View Rule

This rulemaking will update the Department’s Privacy Act regulations at 45 CFR part 5b, which detail how the Department implements requirements of the Privacy Act of 1974, as amended (5 U.S.C. 552a), and will remove duplicative Food and Drug Administration (FDA) Privacy Act regulations at 21 CFR part 21.

Statement of Need:

The Department’s existing regulations were promulgated in 1975, when the Privacy Act was new. Certain details are now outdated, incomplete, or incorrect due to later amendments to the Privacy Act, statutorily mandated organizational changes, and judicial interpretations. The proposed amendment would result in significant changes and improvements to the Department’s regulations (for example, it would remove antiquated provisions that require an individual’s medical records to be released to the individual indirectly, through a doctor or other representative designated by the individual), and it would enable the separate FDA Privacy Act regulations to be removed as duplicative.

Summary of the Legal Basis:

The Privacy Act statute at 5 U.S.C. 552a(f) requires each agency to maintain up-to-date rules implementing the Privacy Act. Based on the definition of agency in the Freedom of Information Act (FOIA) statute at 5 U.S.C. 552(f)(1) (formerly 5 U.S.C. 552(e)), which is incorporated in the Privacy Act statute at 5 U.S.C. 552a(a)(1), such rules must be maintained at the Departmental level but are not required at the sub-agency level. 

Alternatives:

Leaving the regulations in their current state is not recommended, because certain details in the regulations are outdated, incomplete, or incorrect, and some required provisions are missing. For example, court cases have identified legal deficiencies in indirect-access-to-medical records provisions like those in the Department’s regulations, effectively rendering those provisions unenforceable in their current state.

Anticipated Costs and Benefits:

The proposed rule is not significant for purposes of E.O. 12866. Privacy Act regulations do not apply to businesses or other entities and do not impose significant costs and burdens on individuals

Risks:

The only risk that we perceive is associated with eliminating the indirect-access-to-medical-records provisions, i.e., that harm to the individual or another person could result from allowing subject individuals to receive direct access to their medical records under the Privacy Act. However, that same risk is present now, because the indirect access provisions are effectively unenforceable in their current state, and the risk would be present if the provisions were retained with curative provisions added, as the curative provisions would guarantee the full disclosure to the individual of any medical record the agency released to the individual’s designated representative.