eda4acb5">[email&#160;protected]</span></a>.

SUPPLEMENTARY INFORMATION: SAMHSA within the Department of Health and 
Human Services has submitted the following information collection 
requirement to OMB for review and

[[Page 66573]]

clearance under the Paperwork Reduction Act of 1995. This is the second 
notice for public comment; the first was published in the Federal 
Register at 91 FR 52312 and no comments were received. SAMHSA is 
forwarding the proposed Data Security Requirements for Accessing 
Confidential Data information collection to the OMB for clearance 
simultaneously with the publication of this second notice. The full 
submission may be found at: <a href="http://www.reginfo.gov/public/do/PRAMain">http://www.reginfo.gov/public/do/PRAMain</a>.
    Comments: Comments regarding (a) whether the collection of 
information is necessary for the proper performance of the functions of 
SAMHSA, including whether the information will have practical utility; 
(b) the accuracy of SAMHSA's estimate of the burden of the proposed 
collection of information; (c) ways to enhance the quality, use, and 
clarity of the information to be collected, including through the use 
of automated collection techniques or other forms of information 
technology; (d) ways to minimize the burden of the collection of 
information on those who are to respond, including through the use of 
appropriate automated or other forms of information technology.

Proposed Information Collection: Data Security Requirements for 
Accessing Confidential Data (OMB Control Number: 0930-0396)--Extension

    Title III of the Foundations for Evidence-Based Policymaking Act of 
2018 (44 U.S.C. 3583) mandates that the Director of OMB establish a 
standard application process (SAP) for requesting access to certain 
confidential data assets. The Center for Behavioral Health Statistics 
and Quality (CBHSQ) is a federally recognized statistical unit and the 
adoption of the SAP is required for statistical agencies/units 
designated under the Confidential Information Protection and 
Statistical Efficiency Act of 2018 (CIPSEA). The SAP Portal is a single 
web-based common application designed to collect information from 
individuals requesting access to confidential data assets from federal 
statistical agencies/units.
    The SAP allows agencies, the Congressional Budget Office, State, 
local, and Tribal governments, researchers, and other individuals, as 
appropriate, to apply to access confidential data assets held by a 
federal statistical agency or unit for the purposes of developing 
evidence. With the Interagency Council on Statistical Policy (ICSP) as 
advisors, the entities upon whom this requirement is levied are working 
with the SAP Project Management Office (PMO) and with OMB to implement 
the SAP.
    The SAP Portal is a single web-based common application designed to 
collect information from individuals requesting access to confidential 
data assets from federal statistical agencies and units. When an 
application for confidential data is approved through the SAP Portal, 
SAMHSA will collect information to fulfill its data security 
requirements. This is a required step before providing the individual 
with access to restricted use microdata for the purpose of evidence 
building. SAMHSA's data security agreements and other paperwork, along 
with the corresponding security protocols, allow SAMHSA to maintain 
careful controls on confidentiality and privacy, as required by law. 
SAMHSA's collection of data security information will occur outside of 
the SAP Portal.
    The following bullets outline the major components and processes in 
and around the SAP Portal, leading up to SAMHSA's collection of 
security requirements.
    <bullet> SAP Policy: At the recommendation of the ICSP, the SAP 
Policy establishes the SAP to be implemented by statistical agencies 
and units and incorporates directives from the Evidence Act. The SAP 
Policy may be found in OMB Memorandum 23-04.
    <bullet> The SAP Portal: The SAP Portal is an application interface 
connecting applicants seeking data with a catalog of metadata for data 
assets owned by the federal statistical agencies and units. The SAP 
Portal is not a new data repository or warehouse; confidential data 
assets will continue to be stored in secure data access facilities 
owned and hosted by the federal statistical agencies and units. The 
Portal provides a streamlined application process across agencies, 
reducing redundancies in the application process.
    <bullet> Data Discovery: Individuals begin the process of accessing 
restricted use data by discovering confidential data assets through the 
SAP metadata catalog, maintained by federal statistical agencies at 
<a href="https://sap.nsf.gov/">https://sap.nsf.gov/</a>.
    <bullet> SAP Portal Application Process: Individuals who have 
identified and wish to access confidential data assets apply through 
the SAP Portal. Applicants must create an account and follow all steps 
to complete the application. Applicants enter personal, contact, and 
institutional information for the research team and provide summary 
information about their proposed project.
    <bullet> Submission for Review: Agencies approve or reject an 
application within a prompt timeframe. Agencies may also request 
applicants to revise and resubmit their application.
    <bullet> Access to Confidential Data: Approved applicants are 
notified through the SAP Portal that their proposal has been accepted. 
This concludes the SAP Portal process. Agencies will contact approved 
applicants to initiate completion of their security documents. The 
completion and submission of the agency's security requirements will 
take place outside of the SAP Portal.
    <bullet> Collection of Information for Data Security Requirements: 
In the instance of a positive determination for an application 
requesting access to a SAMHSA-owned confidential data asset, SAMHSA 
will contact the applicant(s) to initiate the process of collecting 
information to fulfill its data security requirements. This process 
allows SAMHSA to place the applicant(s) in a trusted access category.
    The estimated response burden is as follows:
    The amount of time to complete the agreements and other paperwork 
that comprise SAMHSA's security requirements will vary based on the 
confidential data assets requested. To obtain access to SAMHSA 
confidential data assets, it is estimated that the average time to 
complete and submit SAMHSA's data security agreements and other 
paperwork is 40 minutes. This estimate does not include the time needed 
to complete and apply within the SAP Portal. All efforts related to SAP 
Portal applications occur prior to and separate from SAMHSA's effort to 
collect information related to data security requirements.
    The expected number of applications in the SAP Portal that receive 
a positive determination from SAMHSA each year may vary. Overall, per 
year, SAMHSA estimates it will collect data security information for 15 
application submissions that received a positive determination within 
the SAP Portal. SAMHSA estimates that the total burden for the 
collection of information for data security requirements over the 
course of the three-year OMB clearance will be about 30 hours and, as a 
result, an average annual burden of 10 hours.

Alicia Broadus,
Public Health Advisor.
[FR Doc. 2026-21486 Filed 10-20-26; 8:45 am]
BILLING CODE 4162-20-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>