(a) General policy. The Act permits certain types of specific systems of records to be exempt from some of its requirements. It is the policy of the Department to exercise authority to exempt systems of records only in compelling cases.

(b) Specific systems of records exempted.

(1) Those systems of records listed in paragraph (b)(2) of this section are exempt from the following provisions of the Act and this part:

(i) 5 U.S.C. 552a(c)(3) and paragraph (c)(2) of §5b.9 of this part which require a subject individual to be granted access to an accounting of disclosures of a record.

(ii) 5 U.S.C. 552a(d) (1) through (4) and (f) and §§5b.6, 5b.7, and 5b.8 of this part relating to notification of or access to records and correction or amendment of records.

(iii) 5 U.S.C. 552a(e)(4) (G) and (H) which require inclusion of information about Department procedures for notification, access, and correction or amendment of records in the notice for the systems of records.

(iv) 5 U.S.C. 552(e)(3) and paragraph (a)(3) of §5b.4 of this part which require that an individual asked to provide a record to the Department be informed of the authority for providing the record (including whether the providing of the record is mandatory or voluntary, the principal purposes for maintaining the record, the routine uses for the record, and what effect his refusal to provide the record may have on him), and if the record is not required by statute or Executive Order to be provided by the individual, he agrees to provide the record. This exemption applies only to an investigatory record compiled by the Department for criminal law enforcement purposes in a system of records exempt under subsection (j)(2) of the Act to the extent that these requirements would prejudice the conduct of the investigation.

(2) The following systems of records are exempt from those provisions of the Act and this part listed in paragraph (b) (1) of this section.

(i) Pursuant to subsection (j)(2) of the Act:

(A) The Saint Elizabeths Hospital's Court-Ordered Forensic Investigatory Materials Files; and

(B) The Investigatory Material Compiled for Law Enforcement Purposes System, HHS.

(ii) Pursuant to subsection (k)(2) of the Act:

(A) The General Criminal Investigation Files, HHS/SSA;

(B) The Criminal Investigations File, HHS/SSA; and,

(C) The Program Integrity Case Files, HHS/SSA.

(D) Civil and Administrative Investigative Files of the Inspector General, HHS/OS/OIG.

(E) Complaint Files and Log. HHS/OS/OCR.

(F) Investigative materials compiled for law enforcement purposes for the Healthcare Integrity and Protection Data Bank (HIPDB), of the Office of Inspector General. (See §61.15 of this title for access and correction rights under the HIPDB by subjects of the Data Bank.)

(G) Investigative materials compiled for law enforcement purposes for the Program Information Management System, HHS/OS/OCR.

(H) Investigative materials compiled for law enforcement purposes from the CMS Fraud Investigation Database (FID), HHS/CMS.

(I) Investigative materials compiled for law enforcement purposes from the Automated Survey Processing Environment (ASPEN) Complaints/ Incidents Tracking System (ACTS), HHS/CMS.

(J) Investigative materials compiled for law enforcement purposes from the Health Insurance Portability and Accountability Act (HIPAA) Information Tracking System (HITS), HHS/CMS.

(K) Investigative materials compiled for law enforcement purposes from the Organ Procurement Organizations System (OPOS), HHS/CMS.

(L) Investigative materials compiled for law enforcement purposes for the National Practitioner Data Bank (NPDB). (See §60.21 of this subchapter for access and correction rights under the NPDB by subjects of the Data Bank.)

(iii) Pursuant to subsection (k)(4) of the Act:

(A) The Health and Demographic Surveys Conduct in Random Samples of the U.S. Population;

(B) The Health Manpower Inventories and Surveys;

(C) The Vital Statistics for Births, Deaths, Fetal Deaths, Marriages and Divorces Occurring in the U.S. during Each Year; and,

(D) The Maryland Psychiatric Case Register.

(E) The Health Resources Utilization Statistics, DHHS/OASH/NCHS.

(F) National Medical Expenditure Survey Records. HHS/OASH/NCHSR.

(iv) Pursuant to subsection (k)(5) of the Act:

(A) The Investigatory Material Compiled for Security and Suitability Purposes System, HHS;

(B) The Suitability for Employment Records, HHS; and

(C) NIH Electronic Research Administration (eRA) Records, HHS/NIH/OD/OER, 09-25-0225.

(v) Pursuant to subsections (j)(2), (k)(2), and (k)(5) of the Act:

(A) The Clinical Investigatory Records, HHS/FDA;

(B) The Regulated Industry Employee Enforcement Records, HHS/FDA;

(C) The Employee Conduct Investigative Records, HHS/FDA; and,

(D) The Service Contractor Employee Investigative Records, HHS/FDA.

(vi) Pursuant to subsection (k)(6) of the Act:

(A) The Personnel Research and Merit Promotion Test Records, HHS/SSA/OMA.

(vii) Pursuant to subsections (k)(2) and (k)(5) of the Act:

(A) Public Health Service Records Related to Investigations of Scientific Misconduct, HHS/OASH/ORI.

(B) Administration: Investigative Records, HHS/NIH/OM/OA/OMA.

(C) FDA Records Related to Research Misconduct Proceedings, HHS/FDA/OC, 09-10-0020.

(D) NIH Records Related to Research Misconduct Proceedings, HHS/NIH, 09-25-0223.

(viii)

(A) HHS Insider Threat Program Records, 09-90-1701.

(B) [Reserved]

(c) Notification of or access to records in exempt systems of records.

(1) Where a system of records is exempt as provided in paragraph (b) of this section, any individual may nonetheless request notification of or access to a record in that system. An individual shall make requests for notification of or access to a record in an exempt system of records in accordance with the procedures of §§5b.5 and 5b.6 of this part.

(2) An individual will be granted notification of or access to a record in an exempt system but only to the extent such notification or access would not reveal the identity of a source who furnished the record to the Department under an express promise, and prior to September 27, 1975 an implied promise, that his identity would be held in confidence, if:

(i) The record is in a system of records which is exempt under subsection (k)(2) of the Act and the individual has been, as a result of the maintenance of the record, denied a right, privilege, or benefit to which he would otherwise be eligible; or,

(ii) The record is in a system of records which is exempt under subsection (k)(5) of the Act.

(3) If an individual is not granted notification of or access to a record in a system of records exempt under subsections (k) (2) and (5) of the Act in accordance with this paragraph, he will be informed that the identity of a confidential source would be revealed if notification of or access to the record were granted to him.

(d) Discretionary actions by the responsible Department official. Unless disclosure of a record to the general public is otherwise prohibited by law, the responsible Department official may in his discretion grant notification of or access to a record in a system of records which is exempt under paragraph (b) of this section. Discretionary notification of or access to a record in accordance with this paragraph will not be a precedent for discretionary notification of or access to a similar or related record and will not obligate the responsible Department official to exercise his discretion to grant notification of or access to any other record in a system of records which is exempt under paragraph (b) of this section.

[40 FR 47409, Oct. 8, 1975, as amended at 43 FR 40229, Sept. 11, 1978; 47 FR 57040, Dec. 22, 1982; 49 FR 14108, Apr. 10, 1984; 51 FR 41352, Nov. 14, 1986; 59 FR 36717, July 19, 1994; 65 FR 34988, June 1, 2000; 65 FR 37289, June 14, 2000; 68 FR 62751, Nov. 6, 2003; 73 FR 55775, Sept. 26, 2008; 76 FR 72327, Nov. 23, 2011; 78 FR 39186, 39188, July 1, 2013; 78 FR 47211, Aug. 5, 2013; 83 FR 14185, Apr. 3, 2018; 84 FR 14624, Apr. 11, 2019]