Privacy Act of 1974; System of Records

AGENCY:

Health Resources and Services Administration (HRSA), Department of Health and Human Services (HHS).

ACTION:

Notice of a modified system of records.

SUMMARY:

In accordance with requirements of the Privacy Act of 1974, as amended, the HHS is updating an existing system of records maintained by HRSA's Bureau of Health Workforce (BHW), System No. 09-15-0037, HHS/HRSA/BHW Scholarship and Loan Repayment Program Records. The records in the system of records are about individuals who have applied for, are receiving, or have received awards under one of BHW's scholarship and loan repayment programs, as well as individuals who indicate an interest in employment in or assignment to a medical facility located in a health professional shortage area or a medically underserved population area, incident to their participation in a BHW scholarship or loan repayment program.

DATES:

In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is applicable May 26, 2021, subject to a 30-day period in which to comment on the new and revised routine uses, described below. Please submit any comments by June 25, 2021.

ADDRESSES:

Written comments may be submitted by mail, addressed to: ATTN: HRSA/BHW/OAA, 5600 Fishers Ln., Rockville, MD 20857, or by using this electronic contact method: https://www.hrsa.gov/about/contact/bhwhelp.aspx.

FOR FURTHER INFORMATION CONTACT:

General questions about the revised system of records may be submitted by telephone to (800) 221-9393.

SUPPLEMENTARY INFORMATION:

This system of records was last comprehensively updated in 2015. The primary reason for updating the system of records now is to add a new loan repayment program, the Substance Use Disorder (SUD) Treatment and Recovery Loan Repayment Program (STAR LRP), to the programs that are covered by this system of records and to clarify that the System of Records Notice (SORN) is intended to include records for all BHW LRP and Scholarship Program (SP) records (sometimes collectively referred to as “Program” or “Programs”). The modifications include:

• Updating contact information in the System Location and System Manager(s) sections.
• Adding a reference to the new loan repayment program, STAR, to the System Manager(s) section; the Purpose(s) section at 7; the Categories of Individuals section at 1; and in Routine Use 16 (formerly Routine Use 17).
• Adding a reference to two other programs not mentioned by name in the existing SORN, i.e., the National Health Service Corps Rural Community (NHSC RC) LRP and the National Health Service Corps Substance Use Disorder (NHSC SUD) Workforce LRP, to the System Manager(s) section; the Purpose(s) section at 7; the Categories of Individuals section at 1; and in Routine use 16 (formerly Routine use 17).
• Clarifying in the Purpose(s) section at 2, in the Categories of Individuals section at 1, and in a revision to Routine Use 8 that the SORN covers records for all BHW loan repayment and scholarship “Programs” (e.g., not just “above-identified Programs” but also any future programs).
• In the Authorities section, adding 42 U.S.C. 294h, which authorizes the new STAR LRP; and broadening the citation to 42 U.S.C. 254f to include additional sections which are applicable, i.e., 42 U.S.C. 254d through 254h-1.
• Revising the Purpose(s) section to:
• Merge former purpose description 10 with purpose description 4, so that 4 now describes both the debt servicing and debt collection purposes.
• Reword the start of purpose description 10 (formerly 11) to read: “To provide information to the Assistant Secretary for Financial Resources . . .” (instead of: “To transfer information to System No. 09-90-0024, Unified Financial Management System . . .”).
• Add a new purpose description at 11, i.e., to use records to create datasets for the agency to use to evaluate and improve the Programs, to make available for outside researchers to use for research purposes and, in deidentified form, to make available to the public.
• Adding a short list of record categories at the start of the Categories of Records section.
• In the Record Source Categories section, spelling out the names of the Department of the Treasury (Treasury) and the Internal Revenue Service (IRS); adding, after the System for Awards Management, “and any other relevant databases included in the Department of the Treasury's Do Not Pay Working System;” adding the Department Education; and adding a paragraph at the end of the section, describing a BHW interconnection with the Department of Education's National Student Loan Data system which Program participants have the option to use to provide BHW with information related to their applications.
• Revising the Routine Uses section to:
• In the introduction to the Routine uses section, change “. . . and (b)(4) through (b)(11) . . .” to “. . . and (b)(4) through (b)(12) . . .” because (b)(12) is applicable to this system of records, due to adding Note 2 at the end of the section which gives notice as required by 31 U.S.C. 3711(e) that the disclosures to consumer reporting agencies permitted by 5 U.S.C. 552a(b)(12) are made from this system of records.
• Remove, from the end of routine use 2, a redundant phrase that repeated part of the definition of a routine use (i.e., a phrase stating that the use must be compatible with the purpose for which the records were collected); and change “litigation” to “litigation and other proceedings.”
• Clarify, in routine use 6, that the contractors in underserved communities who are included as disclosure recipients are contractors supporting the Programs.
• Broaden routine use 8 to replace “. . . who assist with the implementation of the above-identified Programs for the purpose of collecting, compiling, aggregating, analyzing, or refining records in the system, or improving Program operations” with “. . . who assist with the implementation of the Programs or in improving Program operations, when they need access to the records to provide the assistance.”
• Broaden routine use 10 to include, after the reference to the System for Awards Management, “and any other relevant databases included in Treasury's Do Not Pay Working System.”
• Revise routine use 16 to refer to the new loan repayment program, STAR LRP, and the NHSC RC LRP and NHSC SUD Workforce LRP.
• Add new routine use 24, which authorizes disclosure of datasets containing identifiable data to approved outside researchers, subject to the restrictions stated in the routine use.
• Number the existing note at the end of the Routine Uses section as “Note 1;” reword the note without substantively changing it (i.e., to change “debt management” to “debt servicing”); and update the name of the related system of records 09-90-0024 referenced in that note.
• Add a second note, numbered as “Note 2,” providing notice as required by Treasury statute 31 U.S.C. 3711(e) that records from this system of records are disclosed to consumer reporting agencies pursuant to 5 U.S.C. 552a(b)(12).
• Revising the Retrieval section to include address and Applicant/Participant ID number as personal identifiers used for retrieval, and to remove “characteristics,” because they would not be personal identifiers.
• Updating the Retention and Disposal section with new disposition schedule numbers in 2 and 3 and explaining, in 4, that the BHW Management Information System Solution (BMISS) is an information technology system and spelling out the name the National Archives and Records Administration.
• Updating the Safeguards section to include a new introduction and two additional administrative safeguards (ongoing security control audits and reviews, and security awareness training), and to remove a paragraph describing physical safeguards applicable to records at Papa Ola Lokahi (POL) in Hawaii, which included no different safeguards from those described earlier in the section as applying to the system of records.
• Revising the Record Access, Contesting Records, and Notification Procedures sections to:
• Remove detailed in-person request procedures and to instead require requests to be in writing, without specifying different procedures for different submission methods.
• Remove an unnecessary statement that telephone requests will not be honored (such requests would not be in writing).
• Replace social security number (SSN) with “Applicant/Participant ID number” as an item of information that “should” be included in a request (i.e., information that would be helpful to include as opposed to being mandatory to include).

Because some of these changes are significant, a report on the modified system of records was sent to OMB and Congress in accordance with 5 U.S.C. 552a(r).

SYSTEM NAME AND NUMBER:

HHS/HRSA/BHW Scholarship and Loan Repayment Program Records, 09-15-0037.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

The address of the agency component responsible for this system of records is:

• Health Resources and Services Administration/Bureau of Health Workforce, 5600 Fishers Lane, Rockville, MD 20857.

Addresses of third-party service providers assisting BHW:

• Arch Systems, LLC, 1800 Washington Blvd., Ste. 421, Baltimore, MD 21230.
• Publicis Sapient, 1515 N Courthouse Rd., 4th Fl., Arlington, VA 22201.

SYSTEM MANAGER(S):

The System Manager for the system of records is the following Policy-Coordinating Official: Director, Division of Policy and Shortage Designation, BHW, HRSA, 5600 Fishers Ln., Rockville, MD 20857, (877) 464-4772 (TTY: (877) 897-9910).

Points of contact for specific scholarship programs and activities (SP) and loan repayment programs and activities (LRP), collectively referred to as Program or Programs:

• For the National Health Service Corps Scholarship Program (NHSC SP), National Health Service Corps Loan Repayment Program (NHSC LRP), National Health Service Corps Students to Service Loan Repayment Program (NHSC S2S LRP), National Health Service Corps Substance Use Disorder Workforce Loan Repayment Program (NHSC SUD Workforce LRP), NHSC Rural Community LRP (NHSC RC LRP) and Substance Use Disorder Treatment and Recovery Loan Repayment Program (STAR LRP) Applications/Awards: Director, Division of the National Health Service Corps, BHW, HRSA, 5600 Fishers Ln., Rockville, MD 20857.
• For Nurse Corps LRP, Nurse Corps SP, and Faculty Loan Repayment Program (FLRP) Applications/Awards: Director, Division of Health Careers ad Financial Support, BHW, HRSA, 5600 Fishers Ln., Rockville, MD 20857, 1-877-464-4772 (TTY:1-877-897-9910).
• For NHSC SP, NHSC LRP, NHSC S2S LRP, NHSC SUD Workforce LRP, NHSC RC LRP, FLRP, and STAR LRP: Director, Division of Participant Support and Compliance, BHW, HRSA, 5600 Fishers Ln., Rockville, MD 20857.
• For Suspension/Waiver/Default Determination for all BHW Programs: Chief, Legal and Compliance Branch, BHW, HRSA, 5600 Fishers Ln., Rockville, MD 20857.
• For Native Hawaiian Health Scholarship Program (NHHSP): Administrator, Papa Ola Lokahi, 894 Queen St., No. 706, Honolulu, HI 96813.
• For Student/Resident Experiences and Rotations in Community Health (SEARCH) and Ambassadors: Director, Division of External Affairs, BHW, HRSA, 5600 Fishers Ln., Rockville, MD 20857.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

These statutes authorize HHS/HRSA to maintain this system of records:

• 42 U.S.C. 254d through 254h-1 (Secs. 331 through 336 of the Public Health Service (PHS) Act, as amended).
• 42 U.S.C. 234 (Sec. 225 of the PHS Act, as in effect on September 30, 1977, Public Health National Health Service Corp (PH/NHSC) Scholarship Training Program).
• 42 U.S.C. 295g (Sec. 409(b) of the Health Professions Educational Assistance Act of 1976, Physician Shortage Area Scholarship Program (PSASP)).
• 42 U.S.C. 2541-q (Secs. 338A-H of the PHS Act, as amended, NHSC Scholarship and Loan Repayment Programs).
• 42 U.S.C. 254h-1(c) and 254d(b)(1) (Secs. 336(c) and 331(b)(1) of the PHS Act, Student/Resident Experiences and Rotations in Community Health (SEARCH)).
• 42 U.S.C. 297n (Sec. 846 of the PHS Act, as amended, Nurse Corps Loan Repayment Program and the Nurse Corps Scholarship Program).
• 42 U.S.C. 11709 (Sec. 10 of the Native Hawaiian Health Care Improvement Act, as amended, NHHSP).
• 42 U.S.C. 293b(a) (Sec. 738(a) of the PHS Act), Faculty Loan Repayment Program).
• 42 U.S.C. 3505d (Sec. 202 of Title II of Pub. L. 92-157, National Health Professional Shortage Clearinghouse).
• 31 U.S.C. 7701(c) (Debt Collection Improvement Act of 1996, Requirement That Applicant Furnish Taxpayer Identifying Number).
• 5 U.S.C. 3301 (pertaining to civil service employees) and 42 U.S.C. 216(a) (Sec. 215(a) of the PHS Act, as amended, pertaining to PHS commissioned officers), both of which authorize verification of an individual's suitability for employment).
• 42 U.S.C. 295h (Sec. 781 of the Public Health Service Act), STAR LRP.

PURPOSE(S) OF THE SYSTEM:

Relevant agency personnel use records about individuals in this system of records on a need to know basis for the following purposes:

1. To obtain marketing and recruitment information concerning individuals who registered to complete an online application but did not submit or complete an application.

2. To identify and select qualified individuals to participate in any of the BHW Loan Repayment Programs (LRP) and Scholarship Programs (SP), including any future program.

3. To maintain records on and to verify program applicants' or participants' credentials and educational background, and previous and current professional employment data and performance history information to verify that all claimed background and employment data are valid and all claimed credentials are current and in good standing for selection for an award through the completion of service.

4. To assist the HHS Program Support Center (PSC) in servicing Program debts and to assist or obtain assistance from PSC, the Department of Justice (DOJ), and other government entities in the collection of Program debts that are disputed, defaulted, or delinquent.

5. To respond to inquiries from Program applicants and participants, their attorneys or other authorized representatives, and Congressional representatives.

6. To compile and generate managerial and statistical reports.

7. With respect to the PH/NHSC, NHSC SP, NHHSP, Nurse Corps SP, NHSC LRP, Nurse Corps LRP, FLRP, NHSC SUD Workforce LRP, and STAR LRP: (a) To select and match scholarship recipients, loan repayors, and other individuals for assignment to or employment with a health care or other facility appropriate to the Programs' purposes; (b) to perform loan repayment and scholarship program administrative activities, including, but not limited to, payment tracking, deferment of the service obligation, monitoring a participant's compliance with the service requirements, determination of service completion, review of suspension or waiver requests, default determinations, and calculation of liability upon default; and (c) to monitor the services provided by the Programs' health care providers.

8. With respect to the SEARCH Program: (a) To track recruitment of SEARCH participants for the NHSC Scholarship and Loan Repayment Programs; and (b) to determine how many non-obligated SEARCH participants ultimately practice primary health care in a Health Professional Shortage Area (HPSA).

9. With respect to the Ambassador and Alumni activities: (a) To advocate for more health professions students to choose primary care; (b) to mentor students and clinicians; and (c) to recruit students and clinicians for the NHSC Scholarship and Loan Repayment Programs, and to train community leaders and local clinicians to care about and for people in need.

10. To provide information to the HHS Office of the Assistant Secretary for Financial Resources for purposes of effecting payment of program funds (including through the Department of the Treasury) and preparing and maintaining financial management and accounting documentation related to obligations and disbursements of funds (including providing notifications to the Department of the Treasury) related to payments to, or on behalf of, awardees. Information provided to ASFR for these purposes is limited to the individual's name, address, SSN, and other information necessary to identify the individual, the funding being sought or amount of qualifying educational loans, and the program under which the awardee is being processed.

11. To create datasets for HHS to use to evaluate and improve the BHW loan repayment and scholarship programs, and for HHS to make available to the public or to approved outside researchers. Any datasets made available to the public would be de-identified, limited to information the disclosure of which would not constitute a clearly unwarranted invasion of personal privacy under the Freedom of Information Act. Identifiable datasets would be made available to approved researchers only, subject to restrictions, as described in routine use 24.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The system of records contains records about the following categories of individuals:

1. Individuals who have applied for, who are receiving, or who have received awards under any BWH loan repayment programs (LRP) or scholarship programs (SP), including any new programs arising after publication of this SORN. Current programs, which may change over time, include: The National Health Service Corps Scholarship Program (NHSC SP); the National Health Service Corps Loan Repayment Program (NHSC LRP); National Health Service Corps Students to Service Loan Repayment Program (NHSC S2S LRP); the National Health Service Corps Substance Use Disorder Workforce Loan Repayment Program (NHSC SUD Workforce LRP); the National Health Service Corps Rural Community Loan Repayment Program (NHSC RC LRP); the Nurse Corps Loan Repayment Program (Nurse Corps LRP); the Nurse Corps Scholarship Program (Nurse Corps SP); the NHHSP; the Faculty Loan Repayment Program (FLRP); and the Substance Use Disorder (SUD) Treatment and Recovery Loan Repayment Program (STAR LRP).

2. Individuals who have applied to participate, are participating, or have participated in the NHSC Student/Resident Experiences and Rotations in Community Health (SEARCH) Program.

3. Individuals who are current or former Ambassadors, Alumni, or Ready Responders.

4. Individuals who indicate an interest in employment in or an assignment to a medical facility located in a Health Professional Shortage Area (HPSA) or a medically underserved population area, including public and federal medical facilities, such as Bureau of Prisons medical facilities, Indian Health Service health care facilities, and other federally sponsored health care facilities.

CATEGORIES OF RECORDS IN THE SYSTEM:

The categories of records include scholarship and loan repayment applications, and associated forms, documents, reports, correspondence, and contracts, and expressions of interest, for all BHW scholarship programs and loan repayment programs, including those listed in the System Manager(s) section and any new programs not specifically listed.

Examples of particular records and data elements include: The individual's name, address(es), telephone number(s), email address(es), Social Security number (SSN); scholarship, loan repayment, Ambassadors, Alumni, Ready Responders or SEARCH application and associated forms/documents, contracts, employment data, professional performance and credentialing history of licensed health professionals; preference for site-selection; personal, professional, and demographic background information; academic and/or service progress reports (which include related data, correspondence, and professional performance information consisting of continuing education, performance awards, and adverse or disciplinary actions); commercial credit reports, educational data including tuition and other related education expenses; educational data including academic program and status; information concerning educational loans; employment status verification (which includes certifications and verifications of service obligation); medical data, financial data, payment data and related forms, deferment/placement/suspension/waiver data and supporting documentation; repayment/delinquent/default status information, correspondence to and from Program applicants and participants and/or their representatives, Claims Collection Litigation Reports for default cases referred to the DOJ.

RECORD SOURCE CATEGORIES:

Records are obtained directly from the subject individuals, or from the following sources: Educational institutions; internship and/or residency training programs; employers; NHSC-approved service sites; critical shortage facilities; schools of nursing; lending institutions and loan servicing agencies; health professional associations; National Practitioner Data Bank; the System for Awards Management and any other relevant databases included in the Department of the Treasury's Do Not Pay Working System (see https://fiscal.treasury.gov/DNP/ ); HHS Office of Inspector General website listing of individuals excluded from Medicare, Medicaid, and all other federal health care programs; HHS database of Health Professional Shortage Areas; HHS grantees and contractors/subcontractors; consumer reporting agencies/credit bureaus; other federal agencies, including but not limited to the Department of the Treasury (Treasury) and its Internal Revenue Service (IRS), the Department of Education, and the U.S. Postal Service; state health professions licensing boards and/or the Federation of State Medical Boards or a similar non-government entity; and third parties who provide references or other information concerning the subject individual.

Applicants/participants have the option to use a BHW interconnection with the Department of Education's National Student Loan Data System to import information related to their application. The interconnection provides data integrity and security for BHW and convenience for the applicants/participants.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to the disclosures authorized by the Privacy Act at 5 U.S.C. 552a(b)(2) and (b)(4)-(b)(12), information about an individual may be disclosed from this system of records to parties outside HHS, without the individual's prior, written consent, for these routine uses:

1. HHS may disclose to a Member of Congress or to a Congressional staff member information from the record of an individual in response to a written inquiry from the Congressional office made at the written request of that individual.

2. HHS may disclose information from this system of records to the DOJ or to a court or other tribunal when:

a. HHS, or any component thereof, or

b. Any HHS employee in his or her official capacity, or

c. Any HHS employee in his or her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee, or

d. The United States Government,

is a party to litigation or other proceedings and has an interest in such proceedings, and by careful review, HHS determines that the records are both relevant and necessary to the proceedings.

3. In the event that a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, disclosure may be made to the appropriate public authority, whether federal, state, local, Tribal, or otherwise, responsible for enforcing, investigating or prosecuting such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto, if the information is relevant to the enforcement, regulatory, investigative, or prosecutorial responsibility of the receiving entity. This includes, but is not limited to, disciplinary actions by state licensing boards against current or former Program participants.

4. HHS may disclose information consisting of names, SSN, disciplines and/or medical specialties, current mailing addresses, dates of scholarship support, and dates of graduation of NHSC SP, Nurse Corps SP and NHHSP scholarship recipients to: (a) Designated coordinators at each health professions school participating in the scholarship program for the purpose of determining educational expenses and resulting levels of scholarship support, and for the purpose of guiding and informing these recipients about the nature of their service obligation; and (b) schools attended by scholarship recipients who have taken a leave of absence from school, have terminated enrollment or been dismissed from school, or are repeating coursework, for the purpose of determining their academic status and whether their scholarship support should be suspended or resumed, as appropriate.

5. HHS may disclose information consisting of name, address, discipline and/or medical specialty, and SSN from this system of records to a Program participant's health professions school, residency program, or other postgraduate training program, for the purpose of ascertaining the participant's enrollment status and training completion or graduation date.

6. HHS may disclose records consisting of names, disciplines and/or medical specialties, current business or school mailing addresses, email addresses of the Programs' scholarship and loan repayment participants to contractors supporting the Programs, Ambassadors, Alumni, and professional organizations in underserved communities for the purpose of supporting these clinicians in the course of their service obligation in a HPSA, school of nursing, or critical shortage facility.

7. HHS or its contractors may disclose records consisting of a SEARCH participant's name, mailing address, email address, phone number, health professions school, residency training and specialty to state Primary Care Offices (PCOs) and Primary Care Associations (PCAs) and site representatives for the purpose of matching participants to potential employment sites.

8. HHS may disclose records consisting of a participant's name, SSN, mailing address, email address, phone number, health professions school, residency training, specialty, program status, award years, service start and end dates, and service site address and phone number to Department grantees, contractors and subcontractors who assist with the implementation of the Programs, or in improving Program operations, when they need access to the records to provide the assistance. Grantees and contractors maintain, and contractors are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records.

9. HHS may disclose biographical data and information supplied by Program applicants or participants: (a) To references listed on the application and associated forms, for the purpose of evaluating the applicant's or participant's professional qualifications, experience, and suitability; (b) to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity for the purpose of verifying that all claimed background and employment data are valid and all claimed credentials are current and in good standing; and (c) to prospective, current or former employers, or to site representatives, or to PCAs, and PCOs for the purpose of appraising the applicant's professional qualifications and suitability for site assignment or employment.

10. HHS may disclose an applicant's or participant's name, mailing address, email address, phone number, SSN, health professions school, residency training, and specialty to Department grantees, site representatives, contractors, and subcontractors who assist with the implementation of the above-identified Programs, for the purpose of recruiting, screening, evaluating, and matching, placing, or assigning health professionals to a service site appropriate to the relevant Program's purposes. In addition, Department grantees, contractors and subcontractors may disclose biographical data and information supplied by Program applicants, participants, or references listed on the application and associated forms: (a) To other references for the purpose of evaluating the applicant's or participant's professional qualifications, experience, and suitability; (b) to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity for the purpose of verifying that all claimed background and employment data are valid and all claimed credentials are current and in good standing; (c) to the System for Awards Management and any other relevant databases included in Treasury's Do Not Pay Working System (see https://fiscal.treasury.gov/DNP/ ) for the purpose of determining whether applicants or participants are suspended, debarred, or disqualified from participation in covered transactions; (d) to the National Practitioner Data Bank for the purpose of determining whether applicants or participants have information on their reports; and (e) to prospective employers, or to site representatives, for the purpose of appraising the applicant's or participant's professional qualifications and suitability for site assignment or employment. Grantees and contractors maintain, and contractors are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records.

11. HHS may disclose records consisting of name, mailing address, email address, phone number, SSN, specialty, and requested or actual placement site(s) to State Loan Repayment Grantees, state PCOs and PCAs, and site representatives to facilitate PCO, PCA and site activities related to recruitment and placement of Program participants at service sites. For the purpose of monitoring the program participant's compliance with the service obligation, including fact-finding to calculate service credit, to decide transfer requests, or to make default determinations, HHS may release to the participant's service site other information from the participant's file, including but not limited to, his/her allegations concerning conditions at the site, disputes with site management, or circumstances surrounding his/her resignation/termination.

12. HHS may disclose records to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity which maintains records concerning: (a) An individual's employment history; (b) the issuance, retention, suspension, revocation, or reinstatement of licenses or registrations necessary to practice a health professional occupation or specialty; (c) disciplinary action against the individual or other sanctions imposed by a state or local government licensing board; or (d) the individual's attempts to pass health professions licensure exam(s). This disclosure may include the applicant's or participant's name, address, SSN, employment history, educational data, accreditation, licensing, and professional qualification data, and facts concerning any clinical competence, unprofessional behavior, or substance abuse problem of which HHS is aware. The purposes of this disclosure are: (1) To enable HHS to obtain information relevant to a decision concerning a health professional's accomplishments, professional and personal background qualifications, experience, and any licensure sanctions related to substance abuse, to determine the individual's suitability for employment, retention, or termination as a health services provider at a health care facility approved by the relevant Program; and (2) to inform health professions licensing boards or the appropriate non-government entities about the health care practices or conduct of a practicing, terminated, resigned, or retired health services provider whose professional conduct so significantly failed to conform to generally accepted standards of professional practice for health care providers as to raise reasonable concern for the health and safety of patients.

13. HHS may disclose information consisting of name, address, SSN, health professions license number, and place of employment from this system of records to federal, state, or local health agencies and law enforcement regarding a program participant who has a physical or mental condition that is, or has the potential to become, a risk to patients or to the public at large, or whose aberrant behavior poses such a risk (e.g., commission of a sexual assault, illegal use or distribution of narcotics).

14. HHS may disclose information consisting of name, address, SSN, health professions license number, and place of employment to a state or local government agency, including any agent thereof, maintaining criminal, civil, or administrative violation records, or other pertinent information such as records regarding the investigation or resolution of allegations involving a program participant. The purpose of this disclosure is to enable HHS to monitor compliance with program requirements and make determinations regarding administrative actions or other remedies, including default determinations.

15. HHS may disclose Ambassador information consisting of name, email and social network address(es), phone number(s), employment information, and professional biographies to current and prospective participants in BHW programs and other interested individuals. The purpose of this disclosure is to allow these individuals to contact Ambassadors who serve as mentors and local resources for the NHSC programs.

16. HHS may disclose information about applicants or participants in relevant Programs, including, for example, the NHSC LRPs (e.g., LRP, S2S LRP, SUD Workforce LRP, and RC LRP); Nurse Corps LRP; FLRP; and STAR LRP, to lending institutions and loan servicing agencies for the purpose of obtaining payoff balances on educational loans and determining whether loans are eligible for repayment under the applicable Program. Disclosure will be limited to the applicant/participant's name, address, SSN, the loan account number(s), the pre-verified loan balance, account status, and other information necessary to identify the LRP applicant/participant and his/her loans for this purpose.

17. HHS may disclose information to the IRS about an individual applying under the above-identified Programs to find out whether the applicant has a delinquent tax debt. This disclosure is for the sole purpose of determining the applicant's eligibility for funding and/or creditworthiness and is limited to the individual's name, address, SSN, other information necessary to identify him/her, and the program for which the information is being obtained.

18. HHS may disclose information from this system of records to another federal, state, or local agency or private employer to whom a Program defaulter has applied for federal grant funds, federal scholarship, loan, or loan repayment funds, or employment involving federal funds, for the purpose of ensuring that the Program defaulter does not receive federal funds for which he/she is ineligible. Disclosure will be limited to the defaulter's name, address, SSN, inclusion on the Do Not Pay List, and any other information necessary to identify him/her.

19. HHS may disclose information from this system of records to the DOJ and applicable state agencies in order to exclude a debtor from all federal health care programs, as defined in 42 U.S.C. 1320a-7b(f), including Medicare and Medicaid, or to conclude a settlement agreement staying such an exclusion.

20. HHS may disclose information from this system of records to other federal, state, and local agencies, and public and private entities that provide scholarship and/or loan repayment funding or include bonus clauses in employment contracts, for the following purposes: (a) To curtail fraud and abuse of federal funds by identifying individuals who have applied for, or accepted, funding from another source for performance of the same service; and (b) to determine if an applicant has an existing service obligation to another federal, state, local, or other entity.

21. HHS may disclose to federal, state, and local agencies, and public and private non-profit entities for research purposes, the name, address(es), SSN, discipline and service sites of applicants and participants in the above-identified Programs when the Department:

a. Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;

b. has determined that a bona fide research/analysis purpose exists;

c. has required the recipient to (1) establish strict limitations concerning the receipt and use of applicant- and participant-identified data; (2) establish reasonable administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent the unauthorized use or disclosure of the record; (3) remove, destroy, or return the information that identifies the applicant or participant at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research nature for retaining such information; and (4) make no further use or disclosure of the record except as authorized by HHS or when required by law; and

d. has secured a written statement attesting to the recipient's understanding of, and willingness to abide by these provisions.

22. Disclosure may be made in response to a subpoena from another federal agency having the power to subpoena other agencies' records, such as the IRS or U.S. Commission on Civil Rights.

23. Disclosure of information from this system of records may be made to the HHS/PSC/Federal Occupational Health contract physicians to review and provide a written opinion of the medical documentation submitted by scholarship and loan repayment Program participants seeking a suspension or waiver of their service or payment obligation.

24. HHS may disclose individually-identifiable records from this system of records, in the form of restricted datasets, to outside researchers for research purposes, when (a) HHS has determined that the use or disclosure does not violate legal or policy requirements, (b) HHS has determined that the research purpose cannot be reasonably accomplished unless the records are provided in individually-identifiable form, and warrants the risk to the privacy of the individuals which additional exposure of the record might bring; (c) HHS has required the recipient to establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the records, and to remove or destroy the identifiable information at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information.

25. Disclosure to the U.S. Department of Homeland Security (DHS) if captured in an intrusion detection system used by HHS and DHS pursuant to a DHS cybersecurity program that monitors internet traffic to and from federal government computer networks to prevent a variety of types of cybersecurity incidents.

26. Records may be disclosed to appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records, (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the federal government, or national security, and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

27. Records may be disclosed to another federal agency or federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the federal government, or national security, resulting from a suspected or confirmed breach.

Note 1: Because, as described in the Purposes section, certain records in this system of records are included in other systems of records used by HHS offices that handle related financial management and debt servicing and collection functions, the SORNs covering those systems of records should be consulted for additional routine use disclosures that may be made without the individual's consent. See HHS Financial Management System Records, System No. 09-90-0024, and Debt Management and Collection System, System No. 09-40-0012.

Note 2: This Note provides notice, as required by 31 U.S.C. 3711(e), that, pursuant to the authorization in 5 U.S.C 552a(b)(12), HHS may disclose information from this system of records, without the subject individuals' consent, to a consumer reporting agency, as defined in 31 U.S.C. 3701(a)(3). Disclosure purposes include:

a. To obtain a commercial credit report to assess the creditworthiness of a scholarship or loan repayment applicant;

b. To verify information provided on the scholarship or loan repayment application concerning whether the applicant has ever defaulted on a federal or non-federal obligation, or had delinquent federal or non-federal debts or judgment liens;

c. To determine and verify the eligibility of loans submitted for repayment;

d. To assess and verify ability of a debtor to repay debts owed to the federal government; and

e. To provide an incentive for debtors to repay federal debts by making these debts part of their credit records.

Pursuant to 31 U.S.C. 3711(e)(1)(F), the information disclosed to the consumer reporting agency is limited to (i) information necessary to establish the identity of the person, including name, address, and taxpayer identification number; (ii) the amount, status, and history of the claim; and (iii) the agency or program under which the claim arose.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are maintained in electronic database servers and backup servers, file folders, and for NHHSP records, a backup hard drive.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by an individual's name, address, SSN, or Applicant/Participant ID number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records are retained and disposed of as follows:

1. Files concerning participants who complete their obligations or whose obligations are waived, cancelled, or terminated are transferred to the Washington National Records Center in Suitland, MD and are destroyed 6 years after final payment, under disposition schedule HSA B-351 3. 1.

2. HRSA has digitized and uploaded paper files concerning active participants in BHW scholarship and loan repayment programs into the BMISS. The paper files are stored at the Washington National Records Center and are destroyed 15 years after closeout, under disposition schedule DAA-0512-2014-0004-0056.

3. Unfunded or withdrawn applicant records are destroyed 6 months after the close of each fiscal year application period, under disposition schedule DAA-0512-2014-0004-0057.

4. Currently, all records migrated to the BMISS information technology (IT) system or created in BMISS are retained indefinitely, pending the National Archives and Records Administration's approval of a revised disposition schedule.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

These safeguards apply to the records at all locations, including at Papa Ola Lokahi (POL), an entity which collaborates with HRSA/BHW in the administration of the NHHSP through a Cooperative Agreement to assist with the implementation of the NHHSP:

a. Administrative Safeguards:

• Authorized Users: Password-protected access is limited to persons authorized and needing to use the electronic records, which includes system managers and their staff, BHW headquarter officials and staff, HRSA Division of Regional Operations staff, financial and fiscal management personnel, Office of the General Counsel personnel, Office of Information Technology personnel, and POL personnel.
• Additional Authorized Users: Password-protected access is also provided to applicants, participants, and service sites for the purpose of inputting data, uploading documents, or submitting queries through BMISS.
• Security controls are audited and reviewed on an ongoing basis, and security awareness training is conducted at least annually.

b. Technical safeguards:

• Encryption, intrusion detection, and firewalls are utilized. Scans are run against the BMISS platform for web and architecture vulnerabilities. Complex or strong passwords are required and must be changed frequently.

c. Physical Safeguards:

• Rooms where records are located are locked when not in use. During regular business hours, rooms are unlocked but are controlled by on-site personnel. Security guards perform random checks on the physical security of the offices (storage locations) after duty hours, including weekends and holidays.
• Servers and other computer equipment used to process identifiable data are located in secured areas which use physical access control devices (e.g., keys, locks, combinations, card readers) and/or security guards to control entries into the facility. All facilities housing HRSA information systems maintain fire suppression and detection devices or systems (e.g., sprinkler systems, handheld fire extinguishers, fixed fire hoses, and or smoke detectors) that can be activated in the event of a fire.

RECORD ACCESS PROCEDURES:

To request access to a record about you, submit a written access request to the Policy-Coordinating Official identified in the “System Manager” section of this SORN, who will refer your request to the appropriate Point of Contact for the program/activity. The request must contain your full name, address, and signature, and should also include the name of the Program(s) in which you participated (or applied but were not selected) and current status (e.g., in training, in deferment, in service, or in default), and Applicant/Participant ID number. To verify your identity, your signature must be notarized or the request must include your written certification that you are the individual who you claim to be and that you understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a fine of up to $5,000. You may request that copies of the records be sent to you, or you may request an appointment to review the records in person (including with a person of your choosing, if you provide written authorization for agency personnel to discuss the records in that person's presence). You may also request an accounting of disclosures that have been made of records about you, if any.

CONTESTING RECORDS PROCEDURES:

To request correction of a record about you in this system of records, submit a written amendment request to the Policy-Coordinating Official identified in the “System Manager” section of this SORN, who will refer your request to the appropriate Point of Contact for the program/activity. The request must contain the same information required for an access request and include verification of your identity in the same manner required for an access request. In addition, the request must reasonably identify the record and specify the information contested, the corrective action sought, and the reasons for requesting the correction; and should include supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

NOTIFICATION PROCEDURES:

To find out if the system of records contains records about you, submit a written notification request to the Policy-Coordinating Official identified in the “System Manager” section of this SORN who will refer your request to the appropriate Point of Contact for the program/activity. The request must contain the same information required for an access request, and must include verification of your identity in the same manner required for an access request.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

80 FR 18631 (Apr. 7, 2015), 83 FR 6591 (Feb. 14, 2018).