Privacy Act of 1974; Altered System of Records, Including Addition of Routine Use(s) to an Existing System of Records

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

[Docket No. 98N-0864]

Privacy Act of 1974; Altered System of Records, Including

Addition of Routine Use(s) to an Existing System of Records

AGENCY: Department of Health and Human Services (HHS).

[[Page 55874]]

ACTION: Notification of an altered system of records, including the

addition of a new routine use.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of

1974 (Privacy Act), the Department of Health and Human Services (HHS)

is publishing notice of a proposal to alter Privacy Act System of

Records 09-10-0010 for the ``Bioresearch Monitoring Information System,

HHS/FDA,'' including the addition of a new routine use. The major

purposes of the proposed alterations are to add the names of the Center

for Food Safety and Applied Nutrition (CFSAN), and the Center for

Veterinary Medicine (CVM), and related information regarding these

Centers, to ensure that the system covers all of the Food and Drug

Administration's (FDA's) Centers; update the relevant statutory and

regulatory citations; and modify the routine uses section of the

existing system notice by removing unnecessary routine uses, revising

other routine uses to bring them in conformance with case law, and

adding a new routine use providing for disclosure of covered records to

sponsors and Institutional Review Boards (IRB's) involved with studies

affected by a clinical investigator's violative or potentially

violative conduct.

DATES: Submit written comments on the proposed alterations, including

the new routine use, by November 18, 1998. HHS sent a Report of Altered

System to the Congress and the Office of Management and Budget (OMB) on

October 19, 1998. The alteration to the system of records will be

effective 40 days from the date submitted to OMB unless HHS receives

comments which would result in a contrary determination.

ADDRESSES: Submit written comments to the Dockets Management Branch

(HFA-305), Food and Drug Administration, 5630 Fishers Lane, rm. 1061,

Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT: Regulatory Counsel (HFC-230), Office

of Regulatory Affairs, Office of Enforcement, Division of Compliance

Policy, Food and Drug Administration, 12720 Twinbrook Pkwy., suite 517,

Rockville, MD 20852, 301-827-0412.

SUPPLEMENTARY INFORMATION: FDA proposes to alter Privacy Act System of

Records 09-10-0010 for the ``Bioresearch Monitoring Information System,

HHS/FDA.'' The major purposes of the proposed alterations are to: (1)

Add the names of CFSAN, and CVM, and related information regarding

these Centers, to ensure that the system covers all of FDA's Centers;

(2) update the relevant statutory and regulatory citations; and (3)

modify the routine uses section of the existing system notice by

removing unnecessary routine uses, revising other routine uses to bring

them in conformance with case law, and adding a new routine use

providing for disclosure of covered records to sponsors and IRB's

involved with studies affected by a clinical investigator's violative

or potentially violative conduct.

The records in this system will be maintained in a secure manner

compatible with their content and use. All records are kept in secured

areas, locked rooms, and locked buildings. Manual and computerized

records will be maintained in accordance with the standards of Chapter

45-13 of the HHS General Administration Manual, ``Safeguarding Records

Contained in Systems of Records,'' supplementary Chapter PHS hf: 45-13

of the Department's General Administration Manual, and the Department's

Automated Information Systems Security Handbook. Data stored in

computers will be accessed through the use of regularly expiring

passwords and individual ID's known only to authorized users.

FDA staff will be required to adhere to the provisions of the

Privacy Act (5 U.S.C. 552a) and the HHS Privacy Act regulations (45 CFR

5b). Only authorized users whose official duties require the use of

such information will have regular access to the records in this

system. Authorized users are FDA employees and contractors responsible

for training the individuals who will inspect the facilities of the

clinical investigators, who compile and analyze the inspectional data

and information, or who, as a part of their official duties, routinely

disclose information under the Freedom of Information Act (FOIA) or

conduct other authorized sharing of FDA records. Users will be required

to sign an agreement indicating their cooperation with FDA systems

security and Privacy Act policies.

The proposed alteration contains a new routine use permitting

disclosure of records in the system to sponsors and IRB's associated

with the clinical investigator's studies. Under the altered system, FDA

may disclose to sponsors and IRB's those records that on their face, or

in conjunction with other records, indicate a violation or potential

violation of the law by clinical investigators that have conducted or

are conducting studies. Disclosure would be made either under a request

from the sponsor or IRB or, in FDA's discretion, without the need for a

request. The purpose of disclosure would be to alert these parties to

inspectional findings indicating violations or potential violations of

the laws enforced by FDA, including the Federal Food, Drug, and

Cosmetic Act (21 U.S.C. 321 et seq.) and its implementing regulations.

Such disclosure is compatible with the purpose of the system because

the sponsors and IRB's play a significant role in ensuring that

clinical investigators meet the applicable statutory and regulatory

requirements. Disclosure also provides the sponsors and IRB's with

information that is important to meeting their responsibilities under

FDA's regulations, including their responsibility to monitor the data

collected under the study.

In some cases, evidence of a violation or potential violation may

implicate more than one of the clinical investigator's studies. Where

more than one clinical study is involved, FDA may, where it deems

appropriate, share information concerning a violation or potential

violation with the sponsors and IRB's of any of the clinical

investigator's studies.

In addition to creating a new routine use, the proposed alteration

will delete as unnecessary two routine uses which provide for

disclosure of records to certain employees of the agency for use in

performance of their duties, thereby duplicating another Privacy Act

exemption, 5 U.S.C. 552a(b)(1). The proposed alteration also will

revise language in the remaining routine uses to bring them in

conformance with recent case law. (See Covert v. Harrington, 876 F.2d

751 (9th Cir. 1989).) Minor editorial revisions also have been made

throughout the system notice to enhance its clarity and specificity,

and to accommodate normal updating changes.

Interested persons may, on or before (insert date 30 days after

date of publication in the Federal Register), submit to the Dockets

Management Branch (address above) written comments regarding the

revised system notice. Two copies of any comments are to be submitted,

except that individuals may submit one copy. Comments are to be

identified with the docket number found in brackets in the heading of

this document. Received comments may be seen in the office above

between 9 a.m. and 4 p.m., Monday through Friday.

The following notice is written in the present, rather than the

future tense, to avoid the unnecessary expenditure of public funds to

republish the notice after the alteration and routine use has become

effective. The revised system notice, including the proposed

alterations, is set forth in full below.

[[Page 55875]]

Dated: October 9, 1998.

William K. Hubbard,

Associate Commissioner for Policy Coordination.

Revised System Notice

09-10-0010

SYSTEM NAME:

Bioresearch Monitoring Information System, HHS/FDA.

SECURITY CLASSIFICATION:

None.

SYSTEM LOCATION:

Center for Biologics Evaluation and Research (CBER), Office of

Compliance and Biologics Quality, Bioresearch Monitoring Team (HFM-

650), 1401 Rockville Pike, Rockville, MD 20852.

Center for Devices and Radiological Health (CDRH), Office of

Compliance, Division of Bioresearch Monitoring (HFZ-310), 2094 Gaither

Rd., Rockville, MD 20850.

Center for Drug Evaluation and Research (CDER), Office of

Compliance, Division of Scientific Investigations (HFD-340), 7520

Standish Pl., Rockville, MD 20855.

Center for Food Safety and Applied Nutrition (CFSAN), Office of

Premarket Approval, Division of Product Policy (HFS-205), 200 C St.

SW., Washington, DC 20204.

Center for Veterinary Medicine (CVM), Office of Surveillance &

Compliance (HFV-234), Division of Compliance, Bioresearch Monitoring

Staff, 7500 Standish Pl., Rockville, MD 20855.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Clinical investigators who are conducting, or have conducted,

clinical studies of new drugs, biologics, and devices under

investigational new drug and biologics, and investigational device

exemption requests; clinical investigators who are conducting, or have

conducted, studies on food or color additives, generally recognized as

safe (GRAS) substances, or infant formula; and clinical investigators

who are conducting, or have conducted, studies on new animal drugs

under investigational new animal drug requests.

CATEGORIES OF RECORDS IN THE SYSTEM:

Automated file is maintained on all clinical investigators;

contains name, education, professional qualifications and background,

Program Oriented Data Systems (PODS) locator code, and information on

studies conducted. Manual file contains, in addition to that same

information, investigatory material collected by, or developed by, the

Food and Drug Administration (FDA), during investigations of possible

violations of statutes and regulations governing new drug, biologic,

food or color additive, GRAS substance, infant formula, new animal

drug, and/or device studies.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Section 505(i)(3), Federal Food, Drug, and Cosmetic Act (21 U.S.C.

355(i)(3)), 21 CFR part 312 (new drugs and biologics for

investigational use); Section 520, Federal Food, Drug, and Cosmetic Act

(21 U.S.C. 360j), 21 CFR part 812 (new devices for investigational

use); Sections 512(j) and (l)(1), Federal Food, Drug, and Cosmetic Act

(21 U.S.C. 360b(j) and (l)(1)), 21 CFR part 511 (new animal drugs for

investigational use); Sections 409 and 721, Federal Food, Drug, and

Cosmetic Act (21 U.S.C. 348 and 379e), 21 CFR part 71 (color additive

petitions), 21 CFR part 171 (food additive petitions); Section 412,

Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350a) (infant formula

requirements); and Section 351, Public Health Service Act (42 U.S.C.

262).

PURPOSE(S):

1. To provide controls to assure that investigators meet

requirements of the relevant statutes and regulations governing new

drug, biologic, food or color additive, GRAS substance, infant formula,

new animal drug, and/or device studies.

2.To serve as a data base for the effective performance of

activities necessary for the conduct of the bioresearch monitoring

program.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES

OF USERS AND THE PURPOSES OF SUCH USES:

1. Records that, on their face or in conjunction with other

records, indicate a violation or potential violation of law, may be:

(1) Referred for investigation and possible enforcement action under

the applicable Federal, State, or foreign laws to the Department of

Justice and other appropriate Federal agencies, an appropriate State

food and drug enforcement agency or licensing authority, or the

government of a foreign country where studies are being or have been

conducted; or (2) disclosed to sponsors or IRB's responsible for

initiating, approving, monitoring, or overseeing any studies affected

by the violation or potential violation, if the information disclosed

is relevant to any enforcement, regulatory, investigative, or

prosecutorial responsibility of the receiving entity.

2. Disclosure may be made to a congressional office from the record

of an individual in response to an inquiry from the congressional

office made at the written request of that individual.

3. The Department of Health and Human Services (HHS) may disclose

information from this system of records to the Department of Justice,

or to a court or other adjudicative body, when:

(a) HHS, or any component thereof; or

(b) Any HHS employee in his or her official capacity; or

(c) Any HHS employee in his or her individual capacity where the

Department of Justice (or HHS, where it is authorized to do so) has

agreed to represent the employee; or

(d) The United States or any agency thereof (where HHS determines

that the litigation is likely to affect HHS or any of its components),

is a party to litigation or has an interest in such litigation, and

HHS determines that the use of such records by the Department of

Justice, the court or other adjudicative body, is relevant and

necessary to the litigation and would help in the effective

representation of the governmental interest, provided, however, that in

each case, HHS determines that such disclosure is compatible with the

purpose for which the records were collected.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING,

AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Manual files of investigatory materials are maintained in letter-

size manila folders and on microfilm. Automated files are maintained on

magnetic disk or tape.

RETRIEVABILITY:

Indexed by name or code number.

SAFEGUARDS:

1.Authorized users: Personnel in CBER's Bioresearch Monitoring Team

and CBER Product Review Offices; Personnel in CDRH's Division of

Bioresearch Monitoring; Personnel in CDER's Division of Scientific

Investigations, Division of Drug Information Resources, Management and

Data Systems Branch; Personnel in CFSAN's Division of Product Policy,

Division of Health Effects Evaluation; and Personnel in CVM's Division

of Compliance, Bioresearch Monitoring Staff.

2.Physical safeguards: Files are stored in secured areas, locked

buildings, locked rooms, locked tape vaults, and lockable data media

cabinets.

3.Procedural (or technical) safeguards: Limited access and computer

password which is changed periodically.

[[Page 55876]]

4.Implementation guidelines: These practices are in compliance with

the standards of chapter 45-13 of the HHS General Administration

Manual, ``Safeguarding Records Contained in Systems of Records,''

supplementary Chapter PHS hf: 45-13, and the Department's Automated

Information System Security Handbook.

RETENTION AND DISPOSAL:

Records are retained and disposed of under the authority of the FDA

Records Control Schedule transmittal number H:90-1, Departmental number

B-331.

SYSTEM MANAGER(s) AND ADDRESS:

Director, Division of Inspections and Surveillance (HFM-650),

Center for Biologics Evaluation and Research, Office of Compliance and

Biologics Quality, 1401 Rockville Pike, Rockville, MD 20852.

Director, Division of Bioresearch Monitoring (HFZ-310), Office of

Compliance, Center for Devices and Radiological Health, 2094 Gaither

Rd., Rockville, MD 20850.

Deputy Director, Division of Scientific Investigation (HFD-341),

Center for Drug Evaluation and Research, Office of Compliance, 7520

Standish Pl., Rockville, MD 20855.

Bioresearch Monitoring Project Manager (HFS-207), Center for Food

Safety and Applied Nutrition, Office of Premarket Approval, Division of

Product Policy, 200 C St. SW., Washington, DC 20204.

Manager, Bioresearch Monitoring Program (HFV-234), Center for

Veterinary Medicine, Division of Compliance, 7500 Standish Pl.,

Rockville, MD 20855.

NOTIFICATION PROCEDURES:

An individual may learn if a record exists about him or her upon

written request with notarized signature or certification of

identification under penalty of perjury if request is made by mail, or

with identification if request is made in person (see also 21 CFR

21.44), directed to:

FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration,

5600 Fishers Lane, Rockville, MD 20857.

RECORD ACCESS PROCEDURES:

Same as notification procedures. Requesters should also reasonably

specify the record contents being sought. Access to record systems

which have been granted an exemption from the Privacy Act access

requirement may be made at the discretion of the system manager. If

access is denied to requested records, an appeal may be made to:

Commissioner, Food and Drug Administration, 5600 Fishers Lane,

Rockville, MD 20857.

You may also request an accounting of disclosures that have been

made of your record, if any.

CONTESTING RECORD PROCEDURES:

Contact the official at the address specified under notification

procedures above and reasonably identify the record, specify the

information being contested, the corrective action sought, and your

reasons for requesting the correction, along with supporting

information to show how the record is inaccurate, incomplete, untimely,

or irrelevant.

RECORD SOURCE CATEGORIES:

Individual on whom the record is maintained. Some material is

obtained from third parties, e.g., drug companies, publications, or is

developed by FDA.

SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT:

This system is exempt from access and contest and certain other

provisions of the Privacy Act (5 U.S.C. 552a(c)(3), (d)(1) to (d)(4),

(e)(3), (e)(4)(G) to (e)(4)(H) and (f)) to the extent that it includes

investigatory material compiled for law enforcement purposes, where

access would be likely to prejudice the conduct of the investigation.

[FR Doc. 98-27937 Filed 10-16-98; 8:45 am]

BILLING CODE 4160-01-F