```

[Federal Register: April 29, 2010 (Volume 75, Number 82)]
[Notices]               
[Page 22565-22568]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr29ap10-39]                         

-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

Office of the Secretary

[Docket ID: DOD-2010-HA-0056]

 
Privacy Act of 1974; System of Records

AGENCY: Office of the Secretary, DoD.

ACTION: Notice to alter a system of records.

-----------------------------------------------------------------------

SUMMARY: The Office of the Secretary of Defense proposes to alter a 
system of records to its inventory of record systems subject to the 
Privacy Act of 1974 (5 U.S.C. 552a), as amended.

DATES: This proposed action would be effective without further notice 
on June 1, 2010 unless comments are received which result in a contrary 
determination.

ADDRESSES: You may submit comments, identified by docket number and 
title, by any of the following methods:
     Federal Rulemaking Portal: http://www.regulations.gov. 
Follow the instructions for submitting comments.
     Mail: Federal Docket Management System Office, 1160 
Defense Pentagon, Washington, DC 20301-1160.
    Instructions: All submissions received must include the agency name 
and docket number for this Federal Register document. The general 
policy for comments and other submissions from members of the public is 
to make these submissions available for public viewing on the Internet 
at http://www.regulations.gov as they are received without change, 
including any personal identifiers or contact information.

FOR FURTHER INFORMATION CONTACT: Ms. Cindy Allard at (703) 588-6830.

SUPPLEMENTARY INFORMATION: The Office of the Secretary of Defense 
notices for systems of records subject to the Privacy Act of 1974 (5 
U.S.C. 552a), as amended, have been published in the Federal Register 
and are available from the Chief, OSD/JS Privacy Office, Freedom of 
Information Directorate, Washington Headquarters Services, 1155 Defense 
Pentagon, Washington, DC 20301-1155.
    The proposed system report, as required by 5 U.S.C. 552a(r) of the 
Privacy Act of 1974, as amended, was submitted on April 16, 2010, to 
the House Committee on Oversight and Government Reform, the Senate 
Committee on Governmental Affairs, and the Office of Management and 
Budget (OMB) pursuant to paragraph 4c of Appendix I to OMB Circular No. 
A-130, ``Federal Agency Responsibilities for Maintaining Records About 
Individuals,'' dated February 8, 1996 (February 20, 1996; 61 FR 6427).

    Dated: April 23, 2010.
Mitchell S. Bryman,
Alternate OSD Federal Register Liaison Officer, Department of Defense.
DHA 08

SYSTEM NAME:
    Health Affairs Survey Data Base (April 28, 1999; 64 FR 22837).

CHANGES:
* * * * *

SYSTEM NAME:
    Delete entry and replace with ``Health Affairs Survey and Study 
Data Base.''

SYSTEM LOCATION:
    Delete entry and replace with ``Office of the Assistant Secretary 
of Defense (Health Affairs), TRICARE Management Activity Health Program 
Analysis and Evaluation, Suite 810, 5111 Leesburg Pike, Skyline 
Building 5, Falls Church, Virginia 22041-3206.''

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Delete entry and replace with ``Uniformed services beneficiaries 
enrolled in the Defense Eligibility Enrollment Reporting System who are 
eligible for medical and dental health care; veterans and their 
dependents; individuals who submit Medicare and/or Medicaid claims and 
are linked to DoD health care; DoD civilian employees and contractor 
personnel including contracted providers, and health care workers.''

CATEGORIES OF RECORDS IN THE SYSTEM:
    Delete entry and replace with ``Records in the system include name, 
address, sponsor and dependent's Social Security Numbers (SSN), family 
member prefix code, demographics categories that include age, sex, date 
of birth, telephone number, e-mail address, military rank group officer 
and enlisted or civilian.
    Personal health information and clinical encounter data regarding 
interactions with health care systems such as diagnoses, procedures, 
treatments, services, and benefits; self-reported health and health 
related response datasets such as surveys and focus groups; health care 
administrative data, such as inpatient, dental, outpatient, and 
pharmacy utilization rates; budgetary and managerial cost accounting 
data, such as claims processing, direct and purchased care workload and 
costs; contingency tracking system data such as deployment status; and 
health plan eligibility and enrollment data.''

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Delete entry and replace with ``10 U.S.C. 136, Under Secretary of 
Defense for Personnel and Readiness; 10 U.S.C. 1071 (NOTE), Annual 
Beneficiary Survey; 10 U.S.C. Chapter 55, Medical and Dental Care; 42 
U.S.C. 11131-11152, Health Care Improvement Act of 1986; 32 CFR 199.17, 
TRICARE program; 45 CFR parts 160 and 164, General Administrative 
Requirements and Security and Privacy; DoDD 3216.2, Protection of Human 
Subjects and Adherence to Ethical Standards in DoD-Supported Research; 
DoDD 6025.13, Medical Quality Assurance (MQA) in the Military Health 
System (MHS); and E.O. 9397 (SSN), as amended.''

PURPOSE(S):
    Delete entry and replace with ``To collect, assemble, interpret, 
analyze, report and publish surveys; research, study, statistical and 
informational data, in order to improve the quality of DoD health care 
and the health status, welfare and well-being of the DoD beneficiary 
population. Uses of identifiable data include primary analysis; 
secondary analysis; non-response analysis; and cross-mapping analysis. 
Results will only be reported in the aggregate.''

[[Page 22566]]

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSE OF SUCH USES:
    Delete entry and replace with ``In addition to those disclosures 
generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, 
these records may specifically be disclosed outside the DoD as a 
routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:
    To the Department of Health and Human Services and/or the 
Department of Veterans Affairs consistent with their statutory 
administrative responsibilities pursuant to 10 U.S.C. Chapter 55, 
Medical and Dental Care, and 38 U.S.C. Chapter 3, Department of 
Veterans Affairs.
    To the Office of Personnel Management for purposes related to DoD 
Federal employees and/or their health care benefits in DoD.
    To State Departments of Health for health care delivery programs, 
where such programs effect benefits determinations between these 
Department-level programs, continuity of clinical care, or effect 
payment for care between Departmental programs inclusive of care 
provided by commercial entities under contract to these three 
Departments.
    To Academia, non profit and commercial entities, for surveys or 
research, where such releases are consistent with the mission of the 
Military Health System and where exchange and coordination of 
information and data are consistent with the Privacy Act of 1974, the 
Heath Insurance Portability and Accountability Act of 1996 Privacy and 
Security Rules, and applicable DoD Information Security regulations.
    The DoD `Blanket Routine Uses' set forth at the beginning of the 
Office of the Secretary of Defense compilation of systems of records 
notices apply to this system with the following noted exceptions:

    Note: This system of records contains individually identifiable 
health information. The DoD Health Information Privacy Regulation 
DoD 6025.18-R issued pursuant to the Health Insurance Portability 
and Accountability Act of 1996, applies to most health information. 
DoD 6025.18-R may place additional procedural requirements on the 
uses and disclosures of such information beyond those found in the 
Privacy Act of 1974 or mentioned in this system of records notice.

''STORAGE:
    Delete entry and replace with ``Paper and/or electronic storage 
media.''

RETRIEVABILITY:
    Delete entry and replace with ``Records of beneficiaries may be 
retrieved by patient identifiers, such as name, address, sponsor and 
dependent's Social Security Number (SSN), family member prefix code, 
and demographic categories, such as age, sex, e-mail address, military 
rank group officer, enlisted, or civilian.''

SAFEGUARDS:
    Delete entry and replace with ``Media, data and/or records are 
maintained in a controlled area. The computer system is accessible only 
to authorized personnel. Entry into these areas is restricted to those 
personnel with a valid requirement and authorization to enter. Physical 
entry is restricted by the use of locks, passwords which are changed 
periodically, and administrative procedures. The system provides two-
factor authentication including Common Access Cards and passwords. 
Access to personal information is restricted to those who require the 
data in the performance of the official duties, and have received 
proper training relative to the Privacy Act of 1974, Health Insurance 
Portability and Accountability Act of 1996 Privacy and Security Rules, 
and Information Assurance.''

RETENTION AND DISPOSAL:
    Delete entry and replace with ``Disposition pending. Until the 
National Archives and Records Administration has approved the retention 
and disposal of these records, treat them as permanent.''

SYSTEM MANAGER(S) AND ADDRESS:
    Delete entry and replace with ``TRICARE Management Activity, Health 
Plans Operations/Health Program Analysis and Evaluation, Suite 810, 
Skyline Building 5, 5111 Leesburg Pike, Falls Church, VA 22041-3206.''

NOTIFICATION PROCEDURE:
    Delete entry and replace with ``Individuals seeking to determine 
whether this system contains information about themselves should 
address written inquiries to TRICARE Management Activity, Health Plans 
Operations/Health Program Analysis and Evaluation, Suite 810, Skyline 
Building 5, 5111 Leesburg Pike, Falls Church, VA 22041-3206.
    Written requests for the information should contain the 
individual's full name, address, last 4 numbers of the Social Security 
Number (SSN), the name and number of this system of records notice and 
signature.''

RECORD ACCESS PROCEDURES:
    Delete entry and replace with ``Individuals seeking access to 
records about themselves contained in this system should address 
written inquiries to TRICARE Management Activity, Attention: Freedom of 
Information Act Requester Service Center, 16401 East Centretech Parkway 
Aurora, CO 80011-9066.
    Requests should contain the individual's full name, address, last 4 
numbers of the Social Security Number (SSN), the name and number of 
this system of records notice and signature.''

CONTESTING RECORD PROCEDURES:
    Delete entry and replace with ``The Office of the Secretary of 
Defense rules for accessing records, for contesting contents and 
appealing initial agency determinations are published in Office of the 
Secretary of Defense Administrative Instruction 81; 32 CFR part 311; or 
may be obtained from the system manager.''

RECORD SOURCE CATEGORIES:
    Delete entry and replace with ``Individuals, the Defense Enrollment 
Eligibility Reporting System, the Uniformed Services medical and dental 
treatment facilities and facilities contracted by DoD to perform 
medical care for Military members, former members and dependents.''
* * * * *
DHA 08

SYSTEM NAME:
    Health Affairs Survey and Study Data Base.

SYSTEM LOCATION:
    Office of the Assistant Secretary of Defense (Health Affairs), 
TRICARE Management Activity Health Program Analysis and Evaluation, 
Suite 810, 5111 Leesburg Pike, Skyline Building 5, Falls Church, 
Virginia 22041-3206.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Uniformed services beneficiaries enrolled in the Defense 
Eligibility Enrollment Reporting System who are eligible for medical 
and dental health care under 10 U.S.C. Chapter 55; veterans and their 
dependents; individuals who submit Medicare and/or Medicaid claims and 
linked to DoD health care; DoD civilian employees and contractor 
personnel including contracted providers, and health care workers.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Records in the system include name, address, sponsor and dependents 
Social Security Number (SSN), family member prefix code, demographics 
categories that include age, sex, date of birth, telephone number, e-
mail address,

[[Page 22567]]

military rank group officer and enlisted or civilian.
    Personal health information and clinical encounter data regarding 
interactions with health care systems such as diagnoses, procedures, 
treatments, services, and benefits; self-reported health and health 
related response datasets such as surveys and focus groups; health care 
administrative data, such as inpatient, dental, outpatient, and 
pharmacy utilization rates; budgetary and managerial cost accounting 
data, such as claims processing, direct and purchased care workload and 
costs; contingency tracking system data such as deployment status; and 
health plan eligibility and enrollment data.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    10 U.S.C. 136, Under Secretary of Defense for Personnel and 
Readiness; 10 U.S.C. 1071 (NOTE), Annual Beneficiary Survey; 10 U.S.C. 
Chapter 55, Medical and Dental Care; 42 U.S.C. 11131-11152, Health Care 
Improvement Act of 1986; 32 CFR 199.17, TRICARE program; 45 CFR parts 
160 and 164, General Administrative Requirements and Security and 
Privacy; DoDD 3216.2, Protection of Human Subjects and Adherence to 
Ethical Standards in DoD-Supported Research; DoDD 6025.13, Medical 
Quality Assurance (MQA) in the Military Health System (MHS); and E.O. 
9397 (SSN), as amended.

PURPOSE(S):
    To collect, assemble, interpret, analyze, report and publish 
surveys; research, study, statistical and informational data, in order 
to improve the quality of DoD health care and the health status, 
welfare and well-being of the DoD beneficiary population. Uses of 
identifiable data include primary analysis; secondary analysis; non-
response analysis; and cross-mapping analysis. Results will only be 
reported in the aggregate.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSE OF SUCH USES:
    In addition to those disclosures generally permitted under 5 U.S.C. 
552a(b) of the Privacy Act of 1974, these records may specifically be 
disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 
552a(b)(3) as follows:
    To the Department of Health and Human Services and/or the 
Department of Veterans Affairs consistent with their statutory 
administrative responsibilities pursuant to 10 U.S.C. Chapter 55, 
Medical and Dental Care, and 38 U.S.C. Chapter 3, Department of 
Veterans Affairs.
    To the Office of Personnel Management for purposes related to DoD 
Federal employees and/or their health care benefits in DoD.
    To State Departments of Health for health care delivery programs, 
where such programs effect benefits determinations between these 
Department-level programs, continuity of clinical care, or effect 
payment for care between Departmental programs inclusive of care 
provided by commercial entities under contract to these three 
Departments.
    To Academia, non profit and commercial entities, for surveys or 
research, where such releases are consistent with the mission of the 
Military Health System and where exchange and coordination of 
information and data are consistent with the Privacy Act of 1974, the 
Heath Insurance Portability and Accountability Act of 1996 Privacy and 
Security Rules, and applicable DoD Information Security regulations.
    The DoD `Blanket Routine Uses' set forth at the beginning of the 
Office of the Secretary of Defense compilation of systems of records 
notices apply to this system with the following noted exceptions:

    Note: This system of records contains individually identifiable 
health information. The DoD Health Information Privacy Regulation, 
DoD 6025.18-R issued pursuant to the Health Insurance Portability 
and Accountability Act of 1996, applies to most health information. 
DoD 6025.18-R may place additional procedural requirements on the 
uses and disclosures of such information beyond those found in the 
Privacy Act of 1974 or mentioned in this system of records notice.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Paper and/or electronic storage media.

RETRIEVABILITY:
    Records of beneficiaries may be retrieved by patient identifiers, 
such as name, address, sponsor and dependent's Social Security Number 
(SSN), family member prefix code, and demographic categories, such as 
age, sex, e-mail address, military rank group officer, enlisted, or 
civilian.

SAFEGUARDS:
    Media, data and/or records are maintained in a controlled area. The 
computer system is accessible only to authorized personnel. Entry into 
these areas is restricted to those personnel with a valid requirement 
and authorization to enter. Physical entry is restricted by the use of 
locks, passwords which are changed periodically, and administrative 
procedures. The system provides two-factor authentication including 
Common Access Cards and passwords. Access to personal information is 
restricted to those who require the data in the performance of the 
official duties, and have received proper training relative to the 
Privacy Act of 1974, Health Insurance Portability and Accountability 
Act of 1996 Privacy and Security Rules, and Information Assurance.

RETENTION AND DISPOSAL:
    Disposition pending. Until the National Archives and Records 
Administration has approved the retention and disposal of these 
records, treat them as permanent.

SYSTEM MANAGER(S) AND ADDRESS:
    TRICARE Management Activity, Health Plans Operations/Health Program 
Analysis and Evaluation, Suite 810, Skyline Building 5, 5111 Leesburg 
Pike, Falls Church, VA 22041-3206.

NOTIFICATION PROCEDURE:
    Individuals seeking to determine whether this system contains 
information about themselves should address written inquiries to 
TRICARE Management Activity, Health Plans Operations/Health Program 
Analysis and Evaluation, Suite 810, Skyline Building 5, 5111 Leesburg 
Pike, Falls Church, VA 22041-3206.
    Written requests should contain the individual's full name, 
address, Last 4 numbers of the Social Security Number (SSN), the name 
and number of this system of records notice and signature.

RECORD ACCESS PROCEDURES:
    Individuals seeking access to records about themselves contained in 
this system should address written inquiries to TRICARE Management 
Activity, Attention: Freedom of Information Act Requester Service 
Center, 16401 East Centretech Parkway, Aurora, CO 80011-9066.
    Written requests should contain the individual's full name, 
address, Last 4 numbers of the Social Security Number (SSN), the name 
and number of this system of records notice and signature.

CONTESTING RECORD PROCEDURES:
    The Office of the Secretary of Defense rules for accessing records, 
for contesting contents and appealing initial agency determinations are 
published in Office of the Secretary of Defense Administrative 
Instruction 81; 32 CFR part 311; or may be obtained from the system 
manager.

[[Page 22568]]

RECORD SOURCE CATEGORIES:
    Individuals, the Defense Enrollment Eligibility Reporting System, 
and the Uniformed Services medical and dental treatment facilities and 
facilities contracted by DoD to perform medical care for Military 
members, former members and dependents.

EXEMPTIONS CLAIMED FOR THE SYSTEM:
    None.

[FR Doc. 2010-9893 Filed 4-28-10; 8:45 am]
BILLING CODE 5001-06-P
```