[Material Transmitted:]{.underline}

HHS Instruction 297-1, Privacy Procedures for Personnel Records

(all)

[Material Superseded:]{.underline}

HHS Instruction 297-1 (all), HHS Transmittal 97.4, dated 3-7-97

[Background:]{.underline}

This Instruction has been superseded to incorporate the input of a
broader segment of the EEO community and the Office of the General
Counsel (OGC). As a result of this input, the following substantive
clarifications were made to section 297-1-70, entitled Relationship to
Equal Employment Opportunity (EEO) Regulations, and 297-1-10, entitled
References:

\- At any stage in the process (informal counseling or investigative
stage) the EEO Office or investigator may inform a witness who is
currently an employee of HHS about the complaint only to the extent
necessary to obtain information from that witness.

\- There is no entitlement on the part of any witness to receive a copy
of the acceptance letter which is issued to the complainant that
outlines the allegations in the EEO complaint which has been accepted
for processing.

\- The EEO Office should not give any response to a Freedom of
Information Act (FOI) request, but should refer it to the appropriate
FOI Office.

\- References to Office of Personnel Management (OPM) regulations have
been replaced with references to Departmental regulations.

Other changes were minor and involved clarity issues.

Any reference to AOPDIV@ in this Instruction now includes AHCPR, ATSDR,
CDC, FDA, HRSA, IHS, NIH, SAMHSA, the Office of the Secretary, the
Program Support Center, HCFA, ACF, and AoA.

This issuance is effective immediately. Implementation under this
issuance must be carried out in accordance with applicable laws and
bargaining agreements.

[Filing Instructions:]{.underline}

Remove superseded material and file new material. Post receipt of this
transmittal to the HHS Check List of Transmittals and file this
transmittal in sequential order after the check list.

Evelyn M. White

Deputy Assistant Secretary for

Human Resources, OASMB

INSTRUCTION 297-1

# HHS PERSONNEL INSTRUCTION 297-1

[PRIVACY PROCEDURES FOR PERSONNEL RECORDS]{.underline}

297-1-00 Purpose

10 References

20 Disclosure of Information in Personnel Records Systems

30 Amendment of Records by Individuals

40 Appeals of refusals to Amend Records

50 Fees

60 Relationship to Freedom of Information Act

> 70 Relationship to Equal Employment Opportunity (EEO) Regulations

80 Relationship to Parent Locator Service Regulations

297-1-00 PURPOSE

This Instruction states Department policies and requirements for the
maintenance, protection, disclosure, and amendment of personnel records
within the systems of records, as defined by the Privacy Act of 1974 (5
U.S. Code 552a), Public Law 93-579.

297-1-10 REFERENCES

A. 5 U.S. Code 552 (law - public information; agency rules, opinions,
orders, records, and proceedings)

B. 5 U.S. Code 552a (law - records maintained on individuals)

C. 5 U.S. Code 553 (law - rule making)

D. 31 U.S. Code 3701(a)(3) (Federal Claims Collection Act of 1966)

E. 42 U.S. Code 653 (law - Parent Locator Service)

F. 45 CFR, Parts 5 and 5b (regulations - Freedom of Information

Regulations (FOIA and the Privacy Act))

G. 29 CFR, Part 1614 (regulations - Equal Employment Opportunity)

H. 42 CFR, Part 2 (regulations - confidentiality of alcohol and drug
abuse patient records)

I. HHS Instruction 293-1/1614-2, Exhibit C (personnel and equal
employment records disposal)

J. HHS Procurement Manual (procurement)

K. HHS ADP Systems Manual, Part 6 (ADP systems security)

L. HHS Public Affairs Management Manual, Chapter 12 (Privacy

Act - basic requirements and relationships)

M. HHS Public Affairs Management Manual, Chapter 11-00 (Freedom of
Information Act)

N. HHS Records Management Manual, Appendix B (general records schedules)

O. PHS Commissioned Corps Personnel Manual, Subchapter 26.1
(Commissioned Corps personnel records)

297-1-20 DISCLOSURE OF INFORMATION IN PERSONNEL RECORDS SYSTEMS

A. [Disclosure with Subject Individual\'s Consent, with
Exceptions]{.underline}

Disclosure of personal information concerning an individual may be made
with the written consent of the subject individual. Exceptions to this
requirement are listed in 45 CFR, Part 5b.9(b).

B. [Accounting of Disclosure]{.underline}

1\. A record of disclosure is required in cases where records about the
individual are disclosed from an office system of records. Exceptions to
this requirement are listed in 45 CFR, Part 5b.9(c)(1).

2\. The accounting of disclosures will be retained for at least 5 years
or for the life of the record, whichever is longer. 45 CFR, Part
5b.9(c)(2) states the type of information the accounting will contain.

297-1-30 AMENDMENT OF RECORDS BY INDIVIDUALS

A. [Requests for Amendment]{.underline}

1\. Individuals may request that their records be corrected or amended,
if they believe that the record is not accurate, timely, complete or
relevant or necessary to accomplish a Department function.

2\. Individuals making a request to amend their records shall address
their requests to the responsible Department official in writing, unless
the individual makes the request in person and the responsible
Department official amends the record at that time. This request for
amend- ment shall specify:

a\. The system of records from which the record is retrieved;

b\. The particular record sought to be amended;

c\. The specific wording to be deleted, substituted or added; and

d\. A statement of the basis for the requested amendment, with all
available supporting documents and materials to show why the material is
inaccurate, untimely, irrelevant, incomplete or unnecessary.

3\. The processing of requests submitted by mail will be facilitated if
the words \"Privacy Act Request\" appear on the face of the envelope and
on the letter of inquiry.

4\. Any request which is not properly addressed and which is not marked
as specified above will be properly addressed or marked by the
organization that received the request and forwarded immediately to the
responsible Department official. A request not properly addressed by the
individual will not be deemed to have been \"received\" for the purpose
of measuring time periods for response until the responsible Department
official receives it. In each instance when a request so forwarded is
received, the responsible Department official shall notify the
individual that the request was improperly addressed and the date when
the request was received at the proper address.

5\. If a statutory appeal procedure or other administrative review
procedure exists for changing a record, or for reviewing the decision
reflected by the record, then, regardless of whether the existing
procedure has or has not been used, an individual may not use the
amendment procedures of the Privacy Act for these purposes. (Examples of
such statutory appeal procedures or other administrative review
procedures are: reconsideration of level of competence determinations,
adverse action appeals, grievance procedure, etc.) Thus, individuals may
not challenge the management decision or action under the Privacy Act
amendment procedures, although they may challenge the fact that the
decision or action has been inaccurately recorded in their records.

B. [Processing Requests for Amendment]{.underline}

1\. Within 10 work days of the receipt of a request for amendment, the
responsible Department official shall acknowledge the request. Until a
final agency decision is made on the request to amend the record, no
disclosure should normally be made of the record nor should any
determination with respect to a right, benefit, or privilege normally be
made on the basis of the record. Two exceptions to these normal
procedures are where the failure to disclose or to make the
determination would harm the individual or would unreasonably interfere
with the normal course of the agency\'s functions.

2.  If the responsible Department official agrees that the record should
    be amended, the record shall be amended as promptly as possible and
    the individual shall be informed in writing of the action taken (see
    time limits in 297- 30B.6 below). The individual will be provided
    with a copy of the amended record at no charge. In cases where a
    copy cannot be provided, the individual will be informed of how the
    amendment was effected (e.g., erasure of information from a record
    maintained only in an electronic data bank).

> 3\. If the responsible Department official determines that the
> disputed material is not relevant and necessary for the purpose for
> which it was obtained, the material shall be deleted without regard to
> its accuracy and the individual shall be informed in writing of the
> action taken.

4\. If the record is amended or deleted, all previous recipients of the
record for whom an accounting was made will be notified of the
corrective action taken. If another agency was a recipient, the
notification shall suggest that the recipient agency consider amending
its own record and sending notice of the amendment to persons to whom it
has disclosed the record.

5\. If the responsible Department official does not deem it appropriate
to amend a record, the individual shall be notified of the decision. The
notification to the individual shall include:

a\. The name and title or position of the responsible Department
official who is refusing the request for amendment;

b\. The date of the refusal and the reasons for not amending the record,
including citation of sections of the Act or the Civil Service
regulations, where appropriate; and

c\. The procedures by which the individual can appeal the refusal to
amend the record and the name, title, and

business address of the appropriate appeal authority (see 297-1-40
below).

6\. A request for amendment of a record should be granted or refused
within 30 work days from the receipt of the request. If the decision
cannot be made within 30 days, the individual will be advised in writing
of the reasons and of the estimated date by which the decision will be
made.

7\. When the organization detects erroneous data in an individual's
personnel records or a third party source provides corrected
information, the record shall be corrected and the corrected information
provided to the subject individual and to all recipients of the record
to the extent that it is relevant to the recipient\'s uses and deemed
feasible to do so.

297-1-40 APPEALS OF REFUSALS TO AMEND RECORDS

A. [Appeal Requests]{.underline}

1\. Individuals who disagree with a refusal to amend their records may
appeal the refusal in writing, within 30 days after the date of the
refusal. The individual's request for review of the refusal should
include:

a\. A copy of the original request for amendment;

b\. A copy of the initial refusal;

c\. A statement of the reasons why the initial refusal is believed to be
in error; and

d\. The signature of the individual.

2\. The processing of requests will be facilitated if the words
\"Privacy Act Request\" appear on both the envelope and the top of the
appeal letter.

3\. Any appeal which is not properly addressed and which is not marked
\"Privacy Act Request\" will be properly addressed or marked by the
organization that received the appeal and forwarded immediately to the
appropriate appeal authority. A request not properly addressed by the
individual will not be deemed to have been \"received" for purposes of
measuring time periods for response until the appeal authority has
received it. In each instance when a request so forwarded is received,
the appeal authority shall notify the individual that the request was
improperly addressed and the date when the request was received at the
proper address.

B. [Appeal Authorities]{.underline}

Appeals shall be made to the following appeal authorities:

1\. For personnel records in a system of records under the authority of
the Office of Personnel Management, the appeal authority is the
Assistant Director for Workforce Information, Office of Personnel
Management, 1900 E Street, N. W., Washington, D. C. 20415.

2\. For records under the authority of the Department, appeal
authorities are the following (or their designees, or successors in
function):

a\. Assistant Secretary for Management and Budget for records of the
Office of the Secretary (including records covered by the Office of the
Secretary Privacy Act records systems notices) or where the initial
refusal to amend was made by another HHS appeal authority. The appeal
authority for an initial refusal by the Assistant Secretary for
Management and Budget is the Deputy Secretary.

b\. Operating Division (OPDIV) Heads for records of the

respective OPDIVs.

C. [Processing Appeals]{.underline}

1\. The responsible Department officials who issued the initial refusal
will supply the appeal authority with the record that the individual
requests be amended and any other pertinent material requested by the
appeal authority. The subject individual\'s request to amend the record,
the responsible Department official\'s refusal to amend, and any other
pertinent material relating to the appeal will be reviewed. No hearing
will be held.

2\. An appeal will be completed within 30 work days from its receipt by
the appeal authority, except that the appeal authority may for good
cause extend this period for up to an additional 30 work days. If the
appeal period is extended, the individual will be informed in writing of
the extension and the circumstances of the delay.

3\. If the appeal authority agrees with the requester that the record
should be amended, the record will be amended and the individual will be
informed in writing of the amendment. The individual will be provided
with a copy of the amended record at no charge or will be informed of
how the amendment was effected if a copy cannot be provided (e.g.,
erasure of information from a record maintained only in an electronic
data bank). Previous recipients of the record will be notified in
accordance with 297-1-30B.4 above.

4\. If the appeal authority denies the appeal, the denial shall be in
writing, and the requester will be informed:

a\. Of the reasons for the denial;

b\. Of the right to seek judicial review of the denial; and

c\. That he/she may submit a concise statement of the reasons for
disagreeing with the denial.

5\. If the individual submits a statement under 297-1- 40C.4.c., the
agency must, whenever it discloses the contested portion of the record,
note the disagreement and provide a copy of the statement. It can also
include a concise statement of the reasons for denying the amendment.

297-1-50 FEES

[Policy]{.underline}

Fees for copying records will be charged in accordance with 45 CFR, Part
5b.13.

297-1-60 RELATIONSHIP TO FREEDOM OF INFORMATION ACT

A. The Privacy Act is intended to prevent invasions of the privacy of
individuals. It permits individuals to have some control over the
accuracy and disclosure of records pertaining to them maintained by
Federal agencies. On the other hand, the Freedom of Information (FOI)
Act is intended to permit the general public to be informed on the
activities undertaken by its government. The FOI Act provides that all
records maintained by Government agencies, excluding nine exemptions,
are to be made available to the public. One of these exemptions is for
records the disclosure of which would constitute a clear unwarranted
invasion of privacy. In exercising this exemption, agencies must balance
the public interest in disclosure against the privacy interests of the
individual to whom the record pertains. The FOI Act does not protect the
individual from all invasions of privacy but only those which are
clearly unwarranted. The Privacy Act maintains this concept and allows
disclosure without the consent of the subject individual when the record
is required to be made available under the FOI Act. In addition to the
information below, see the HHS Public Affairs Management Manual, Chapter
12-00-40 for further discussion of the relationship between the Privacy
Act and the Freedom of Information Act.

B. The FOI Act is contained in Title 5 U.S. Code 552. The applicable
regulations are in 45 CFR, Part 5. Department policies and procedures on
the FOI Act are contained in Chapter 11-00 of the HHS Public Affairs
Management Manual. These references contain information on the time
limits for response to an FOI request, the officials authorized to deny
an FOI request, the officials to whom the denial of an FOI request may
be appealed, etc.

C. If an individual requests information about himself/herself and the
information is in a system of records about that person (and retrieved
by his/her identifier), all such records must be released to the
individual except those the Department could withhold under
[both]{.underline} statutes. This is so whether the requester mentions
the Privacy Act, the FOI Act, both, or neither. Also, this paragraph
applies to requests by a parent or guardian for information about a
minor or incompetent. Fees for such a request will be charged as
provided by the Privacy Act and 297-1-50. Such requests will be
processed under the procedures of the Privacy Act, the Department\'s
Privacy Act regulation (45 CFR, Part 5b), and 297-1-20. If a request
cites the Freedom of Information Act but should be processed under the
Privacy Act, for reasons stated above, the office receiving it should
forward it to the appropriate Privacy Act system of records manager.

D. If a person requests information that would come from a system of
records, but the requester is not an individual, or the information is
not in a record about the requester, then FOI Act procedures will apply
to the request. The only records that may be released are those for
which disclosure is required under the FOI Act or otherwise allowed by
297-1-20A.

297-1-70 RELATIONSHIP TO EQUAL EMPLOYMENT OPPORTUNITY (EEO) REGULATIONS

A. Discrimination complaint files, containing correspondence and
investigatory material on EEO complaints, are retrieved by either the
name of the complainant or the Complaint File Number only, and the
complainants are the only subjects of the files.

B. If a witness cites the FOI Act as a basis for his/her request to see
any portion of the EEO file, whether he/she makes the request during the
EEO process or after a final decision on the complaint, the EEO Office
should not respond to the request except to indicate that the request
has been referred to the appropriate FOI Office.

1\. At any stage in the process (informal counseling or investigative
stage), the EEO Office or investigator may inform a witness who is
currently an employee of HHS about the complaint only to the extent
necessary to obtain information from that witness. Likewise, at any
stage of the process, the EEO Office or investigator may show such a
witness documents that are from the complaint file or are pertinent to
the complaint only to the extent necessary to obtain from that witness
information needed for the EEO Process.

2\. When showing documents to a witness, the EEO Office or investigator
may delete information identifying individuals. In making determinations
whether to delete information and, if so, what information to delete,
the EEO Office or investigator should consider both the individuals'
privacies and the extent to which deletion would diminish the witness\'s
ability to provide information needed for the EEO process.

3\. The EEO Office should show appropriate management officials those
portions of the file that management needs to make decisions about
possible settlement of the case or about other appropriate management
actions relating to the matters at issue in the case.

C. Following issuance of a final decision on the discrimination
complaint, the witness has a right of access to portions of the EEO
file, only if, as a result of a final agency decision, adverse or
disciplinary action is proposed by his/her supervisor or manager. Also,
the witness (and now subject of a proposed adverse action) may have a
right of discovery, to the extent allowed by the routine use in the EEO
system.

D. Other requesters, such as the public or the media, may request access
to EEO files under the FOI Act. Any request should be referred to the
appropriate FOI Office, which will determine how to respond.

297-1-80 RELATIONSHIP TO PARENT LOCATOR SERVICE REGULATIONS

42 U.S. Code 653 states that upon receipt of a proper, official request,
the Department employees who have custody of relevant records must turn
over to the Parent Locator Service the address and place of employment
of any absent parent if that information is in their records or can be
obtained by them.