[Material Transmitted]{.underline}:

Department of Health and Human Services (HHS) Instruction 297-1, Privacy
Procedures for Personnel Records, dated April 25, 2008.

[Material Superseded]{.underline}:

HHS Instruction 297-1, Policy Procedures for Personnel Records, dated
August 14, 1997.

[Background]{.underline}:

This Instruction was revised to reflect the establishment of the new
titles, roles and responsibilities within ASAM, effective October, 2001.
In addition, this Instruction was revised to incorporate input from a
broader segment of the Equal Employment Opportunity community, the
Office of the General Counsel and the Human Resources community. Changes
were minor, but involved clarification of issues.

This issuance is effective immediately. Implementation under this
issuance must be carried out in accordance with applicable laws,
regulations, bargaining agreements, and Departmental policy.

Antonia T. Harris

Deputy Assistant Secretary for Human Resources

INSTRUCTION 297-1

**SUBJECT: PRIVACY PROCEDURES FOR PERSONNEL RECORDS**

297-1-00 Purpose

297-1-10 References

297-1-20 Coverage and Exclusions

297-1-30 Disclosures of Information in Personnel Record Systems

297-1-40 Amendment of Records by Individuals

297-1-50 Appeals of refusals to Amend Records

297-1-60 Fees

297-1-70 Relationship to Freedom of Information Act (FOIA)

297-1-80 Relationship to Equal Employment Opportunity (EEO) Regulations

297-1-90 Relationship to Parent Locator Service Regulations

**297-1-00 PURPOSE**

The purpose of this Instruction is to state the Department's policies
and requirements for the maintenance, protection, disclosure, and
amendment of personnel records within the systems of records, as defined
by the Privacy Act of 1974 (5 USC § 552a), Public Law 93-579.

**297-1-10 REFERENCES**

A.  5 USC § 552 (law-public information; agency rules, opinions, orders,
    records and proceedings).

B.  5 USC § 552 (a) (law- records maintained on individuals)

C.  5 USC § 553 (law- rule making)

D.  31 USC § 3701 (a) (3) (Federal Claims Collection Act of 1966)

E.  42 USC § 653 (law- Parent Locator Service)

F.  45 CFR, Parts 5 and 5b (regulations-Freedom of Information
    Regulations (FOIA and the Privacy Act))

G.  29 CFR § 1614 (regulations-Equal Employment Opportunity)

H.  42 CFR, Part 2 (regulations-confidentiality of alcohol and drug
    abuse patient records)

I.  HHS Public Affairs Management Manual, Chapter 12 (Privacy Act- basic
    requirements and relationships)

J.  HHS Public Affairs Management Manual, Chapter 11-00 (Freedom of
    Information Act)

K.  HHS Records Management Manual, Appendix B (general records
    schedules)

L.  PHS Commissioned Corps Personnel Manual, Subchapter 26.1
    (Commissioned Corps personnel records)

**297-1-20 COVERAGE AND EXCLUSIONS**

A.  Coverage: This Instruction applies to all civil service employees
    and Commissioned Corps Officers of the Department.

B. Exclusions: None.

**297-1-30 DISCLOSURES OF INFORMATION IN PERSONNEL RECORD SYSTEMS**

A. Disclosure with Subject Individual's Consent with Exceptions

Disclosure of personal information concerning an individual must be made
with the written consent of the subject individual. Exceptions to this
requirement are listed in 45 CFR, Part 5b.9(b).

B. Accounting of Disclosure

1.  A record of disclosure is required in cases where records about the
    individual are disclosed from an office system of records.

2.  The accounting of disclosures will be retained for at least 5 years
    or for the life of the record, whichever is longer. Part
    5b.9 (c) (2) states the type of information the accounting will
    contain (the date, nature and purpose of each disclosure; and the
    name and address of the person or entity to whom the disclosure is
    made).

**297-1-40 AMENDMENT OF RECORDS BY INDIVIDUALS**

A. Requests for Amendment

1.  Individuals may request that their records be corrected or amended,
    if they believe that the record is not accurate, timely, complete,
    relevant or necessary to accomplish a Department function.

2.  Individuals making a request to amend their records shall address
    their requests to the responsible Department official in writing,
    unless the individual makes the request in person and the
    responsible Department official amends the record at that time. This
    request for amendment shall specify:

```{=html}
<!-- -->
```
a.  The system of records from which the record is retrieved;

b.  The particular record sought to be amended;

c.  The specific wording to be deleted, substituted or added and;

d.  A statement of the basis for the requested amendment, with all
    available supporting documents and materials to show why the
    material is inaccurate, untimely, irrelevant, incomplete, or
    unnecessary.

    3.  The processing of requests submitted by mail will be facilitated
        with the words "Privacy Act Request" appearing on the face of
        the envelope with the letter of inquiry.

    4.  Any request which is not properly addressed and which is not
        marked as specified above will be properly addressed or marked
        by the organization that received the request and forwarded
        immediately to the responsible Department official. A request
        not properly addressed by the individual will not be deemed as
        being "received" for measuring response times until the
        responsible Department official receives it. In each instance
        when a forwarded request is received, the responsible Department
        official shall notify the individual that the request was
        improperly addressed and the date when the request was received
        at the proper address.

    5.  If a statutory appeal procedure or other administrative review
        procedure exists for changing a record, or for reviewing the
        decision reflected by the record, then, regardless of whether
        the existing procedure has or has not been used, an individual
        may not use the amendment procedures of the Privacy Act for
        these purposes. (Examples of such statutory appeal procedures or
        other administrative review procedures are: reconsideration of
        level of competence determinations, adverse action appeals,
        grievance procedure, etc.) Thus, individuals may not challenge
        the management decisions or actions under the Privacy Act
        amendment procedures, although they may challenge the fact that
        the decision or action has been inaccurately recorded in their
        records.

B. Processing Requests for Amendment

1.  Within 10 working days of the receipt of a request for amendment,
    the responsible Department official shall acknowledge the request.
    Until a final agency decision is made on the request to amend the
    record, no disclosure should normally be made of the record, nor
    should any determination with respect to a right, benefit, or
    privilege normally be made based on the record. Two exceptions to
    these normal procedures are where the failure to disclose or to make
    the determination would harm the individual or would unreasonably
    interfere with the normal course of the agency's function.

2.  If the responsible Department official agrees that the record should
    be amended, the record shall be amended as promptly as possible and
    the individual shall be informed in writing of the action taken. The
    individual will be provided with a copy of the amended record at no
    charge. In cases where a copy cannot be provided, the individual
    will be informed of how the amendment was effected (e.g., erasure of
    information from a record maintained only in an electronic data
    bank).

3.  If the responsible Department official determines that the disputed
    material is not relevant and necessary for the purpose for which it
    was obtained, the material shall be deleted without regard to its
    accuracy and the individual shall be informed in writing of the
    action taken.

4.  If the record is amended or deleted, all previous recipients of the
    record for whom an accounting was made will be notified of the
    corrective action taken. If another agency was a recipient, the
    notification shall suggest that the recipient agency consider
    amending its own record and sending notice of the amendment to
    persons to whom it has disclosed in the record.

5.  If the responsible Department official does not deem it appropriate
    to amend a record, the individual shall be notified of the decision.
    The notification to the individual shall include:

    a.  The name and title or position of the responsible Department
        official who is refusing the request for amendment;

    b.  The date of the refusal and the reason for not amending the
        record, including citation of sections of the Act or the Civil
        Service regulations, where appropriate, and

    c.  The procedures by which the individual can appeal the refusal to
        amend the record and the name, title, and business address of
        the appropriate appeal authority.

        6.  A request for the amendment of a record should be granted or
            refused within 30 working days from the receipt of the
            request. If the decision cannot be made within 30 days, the
            individual will be advised in writing of the reason and of
            the estimated date by which the decision will be made.

        7.  When the organization detects erroneous data in an
            individual's personnel records or a third party source
            provides corrected information, the record shall be
            corrected and the corrected information provided to the
            subject individual and to all recipients of the record to
            the extent that it is relevant to the recipient's uses and
            deemed feasible to do so.

**297-1-50 APPEALS OF REFUSALS TO AMEND RECORDS**

A. Appeal Requests

1.  Individuals who disagree with a refusal to amend their records may
    request an appeal, in writing. The appeal must occur within 30 days
    after the date of the refusal. The individual's request for review
    of the refusal should include:

> a\. A copy of the original request for amendment;
>
> b\. A copy of the initial refusal;
>
> c\. A statement of the reasons why the initial refusal is believed to
> be in error; and
>
> d\. The individual's signature.

2.  The processing of requests will be facilitated if the words "Privacy
    Act Request" appear on both the envelope on both the envelope and
    the top of the appeal letter.

3.  Any appeal which is not properly addressed and which is not marked
    "Privacy Act Request" will be properly addressed or marked by the
    organization that received the appeal and forwarded immediately to
    the appropriate appeal authority. A request not properly addressed
    by the individual will not be deemed as having been "received" for
    purposes of measuring response times until the appeal authority has
    received it. In each instance when a request so forwarded is
    received, the appeal authority shall notify the individual that the
    request was improperly addressed and the date when the request was
    received at the proper address.

B. Appeal Authorities

Appeals shall be made to the following appeal authorities:

1.  For personnel records in a system of records under the authority of
    the Office of Personnel Management, the appeal authority is the:

> Assistant Director for Workforce Information
>
> Office of Personnel Management
>
> 1900 E Street, N.W.
>
> Washington, DC 20145

2.  For records under the authority of the Department, appeal
    authorities are the following (or their designees, or successors in
    function):

```{=html}
<!-- -->
```
a.  The Assistant Secretary for Administration and Management is
    responsible for the records of the Office of the Secretary,
    (including records covered by the Office of the Secretary Privacy
    Act records systems notices) or when the initial refusal to amend
    was by another HHS appeal authority.

> b\. Operating Division (OPDIV) Heads for records of the respective
> OPDIVs.

C. Processing Appeals

1.  The responsible Department official who issued the initial refusal
    will supply the appeal authority with the record that the individual
    requested be amended and any other pertinent material requested by
    the appeal authority. The subject individual's request to amend the
    record, the responsible Department official's refusal to amend, and
    any other pertinent material relating to the appeal will be
    reviewed. No hearing will be held.

2.  An appeal will be completed within 30 working days from its receipt
    by the appeal authority, except that the appeal authority may for
    good cause, extend this period for up to an additional 30 workdays.
    If the appeal period is extended, the individual will be informed in
    writing of the extension and of the circumstances for the delay.

3.  If the appeal authority agrees with the requester that the record
    should be amended, the record will be amended and the individual
    will be informed in writing of the amendment. The individual will be
    provided with a copy of the amended record at no charge or will be
    informed of how the amendment was effected if a copy can not be
    provided (e.g., erasure of information from a record maintained only
    in an electronic data bank). Previous recipients of the record will
    be notified in accordance with above.

4.  If the appeal authority denies the appeal, the denial shall be in
    writing, and the requester will be informed:

> a\. Of the reasons for the denial.
>
> b\. Of the right to seek judicial review of the denial; and
>
> c\. That he/she may submit a statement of the reasons for disagreeing
> with the denial.

5.  If the individual submits a statement, the agency must, whenever it
    discloses the contested portion of the record, note the disagreement
    and provide a copy of the statement. It can also include a concise
    statement of the reason for denying the amendment.

**297-1-60 FEES**

Fees for copying records will be charged in accordance with 45 CFR, Part
5b.13:

A.  Fees may only be charged where an individual requests that a copy be
    made of the record to which he or she is granted access.

B.  No fee may be charged for making a search of the system of records
    whether the search is manual, mechanical or electronic. Where a copy
    of the record must be made in order to provide access to the record
    (e.g., computer printout where no screen reading is available), the
    copy will be made available to the individual without cost.

C.  Where a medical record is made available to a representative
    designated by the individual, a physician or a health professional
    designated by a parent/guardian, no fee will be charged.

**297-1-70 RELATIONSHIP TO FREEDOM OF INFROMATION ACT**

A.  The Privacy Act is intended to prevent invasions of the privacy of
    individuals. It permits individuals to have some control over the
    accuracy and disclosure of records pertaining to them maintained by
    Federal agencies. On the other hand, the Freedom of Information Act
    (FOIA) is intended to permit the public to be informed of the
    activities undertaken by its government. The FOIA provides that all
    records, which are maintained by Government agencies, excluding nine
    exemptions are made available to the public. One of these exemptions
    is for records in which the disclosure would constitute a clear
    unwarranted invasion of privacy. In exercising this exemption,
    agencies must balance the public interest in disclosure against the
    privacy interests of the individual to whom the record pertains. The
    FOIA does not protect the individual from all invasions of privacy
    but only those that are clearly warranted. The Privacy Act maintains
    this concept and allows disclosure without the consent of the
    subject individual when the record is required to be made available
    under the FOIA. In addition to the information below, see the HHS
    Public Affairs Management Manual, Chapter 12-00-40 for further
    discussion of the relationship between the Privacy Act and the
    Freedom of Information Act.

B.  The FOIA is contained in Title 5 USC 552. The applicable regulations
    are in 45 CFR, Part 5. Department policies and procedures on the
    FOIA are contained in Chapter 11-00 of the HHS Public Affairs
    Manual. These references contain information on the time limits for
    response to an FOI request, the officials authorized to deny an FOI
    request, the officials to whom the denial of an FOI request may be
    appealed, etc.

C.  If an individual requests information about himself/herself and the
    information is in a system of records (and retrieved by his/her
    identifier), all such records must be released to the individual
    except those the Department could withhold under
    ***[both]{.underline}*** statutes. This is whether the requester
    mentions the Privacy Act, the FOIA, both or neither. In addition,
    this paragraph applies to requests by a parent or guardian for
    information about a minor or incompetent. Fees for such requests
    will be charged as provided by the Privacy Act and 297-1-60**.**
    Such requests will be processed under the procedures of the Privacy
    Act, the Department's Privacy Act regulation and (45 CFR, Part 5b)
    and 297-1-30. If a request cites the Freedom of Information Act, for
    reasons stated above, the office receiving it should forward it to
    the appropriate Privacy Act system of records manager.

D.  If a person requests information that would come from a system of
    records, but the requester is not an individual, or the information
    is not in a record about the requester, then FOIA procedures will
    apply to the request. The only records that may be released are
    those for which disclosure is required under the FOIA or by others
    allowed by 297-1-30 A.

**297-1-80 RELATIONS TO EQUAL EMPLOYMENT OPPORTUNITY (EEO) REGULATIONS**

A.  Discrimination complaint files containing correspondence and
    investigatory material on EEO complaints are retrieved by either the
    name of the complainant or the Complaint File Number only and the
    complainants are the only subjects of the files.

B.  If a witness cites the FOIA as a basis for his/her request to see
    any portion of the EEO file, whether he/she makes the request during
    the EEO process or after a final decision on the complaint, the EEO
    office should not respond to the request except to indicate that the
    request has been referred to the appropriate FOI Office.

```{=html}
<!-- -->
```
1.  At any stage in the process (informal counseling or investigative
    stage), the EEO Office or investigator may inform a witness who is
    currently an employee of HHS about the complaint only to the extent
    necessary to obtain information from that witness. Likewise, at any
    stage of the process, the EEO office or investigatory may show such
    a witness documents that are from the complaint file or are
    pertinent to the complaint only to the extent necessary to obtain
    from that witness information needed for the EEO process.

2.  When showing documents to a witness, the EEO Office or investigator
    may delete information identifying individuals. In making
    determinations whether to delete information and, if so, what
    information to delete, the EEO Office or investigator should
    consider both the individuals' privacies and the extent to which
    deletion would diminish the witness' ability to provide information
    needed for the EEO process.

    C.  Following issuance of a final decision on the discrimination
        complaint, the witness has a right of access to portions of the
        EEO file, only if, because of a final agency decision, an
        adverse or disciplinary action is proposed by his/her supervisor
        or manager. In addition, the witness (and now subject of a
        proposed adverse action) may have a right of discovery to the
        extent allowed by routine use in the EEO system.

    D.  Other requesters, such as the public or the media, may request
        access to EEO files under the FOIA. Any request should be
        referred to the appropriate FOI Office, which will determine how
        to respond.

**297-1-90 RELATIONSHIP TO PARENT LOCATOR SERVICE REGULATIONS**

42 USC § 653 states that upon receipt of a proper, official request,
Department employees who have custody of relevant records must turn over
to the Parent Locator Service the address and place of employment of any
absent parent if that information is in their records or can be obtained
by them.