System of Record Notice 09-15-0044
System name: Health Education Assistance On-Line Processing System (HOPS)
Security classification: None
- Division of Student Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, Room 9-105, Parklawn Building, 5600 Fishers Lane, Rockville, MD 20857.
- Records are also located at contractor sites. A list of contractor sites where individually identifiable data are currently located is available upon request to the System Manager.
- Washington National Records Center, 4205 Suitland Road, Suitland, MD 20409.
Categories of individuals covered by the system: Health Education Assistance Loans.
Categories of records in the system: Contains name, social security number or other identifying number, birth date, demographic background, educational status, loan location and status, and financial information about the individual for whom the record is maintained. Contains lender and school identification.
Authority for maintenance of the system: Sections 701 and 702 of the Public Health Service Act, as amended (42 U.S.C. 292 and 292a), which authorize the establishment of a Federal program of student loan insurance; Section 715 of the Public Health Service Act, as amended (42 U.S.C. 292n), which directs the Secretary to require institutions to provide information for each student who has a loan; Section 709 of the Public Health Service Act, as amended (42 U.S.C. 292h), which authorizes disclosure and publication of HEAL defaulters; and the Debt Collection Improvement Act (31 U.S.C. 3701 and 3711-3720E).
Purpose(s) for Records in this System: The purpose of this system is
- to identify borrowers participating in the HEAL Program;
- to monitor the loan status of HEAL recipients, which includes the collection of overdue debts owed under the HEAL Program; and
- to compile and generate managerial and statistical reports.
Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
- Disclosure may be made to Federal, State, or local agencies, to private parties such as relatives, present and former employers, business and personal associates, educational and financial institutions, and collection agencies. The purpose of such disclosures is to verify the identity of the loan applicant, to determine program eligibility and benefits, to enforce the conditions or terms of the loan, to counsel the borrower in repayment efforts, to investigate possible fraud and abuse, to verify compliance with program regulations, and to locate delinquent borrowers through pre-claims assistance. Information may be disclosed to educational or financial institutions to assist them in loan management.
- Disclosure may be made to a Congressional office from the record of an individual in response to an inquiry from the Congressional office made at the request of that individual.
- The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when: (a) HHS, or any component thereof; or (b) any HHS employee in his or her official capacity; or (c) any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
- In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred to the appropriate agency, whether Federal, State or local, charged with enforcing or implementing the statute or any rule, regulation or order issued pursuant thereto.
- HRSA will disclose from this system of records a delinquent debtor’s name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose, as follows: (a) To another Federal agency so that agency can effect a salary offset for debts owed by Federal employees; if the claim arose under the Social Security Act, the employee must have agreed in writing to the salary offset. (b) To another Federal agency so that agency can affect an authorized administrative offset; i.e., withhold money payable to, or held on behalf of, debtors other than Federal employees. (c) To the Treasury Department, Internal Revenue Service (IRS), to request a debtor’s current mailing address to locate him/her for purposes of either collecting or compromising a debt or to have a commercial credit report prepared.
- Records may be disclosed to the Office of Management and Budget for auditing financial obligations to determine compliance with programmatic, statutory, and regulatory provisions.
- HRSA may disclose information from this system of records to a consumer reporting agency (credit bureau) to obtain a commercial credit report for the following purposes: (a) to establish creditworthiness of a loan applicant; and (b) to assess and verify the ability of a debtor to repay debts owed to the Federal Government. Disclosures are limited to the individual’s name, address, Social Security number and other information necessary to identify him/her; the funding being sought or amount and status of the debt; and the program under which the application or claim is being processed.
- HRSA may disclose to the Internal Revenue Service (IRS), U.S. Department of the Treasury (Treasury Department), information about an individual applying for a loan under any loan program authorized by the Public Health Service Act to find out whether the loan applicant has a delinquent tax account. This disclosure is for the sole purpose of determining the applicant’s creditworthiness and is limited to the individual’s name, address, Social Security number, other information necessary to identify him/her, and the program for which the information is being obtained.
- HRSA will report to the IRS, Treasury Department, as taxable income, the written-off amount of a debt owed by an individual to the Federal Government when a debt becomes partly or wholly uncollectible--either because the time period for collection under the statute of limitations has expired, or because the Government agrees with the individual to forgive or compromise the debt.
- HRSA will disclose to debt collection agents, other Federal agencies, and other third parties who are authorized to collect a Federal debt, information necessary to identify a delinquent debtor. Disclosure will be limited to the debtor’s name, address, Social Security number, and other information necessary to identify him/her; the amount, status, and history of the claim, and the agency or program under which the claim arose.
- HRSA will disclose information from this system of records to any third party that may have information about a delinquent debtor’s current address, such as the U.S. Post Service, a consumer reporting agency (credit bureau), a State motor vehicle administration, a professional organization, an alumni association, etc., for the purpose of obtaining the debtor’s current address. This disclosure will be limited to information necessary to identify the individual (defaulter’s name, latest known City and State of residence, total amount of the HEAL debt).
- Records may be disclosed to Department contractors and subcontractors for the purpose of assisting HEAL program managers in collating, compiling, aggregating, or analyzing records used in administering the HEAL program. Contractors maintain, and are also required to ensure that subcontractors maintain, Privacy Act safeguards with respect to the records.
- HRSA may disclose from this system of records to the IRS, Treasury Department: (a) a delinquent debtor’s name, address, Social Security number, and other necessary information to identify the debtor; (b) the amount of the debt; and (c) the program under which the debt arose, so that the IRS can offset against the debt any income tax refunds which may be due to the debtor.
- HRSA may disclose the complete loan file of defaulted HEAL recipients to potential purchasers of HEAL loans to enable them to value and price the loans, and to actual purchasers to enable them to collect the defaulted loans. The purpose of this disclosure will be to facilitate the sale and collection of defaulted HEAL loans. Potential purchasers are required to maintain Privacy Act safeguards with respect to the records.
- In accordance with the directive in 42 U.S.C. 292h(c) (1), the names of HEAL borrowers who are in default will be published in the Defaulted Borrowers website, http://www.defaulteddocs.dhhs.gov, by city and State along with the amounts of their HEAL debts. The individual’s address also may be published if the address is a matter of public record as a result of legal proceedings having been filed concerning the individual’s HEAL debt.
- In accordance with the directive in 42 U.S.C. 292h(c) (2), disclosure may be made to relevant Federal agencies, schools, school associations, professional and specialty associations, State licensing boards, hospitals with which a HEAL defaulter may be associated, and other similar organizations.
- To appropriate Federal agencies and Department contractors that have a need to know the information for the purpose of assisting the Department’s efforts to respond to a suspected or confirmed breach of the security or confidentiality of information maintained in this system of records, and the information disclosed is relevant and necessary for that assistance.
Disclosure to consumer reporting agencies: Disclosures pursuant to 5 U.S.C. 552a(b) (12), (as set forth in 31 U.S.C. Section 3711(e)) : Disclosures may be made from this system to consumer reporting agencies’’ as defined in the Fair Credit Reporting Act (15 U.S.C. l681a(f)) or the Debt Collection Improvement Act (31 U.S.C. 3701(a) (3)). The purposes of these disclosures are:
- To provide an incentive for debtors to repay delinquent Federal Government debts by making these debts part of their credit records; and
- To enable HRSA to improve the quality of loan and scholarship decisions by taking into account the financial reliability of applicants. Disclosure of records will be limited to the individual’s name, Social Security number (SSN), and other information necessary to establish the identity of the individual, the amount, status, and history of the claim, and the agency or program under which the claim arose.
Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:
- Storage: Records are maintained in database servers, file folders, cd’s, dvd’s and magnetic tapes.
- Retrievability: Social Security Number or other identifying number.
- Authorized users: Access is limited to authorized HEAL personnel and contractors responsible for administering the HEAL program. Authorized personnel include HEAL employees and officials, financial and fiscal management personnel, computer personnel and program managers who have responsibilities for implementing the HEAL program. Read-Only users: Read-only access is given to Servicers, Holders and financial/fiscal management personnel.
- Physical safeguards: Magnetic tapes, disc packs, computer equipment and other forms of personal data are stored in areas where fire and life safety codes are strictly enforced. All documents are protected during lunch hours and non-working hours in locked file cabinets or locked storage areas. Twenty-four hour, seven-day security guards perform random checks on the physical security of the records storage areas.
- Procedural safeguards: A password is required to access the terminal and a data set name controls the release of data to only authorized users. All users of personal information in connection with the performance of their jobs protect information from public view and from unauthorized personnel entering an unsupervised office. In addition, all sensitive data is encrypted using Oracle Transparent Data Encryption functionality. Access to records is strictly limited to those staff members trained in accordance with the Privacy Act and ADP security procedures. Contractors are required to maintain, and are also required to ensure that subcontractors maintain, confidentiality safeguards with respect to these records. Contractors and subcontractors are instructed to make no further disclosure of the records except as authorized by the System Manager and permitted by the Privacy Act. All individuals who have access to these records receive the appropriate ADP security clearances. HEAL personnel make site visits to ADP facilities for the purpose of ensuring that ADP security procedures continue to be met. Privacy Act and ADP system security requirements are specifically included in contracts. The HRSA project directors, project officers, and the System Manager oversee compliance with these requirements.
- Implementing guidelines: The safeguards described above were established in accordance with DHHS Chapter 45-13 and supplementary Chapter PHS.hf: 45-13 of the General Administration Manual; and the www.hhs.gov/ocio/policy#Security website.
Retention and disposal: HRSA is working with the Records Officer and NARA to obtain the appropriate retention value.
System manager(s) and address:
- Chief, Health Education Assistance Loan Program, Division of Student Loans and Scholarships, Bureau of Health Professions, Health Resources and Services Administration, 5600 Fishers Lane, Room 9-105, Rockville, MD 20857.
Notification procedure: To find out if the system contains records about you contact the System Manager.
Requests in person: Written requests for information and/or access to records received by mail must contain information providing the identity of the writer and a reasonable description of the record desired. Written requests must contain the name and address of the requester, his/her date of birth and at least one piece of information which is also contained in the subject record, and his/ her signature for comparison purposes.
Requests by mail: Written requests for information and/or access to records received by mail must contain information providing the identity of the writer and a reasonable description of the record desired. Written requests must contain the name and address of the requester, his/her date of birth and at least one piece of information which is also contained in the subject record, and his/ her signature for comparison purposes.
Requests by telephone: Since positive identification of the caller cannot be established, telephone requests are not honored.
Record access procedures: Same as notification procedures. Requesters should also provide a reasonable description of the record being sought. Requesters may also request an accounting of disclosures that have been made of their records, if any.
Contesting record procedures: Contact the System Manager, provide a reasonable description of the record, specify the information being contested, the corrective action sought, and the reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.
Record source categories: Individual loan recipients, HEAL schools, lenders, and holders of HEAL loans and their agents.
Systems exempted from certain provisions of the act: None