System of Record Notice 09-15-0069

System of Record Number: 09-15-0069

System Name: Campus Based Branch (CBB) Program Document Management System (DMS), HHS/HRSA/BHPr.

Security Classification: None.

System Location: The Division of Students Loans and Scholarships of the Bureau of Health Professions (BHPr), Health Resources and Services Administration (HRSA), Department of Health and Human Services (HHS). Records are located at 5600 Fishers Lane, Room 9-105, Rockville, MD 20857.

Categories of individual covered by the system: Student and faculty borrowers who participate/participated in CBB loan and scholarship programs.

Categories of records in the system:
The system includes materials such as:

1. Names, addresses, phone numbers, financial information, and social security numbers of borrowers.
2. Annual Operating Reports that contain financial information from institutions, including aggregate amounts of loans disbursed, collected and retired.
3. Performance reports on the aggregate number of borrowers, their classification in race/ethnicity categories, and whether they are practicing in primary care.
4. Contact information of financial aid officers that include name, title, school address and direct phone number.
5. Correspondence from the financial aid officers regarding issues with specific borrowers. The majority of these correspondences only indicate the borrower's name and/or amount borrowed.
6. Correspondence from borrowers on specific issues on CBB programs or the school that administers the programs. These correspondences may include the borrower's name, address and phone number.
7. Case reports from educational institutions on borrowers whom the school is claiming an uncollectible debt. The documents contained in these case reports may include name, address, financial income information, medical records and social security numbers.
8. Any other correspondence or documentation related to general or specific issues regarding CBB programs at institutions or borrowers who participate in CBB programs.

Authority for maintenance of the system: Section 721 of the Public Health Service Act (42 U.S.C. 292q), Health Professions Student Loan; Section 835 of the Public Health Service Act (42 U.S.C. 297a), Nursing Student Loan; Section 723 of the Public Health Service Act (42 U.S.C. 292s), Primary Care Loan; Section 724 of the Public Health Service Act (42 U.S.C. 292t), Loans for Disadvantaged Students; Section 737 of the Public Health Service Act (42 U.S.C. 293a), Scholarships for Disadvantaged Students.

Purpose(s): The purpose of the DMS system is to support the CBB in monitoring its programs, in order to ensure the efficiency of the factual information in reports and documents, and to archive the documents for efficient access and verification.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses: Records maintained in the system above, disclosure of which is governed by the System of Records Notice for the "Campus Based Branch Program Document Management System, HHS/HRSA/BHPr'' may be disclosed to others:

1. HRSA may disclose records to Department contractors and subcontractors for the purpose of assisting CBB in reviewing cases and maintaining systems, including conducting data analysis for program evaluations, compiling managerial and statistical reports, and record systems processing and refinement. Contractors will maintain, and are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to such records.
2. Disclosure may be made to a Congressional office from the record of an individual or institutional participant, in response to any inquiry from the Congressional office made at the written request of that individual.
3. Disclosure may be made to the Department of Justice, or to a court or other tribunal, from this system of records, when (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof, where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in such case HHS determines that such disclosure is compatible with the purpose for which the records were collected.

• In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute or rule, regulation or order issued pursuant thereto.
• HRSA may disclose from this system of records a delinquent debtor's name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose, to the Treasury Department, Internal Revenue Service (IRS), to request a debtor's current mailing address to locate him/her for purposes of collecting a debt. This address may be disclosed by HRSA to any school from which the defaulted borrower received the student loan, for use only by officers, employees, or agents of the school whose duties relate to the collection of health professions or nursing student loan funds, to locate the defaulted borrower to collect the loan. Any school which requests and obtains this address information must comply with the requirements of HRSA and the IRS regarding the safeguarding and proper handling of this information.
• To appropriate federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

• Storage: Records are maintained in the DMS or in file folders and/or computer data files.
• Retrievability: Retrieval of data and case files is by subject's name or institution ID.
• Safeguards:
• Authorized users: Access is limited to authorized HHS staff and contractors in performance of their duties. Authorized personnel include the contractor/system manager and his staff who have responsibilities for administering the programs. HRSA maintains current lists of authorized users. Institutions do not have remote access to this system.
• Physical safeguards: The DMS is housed on a HRSA server behind a firewall. The DMS is an intra-office system only for the sole use of CBB staff. All computer equipment and files and hard copy files are stored in areas where fire and life safety codes are strictly enforced. All automated and non-automated documents are protected on a 24-hour basis. Perimeter security includes intrusion alarms, on-site guard force, random guard patrol, key/passcard/combination controls, and receptionist controlled area. Hard copy files are maintained in a file room used solely for this purpose with access limited by combination lock to authorized users identified above. Computer files are password protected and are accessible only by use of computers which are password protected.
• Procedural safeguards: A password is required to access computer files. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised area. All passwords, keys and/or combinations are changed when a person leaves or no longer has authorized duties. Access to records is limited to those authorized personnel trained in accordance with the Privacy Act and ADP security procedures. The safeguards described above were established in accordance with DHHS chapter 45-13 and supplementary chapter PHS hf: 45-13 of the General Administration Manual; and the DHHS Information
  Resources Management Manual, Part 6, "ADP Systems Security.''

Retention and disposal: HRSA is working with the Records Officer and NARA to obtain the appropriate retention value.

System manager(s) and address: Director, Division of Students Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, Department of Health and Human Services, 5600 Fishers Lane, Room 9-105, Rockville, Maryland 20857.

Notification procedure: Requests concerning whether the system contains records about you should be made to the Systems Manager. When requesting notification of or access to records covered by this Notice, an individual must provide his/her full name, date of birth, and other proof of identity as required for Privacy Requests.

• Request in person: A subject individual who appears in person at a specific location seeking access or disclosure of records relating to him/her shall provide his/her name, current address, and at least one piece of tangible identification such as driver's license, passport, voter registration card, or union card. Identification papers with current photographs are preferred but not required. Additional identification may be requested when there is a request for access to records which contain an apparent discrepancy between information contained in the records and that provided by the individual requesting access to the records. Where the subject individual has no identification papers, the responsible agency official shall require that the subject individual certify in writing that he/she is the individual who he/she claims to be and that he/she understands that the knowing and willful request or acquisition of a record concerning an individual under false pretenses is a criminal offense subject to a $5,000 fine.
• Requests by telephone: Because positive identification of the caller cannot be established, no requests by telephone will be honored.
• Requests by mail: A written request must contain the name and address of the requester, and his/her signature which is either notarized to verify his/her identify or includes a written certification that the requester is a person he/ she claims to be and that he/she understands that the knowing and willful request or acquisition of records pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine.

Contesting record procedures: Any record subject may contest the accuracy of information on file at CBB by writing to the Director, Division of Students Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, Department of Health and Human Services, 5600 Fishers Lane, Room 9-105, Rockville, Maryland 20857. The request should contain a reasonable description of the record, specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant.

Record source categories:

1. Educational institutions participating in CBB programs
2. Financial aid officers administering CBB programs
3. Student borrowers and recipients participating in CBB programs
4. Borrowers submitted for uncollectible debt write-offs

Systems exempted from certain provisions of the act: None.