Privacy Act; Implementation

AGENCY:

Department of Health and Human Services.

ACTION:

Final rule.

SUMMARY:

The Department of Health and Human Services (HHS or Department) is issuing this final rule to make effective the exemptions that were previously proposed for a subset of records covered in a new Privacy Act system of records, No. 09-25-0165, NIH Loan Repayment Records, which is maintained by the National Institutes of Health (NIH). The system of records covers records used to manage and evaluate the Loan Repayment Programs (LRPs) at NIH. The exemptions are necessary to maintain the integrity of the NIH peer review and award processes by enabling NIH to protect the identities of reviewers.

DATES:

This final rule is effective February 17, 2022.

FOR FURTHER INFORMATION CONTACT:

Dustin Close, Office of Management Assessment, National Institutes of Health, 6705 Rockledge Drive, Suite 601, Bethesda, Maryland 20892, telephone 301-402-6469, email privacy@mail.nih.gov.

SUPPLEMENTARY INFORMATION:

The NIH Loan Repayment Programs (LRPs) are administered by the Division of Loan Repayment (DLR) within NIH's Office of Extramural Research. DLR provides repayment of student loans for approved applicants to encourage outstanding health professionals to pursue careers in biomedical, behavioral, social, and clinical research. Research health professionals who owe qualified educational debt and who meet eligibility criteria may apply for student loan repayment. A peer review process recommends applicants for loan repayments. The peer review process is committee-based, with a peer review group comprised of individual reviewers, referees, or other recommenders (hereafter collectively referred to as Reviewers). Reviewers are primarily non-government experts qualified by training and experience in scientific or technical fields, or as authorities knowledgeable in disciplines and fields related to the areas under review. Reviewers give DLR expert recommendations and materials (such as ratings, summaries, and communications) about applicants' suitability, eligibility, or qualifications for student loan repayments under express promises that the Reviewers will not be identified as the sources of the information. DLR uses the information solely for the purpose of determining applicants' suitability, eligibility, or qualifications for Federal loan repayment. System of records 09-25-0165 covers records about health professionals who apply for student loan repayments and about other categories of individuals who are related to the applications. These records include material that could reveal the identity of the Reviewers either directly or indirectly.

Under the Privacy Act of 1974, as amended (Privacy Act, 5 U.S.C. 552a, or “Privacy Act”), individuals have a right of access to records about themselves in Federal agency systems of records, and other rights with respect to those records (such as notification, amendment, and an accounting of disclosures), but the Act permits certain types of systems of records (identified in section 552a(j) and (k)) to be exempted from certain requirements of the Act. Subsection (k)(5) permits the head of an agency to promulgate rules to exempt from the requirements in subsections (c)(3) and (d)(1) through (4) of the Act investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal contracts, to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Federal Government under an express promise that the identity of the source would be held in confidence.

In accordance with the Privacy Act, HHS/NIH proposed to exempt material that would identify a confidential source in system of records 09-25-0165 from the notification, access, and amendment requirements of the Act pursuant to subsection (k)(5) of the Act, as described in a notice of proposed rulemaking (NPRM) published in the Federal Register (86 FR 2633) for public comment on January 13, 2021. The agency also published a modified notice describing system of records 09-25-0165 (SORN) in the Federal Register (86 FR 2677) for public comment the same day. The 60-day public comment period provided for both the SORN and the NRPM expired March 15, 2021. Thirteen comments were received on the NPRM and no comments were received on the SORN. The comments received applauded NIH's efforts to exempt material that would identify Reviewers contained within the system of records as specified in the notice. Additionally, none of the commentors recommended any changes to the proposed exemptions or the SORN. Therefore, HHS/NIH has made no changes to the proposed exemptions in the NPRM or to the SORN.

NIH believes the exemptions are necessary to maintain the integrity of the NIH peer review and award processes. Protecting Reviewer identities as the sources of the information they provide protects them from harassment, intimidation, and other attempts to improperly influence award outcomes, and ensures that they are not reluctant to provide sensitive information or frank assessments. Case law has held that exemptions promulgated under subsection (k)(5) may protect source-identifying material even where the identity of the source is known. Therefore, NIH solicits Reviewers to assess applicants for loan repayment programs under an express promise of confidentiality.

The specific rationales that support the exemptions concerning each affected Privacy Act provision, are as follows:

• Subsection (c)(3). An exemption from the requirement to provide an accounting of disclosures to record subjects is needed to protect the identity of any Reviewer who is expressly promised confidentiality. Providing an accounting of disclosures to an applicant could identify specific Reviewers as sources of recommendations or evaluative input received, or to be received, on the application. Inappropriately revealing the Reviewers' identities in association with the nature and scope of their assessments or evaluations could lead them to alter or destroy their assessments or evaluations or subject them to harassment, intimidation, or other improper influence, which would impede or compromise the fairness and objectivity of the loan repayment application review process; constitute an unwarranted invasion of the personal privacy of the Reviewer; and violate the express promise of confidentiality made to the Reviewer.

• Subsection (d)(1). An exemption from the access requirement is needed both during and after an application review proceeding to avoid inappropriately revealing the identity of the Reviewers. Protecting the Reviewers' identities from access by record subjects is necessary to maintain the integrity of the review process. It ensures Reviewers provide candid assessments or evaluations to the Federal Government without fear that their identities as linked to a specific work product will be revealed inappropriately. Allowing an individual applicant who is the subject of an assessment or evaluation, or another record subject who has a relationship to the application, to access material that would reveal a Reviewer could lead Reviewers to alter or destroy their assessments or evaluations or subject them to harassment, intimidation, or other improper influence; interfere with or compromise the objectivity and fairness of award application review proceedings; constitute an unwarranted invasion of the personal privacy of the Reviewer; and violate the express promise of confidentiality made to the Reviewer.

• Subsection (d)(2) through (4). An exemption from the amendment and appeal provisions is necessary while one or more related application review proceedings are pending, but only if and to the extent that disclosure of material in the amendment request and appeal process would reveal inappropriately the identity of any Reviewer who was expressly promised confidentiality. The exemption will be limited to allowing the agency, when processing an amendment request or the review of a refusal to amend a record, to avoid disclosing the existence of the record sought to be amended and its contents, if doing so would reveal the identity of a Reviewer. Revealing the identity of a Reviewer to an individual applicant or other subject individual could lead them to alter or destroy their assessments or evaluations or subject them to harassment, intimidation, or other improper influence; interfere with or compromise the objectivity and fairness of award application review proceedings; interfere with the agency's application review process; constitute an unwarranted invasion of the personal privacy of the Reviewer; and violate the express promise of confidentiality made to the Reviewer.

Accordingly, pursuant to 5 U.S.C. 552a(k)(5), NIH is exempting records about LRP applicants in system of records 09-25-0165 NIH Division of Loan Repayment Record System from the access, amendment, and accounting of disclosures provisions of the Privacy Act (5 U.S.C. 552a(c)(3) and (d)(1) through (4)), to the extent necessary to protect material in the records furnished under an express promise that the identity of the source would be held in confidence, based on the specific rationales discussed above.

In the case of a request for access to, or amendment of, a record in the DLR Record System from an individual covered by the system of records, NIH will withhold only material that would inappropriately reveal the identities of Reviewers who provide recommendations and evaluative input to NIH about particular award applications under an express promise that their identities would be held in confidence. This includes only material that would reveal a particular Reviewer as the author of a specific work product ( e.g., reference or recommendation letters, reviewer critiques, preliminary or final individual overall scores, assignment of Reviewers to an application); and it includes not only a Reviewer's name but any content that could enable the Reviewer to be identified from context, such as the Reviewer's institutional affiliation, title, or specific comment that might allow an applicant to deduce the Reviewer's identity.

Notwithstanding the exemptions, NIH will consider any request for access or amendment that is addressed to the System Manger as provided in the SORN for system of records 09-25-0165, and NIH will consider any request for an accounting of disclosures.

The Federal Register notice containing the SORN proposed for new system of records 09-25-0165 (86 FR 2677), published January 13, 2021, provides for the SORN to be effective upon publication of this final rule. HHS/NIH made no changes to the SORN in response to public comments and, therefore, the SORN, as published at 86 FR 2677, is now effective.

Analysis Impacts

I. Review Under Executive Orders 12866 and 13563

The agency has reviewed this rule under Executive Orders 12866, Regulatory Planning and Review (58 FR 51735, September 30, 1993), and 13563, Improving Regulation and Regulatory Review (76 FR 3821, January 18, 2011), which direct agencies to assess costs and benefits of available regulatory alternatives and, if regulation is necessary, to maximize the net benefits. The agency believes that this rule is not a significant regulatory action under Executive Order 12866, because it will not (1) have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or state, local or tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) materially alter the budgetary impact of entitlements, grants, user fees or loan programs, or the rights and obligations of recipients thereof; or (4) raise novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles set forth in Executive Order 12866. This rule removes certain Privacy Act rights from the subjects of these records in accordance with criteria established in the Privacy Act at 5 U.S.C. 552a(k)(5). This decision is based on a showing that agency compliance with all the Privacy Act requirements with respect to those records would harm the effectiveness or integrity of the agency function or process for which the records are maintained (in this case, NIH research and development loan award processes). Thus, this agency believes that a regulatory impact analysis is not required.

II. Review Under the Regulatory Flexibility Act (5 U.S.C. 601-612)

The Regulatory Flexibility Act requires agencies to analyze regulatory options that would minimize any significant regulatory impacts of a rule on small entities. Because the rule imposes no duties or obligations on small entities, we have determined, and the Director certifies, that the rule will not have a significant economic impact on a substantial number of small entities.

III. Review Under the Unfunded Mandates Reform Act of 1995 (Section 202, Public Law 104-4)

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires agencies to prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by state, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current threshold after adjustment for inflation is $156 million, using the most current (2020) Implicit Price Deflator for the Gross Domestic Product. The agency does not expect that this final rule will result in any 1-year expenditure by state, local, and tribal governments that will meet or exceed this amount.

IV. Review Under the Paperwork Reduction Act of 1995 (44 U.S.C. 35-1 et seq.)

This rule does not contain any information collection requirements subject to the Paperwork Reduction Act.

V. Review Under Executive Order 13132, Federalism

This rule will not have any direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government. Therefore, the requirements of Executive Order 13132 are inapplicable.

List of Subjects in 45 CFR Part 5b

• Privacy

For the reasons set out in the preamble, the Department amends part 5b of title 45 of the Code of Federal Regulations as follows:

PART 5b—PRIVACY ACT REGULATIONS

1. The authority citation for part 5b continues to read as follows:

Authority: 5 U.S.C. 301, 5 U.S.C. 552a.

2. Amend § 5b.11 by adding paragraph (b)(3) to read as follows: