19010 Federal Register / Vol. 74, No. 79 / Monday, April 27, 2009 / Rules and Regulations 

17Available at http://www.csrc.nist.gov/. 

18Available at http://www.csrc.nist.gov/. 

19Available at http://www.csrc.nist.gov/. 

Publication 800–111, Guide to Storage 

Encryption Technologies for End User 

Devices.17

(ii) Valid encryption processes for 

data in motion are those that comply 

with the requirements of Federal 

Information Processing Standards (FIPS) 

140–2. These include, as appropriate, 

standards described in NIST Special 

Publications 800–52, Guidelines for the 

Selection and Use of Transport Layer 

Security (TLS) Implementations; 800– 

77, Guide to IPsec VPNs; or 800–113, 

Guide to SSL VPNs, and may include 

others which are FIPS 140–2 

validated.18

(b) The media on which the PHI is 

stored or recorded has been destroyed in 

one of the following ways: 

(i) Paper, film, or other hard copy 

media have been shredded or destroyed 

such that the PHI cannot be read or 

otherwise cannot be reconstructed. 

(ii) Electronic media have been 

cleared, purged, or destroyed consistent 

with NIST Special Publication 800–88, 

Guidelines for Media Sanitization,19

such that the PHI cannot be retrieved. 

III. Solicitation of Comments 

A. Guidance Specifying the 

Technologies and Methodologies That 

Render Protected Health Information 

Unusable, Unreadable, or 

Indecipherable to Unauthorized 

Individuals 

The Department is seeking comments 

on its guidance regarding the 

technologies and methodologies that 

render PHI unusable, unreadable, or 

indecipherable to unauthorized 

individuals for purposes of section 

13402(h)(2) of the Act. In particular, the 

Department is interested in receiving 

comments on the following: 

1. Are there particular electronic 

media configurations that may render 

PHI unusable, unreadable, or 

indecipherable to unauthorized 

individuals, such as a fingerprint 

protected Universal Serial Bus (USB) 

drive, which are not sufficiently covered 

by the above and to which guidance 

should be specifically addressed? 

2. With respect to paper PHI, are there 

additional methods the Department 

should consider for rendering the 

information unusable, unreadable, or 

indecipherable to unauthorized 

individuals? 

3. Are there other methods generally 

the Department should consider for 

rendering PHI unusable, unreadable, or 

indecipherable to unauthorized 

individuals? 

4. Are there circumstances under 

which the methods discussed above 

would fail to render information 

unusable, unreadable, or indecipherable 

to unauthorized individuals? 

5. Does the risk of re-identification of 

a limited data set warrant its exclusion 

from the list of technologies and 

methodologies that render PHI 

unusable, unreadable, or indecipherable 

to unauthorized individuals? Can risk of 

re-identification be alleviated such that 

the creation of a limited data set could 

be added to this guidance? 

6. In the event of a breach of protected 

health information in limited data set 

form, are there any administrative or 

legal concerns about the ability to 

comply with the breach notification 

requirements? 

7. Should future guidance specify 

which off-the-shelf products, if any, 

meet the encryption standards 

identified in this guidance? 

B. Breach Notification Provisions 

Generally 

In addition to public comment on the 

guidance, the Department also requests 

comments concerning any other areas or 

issues pertinent to the development of 

its interim final regulations for breach 

notification. In particular, the 

Department is interested in comment in 

the following areas: 

1. Based on experience in complying 

with state breach notification laws, are 

there any potential areas of conflict or 

other issues the Department should 

consider in promulgating the federal 

breach notification requirements? 

2. Given current obligations under 

state breach notification laws, do 

covered entities or business associates 

anticipate having to send multiple 

notices to an individual upon discovery 

of a single breach? Are there 

circumstances in which the required 

federal notice would not also satisfy any 

notice obligations under the state law? 

3. Considering the methodologies 

discussed in the guidance, are there any 

circumstances in which a covered entity 

or business associate would still be 

required to notify individuals under 

state laws of a breach of information 

that has been rendered secured based on 

federal requirements? 

4. The Act’s definition of ‘‘breach’’ 

provides for a variety of exceptions. To 

what particular types of circumstances 

do entities anticipate these exceptions 

applying? 

Dated: April 22, 2009. 

Charles E. Johnson, 

Acting Secretary. 

[FR Doc. E9–9512 Filed 4–22–09; 4:15 pm] 

BILLING CODE 4150–03–P 

FEDERAL COMMUNICATIONS 

COMMISSION 

47 CFR Part 27 

[WT Docket Nos. 03–66; 03–67; 02–68; IB 

Docket No. 02–364; ET Docket No. 00–258] 

Small Business Size Standards for the 

Broadband Radio Service in the 2495– 

2690 MHz Band 

AGENCY: Federal Communications 

Commission. 

ACTION: Final rule; notification of Small 

Business Administration approval. 

SUMMARY: This document announces 

that the U.S. Small Business 

Administration (SBA) has approved the 

small business size standards adopted 

by the Commission for the Broadband 

Radio Service (BRS) in the 2495–2690 

MHz band. 

DATES: This announcement is made as 

of April 27, 2009. 

FOR FURTHER INFORMATION CONTACT: Gary 

D. Michaels, Auctions and Spectrum 

Access Division, Wireless 

Telecommunications Bureau, (202) 418– 

0660. 

SUPPLEMENTARY INFORMATION: 

1. Pursuant to SBA regulations, the 

Commission consulted with the SBA on 

March 7, 2003, and June 29, 2004, 

regarding small business size standards 

under which certain small businesses 

would be eligible for bidding credits in 

any auction of BRS licenses in the 

2495–2650 MHz band and Educational 

Broadband Service (EBS) licenses in the 

2500–2690 MHz band. Both the March 

7, 2003, and June 29, 2004 consultation 

letters proposed the following small 

business definitions: ‘‘Small 

business’’—an entity with average 

annual gross revenues for the preceding 

three years not exceeding $40 million; 

‘‘Very small business’’—an entity with 

average annual gross revenues for the 

preceding three years not exceeding $15 

million; and ‘‘Entrepreneur’’—an entity 

with average gross revenues not 

exceeding $3 million for the preceding 

three years. The SBA responded to the 

Commission on July 22, 2004, replying 

to both of the Commission’s requests 

and stating that the contemplated BRS 

and EBS size standards appeared 

reasonable. The Commission 

subsequently proposed those same 

small business size standards for BRS 

and EBS in the BRS/EBS Further Notice 

of Proposed Rulemaking, FCC 04–135, 

released on July 29, 2004, 69 FR 72048, 

December 10, 2004. The Commission 

received no comments from the public 

regarding the proposed size standards. 

2. On March 20, 2008, the 

Commission released the Big LEO Third 


dwashington3 on PROD1PC60 with RULES
Federal Register / Vol. 74, No. 79 / Monday, April 27, 2009 / Rules and Regulations 19011 

Order on Reconsideration and AWS 

Sixth Memorandum Opinion and Order 

and BRS/EBS Fourth Memorandum 

Opinion and Order and Declaratory 

Ruling, FCC 08–83, 73 FR 26032, May 

8, 2008 (‘‘BRS/EBS 4th MO&O’’), in 

which it adopted the following small 

business definitions for BRS in the 

2496–2690 MHz band: (1) Small 

business—An entity with average gross 

revenues for the preceding three years 

not exceeding $40 million; (2) Very 

small business—An entity with average 

annual gross revenues for the preceding 

three years not exceeding $15 million; 

and (3) Entrepreneur—An entity with 

average gross revenues not exceeding $3 

million for the preceding three years. 

Under these definitions, the 

Commission would provide small 

businesses with a bidding credit of 15 

percent, very small businesses with a 

bidding credit of 25 percent, and 

entrepreneurs with a bidding credit of 

35 percent. 

3. On May 6, 2008, prior to 

publication of a summary of the BRS/ 

EBS 4th MO&O in the Federal Register, 

the Commission requested the SBA’s 

approval of the final rule adopting small 

business size standards for the BRS. 

4. By letter dated January 22, 2009, 

the SBA approved the Commission’s 

final rule adopting small business size 

standards for BRS subject to 

republication of the size standards in 

the Federal Register. 

5. This notice satisfies the SBA’s 

condition of approval as stated in the 

SBA’s January 22, 2009 letter. 

Federal Communications Commission. 

Gary D. Michaels, 

Deputy Chief, Auctions and Spectrum Access 

Division, WTB. 

[FR Doc. E9–9463 Filed 4–24–09; 8:45 am] 

BILLING CODE 6712–01–P 

DEPARTMENT OF COMMERCE 

National Oceanic and Atmospheric 

Administration 

50 CFR Part 660 

[Docket No. 0809121213–9221–02] 

RIN 0648–AX84 

Magnuson-Stevens Act Provisions; 

Fisheries Off West Coast States; 

Pacific Coast Groundfish Fishery; 

Biennial Specifications and 

Management Measures; Inseason 

Adjustments 

AGENCY: National Marine Fisheries 

Service (NMFS), National Oceanic and 

Atmospheric Administration (NOAA), 

Commerce. 

ACTION: Final rule; inseason 

adjustments to biennial groundfish 

management measures; request for 

comments. 

SUMMARY: This final rule announces 

inseason changes to management 

measures in the commercial Pacific 

Coast groundfish fisheries. These 

actions, which are authorized by the 

Pacific Coast Groundfish Fishery 

Management Plan (FMP), are intended 

to allow fisheries to access more 

abundant groundfish stocks while 

protecting overfished and depleted 

stocks. The rule also implements 

changes to the incidental retention 

allowance for halibut in the primary 

sablefish fishery under the authority of 

the Northern Pacific Halibut Act. 

DATES: Effective 0001 hours (local time) 

May 1, 2009. Comments on this final 

rule must be received no later than 5 

p.m., local time on May 27, 2009. 

ADDRESSES: You may submit comments, 

identified by RIN 0648–AX84 by any 

one of the following methods: 

• Electronic Submissions: Submit all 

electronic public comments via the 

Federal eRulemaking Portal http:// 

www.regulations.gov. 

• Fax: 206–526–6736, Attn: Gretchen 

Arentzen 

• Mail: Barry Thom, Acting 

Administrator, Northwest Region, 

NMFS, 7600 Sand Point Way NE, 

Seattle, WA 98115–0070, Attn: Gretchen 

Arentzen. 

Instructions: All comments received 

are a part of the public record and will 

generally be posted to http:// 

www.regulations.gov without change. 

All Personal Identifying Information (for 

example, name, address, etc.) 

voluntarily submitted by the commenter 

may be publicly accessible. Do not 

submit Confidential Business 

Information or otherwise sensitive or 

protected information. 

NMFS will accept anonymous 

comments (enter ‘‘N/A’’ in the required 

fields, if you wish to remain 

anonymous). Attachments to electronic 

comments will be accepted in Microsoft 

Word, Excel, WordPerfect, or Adobe 

PDF file formats only. 

FOR FURTHER INFORMATION CONTACT: 

Gretchen Arentzen (Northwest Region, 

NMFS), phone: 206–526–6147, fax: 206– 

526–6736 and e-mail 

gretchen.arentzen@noaa.gov. 

SUPPLEMENTARY INFORMATION: 

Electronic Access 

This final rule is accessible via the 

Internet at the Office of the Federal 

Register’s Website at http:// 

www.gpoaccess.gov/fr/index.html. 

Background information and documents 

are available at the Pacific Fishery 

Management Council’s website at http:// 

www.pcouncil.org/. 

Background 

The Pacific Coast Groundfish FMP 

and its implementing regulations at title 

50 in the Code of Federal Regulations 

(CFR), part 660, subpart G, regulate 

fishing for over 90 species of groundfish 

off the coasts of Washington, Oregon, 

and California. Groundfish 

specifications and management 

measures are developed by the Pacific 

Fishery Management Council (Council), 

and are implemented by NMFS. A 

proposed rule to implement the 2009– 

2010 groundfish harvest specifications 

and management measures published 

on December 31, 2008, (73 FR 80516). 

The final rule to implement the 2009– 

2010 specifications and management 

measures for the Pacific Coast 

Groundfish Fishery was published on 

March 6, 2009 (74 FR 9874). These 

specifications and management 

measures are codified in the CFR (50 

CFR part 660, subpart G). 

Changes to current groundfish 

management measures implemented by 

this action were recommended by the 

Council, in consultation with Pacific 

Coast Treaty Indian Tribes and the 

States of Washington, Oregon, and 

California, at its April 4–9, 2009, 

meeting in Millbrae, California. The 

Council recommended adjustments to 

current groundfish management 

measures to respond to updated fishery 

information and other inseason 

management needs. This action is not 

expected to result in greater impacts to 

overfished species than originally 

projected through the end of 2009. 

Estimated mortality of overfished and 

target species are the result of 

management measures designed to meet 

the Pacific Coast Groundfish FMP 

objective of achieving, to the extent 

possible, but not exceeding, OYs of 

target species, while fostering the 

rebuilding of overfished stocks by 

remaining within their rebuilding OYs. 

Limited Entry Fixed Gear Fishery 

Management Measures 

Sablefish Daily Trip Limit Fishery 

Over the past several years, the 

amount of sablefish harvested in the 

limited entry fixed gear sablefish daily 

trip limit (DTL) fishery North of 36° N. 

lat. has been lower than their sablefish 

allocation. In 2006, 106 mt of the 356 mt 

allocation was harvested. In 2007 and 

2008, 116 mt and 150 mt, respectively, 

of the 2007 and 2008 allocations of 276 

mt were taken. Over the 2006 to 2008 


dwashington3 on PROD1PC60 with RULES