[Federal Register Volume 85, Number 11 (Thursday, January 16, 2020)]
[Notices]
[Pages 2747-2752]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-00633]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
National Institutes of Health
Privacy Act of 1974; System of Records Notice
AGENCY: National Institutes of Health (NIH), Department of Health and
Human Services (HHS).
ACTION: Notice of a modified system of records and rescindment of a
system of records notice.
-----------------------------------------------------------------------
SUMMARY: In accordance with the requirements of the Privacy Act of
1974,
[[Page 2748]]
as amended, the Department of Health and Human Services (HHS) through
the National Institutes of Health (NIH) is modifying system of records
09-90-0067 to reflect that the records are now maintained by NIH, the
Food and Drug Administration (FDA), and the Centers for Disease Control
and Prevention (CDC) and to rename the system of records ``Invention,
Patent, and Licensing Documents Related to Inventions By Public Health
Service Employees, Grantees, Fellowship Recipients, and Contractors.''
In addition, HHS/NIH is rescinding a related NIH system of records, 09-
25-0168.
DATES: The modified system of records is effective February 18, 2020,
with the exception of the new and revised routine uses. The new and
revised routine uses will be effective 30 days after publication of
this notice, unless comments are received that warrant a revision to
this notice. Comments should be submitted within 30 days of
publication, but may be made at any time.
ADDRESSES: You may submit comments, identified by the Privacy Act
system of records number 09-90-0067, by any of the following methods:
Federal eRulemaking Portal: http://regulations.gov. Follow
the instructions for submitting comments.
Email: [email protected] and include the system
of records number, 09-90-0067, in the subject line of the message.
Phone: (301) 402-6201.
Fax: (301) 402-0169.
Mail: NIH Privacy Act Officer, Office of Management
Assessment, National Institutes of Health, 6011 Executive Blvd., Suite
601, MSC 7669, Rockville, MD 20892.
Hand Delivery/Courier: 6011 Executive Blvd., Suite 601,
MSC 7669, Rockville, MD 20892.
Comments received will be available for inspection and copying at
this same address from 9:00 a.m. to 3:00 p.m., Monday through Friday,
federal holidays excepted.
FOR FURTHER INFORMATION CONTACT: General questions about the modified
system of records may be submitted by mail or telephone to: Celeste
Dade-Vinson, NIH Privacy Act Officer, Office of Management Assessment
(OMA), Office of the Director (OD), National Institutes of Health
(NIH), 6011 Executive Blvd., Suite 601, MSC 7669, Rockville, MD 20892,
telephone number (301) 402-6201 (not a toll-free number).
SUPPLEMENTARY INFORMATION:
I. Modifications to System of Records 09-90-0067
This system of records was established in 1979 or earlier (see 44
FR 58144, at 58164) by HHS' Office of General Counsel which managed the
records until approximately 1993, when that responsibility was
transferred to NIH and NIH established related system of records 09-25-
0168 (see 58 FR 45111). Until fiscal year (FY) 2017, NIH managed all
records on behalf of the relevant Public Health Service (PHS)
components (NIH, FDA, and CDC) whose funding, employment, or other
activities give rise to the records. Starting in FY 2017, records
related to an invention arising in FY 2017 or later that is associated
with only one PHS component are managed by that component, and NIH now
manages only the following records for other components: (i) Records
related to inventions that arose prior to FY 2017, and (ii) records
related to joint inventions associated with more than one component.
Consequently, HHS has decided to update the department-level system of
records notice (SORN) 09-90-0067 to cover all three components' records
to avoid the need for multiple component-specific SORNs, and to rescind
NIH SORN 09-25-0168.
The modifications to SORN 09-90-0067 include the following
substantive changes, in addition to formatting changes required by OMB
Circular A-108 and minor wording changes throughout the SORN:
The system name has been changed from ``Invention Reports
Submitted to the Department of Health and Human Services by its
Employees, Grantees, Fellowship Recipients, and Contractors'' to
``Invention, Patent, and Licensing Documents Related to Inventions By
Public Health Service Employees, Grantees, Fellowship Recipients, and
Contractors.''
The ``System Location'' and ``System Manger(s)'' sections
now provide contact information for each relevant PHS component (NIH,
FDA, and CDC) instead of for OGC.
The ``Authorities'' section, which formerly cited only 45
CFR parts 6, 7, and 8 and Executive Orders (E.O.s) 9865 and 10096, no
longer cites 45 CFR parts 6 and 8 but now cites many additional
authorities which were cited in NIH SORN 09-25-0168, plus these
additional authorities which were not cited in that SORN: 42 U.S.C.
secs. 241, 282, and 284; 37 CFR part 401; and 15 U.S.C. 3701-3708.
The ``Categories of Records'' section now identifies more
categories than just invention reports and includes the list of data
elements that was in NIH SORN 09-25-0168, updated to include employing
office or organization name and address, email address, phone, and fax
numbers, status as Fellow or contract employee, educational degree(s),
and citizenship, and to remove Social Security Number (SSN). SSN is
needed only by HHS finance offices, to disburse royalty payments to an
inventor; records used for disbursement and related functions are
covered under another system of records (e.g., 09-90-0024 HHS Financial
Management System Records).
The ``Purposes'' section, which previously stated: ``To
maintain the information and patent records for the entire
Department,'' now includes the four purposes described in NIH SORN 09-
25-0168 (now numbered as 1, 2, 3, and 7) and three additional purposes
(4, 5, and 6).
The ``Record Source Categories'' section now includes
these additional, broadened, or updated categories: Other inventors,
co-inventors, collaborating persons; grantees, fellowship recipients
and contractors; other federal agencies; United States and foreign
patent offices; prospective licensees; PHS technology development
coordinators; internet and commercial databases; and third parties who
PHS contacts to determine individual invention ownership or government
ownership.
The ``Routine Uses'' section has been modified as follows:
[cir] It includes nine new routine uses (1, 4, 5, 6, 7, 8, 10, 11,
and 14; however, closely similar versions of 5 and 10 were in NIH SORN
09-25-0168).
[cir] It includes three revised routine uses:
--Routine use 2: This routine use, which authorizes disclosures to a
congressional office when responding to its inquiries regarding
constituent requests, has been reworded to include the word ``written''
in describing the constituents' requests and the congressional office's
inquiries.
--Routine use 3: Two previously separate litigation-related routine
uses are now combined in routine use 3.
--Routine use 9: Six previously separate routine uses (which were
combined in one routine use in NIH SORN 09-25-0168 but divided in
subparts numbered a. through f.) are now combined in routine use 9 and
divided in subparts numbered a. through f.
[cir] Two breach response-related routine uses which were published
for all HHS systems of records on February 14, 2018 (see 83 FR 6591) as
required by
[[Page 2749]]
OMB Memorandum M-17-12 are now numbered as 12 and 13.
[cir] Five routine uses which were in NIH SORN 09-25-0168 (numbered
as 4, 5, 6, 7, and 10 in that SORN) have not been included in modified
SORN 09-90-0067 because the disclosures they described would be made by
other systems of record or otherwise are no longer needed for this
system of records.
The ``Storage'' section has been updated to include
electronic media and to list types of portable devices that could be
used, with prior HHS approval, to access and store system records.
The ``Safeguards'' section has been updated to list
additional safeguards which are now used to protect records from
unauthorized access (e.g., privacy and security documents and training,
encryption, smart cards, biometrics, firewalls, and intrusion
detection).
The ``Retention'' section, which previously reflected that
records are maintained onsite for the life of the patent (17 years) or
for 7 years if the invention was not patented, and are then stored
offsite at a federal records center (without indicating when they would
be destroyed), now states that, currently, all records are retained in
accordance with a NIH disposition schedule which provides for records
to be retained for a maximum of 30 years, and that, if required,
separate schedules will be developed for the records managed by FDA and
CDC in FY 2017 or later.
The ``Record Access Procedures,'' ``Contesting Record
Procedures,'' and ``Notification Procedures'' sections now provide more
detailed instructions for making a sufficiently specific request and
now also include identity verification requirements.
II. Rescindment of NIH System of Records Notice (SORN) 09-25-0168
As modified, the department-level SORN 09-90-0067 now includes
updated descriptions of the same NIH records that are covered in NIH
SORN 09-25-0168. Accordingly, HHS is rescinding NIH SORN 09-25-0168 as
duplicative of modified SORN 09-90-0067.
Dated: January 9, 2020.
Alfred C. Johnson,
Deputy Director for Management, National Institutes of Health.
SYSTEM NAME AND NUMBER:
Invention, Patent, and Licensing Documents Related to Inventions By
Public Health Service Employees, Grantees, Fellowship Recipients, and
Contractors, 09-90-0067.
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
The address of each agency component responsible for the system of
records is as shown in the System Manager(s) section.
SYSTEM MANAGER(S):
The System Managers are as follows:
For NIH invention records, joint invention records, and
records related to inventions that arose prior to FY 2017: National
Institutes of Health, Director, Office of Technology Transfer, Office
of Intramural Research, Office of the Director, 6011 Executive Blvd.,
Suite 325, Rockville, MD 20892-7660, [email protected], (301) 496-
7057.
For FDA invention records related to inventions that arose
in FY 2017 or later: Food and Drug Administration, Director, FDA
Technology Transfer Program, Office of the Chief Scientist, 10903 New
Hampshire Ave., Silver Spring, MD 20993, [email protected].
For CDC invention records related to inventions that arose
in FY 2017 or later: Centers for Disease Control and Prevention,
Associate Director for Science, Office of Technology and Innovation,
1600 Clifton Rd. NE, M/S D-42, Atlanta GA 30329-4018, [email protected],
(404) 639-1330.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
15 U.S.C. secs. 3701-3710d, National Technology Transfer and
Advancement Act; 35 U.S.C. secs. 200-212, Patent Rights in Inventions
Made with Federal Funding Assistance; 42 U.S.C. secs. 241, 282 and 284,
the Public Health Service Act; Executive Order (E.O.) 9865, Providing
for the Protection Abroad of Inventions Resulting from Research
Financed by the Government; and E.O. 10096, Providing for a Uniform
Patent Policy for the Government with Respect to Inventions made by
Government Employees and for the Administration of Such Policy. See
also 37 CFR parts 401 and 404, and 45 CFR part 7.
PURPOSE(S) OF THE SYSTEM:
The records are maintained and used by HHS for these purposes:
1. To obtain patent protection for inventions reported by Public
Health Service (PHS) employees, inventors, contractors, and non-profit
and educational institutions to which title is owned or co-owned by the
Federal Government.
2. To grant licenses to patents obtained through the invention
reports.
3. To provide royalty payments to the relevant PHS employees,
inventors, contractors, and non-profit and educational institutions.
4. To manage all assets of the technology transfer process (i.e.,
marketing, statistics, technology abstracts).
5. To refer to for information needed during award processing,
querying, and reporting.
6. To share relevant information with other HHS offices that manage
grants, contracts, or personnel associated with the invention,
including any information needed to investigate matters such as
possible law, contract, or grant agreement violations and issues
concerning an individual's or entity's suitability or eligibility for
federal employment, contracts, grants, licenses, or other federal
benefits. Records used by other HHS offices for such purposes, if
retrieved by personal identifier, would be covered under other Systems
of Records Notices (SORNs); see, for example, OPM/GOVT-3 covering
Adverse Action Files, 09-90-0020 covering Suitability for Employment
Records, and 09-90-0100 covering Civil and Administrative Investigative
Files of the Inspector General.
7. To provide documentation needed for related financial management
and debt collection functions, including effecting disbursements of
royalty awards and payments by the Department of the Treasury
(Treasury), coordinating with Treasury to recover any improper payments
or other claims through offsets against federal salary and tax refund
payments, and reporting royalty payments and uncollectible debt amounts
to the Internal Revenue Service (IRS) as income. Records used for
financial management and debt collection purposes are covered under
other HHS System of Records Notices (SORNs); see, e.g., HHS SORN Nos.
09-90-0024 HHS Financial Management System Records and 09-40-0012 Debt
Management and Collection System for descriptions of purposes for which
such records are used within HHS and routine uses for which such
records may be disclosed to the Department of Treasury and other
parties outside HHS.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
The records are about inventors; i.e., any individual involved in
the development of an NIH, FDA, or CDC technology who reported an
invention, applied for a patent, was granted a patent, and/or is
receiving royalties from a patent to which title is owned or co-owned
by the Federal Government or by a grantee, fellowship recipient, or
contractor of the Federal Government. The inventor may be a PHS (or
other
[[Page 2750]]
HHS) employee, extramural grantee, fellowship recipient, independent
contractor, or other outside inventor or co-inventor.
CATEGORIES OF RECORDS IN THE SYSTEM:
The records consist of invention reports, patent prosecution and
licensing documents (such as patent applications and license
agreements) and related documents, containing all information necessary
to be included in such documents, for all individuals who contributed
to the invention. Applicable data elements may include: Inventor name,
job title, employing office or organization name and address, contact
information (mailing and email addresses, phone numbers, and fax
numbers), HHS employee identification number or other unique
identifier, inventor's status as a fellow or contract employee,
educational degree(s), citizenship, title and description of the
invention, Employee Invention Report (EIR) number, license number (if
an agreement provides for royalties to be paid by a third party),
number assigned to submitted invention report, case/serial number,
prior art related to the invention, evaluation of the commercial
potential of the invention, prospective licensees' intended development
of the invention, and royalty payment information.
RECORD SOURCE CATEGORIES:
Sources of information about inventors contained in these records
include the subject individual (i.e., inventor); other inventors, co-
inventors, and collaborating persons; grantees, fellowship recipients
and contractors; other federal agencies; scientific experts from non-
government organizations; contract patent counsel and their employees
and foreign contract personnel; United States and foreign patent
offices; prospective licensees; PHS technology development
coordinators; internet and commercial databases; and third parties who
PHS contacts to determine individual invention ownership or government
ownership.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
In addition to other disclosures authorized directly in the Privacy
Act at 5 U.S.C. 552a(b)(4) through (11), information about an inventor
may be disclosed from this system of records to following parties
outside of HHS without the individual's prior written consent, for
these purposes:
1. HHS may make the inventor's name and other information public,
when making information about the invention public. For example, HHS
makes the inventor's name public in the Federal Register and/or on the
internet when it lists inventions that are available for collaboration
and/or licensing (i.e., to seek parties interested in licensing the
invention or in undertaking collaborative research activities to
further develop, evaluate, or commercialize the invention), and when
publicizing results of agency research activities. Information made
public without the inventor's prior, written consent would be limited
to information that HHS would be required to release to a requester
under the Freedom of Information Act (FOIA); meaning, information that
would not result in a clearly unwarranted invasion of privacy.
2. Disclosure may be made to a congressional office from the record
of an individual in response to a written inquiry from the
congressional office made at the written request of the individual.
3. A record may be disclosed to the Department of Justice (DOJ) or
to a court or other tribunal in litigation or other proceedings when:
(a) HHS, or any component thereof; (b) any HHS employee in his/her
official capacity; (c) any HHS employee in his/her individual capacity
where the DOJ (or HHS, where it is authorized to do so) has agreed to
represent the employee; or (d) the United States Government, is a party
to the proceeding or has a direct and substantial interest in the
proceeding and, by careful review, HHS determines that the records are
both relevant and necessary to the proceeding.
4. Records may be disclosed to authorized federal agencies,
programs, or other entities for purposes of program evaluation and
assessment, including quality assurance or peer review, audit, or
accreditation activities.
5. Information may be disclosed to federal agencies and HHS
contractors, grantees, consultants, or volunteers who have been engaged
by HHS to assist in accomplishment of an HHS function relating to the
purposes of this system of records and need to have access to the
records in order to assist HHS. Any contractor will be required to
comply with the requirements of the Privacy Act of 1974, as amended.
6. Information about an inventor may be included in information
disclosed to an awardee or contractor entity in connection with the
performance, administration, or evaluation of its contract under the
conditions of the particular award or contract.
7. Information about an inventor may be included in contractor past
performance information disclosed to a federal agency upon request.
8. As prescribed in HHS regulations, HHS may disclose system
information to qualified experts not within the definition of HHS
employees in order to obtain their advice about patent, licensing, and
other issues involved in the transfer, among agencies, of scientific
and technical discoveries.
9. HHS may disclose information from this system of records for the
purpose of obtaining patent protection for HHS inventions and licenses
to:
a. Scientific personnel, both in this agency and other government
agencies, and in non-governmental organizations such as universities,
who possess the expertise to understand the invention and evaluate its
importance as a scientific advance;
b. Contract patent counsel and their employees and foreign contract
personnel retained by HHS for patent searching and prosecution in both
the United States and foreign patent offices;
c. All other government agencies whom HHS contacts regarding the
possible use, interest in, or ownership rights in HHS inventions;
d. Prospective licensees or technology finders who may further make
the invention available to the public through sale or use;
e. Parties, such as supervisors of inventors, whom HHS contacts to
determine ownership rights, and those parties contacting HHS to
determine the Federal Government's ownership; and,
f. The United States and foreign patent offices involved in the
filing of HHS patent applications.
10. Disclosure may be made to: (a) Potential clinical trial
participants, consistent with the rules and regulations governing the
HHS human subjects protections program, when informing the participants
of an investigator's financial interests that might be relevant for
their consideration when deciding whether or not to participate in a
trial (i.e., if the financial interests include interests in an
invention); and (b) the general public to reveal summary-level
compensation that government scientists receive, under 15 U.S.C. 3710c,
on licensed inventions generated during their government work.
11. HHS may disclose information to the National Archives and
Records Administration (NARA), General Services Administration (GSA),
or other relevant federal agencies pursuant to records management
inspections conducted under the authority of 44 U.S.C. 2904 and 2906.
12. A record may be disclosed to appropriate agencies, entities,
and
[[Page 2751]]
persons when (1) HHS suspects or has confirmed that there has been a
breach of the system of records; (2) HHS has determined that as a
result of the suspected or confirmed breach there is a risk of harm to
individuals, HHS (including its information systems, programs, and
operations), the Federal Government, or national security; and (3) the
disclosure made to such agencies, entities, and persons is reasonably
necessary to assist in connection with HHS's efforts to respond to the
suspected or confirmed breach or to prevent, minimize, or remedy such
harm.
13. A record may be disclosed to another federal agency or federal
entity, when HHS determines that information from this system of
records is reasonably necessary to assist the recipient agency or
entity in (1) responding to a suspected or confirmed breach or (2)
preventing, minimizing, or remedying the risk of harm to individuals,
the recipient agency or entity (including its information systems,
programs, and operations), the Federal Government, or national
security, resulting from a suspected or confirmed breach.
14. Records may be disclosed to the Department of Homeland Security
(DHS) if captured in an intrusion detection system used by HHS and DHS
pursuant to a DHS cybersecurity program that monitors internet traffic
to and from federal government computer networks to prevent a variety
of types of cybersecurity incidents.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records are stored in electronic media (including, with prior
approval, on approved portable/mobile devices such as laptops, tablets,
PDAs, USB drives, media cards, portable hard drives, Blackberrys,
Smartphones, CDs, DVDs, and/or other mobile storage devices) and in
paper form.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrieved by inventor name or identifying number (for
example, the NIH Enterprise Directory or NED ID number).
POLICIES AND PROCEDURES FOR RETENTION AND DISPOSAL OF RECORDS:
Currently, all records are retained and disposed of in accordance
with NIH records disposition schedule N1-443-10-1 and NIH Manual
Chapter 1743, Keeping and Destroying Records, Appendix 1, item 1100-L,
which provides for records to be kept for a maximum of thirty years. In
the event that separate disposition schedules are required for records
managed by FDA and CDC in FY 2017 or later, HHS will submit disposition
schedules for approval by the National Archives and Records
Administration (NARA) to cover those records.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Measures to prevent unauthorized disclosures are implemented as
appropriate for each location or form of storage and for the types of
records maintained. Safeguards conform to the HHS Information Security
and Privacy Program, https://www.hhs.gov/ocio/securityprivacy/. Site(s)
implement personnel and procedural safeguards such as the following:
Authorized Users: Access is strictly limited to authorized
personnel whose official duties require such access (i.e., valid,
business need to know).
Administrative Safeguards: Controls to ensure proper
protection of information and information technology systems include,
but are not limited to, the completion of a Security Assessment and
Authorization (SA&A) package and a Privacy Impact Assessment (PIA) and
mandatory completion of annual Information Security and Privacy
Awareness training. The SA&A package consists of a Security
Categorization, e-Authentication Risk Assessment, System Security Plan,
evidence of Security Control Testing, Plan of Action and Milestones (if
applicable), Contingency Plan, and evidence of Contingency Plan
Testing. When the design, development, or operation of a system of
records is performed by a contractor to accomplish an agency function,
the applicable Privacy Act Federal Acquisition Regulation (FAR) clauses
are inserted in solicitations and contracts.
Technical Safeguards: Controls that are generally executed
by the computer system and are employed to minimize the possibility of
unauthorized access, use, or dissemination of the data in the system
include, but are not limited to, user identification, password
protection, firewalls, virtual private network, encryption, intrusion
detection system, common access cards, smart cards, biometrics and
public key infrastructure.
Physical Safeguards: Controls to secure the data and
protect paper and electronic records, buildings, and related
infrastructure against threats associated with their physical
environment include, but are not limited to, the use of the HHS
Employee ID and/or badge number and key cards, security guards, cipher
locks, biometrics and closed-circuit TV. Paper records are secured in
locked file cabinets, offices and facilities. Electronic media are kept
on secure servers or computer systems. Records are stored in a
dedicated file room or in locking file cabinets in file folders. During
normal business hours, assigned agency personnel, including Records
Management staff and on-site contractor personnel, regulate
availability of the files. During evening and weekend hours the offices
are locked.
RECORD ACCESS PROCEDURES:
An individual who wishes to access a record about him or her in
this system of records must submit a written request to the relevant
System Manager, reasonably specify the record sought, and include (a)
the inventor's full name and address, (b) the approximate date(s) the
information was submitted, (c) the type(s) of information collected,
and (d) the office(s) or official(s) responsible for the collection of
information. In addition, the requester must verify his or her identity
by providing either a notarization of the request or a written
certification that the requester is who he or she claims to be and
understands that the knowing and willful request of a record pertaining
to an individual under false pretenses is a criminal offense under the
Privacy Act, subject to a fine of up to five thousand dollars.
Individuals may also request an accounting of disclosures that have
been made of any records about them.
CONTESTING RECORD PROCEDURES:
Records that contain factually incorrect information may be
contested. To contest information in a record about you, write to the
relevant System Manager; provide the same information described under
``Record Access Procedures,'' including identity verification
information; and specify the information which is contested, the
corrective action sought, and the reason(s) for requesting the
correction, along with supporting information. The right to contest
records is limited to information which is factually inaccurate,
incomplete, irrelevant, or untimely (obsolete).
NOTIFICATION PROCEDURES:
An individual who wishes to know if this system of records contains
a record about him or her must write to the relevant System Manager and
provide the same information described under ``Record Access
Procedures,'' including identity verification information.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
[[Page 2752]]
HISTORY:
47 FR 45514 (Oct. 13, 1982), 59 FR 55845 (Nov. 9, 1994), 83 FR 6591
(Feb. 14, 2018).
NOTICE OF RESCINDMENT:
The following system of records is rescinded as duplicative of
system 09-90-0067:
SYSTEM NAME AND NUMBER:
Invention, Patent, and Licensing Documents Submitted to the Public
Health Service by its Employees, Grantees, Fellowship Recipients, and
Contractors, 09-25-0168.
HISTORY:
71 FR 46496 (Aug. 14, 2006), 83 FR 6591 (Feb. 14, 2018).
[FR Doc. 2020-00633 Filed 1-15-20; 8:45 am]
BILLING CODE 4140-01-P