´óÏóAPP

System of Records Notices (SORNs)

The Privacy Act of 1974, () establishes a code of fair information practices that governs the collection, maintenance, use, and dissemination of information about individuals that is maintained in systems of records by Federal agencies. A description of the information to be collected in any system of records must be published in the Federal Register before the data collection begins.

For each system of records, a specified ´óÏóAPPemployee, known as a system manager, is responsible for the business requirements of the data maintained in the system, for answering any questions about viewing the records, and for amending or correcting information contained therein. The ´óÏóAPPsystem manager, along with his or her mailing address, is listed in the Federal Register notice.

on the HHS website.

Privacy Impact Assessments (PIAs)

The , Section 208, establishes the requirement for agencies to conduct PIAs for electronic information systems and collections. The assessment is a method for ´óÏóAPPto evaluate the privacy of information it collects, uses, and maintains within its information systems and applications. The Department of Health and Human Services (HHS) reviews, signs, and posts all ´óÏóAPPPIAs on the HHS PIA webpage in accordance with the requirements of the E-Government Act of 2002, and can be found .

Matching Notices and Agreements

The Computer Matching and Privacy Protection Act of 1988, [PDF, 1.35 MB], amended the Privacy Act of 1974, 5 U.S.C. § 552a, to include provisions governing computer matching activities. In accordance with Privacy Act stipulation 5 U.S.C. § 552a(o), "no record which is contained in a system of records may be disclosed to a recipient agency or non-Federal agency for use in a computer matching program except pursuant to a written agreement between the source agency and the recipient agency or non-Federal agency." Agencies must publish a matching notice or agreement to notify individuals of the use of their information in this manner. Currently, ´óÏóAPPdoes not conduct matching programs.

Exemptions to the Privacy Act

The Privacy Act of 1974 generally grants individuals the right to access ´óÏóAPPrecords maintained about themselves, and the right to request that ´óÏóAPPamend those records if they are not accurate, relevant, timely, or complete. However, the Privacy Act also exempts ´óÏóAPPfrom granting a person access to information about themselves that the agency compiles for certain types of law enforcement or investigatory actions based on 10 specific types of exemptions. The Privacy Act requires ´óÏóAPPto provide citations and links to the final rules published in the Federal Register that promulgate each Privacy Act exemption claimed for their systems of records. ´óÏóAPPhas published exemptions for the following systems of records, as stated in the Federal Register SORN:

•     Medical Expenditure Panel Survey (MEPS) and National Medical Expenditure Survey 2 (NMES 2).

Privacy Act Implementation Rules

The Privacy Act of 1974 requires ´óÏóAPPto implement Privacy Act implementation rules promulgated pursuant to . ´óÏóAPPhas established procedures for individuals to request, access, and address their information found in ´óÏóAPPSORNs, which are documented in the ´óÏóAPPSORNs published in the Federal Register. In addition, ´óÏóAPPSORNs identify and describe the National Archives and Records Administration (NARA) records retention schedules that ´óÏóAPPuses to maintain records. Individuals that have questions about these procedures, or about their information, may also contact the following ´óÏóAPPpoints of contact:

• ´óÏóAPPChief Information Security Officer: Eric Colombel
  • Email: eric.colombel@ahrq.hhs.gov
  • Phone: 301-427-1750
• ´óÏóAPPSenior Official for Privacy: Tim Erny
  • Email: tim.erny@ahrq.hhs.gov.
  • Phone: 301-427-1760
• ´óÏóAPPInformation Security and Privacy Team
  • Email: SecureAHRQ@ahrq.hhs.gov

Publicly Available ´óÏóAPPPolicies on Privacy

The ´óÏóAPPInformation Security and Privacy Program fosters an enterprise-wide secure and trusted environment in support of AHRQ's mission. It was established to help protect the Agency and its data against potential information technology (IT) threats and vulnerabilities and ensures compliance with Federal mandates and legislation that enable ´óÏóAPPto provide mission-critical IT security and privacy services. As an Operating Division (OpDiv) of HHS, ´óÏóAPPis also required to comply with HHS policy and guidance. Below is a list of policies and procedures that ´óÏóAPPfollows in compliance with Federal privacy legislation and guidance.

´óÏóAPPWeb site Privacy Policy

This Web site is maintained as a public service to provide information on health care research and quality from AHRQ, a component of HHS. We collect no personal information about you when you visit this Web site unless you choose to provide that information to ´óÏóAPPvoluntarily. Select for more on the ´óÏóAPPWeb site privacy policy.

Health Information Privacy and Security Tool

is an online tool that helps health care providers and organizations meet Health Insurance Portability and Accountability Act (HIPAA) requirements for protecting patient information in electronic health records. The tool provides practical tips in four areas:

• Preparation.
• Risk analysis and action planning.
• Risk management.
• Meaningful use.

Privacy and Security Toolkit

The to the Health Information Privacy and Security Tool is meant to be a companion document that implements the principles set forth in The Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information (Privacy and Security Framework).

Training and Awareness

Information security and privacy awareness training is mandatory for all ´óÏóAPPFederal employees and contract personnel. Federal guidelines and HHS mandate that all employees must complete information security and privacy training upon initial hiring and annually thereafter. The ´óÏóAPPInformation Security and Privacy Program is responsible for ensuring that all Agency employees and contractors receive annual information security and privacy awareness training and role-based training in compliance with Federal requirements. ´óÏóAPPalso developed an online Information Security and Privacy Awareness Training Module that is available on the Agency Intranet to ´óÏóAPPstaff.

HHS also offers the following role-based training courses, which ´óÏóAPPtransmits on an annual basis to personnel with significant security responsibilities:

For more information on ´óÏóAPPInformation Security and Privacy training, contact the ´óÏóAPPInformation Security and Privacy Team (SecureAHRQ@ahrq.hhs.gov).

Publicly Available ´óÏóAPPReports on Privacy

´óÏóAPPsubmits a required Federal Information Security Management Act (FISMA) report to HHS, which includes privacy performance metrics, on an annual basis. ´óÏóAPPcurrently does not have additional reports on privacy outside of FISMA reporting for publication.

Instructions for Submitting a Privacy Act Request

´óÏóAPPhas established procedures for individuals to request, access, and address their information found in ´óÏóAPPSORNs; these procedures can be found in the ´óÏóAPPSORNs published in Federal Register notices. For each system of records, a specified Agency employee, known as a system manager, is responsible for the business requirements of the data maintained in the system, for answering any questions about seeing the records, and for amending or correcting information contained therein. The system manager, along with his or her mailing address, is also listed in the Federal Register.

Contact Information for Submitting a Privacy Question or Complaint

´óÏóAPPhas established procedures for individuals to request, access, and address their information found in ´óÏóAPPSORNs, and these procedures can be found in the ´óÏóAPPSORNs published in the Federal Register.  For each system of records, a specified Agency employee, known as a system manager, is responsible for the business requirements of the data maintained in the system, for answering any questions about seeing the records, and for amending or correcting information contained therein. The system manager, along with his or her mailing address, is also listed in the Federal Register notice.

Contact Information: Senior Agency Official for Privacy

Individuals that have questions about the information set forth in this Privacy Notice, related procedures, and/or about their information, may also contact the following ´óÏóAPPpoints of contact:

• ´óÏóAPPChief Information Security Officer: Eric Colombel
  • Email: eric.colombel@ahrq.hhs.gov
  • Phone: 301-427-1750
• ´óÏóAPPSenior Official for Privacy: Tim Erny
  • Email: tim.erny@ahrq.hhs.gov.
  • Phone: 301-427-1760
• ´óÏóAPPInformation Security and Privacy Team
  • Email: SecureAHRQ@ahrq.hhs.gov.