SUPPLEMENTARY INFORMATION:

The revised SORN published in this notice for system No. 09-25-0005 is in accordance with 5 U.S.C. 552a(e)(4) and (11), and includes the following significant changes:

• The system's name has been changed from Administration: Library Operations and NIH Library User I.D. File to Administration: National Library of Medicine, User Services and Collection Division (NIH Library).
• The System Locations have been updated to remove old locations that no longer exist, update the room number for building 38, and update the name and room number for building 10.
• The System Managers section has been updated to reflect the new names for the System Manager's roles, remove old designations, and update department locations.
• The purpose section has been updated to remove two purposes (previously 2 and 4) that are no longer done by the program or NIH (providing user documentation and managing invoice and billing transactions). The remaining purposes have been re-numbered accordingly and updated to add clarity.
• An additional category of individuals was added to cover authors and other responsible individuals associated with works in the National Library of Medicine (NLM) and NIH Library collections.
• Category types were updated to cover citations and other bibliographic information, while removing record types that are no longer collected (user codes and photographs).
• Record sources were added to cover data that comes from source systems, including the NLM catalog and NIH Library systems and other federal agency systems.
• Routine Use 4 was removed because the NIH Library system no longer provides the function of billing.
• The new Routine Uses 4 and 5 were added in 2018 as an HHS-wide SORN modification and have been explicitly included in this SORN for additional transparency.
• The policies and practices for retention and disposal of records have been updated to remove dated and superseded records retention schedules.

SYSTEM NAME AND NUMBER:

National Library of Medicine, User Services and Collection Division, and Office of Research Services, Division of Library Services (NIH Library), 09-25-0005.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

This system of records is an umbrella system comprising separate sets of records located in National Institutes of Health (NIH) facilities in Bethesda, Maryland, or facilities of contractors of the NIH. Write to the appropriate System Manager listed below for list of current contractor locations.

NIH Library, Building 10, Room 1L19A, 10 Center Drive, Bethesda, MD 20892.

National Library of Medicine, Building 38, Room B1E04, 8600 Rockville Pike, Bethesda, MD 20894.

SYSTEM MANAGER(S):

Management Analyst, Office of Administration, National Library of Medicine, Building 38A, Room B2N12, 8600 Rockville Pike, Bethesda, MD 20894.

Chief, Library Technology Services Branch, Division of Library Services, Office of Research Services, Office of the Director (OD), Building 10, Room 1L19A, 10 Center Drive, Bethesda, MD 20892.

Chief, Collection Branch, National Library of Medicine, Building 38, Room B1E04, 8600 Rockville Pike, Bethesda, MD 20894.

Access Program Manager, Collection Branch, National Library of Medicine, Building 38, Room B1E04, 8600 Rockville Pike, Bethesda, MD 20894.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

42 U.S.C. 286, National Library of Medicine; 42 U.S.C. 241—Research and Investigations Generally (Public Health Service (PHS) Act 401); 42 U.S.C. 282—Director of National Institutes of Health (PHS Act 402); 42 U.S.C. 284—Directors of National Research Institutes (PHS Act 405).

PURPOSE(S) OF THE SYSTEM:

Records are used within the agency for these purposes:

1. Monitoring library material for circulation to library users (including providing access information to users and library material copying services).

2. Preservation and security of library material to ensure availability for future generations.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

1. Users of library services.

2. Authors and other responsible individuals associated with works in the NLM and NIH Library collections: individuals whose names or other identifying information appear in the NIH Library and/or the NLM catalogs, archival, or other descriptive records and associated bibliographic or authority files, including authors, contributors, editors, compilers, and other responsible parties associated with works in the collections.

CATEGORIES OF RECORDS IN THE SYSTEM:

For library users: name, organization, address, phone number, issue date, email address, signature, identification number, primary identifier, and user group code.

For authors and other responsible individuals associated with works in the NLM and NIH Library collections: bibliographic, archival, and descriptive and associated identifying information, including names; standardized name authority forms; variant names; dates; and other cataloging or archival data used for identification, indexing, and disambiguation purposes.

RECORD SOURCE CATEGORIES:

Individuals, NLM catalog and NIH Library systems, and publicly available bibliographic, archival, and name authority records maintained by federal agencies and other authoritative sources.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

Under the Privacy Act of 1974, as amended, NIH may disclose information about an individual from this system of records to parties outside HHS, without the individual's prior written consent, pursuant to the following routine uses.

1. To a congressional office from the record of an individual in response to an injury from the congressional office made at the request of that individual.

2. To the Department of Justice (DOJ), or to a court or other tribunal, when (a) HHS, or any component thereof; (b) any HHS employee in his or her official capacity; (c) any HHS employee in his or her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or (d) the United States or any agency thereof is a party to ( printed page 72886) litigation or has an interest in such litigation, where HHS determines that the litigation is likely to affect HHS or any of its components, and HHS determines that the use of such records by the DOJ, court or other tribunal is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.

3. To contractors and staff to monitor library material, services, circulation control; to provide user documentation; and to process or refine the records. Recipients are required to maintain Privacy Act safeguards with respect to those records.

4. To appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records; (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the federal government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

5. To another federal agency or federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the federal government, or national security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are stored on computer tape and disk, paper file cards, and in IT systems.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by name, user group code and/or identification number, or other unique identifier assigned to library users. Catalog, archival, and authority records may be retrieved by the name of an author, contributor, or other responsible individual; by title; by subject; by control number or other bibliographic identifier; or by other descriptive metadata elements associated with works or collections maintained by the NIH Library and the NLM.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Retention Period: DAA-0443-2026-0001: Unscheduled. In accordance with 36 CFR 1225 and 44 U.S.C. Chapter 33, Records are retained indefinitely pending approval of a National Archives and Records Administration (NARA) records schedule. Records must be preserved and may not be destroyed until disposition authority is approved by NARA.

1. Scientific Bibliographic Master Database: Master bibliographic records containing citation data, indexing terms, abstracts, metadata, authority records, persistent identifiers, and related information documenting the agency's scientific information dissemination mission. Permanent. Transfer a copy to NARA when no longer needed for current agency business or according to an approved transfer agreement.

2. Database Change History and Audit Records: Records documenting additions, deletions, corrections, indexing updates, authority control changes, and quality assurance activities affecting master records. Destroy 10 years after superseded or no longer needed for business use.

3. Data Dictionaries and Metadata Specifications: Documentation describing data elements, schemas, indexing standards, controlled vocabularies, relationships, and database structures. Permanent. Transfer with the master database or according to approved transfer instructions.

4. System Documentation: System design records, technical specifications, interfaces, file layouts, user manuals, and system architecture documentation. Destroy 5 years after system retirement or transfer permanent documentation with the master files, as appropriate.

5. Input Source Files: Publisher submissions, data imports, indexing worksheets, and other source records used to create or update bibliographic records. Destroy 5 years after successful verification and incorporation into the master database.

6. Routine Outputs and Reports: Ad hoc reports, extracts, statistical reports, and working copies generated from the database. Destroy when no longer needed for agency business.

7. Backup and Recovery Copies: Backup copies maintained solely for disaster recovery and continuity purposes. Delete when superseded or no longer required for recovery operations.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Authorized Users: Employees who maintain records in this system are instructed to grant regular access only to NIH Library staff members who need to verify that NIH Library identification cards have been issued to those library users requesting services such as reference and interlibrary loans. Other one-time and special access by other employees is granted on a need-to-know basis as specifically authorized by the system manager. The contractor maintains a list of personnel having authority to access records to perform their duties.

Physical Safeguards: The offices housing the cabinets and file drawers for storage of records are locked during all library off-duty hours. During all duty hours offices are attended by employees who maintain the files. The contractor has secured records storage areas which are not left unattended during the working hours and file cabinets which are locked after hours.

Procedural Safeguards: Access to the file is strictly controlled by employees who maintain the files. Records may be removed from files only at the request of the system manager or other authorized employees. Access to computerized records is controlled by the use of security codes known only to authorized users. Contractor personnel receive instruction concerning the significance of safeguards under the Privacy Act.

These practices are in compliance with the standards of Chapter 45-13 of the HHS General Administration Manual, “Safeguarding Records Contained in Systems of Records,” supplementary Chapter PHS hf: 45-13, and the HHS Automated Information Systems Security Program Handbook.

RECORD ACCESS PROCEDURES:

Same as Notification Procedures. Requesters should also reasonably specify the record contents being sought. Individuals may also request an accounting of disclosures that have been made of their records, if any.

CONTESTING RECORD PROCEDURES:

Write to the official at the address specified under Notification Procedures above and reasonably identify the record and specify the information to be contested, the corrective action sought, and the reasons for the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant. The right to contest records is limited to information that is incomplete, irrelevant, incorrect, or obsolete. ( printed page 72887)

NOTIFICATION PROCEDURES:

Write to the System Manager to determine if a record exists. The requester must also verify his or her identity by providing either a notarization of the request or a written certification that the requester is who he or she claims to be and understands that the knowing and willful request for acquisition of a record pertaining to an individual under false pretenses is a criminal offense under the Privacy Act, subject to a five thousand dollar fine.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

67 FR 60742 at 60744 (Sept. 26, 2002), 83 FR 6591 (Feb. 14, 2018).

91 FR 72884