09-10-0017 Epidemiological Research Studies of the Center for Devices and Radiological Health, HHS/FDA/CDRH

System name:

Epidemiological Research Studies of the Center for Devices and Radiological Health, HHS/FDA/CDRH.

Security classification:

None.

System location:

Epidemiology Branch (HFZ–541), Division of Postmarket Surveillance, Center for Devices and Radiological Health, 1350 Piccard Drive, Rockville, MD 20850.

Categories of individuals covered by the system:

Persons who have been exposed to radiation (ionizing, nonionizing, sonic) from either medical, occupational or environmental sources; patients with cancer, birth defects, or other diseases or conditions which result from radiation exposure; unexposed persons (e.g., family members) for the purpose of making comparisons.

Categories of records in the system:

ID number, Social Security number which is supplied on a voluntary basis, name, demographic characteristics, radiation exposure, occupational and personal health histories, medical data, and information on or from death certificates, if deceased.

Authority for maintenance of the system:

Public Health Service Act, sections 301, 310, 354, 356, and 357, 42 U.S.C. 241, 242A, 263b, 263c, and 263d. Federal Food, Drug, and Cosmetic Act, section 702(a), 21 U.S.C. 372(a). Reorganization Plan No. 3 of 1970, Section 2.

Purpose(s):

To maintain records used by epidemiologists, statisticians, and authorized staff for epidemiological research and analyses on the effect of radiation exposure.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

A record may be disclosed for a research purpose, when the Department: (a) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained; (b) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring; (c) has required the recipient to— (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, and (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except— (A) in emergency circumstances affecting the health or safety of any individual, (B) for use in another research project, under these same conditions, and with written authorization of the Department, (C) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (D) when required by law; (d) has secured a written statement attesting to the recipient's understanding of, and willingness to abide these provisions.

Records in the system may be made available to Federal, state, and local agencies having an interest in protecting the public from the effects of radiation.

Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.

In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:

Records are stored in file folders, on punch cards and on magnetic tape and discs, computer printouts and on microfiche.

Retrievability:

Records are retrieved by name and study number.

Safeguards:

1. Authorized users: Designated employees of the Center for Devices and Radiological Health.

2. Physical safeguards: Data collection instruments are stored in locked file cabinets, locked rooms, and locked buildings.

3. Procedural (or technical) safeguards: Name listings and log books containing information to permit the identification of an individual and microfilmed records are kept in locked files. Computer password is changed periodically.

4. Implementation guidelines: Safeguards are established in accordance with Chapter 45–13 and PHS hf:45–13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.

Retention and disposal:

One year to permanently, depending on the length of follow-up required to complete all phases of the study. The records are destroyed by shredding, burning, or other appropriate means so as to render them illegible. Computer tapes and discs are erased.

System manager(s) and address:

Chief, Epidemiology Branch (HFZ–116), Division of Biometric Sciences, Center for Devices and Radiological Health, 5600 Fishers Lane, Rockville, MD 20857.

Notification procedure:

An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to:

 

FDA Privacy Act Coordinator (HFI–30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857

Record access procedures:

Same as notification procedure. Requesters should also reasonably specify the record contents being sought. An individual who requests notification of, or access to, a medical record shall at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. You may also request an accounting of disclosures that have been made of your record, if any.

Contesting record procedures:

Contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories:

Individuals in the system of records, employers, health care providers and facilities, administrative and vital statistics agencies.

Systems exempted from certain provisions of the act:

None.