System of Record Notice 09-15-0007

System number:  09-15-0007

System name:  Patients Medical Record System Public Health Service Hospitals, HHS/HRSA/BPHC.

Security classification:  None.

System location:  See Appendices 1 and 2.  A list of sites where individually identifiable data is currently located is available upon request to the System Manager.

Appendix 1

A. Public Health Service Facilities:  Director, Public Health Service Health Data Center, 1770 Physicians Park Drive, Baton Rouge, Louisiana, 70816.

B. Successor Organizations:  Director, Johns Hopkins Medical Service, 3100 Wyman Park Drive, Baltimore, Maryland, 21211.  Administrator, Lutheran Medical Center, 2609 Franklin Boulevard, Cleveland, Ohio, 44114.  Administrator, Martins Point Health Center, 331 Veranda Street, Portland, Maine, 04103.  Director, Pacific Medical Center, 1200 12th Avenue South, Seattle, Washington, 98144.

Appendix 2

Federal Records Centers

• Area served:  Buffalo, New York OutPatient Clinic, San Juan, and Staten Island.  Central Plains Federal Records Center, 200 Space Center Drive, Lee’s Summit, Missouri, 64064-1182.
• Area served:  Chicago and Detroit.  Federal Records Center, 7358 S. Pulaski Road, Chicago, Illinois, 60629-5898.
• Area served:  Cincinnati and Detroit.  Federal Records Center, 3150 Springboro Road, Dayton, Ohio, 45439-1883.
• Area served:  Atlanta, Charleston, Jacksonville, Memphis, Miami, Mobile, Savannah and Tampa.  Federal Records Center, 4712 Southpark Boulevard, Ellenwood, Georgia, 30294.
• Area served:  090 section of Houston, New Orleans, Galveston and Nassau Bay.  Federal Records Center, P.O. Box 6216, Fort Worth, Texas, 76115.
• Area served:  512 section of Houston, New Orleans, Galveston/Nassau Bay.  Federal Records Center, 17501 W. 98th Street, Suite 47-48, Lenexa, Kansas, 66219.
• Area served:  San Diego and San Pedro.  Federal Records Center, P.O. Box 6719, 23123 Cajalco Road, Perris, California, 92570-7298.
• Area served:  Philadelphia and Pittsburg.  Federal Records Center, 14700 Townsend Road, Philadelphia, Pennsylvania, 19154-1096.
• Area served:  San Francisco and Honolulu.  Federal Records Center, 1000 Commodore Drive, San Bruno, California, 94066-2350.
• Area served:  Honolulu and Portland, Oregon.  Federal Records Center, 6125 Sand Point Way, NE, Seattle, Washington, 98115-7999.
• Area served:  Buffalo, DC, Norfolk, Port Arthur, St. Louis Space Park Memorial, Seattle, New Orleans, Tampa, San Francisco, Galveston, Seattle and Maryland.  Washington National Records Center, 4205 Suitland Road, Suitland, Maryland, 20746.
• Area served:  Boston, Maine, Massachusetts, Kentucky and Indiana.  Federal Records Center, 380 Trapelo Road, Waltham, Massachusetts, 02154-6399.
• Area served:  Individuals with Hansen’s disease, examined and/or treated at the National Hansen’s Disease Program (formerly Public Health Service Hospital), National Hansen’s Disease Programs, 1770 Physician’s Park Drive, Baton Rouge, Louisiana, 70816.

Categories of individuals covered by the system:  Uniformed and non-uniformed individuals treated as inpatients in Public Health Service Hospitals. 

Categories of records in the system:  Medical examination, diagnostic and treatment data; information for proof of eligibility; social data such as address and birth date; disease registers, such as Hansen’s disease and tumor and surgical procedure registers; treatment logs, medical summaries and correspondence (for example, family to doctor, doctor to doctor, doctor to clinic).

Authority for maintenance of the system:  Section 320 of the Public Health Service Act, as amended (42 USC 247e), the National Hansen’s Disease Program; and section 326 of the Public Health Service Act, as amended (42 USC 253), Medical Services to Coast Guard, National Oceanic and Atmospheric Administration, and Public Health Service.

Purpose(s):  The purposes of this system are:

• To serve as a basis for planning patient care and for continuity in the evaluation of the patient’s condition and treatment to furnish documentary evidence of the course of the patient’s medical evaluation, treatment and change in condition during the hospital stay, ambulatory care or emergency visit, or while being followed in a facility-based home care program;
• To document communications between the responsible practitioner and any other health professional’s contribution to the patient’s care and treatment in order to assist in protecting the legal interests of the patient, the hospital or clinic, and responsible practitioners;
• To provide data for use in facility management, continuing education, Department initiatives, quality assurance activities and research at the National Hansen’s Disease Program, Baton Rouge, Louisiana.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:  

• Disclosure may be made to:
  • Any community health organization, government agency, private physician and/or company which has requested or arranged for an examination, treatment or care of an individual.
  • Army, Navy, Air Force to report results of examination or treatment of their uniformed service personnel.
  • Department of Transportation to report results of examination/treatment of their uniformed services personnel found to be suffering from conditions that render them hazardous to themselves or to others.
• Department of Commerce to report results of examination/ treatment of uniformed services and other personnel of that agency.
• Immigration and Customs Enforcements (ICE) to report results of examination/treatment of aliens examined and treated for and in behalf of that agency.
• U.S. Department of Labor, Office of Workers’ Compensation Programs for persons claiming compensation benefits due to personal injury while employed by the Government.
• Organizations such as Joint Commission on Accreditation of Hospitals for accreditation of hospitals and clinics, and American Medical Association for accreditation of resident training programs.  Medical records are used to document quality of service by health care providers.
• Health professions students serving an affiliation at the institution and their parent education program; students provide patient care and use medical records in performance of their duties.
• Non-agency physicians providing continuing care to current and former Public Health Service Beneficiaries, laboratories performing tests for the continuing care of these patients, and successor organizations providing health care in former Public Health Service hospitals and clinics.
• Veterans Administration to assist uniformed service personnel, retirees and veterans to obtain medical care or benefits.
• Disclosure may be made to a congressional office from the record of an individual in response to a verified inquiry from the congressional office made at the written request of that individual.
• A record may be disclosed for a research purpose, when the Department:  (a) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (b) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (c) has required the recipient to--(l) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, and (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except--(A) in emergency circumstances affecting the health or safety of any individual, (B) for use in another research project, under these same conditions, and with written authorization of the Department, (C) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (D) when required by law; (d) has secured a written statement attesting to the recipient’s understanding of, and willingness to abide by these provisions.
• Organizations deemed qualified by the Secretary to carry out quality assessment, medical audits or utilization review.
• Information regarding the commission of crimes or the reporting or occurrence of communicable diseases, tumors, child abuse, births, deaths, alcohol or drug abuse, etc. as may be required by health providers and facilities, by state law, or regulation of the department of health or other agency of the state or its subdivision in which the facility is located.  Disclosure may be made to organizations as specified by the state law or regulation such as birth and deaths to vital statistics agencies and crimes to law enforcement agencies.  Disclosure of the contents of records which pertain to patient identity, diagnosis, prognosis or treatment of alcohol or drug abuse is restricted under the provisions of the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations 42 CFR part 2 as authorized by 21 U.S.C. 1175 and 42 U.S.C. 4582, as amended by Pub. L. 93-283.  To the extent possible, identical restrictions are applied to the disclosure of the contents of records pertaining to individuals with other programs who are participating in employee counseling programs.
• In the event of litigation where the defendant is
  • The Department, any component of the Department, or any employee of the Department in his or her official capacity;
  • The United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or
  • Any Department employee in his or her individual capacity
    where the Justice Department has agreed to represent such employee, for example in defending a claim against the Public Health Service based upon an individual’s mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual. Disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.
• To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

• Storage:  File folders, magnetic tape, disk or laser optical media, punch cards, and microfilm.
• Retrievability:  Indexed by name, register number, number control register, disease and operation, and uniformed services service number (which is the Social Security number (SSN)). Those records indexed by SSN are retrieved in accordance with section 7(a)(2)(B) of the Privacy Act.
• Safeguards:
  1. Authorized Users:  Health care practitioners, and other allied health personnel, medical and allied health students and administrative personnel for determination of eligibility for care and facility management; qualified research personnel with approved protocol; Public Health Service Commissioned Personnel Operations Division; and Public Health Service Claims Officer.
  2. Physical Safeguards:  Magnetic tapes, discs, other computer equipment and other forms of personal data are stored in areas where fire and life safety codes are strictly enforced.  All documents are protected during lunch hours and nonworking hours in locked file cabinets in double-locked storage areas.
  3. Procedural Safeguards:  A password is required to access the terminal and a data set name controls the release of data only to authorized users.  All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office.  Access to records is strictly limited to those staff members trained in accordance with Privacy Act safeguards.  The contractor is required to maintain confidentiality safeguards with respect to these records.  These safeguards are in accordance with DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual, and Part 6 of the DHHS Information Resources Management Manual.  The Memorandums of Agreement between the successor organizations and the Public Health Service require the successor organizations to comply with the Privacy Act.  Public Health Service and HHS guidelines have been provided to each successor organization.

Retention and disposal:

1. Former Public Health Service Hospitals/Clinics:  Destroyed 50 years after date of last treatment, inactive medical records for active duty uniformed service personnel and non-uniformed service personnel.
2. National Hansen’s Disease Program:  Retained at facility-not transferred to a Federal Records Center.  Destroyed, as appropriate, after 50 years, or when no longer needed for research purposes, as determined by the project leader or principal investigator.

System manager(s) and address:
Director, Public Health Service Health Data Center, National Hansen’s Disease Program, 1770 Physician’s Park Drive, Baton Rouge, Louisiana, 70816.

Notification procedure:  To determine the existence of a record, write to:
Public Health Service Health Data Center
National Hansen’s Disease Program
1770 Physician’s Park Drive
Baton Rouge, Louisiana 70816

If requesting records by mail, a written certification verifying identity must be provided. If appearing in person at the National Hansen’s Disease Program, Baton Rouge, Louisiana, positive identification such as a driver’s license, passport, or voter’s registration card must be provided.  An individual who requests access to a medical/dental record shall designate in writing, at the time the request is made, a responsible representative who will be willing to review the record and inform the subject individual of its contents.  Finally, a parent or guardian who requests notification of access to a child’s/incompetent person’s record shall designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent.  The parent or guardian must verify relationship to the child/incompetent person as well as his/her own identity.

Record access procedures:  Same as notification procedures.  Requesters should also reasonably specify the record contents being sought.

Contesting record procedures:  Contact the official at the address specified in the notification procedures above, and reasonably identify the record, specify the information to be contested, and state the corrective action sought, with supporting justification.

Record source categories:  Individual, health care personnel, other hospitals and physicians, employers, social agencies, maritime unions,  shipping companies.

Systems exempted from certain provisions of the act:  None.