SUPPLEMENTARY INFORMATION:

Comments: Comments regarding (a) whether the collection of information is necessary for the proper performance of the functions of SAMHSA, including whether the information will have practical utility; (b) the accuracy of SAMHSA's estimate of the burden of the proposed collection of information; (c) ways to enhance the quality, use, and clarity of the information to be collected, including through the use of automated collection techniques or other forms of information technology; (d) ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated or other forms of information technology.

Proposed Information Collection: Data Security Requirements for Accessing Confidential Data (OMB Control Number: 0930-0396)—Extension

Title III of the Foundations for Evidence-Based Policymaking Act of 2018 (44 U.S.C. 3583) mandates that the Director of OMB establish a standard application process (SAP) for requesting access to certain confidential data assets. The Center for Behavioral Health Statistics and Quality (CBHSQ) is a federally recognized statistical unit and the adoption of the SAP is required for statistical agencies/units designated under the Confidential Information Protection and Statistical Efficiency Act of 2018 (CIPSEA). The SAP Portal is a single web-based common application designed to collect information from individuals requesting access to confidential data assets from federal statistical agencies/units.

The SAP allows agencies, the Congressional Budget Office, State, local, and Tribal governments, researchers, and other individuals, as appropriate, to apply to access confidential data assets held by a federal statistical agency or unit for the purposes of developing evidence. With the Interagency Council on Statistical Policy (ICSP) as advisors, the entities upon whom this requirement is levied are working with the SAP Project Management Office (PMO) and with OMB to implement the SAP.

The SAP Portal is a single web-based common application designed to collect information from individuals requesting access to confidential data assets from federal statistical agencies and units. When an application for confidential data is approved through the SAP Portal, SAMHSA will collect information to fulfill its data security requirements. This is a required step before providing the individual with access to restricted use microdata for the purpose of evidence building. SAMHSA's data security agreements and other paperwork, along with the corresponding security protocols, allow SAMHSA to maintain careful controls on confidentiality and privacy, as required by law. SAMHSA's collection of data security information will occur outside of the SAP Portal.

The following bullets outline the major components and processes in and around the SAP Portal, leading up to SAMHSA's collection of security requirements.

• SAP Policy: At the recommendation of the ICSP, the SAP Policy establishes the SAP to be implemented by statistical agencies and units and incorporates directives from the Evidence Act. The SAP Policy may be found in OMB Memorandum 23-04.
• The SAP Portal: The SAP Portal is an application interface connecting applicants seeking data with a catalog of metadata for data assets owned by the federal statistical agencies and units. The SAP Portal is not a new data repository or warehouse; confidential data assets will continue to be stored in secure data access facilities owned and hosted by the federal statistical agencies and units. The Portal provides a streamlined application process across agencies, reducing redundancies in the application process.
• Data Discovery: Individuals begin the process of accessing restricted use data by discovering confidential data assets through the SAP metadata catalog, maintained by federal statistical agencies at sap.nsf.gov/​.
• SAP Portal Application Process: Individuals who have identified and wish to access confidential data assets apply through the SAP Portal. Applicants must create an account and follow all steps to complete the application. Applicants enter personal, contact, and institutional information for the research team and provide summary information about their proposed project.
• Submission for Review: Agencies approve or reject an application within ( printed page 52313) a prompt timeframe. Agencies may also request applicants to revise and resubmit their application.
• Access to Confidential Data: Approved applicants are notified through the SAP Portal that their proposal has been accepted. This concludes the SAP Portal process. Agencies will contact approved applicants to initiate completion of their security documents. The completion and submission of the agency's security requirements will take place outside of the SAP Portal.
• Collection of Information for Data Security Requirements: In the instance of a positive determination for an application requesting access to a SAMHSA-owned confidential data asset, SAMHSA will contact the applicant(s) to initiate the process of collecting information to fulfill its data security requirements. This process allows SAMHSA to place the applicant(s) in a trusted access category.

The estimated response burden is as follows:

The amount of time to complete the agreements and other paperwork that comprise SAMHSA's security requirements will vary based on the confidential data assets requested. To obtain access to SAMHSA confidential data assets, it is estimated that the average time to complete and submit SAMHSA's data security agreements and other paperwork is 40 minutes. This estimate does not include the time needed to complete and apply within the SAP Portal. All efforts related to SAP Portal applications occur prior to and separate from SAMHSA's effort to collect information related to data security requirements.

The expected number of applications in the SAP Portal that receive a positive determination from SAMHSA each year may vary. Overall, per year, SAMHSA estimates it will collect data security information for 15 application submissions that received a positive determination within the SAP Portal. SAMHSA estimates that the total burden for the collection of information for data security requirements over the course of the three-year OMB clearance will be about 30 hours and, as a result, an average annual burden of 10 hours.

91 FR 52312