Code of Federal Regulations: Containing a Codification of Documents of ...

within the grant and the records within the denial.

§ 4b.6 Special procedures: Medical records.

(a) No response to any request for access to medical records by an individual will be issued by the Privacy Officer for a period of seven days (excluding Saturdays, Sundays and holidays) from the date of receipt.

(b) The Department has published as a routine use, for all systems of records containing medical records, consultations with an individual's physician or psychologist if, in the sole judgment of the Department, disclosure could have an adverse effect upon the individual. The mandatory waiting period set forth in paragraph (a) of this section will permit exercise of this routine use in appropriate cases. The Department will pay no cost of any such consultation.

(1) Inform the individual of the waiting period prescribed in paragraph (a) of this section;

(2) Obtain the name and address of the individual's physician and/or psychologist, if the individual consents to give them;

(3) Obtain specific, written consent for the Department to consult the individual's physician and/or psychologist in the event that the Department believes such consultation is advisable, if the individual consents to give such authorization;

(4) Obtain specific, written consent for the Department to provide the medical records to the individual's physician or psychologist in the event that the Department believes access to the record by the individual is best effected under the guidance of the individual's physician or psychologist, if the individual consents to give such authorization; and,

(5) Forward the individual's medical record to the Department's medical officer for review and a determination on whether consultation with or transmittal of the medical records to the individual's physician or psychologist is warranted. If the consultation with or transmittal of such records to the indi

vidual's physician or psychologist is determined to be warranted, the Department's medical officer shall so consult or transmit. Whether or not such a consultation or transmittal occurs, the Department's medical officer shall provide instruction to the Privacy Officer regarding the conditions of access by the individual to his or her medical records.

(d) If an individual refuses in writing to give the names and consents set forth in paragraphs (c)(2) through (4) of this section and the Department has determined that disclosure could have an adverse effect upon the individual, the Department shall give the individual access to said records by means of a copy, provided without cost to the requester, sent registered mail return receipt requested.

§ 4b.7 Request for correction or amendment to record.

(a) Any individual, regardless of age, who is a citizen of the United States or an alien lawfully admitted for permanent residence into the United States may submit a request for correction or amendment to the Department. The request should be made either in person or by mail addressed to the Privacy Officer who processed the individual's request for access to the record, and to whom is delegated authority to make initial determinations on requests for correction or amendment. The offices of Privacy Officers are open to the public between the hours of 9:00 a.m. and 4:00 p.m. Monday through Friday (excluding holidays).

(b) The processing of requests submitted by mail will be facilitated if the words "PRIVACY ACT REQUEST" appear in capital letters on the face of the envelope. If, for some reason, the individual is unable to use the Department's official form, the letter should bear the words "PRIVACY ACT REQUEST" in capital letters at the top.

(c) Any request which is not addressed as specified in paragraph (a) of this section or which is not marked as specified in paragraph (b) of this section will be So addressed and marked by Department personnel and forwarded immediately to the responsible Privacy Officer. A request which

is not properly addressed by the individual will not be deemed to have been "received" for purposes of measuring time periods for response until actual receipt by the Privacy Officer. In each instance when a request so forwarded is received, the Privacy Officer shall notify the individual that his or her request was improperly addressed and the date when the request was received at the proper address.

(d) Since the request, in all cases, will follow a request for access under § 4b.5, the individual's identity will be established by his or her signature on the request and use of the Department control number assigned to the request.

(e) A request for correction amendment should include the following:

(1) A specific identification of the record sought to be corrected or amended (for example, description, title, date, paragraph, sentence, line and words);

(2) The specific wording to be deleted, if any;

(3) The specific wording to be inserted or added, if any, and the exact place at which to be inserted or added; and,

(4) A statement of the basis for the requested correction or amendment, with all available supporting documents and materials which substantiate the statement. The statement should identify the criterion of the Act being invoked, that is, whether the information in the record is unnecessary, inaccurate, irrelevant, untimely or incomplete.

§ 4b.8 Agency review of request for correction or amendment of record. (a)(1) (i) Not later than ten days (excluding Saturdays, Sundays and holidays) after receipt of a request to correct or amend a record, the Privacy Officer shall send an acknowledgment providing an estimate of time within which action will be taken on the request and asking for such further information as may be necessary to process the request. The estimate of time may take into account unusual circumstances as described in § 4b.5(a). No acknowledgment will be sent if the request can be reviewed, processed and

the individual notified of the results of review (either compliance or denial) within the ten days. Requests filed in person will be acknowledged in writing at the time submitted.

(ii) If the Privacy Officer fails to send the acknowledgment within the ten days, as provided above, the requester may ask the responsible Privacy Appeals Officer, identified in Appendix B to this part, to take corrective action. No failure of a Privacy Officer to send an acknowledgment shall confer administrative finality for purposes of judicial review.

(2) Promptly after acknowledging receipt of a request, or after receiving such further information as might have been requested, or after arriving at a decision within the ten days, the Privacy Officer shall either:

(i) Make the requested correction or amendment and advise the individual in writing of such action, providing either a copy of the corrected or amended record or a statement as to the means whereby the correction or amendment was effected in cases where a copy cannot be provided (for example, erasure of information from a record maintained only in magnetically recorded computer files); or,

(ii) Inform the individual in writing that his or her request is denied and provide the following information:

(A) The Privacy Officer's name and title or position;

(B) The date of the denial;

(D) The procedures for appeal of the denial as set forth in § 4b.9, including the name and address of the responsible Privacy Appeals Officer from Appendix C to this part.

The term "promptly" in this subsection means within thirty days (excluding Saturdays, Sundays and holidays). If the Privacy Officer cannot make the determination within thirty days, the individual will be advised in writing of the reason therefor and of the estimated date by which the determination will be made.

(b) Whenever an individual's record is corrected or amended pursuant to a request by that individual, the Privacy Officer shall see to the notification of

all persons and agencies to which the corrected or amended portion of the record had been disclosed prior to its correction or amendment, if an accounting of such disclosure required by the Act was made. The notification shall require a recipient agency maintaining the record to acknowledge receipt of the notification, to correct or amend the record and to apprise any agency or person to which it had disclosed the record of the substance of the correction or amendment.

(1) The sufficiency of the evidence submitted by the individual;

(2) The factual accuracy of the information;

(3) The relevance and necessity of the information in terms of purpose for which it was collected;

(4) The timeliness and currency of the information in light of the purpose for which it was collected;

(5) The completeness of the information in terms of the purpose for which it was collected;

(6) The degree of risk that denial of the request could unfairly result in determinations adverse to the individual;

(7) The character of the record sought to be corrected or amended; and,

(8) The propriety and feasibility of complying with the specific means of correction or amendment requested by the individual.

(d) The Department will not undertake to gather evidence for the individual, but does reserve the right to verify the evidence which the individual submits.

(e) Correction or amendment of a record requested by an individual will be denied only upon a determination by the Privacy Officer that:

(1) The individual has failed to establish, by a preponderance of the evidence, the propriety of the correction or amendment in light of the criteria set forth in paragraph (c) of this section;

(2) The record sought to be corrected or amended is part of the official record in a terminated judicial, quasijudicial or quasi-legislative proceeding

to which the individual was a party or participant;

(3) The information in the record sought to be corrected or amended, or the record sought to be corrected or amended, is the subject of a pending judicial, quasi-judicial or quasi-legislative proceeding to which the individual is a party or participant;

(4) The correction or amendment would violate a duly enacted statute or promulgated regulation; or,

(5) The individual unreasonably has failed to comply with the procedural requirements of this part.

(f) If a request is partially granted and partially denied, the Privacy Officer shall follow the appropriate procedures of this section as to the records within the grant and the records within the denial.

§ 4b.9 Appeal of initial adverse agency determination on correction or amendment.

(a) When a request for correction or amendment has been denied initially under § 4b.8, the individual may submit a written appeal within thirty days after the date of the initial denial. When an appeal is submitted by mail, the postmark is conclusive as to timeliness.

(b) An appeal shall be addressed to the Privacy Appeals Officer identified in the initial denial (that official is authorized to make final determinations). The processing of appeals will be facilitated if the words "PRIVACY APPEAL" appear in capital letters on both the envelope and the top of the appeal papers. An appeal not addressed and marked as provided herein will be so marked by Department personnel when it is so identified, and will be forwarded immediately to the responsible Privacy Appeals Officer. An appeal which is not properly addressed by the individual will not be deemed to have been "received" for purposes of measuring the time periods in this section until actual receipt by the Privacy Appeals Officer. In each instance when an appeal so forwarded is received, the Privacy Appeals Officer shall notify the individual that his or her appeal was improperly addressed and the date when the appeal was received at the proper address.

(c) The individual's appeal papers shall include a statement of the reasons why the initial denial is believed to be in error and the Department's control number assigned to the request. The appeal shall be signed by the individual. The record which the individual requests be corrected or amended and all correspondence between the Privacy Officer and the requester will be supplied by the Privacy Officer who issued the initial denial. While the foregoing normally will comprise the entire record on appeal, the Privacy Appeals Officer may seek additional information necessary to assure that the final determination is fair and equitable and, in such instances, the additional information will be disclosed to the individual to the greatest extent possible and an opportunity provided for comment there

on.

(d) No personal appearance or hearing on appeal will be allowed.

(e) The Privacy Appeals Officer shall act upon the appeal and issue a final determination in writing not later than thirty days (excluding Saturdays, Sundays and holidays) from the date on which the appeal is received; provided, that the Privacy Appeals Officer may extend the thirty days upon deciding that a fair and equitable review cannot be made within that period, but only if the individual is advised in writing of the reason for the extension and the estimated date by which a final determination will issue. The estimated date should not be later than the sixtieth day (excluding Saturdays, Sundays and holidays) after receipt of the appeal unless unusual circumstances, as described in § 4b.5(a), are met.

(f) If the appeal is determined in favor of the individual, the final determination shall include the specific corrections or amendments to be made and a copy thereof shall be transmitted promptly both to the individual and to the Privacy Officer who issued the initial denial. Upon receipt of such final determination, the Privacy Officer promptly shall take the actions set forth in §§ 4b.8(a)(2)(i) and 4b.8(b).

(g) If the appeal is denied, the final determination shall be transmitted promptly to the individual and state

the reasons for the denial. The notice of final determination also shall inform the individual of the following:

(1) The right of the individual under the Act to file a concise statement of reasons for disagreeing with the final determination. The statement ordinarily should not exceed one page and the Department reserves the right to reject a statement of excessive length. Such a statement shall be filed with the Privacy Appeals Officer. It should provide the Department control number assigned to the request, indicate the date of the final determination and be signed by the individual. The Privacy Appeals Officer shall acknowledge receipt of such statement and inform the individual of the date on which it was received;

(2) The facts that any such disagreement statement filed by the individual will be noted in the disputed record, that the purposes and uses to which the statement will be put are those applicable to the record in which it is noted, and that a copy of the statement will be provided to persons and agencies to which the record is disclosed subsequent to the date of receipt of such statement;

(3) The fact that the Department will append to any such disagreement statement filed by the individual, copy of the final determination or summary thereof which also will be provided to persons and agencies to which the disagreement statement is disclosed; and,

(4) The right of the individual to judicial review of the final determination under 5 U.S.C. 552a(g)(1)(A), as limited by 5 U.S.C. 552a(g)(5).

(h) In making the final determination, the Privacy Appeals Officer shall employ the criteria set forth in § 4b.8(c) and shall deny an appeal only on the grounds set forth in § 4b.8(e).

(i) If an appeal is partially granted and partially denied, the Privacy Appeals Officer shall follow the appropriate procedures of this section as to the records within the grant and the records within the denial.

(j) Although a copy of the final determination or a summary thereof will be treated as part of the individual's record for purposes of disclosure in instances where the individual has filed

a disagreement statement, it will not be subject to correction or amendment by the individual.

(k) The provisions of paragraphs (g)(1) through (3) of this section satisfy the requirements of 5 U.S.C. 552a(e)(3).

84b.10 Disclosure of record to person other than the individual to whom it pertains.

(a) The Department may disclose a record pertaining to an individual to a person other than the individual to whom it pertains only in the following instances:

(1) Upon written request by the individual, including authorization under § 4b.5(f);

(2) With the prior written consent of the individual;

(3) To a parent or legal guardian under 5 U.S.C. 552a(h);

(4) When required by the Act and not covered explicitly by the provisions of 5 U.S.C. 552a(b); and

(5) When permitted under 5 U.S.C. 552a(b)(1) through (11), which read as follows: 1

(i) To those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties;

(ii) Required under section 552 of this title;

(iii) For a routine use as defined in paragraph (a)(7) of this section and described under paragraph (e)(4)(D) of this section;

(iv) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13; (v) To a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;

(vi) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Administrator of

15 U.S.C. 552a(b)(4) has no application within the Department.

General Services or his designee to determine whether the record has such value;

(vii) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought;

(viii) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual;

(ix) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee;

(x) To the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office; or

(xi) Pursuant to the order of a court of competent jurisdiction.

(b) The situations referred to in paragraph (a)(4) of this section include the following:

(1) 5 U.S.C. 552a(c)(4) requires dissemination of a corrected or amended record or notation of a disagreement statement by the Department in certain circumstances;

(2) 5 U.S.C. 552a(d) requires disclosure of records to the individual to whom they pertain, upon request;

(3) 5 U.S.C. 552a(g) authorizes civil action by an individual and requires disclosure by the Department to the court;

(4) Section 5(e)(2) of the Act authorizes release of any records or information by the Department to the Privacy Protection Study Commission upon request of the Chairman; and

(5) Section 6 of the Act authorizes the Office of Management and Budget to provide the Department with continuing oversight and assistance in implementation of the Act.

« Previous Continue »

Books