HHS Exempt Systems of Records

Return to HHS System of Records Notices (SORNs)

The records in these systems of records are exempt, in full or in part, from certain requirements of the Privacy Act, based on rulemakings promulgated under subsection (j) or (k) of the Privacy Act (5 U.S.C. § 552a(j), (k)). Note that 5 U.S.C §. 552a(d)(5) excludes material compiled in reasonable anticipation of a civil action or proceeding from the Privacy Act's access requirement, in all systems of records, without the need for a rulemaking.

*83 FR 6591 (2/14/18) added two security-related routine uses required by OMB in January 2017.

Office of the Secretary/Office of Inspector General (OS/OIG) Exempt Systems of Records

• 09-90-0002 Investigatory Material Compiled for Security and Suitability Purposes
  SORN history: 47 FR 45514, at 45524 (10/13/82) (scroll to page 300 of 640); updated 59 FR 55845 (11/9/94), *83 FR 6591 (2/14/18)
  [Exempt based on (k)(5); see 40 FR 47406 (10/8/75) (Final Rule) & 40 FR 41140 (9/5/75) (NPRM)]
• 09-90-0003 Criminal Investigative Files of the Inspector General
  SORN history: 73 FR 11650 (3/4/08), *83 FR 6591 (2/14/18)
  [Exempt based on (j)(2); see 40 FR 47406 (10/8/75) (Final Rule) & 40 FR 41140 (9/5/75) (NPRM)]
• 09-90-0100 Civil and Administrative Investigative Files of the Inspector General
  SORN history: 47 FR 43190 (9/30/82); updated 59 FR 55845 (11/9/94), 68 FR 36827 (6/19/03), *83 FR 6591 (2/14/18)
  [Exempt based on (k)(2); see 47 FR 57040 (12/22/82) (Final Rule)]

Office of the Secretary/Immediate Office of the Secretary (OS/IOS) Exempt System of Records

• 09-90-1701 HHS Insider Threat Program Records
  SORN history: 83 FR 42667 (8/23/18) 
  [Exempt based on (k)(1) and (k)(2); see 84 FR 14622 (4/11/19) (Final Rule)]

Office of the Secretary/Assistant Secretary for Administration (OS/ASA) Exempt System of Records

• 09-90-0020 Suitability for Employment Records
  SORN history: 58 FR 28880 (5/17/93); updated 59 FR 55845 (11/9/94), *83 FR 6591 (2/14/18)
  [Exempt based on (k)(5); see 40 FR 47406 (10/8/75) (Final Rule) & 40 FR 41140 (9/5/75) (NPRM)]

Office of the Secretary/Office for Civil Rights (OS/OCR) Exempt System of Records

• 09-90-0052 Program Information Management System (PIMS)
  SORN history: 75 FR 18841 (4/13/10), *83 FR 6591 (2/14/18)
  [Exempt based on (k)(2); see 68 FR 62750 (11/6/03) (Final Rule)]

Office of the Secretary/Office of the Assistant Secretary for Health (OS/OASH) Exempt System of Records

• 09-37-0021 HHS Records Related to Research Misconduct Proceedings
  SORN history: 74 FR 44847 (8/31/09), *83 FR 6591 (2/14/18)
  [Exempt based on (k)(2)/(k)(5); see 59 FR 36717 (7/19/94) (Final Rule)]

Administration for Children & Families (ACF) Exempt Systems of Records

• 09-80-0323 ORR Unaccompanied Children Bureau (UCB) Child Abuse or Neglect Investigation Records and Central Registry
  SORN history: 89 FR 96250 (12/4/24)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(2) of the Privacy Act (5 USC 552a(k)(2)); see 89 FR 104450 (12/23/24) (Direct Final Rule) and 90 FR 8781 (2/3/25) (extending the comment period and effective date)]
• 09-80-0385 OCSE Federal Case Registry of Child Support Orders (FCR)
  SORN history: 87 FR 56055 (9/13/22)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(2) of the Privacy Act (5 USC 552a(k)(2)); see 87 FR 55977 (9/13/22) (NPRM) and 88 FR 48736 (7/28/23) (Final Rule)]

Agency for Healthcare Research and Quality (AHRQ) Exempt System of Records

• 09-35-0002 Medical Expenditure Panel Survey (MEPS) and National Medical Expenditure Survey 2 (NMES 2)
  SORN history: 69 FR 17666 (4/5/04), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(4) of the Privacy Act (5 USC 552a(k)(4)); see 51 FR 41352 (11/14/86) (Final Rule)]

Centers for Disease Control and Prevention (CDC) Exempt Systems of Records

• 09-20-0164 Health and Demographic Surveys Conducted in Probability Samples of the United States Population 
  SORN history: 49 FR 37693 (9/25/84); updated 52 FR 45023 (11/24/87), 56 FR 1324 (1/11/91),57 FR 62811 (12/31/92), 58 FR 69048 (12/29/93), 59 FR 48331 (9/7/94), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(4) of the Privacy Act (5 USC 552a(k)(4)); see  40 FR 47406 (10/8/75) (Final Rule) and 40 FR 34129 (8/14/75) (NPRM)]
• 09-20-0165 Health Facilities' Inventories and Survey
  SORN history: 49 FR 37694 (9/25/84); updated 52 FR 45023 (11/24/87), 56 FR 1324 (1/11/91), 57 FR 62811 (12/31/92), 58 FR 69048 (12/29/93), 59 FR 48331 (9/7/94), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(4) of the Privacy Act (5 USC 552a(k)(4)); see 40 FR 47406 (10/8/75) (Final Rule) and 40 FR 34129 (8/14/75) (NPRM)]
• 09-20-0166 Vital Statistics for Births, Deaths, Fetal Deaths, Marriages, and Divorces Occurring in the United States During Each Year
  SORN history: 49 FR 37695 (9/25/84); updated 52 FR 45023 (11/24/87), 56 FR 1324 (1/11/91), 57 FR 62811 (12/31/92), 58 FR 69048 (12/29/93), 59 FR 48331 (9/7/94), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(4) of the Privacy Act (5 USC 552a(k)(4)); see 40 FR 47406 (10/8/75) (Final Rule) and 40 FR 34129 (8/14/75) (NPRM)]
• 09-20-0167 Health Care Statistics (Formerly numbered 09-37-0013.)
  SORN history: 49 FR 37697 (9/25/84); updated 52 FR 45023 (11/24/87), 56 FR 1324 (1/11/91), 57 FR 62811 (12/31/92), 58 FR 69048 (12/29/93), 59 FR 48331 (9/7/94), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(4) of the Privacy Act (5 USC 552a(k)(4)); see 43 FR 40229 (9/11/78) (Final Rule) and 42 FR 60573 (11/28/77) (NPRM)]

Centers for Medicare & Medicaid Services (CMS) Exempt Systems of Records

• 09-70-0527 Fraud Investigation Database (FID)
  SORN history: 71 FR 77759 (12/27/06); updated 78 FR 32257 (5/29/13), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(2) of the Privacy Act (5 USC 552a(k)(2)); see 73 FR 55772 (9/26/08) (Final Rule)]
• 09-70-0544 Health Insurance Portability and Accountability Act (HIPAA) Information Tracking System (HITS)
  SORN history: 70 FR 38944 (7/6/05), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(2) of the Privacy Act (5 USC 552a(k)(2)); see 73 FR 55772 (9/26/08) (Final Rule)]
• 09-70-0565 Automated Survey Processing Environment (ASPEN) Complaints/Incidents Tracking System (ACTS)
  SORN history: 71 FR 29643 (5/23/06), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(2) of the Privacy Act (5 USC 552a(k)(2)); see 73 FR 55772 (9/26/08) (Final Rule)]
• 09-70-0575 Organ Procurement Organizations System (OPOS)
  SORN history: 71 FR 29336 (5/22/06); updated 74 FR 30606 (6/26/09), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(2) of the Privacy Act (5 USC 552a(k)(2)); see 73 FR 55772 (9/26/08) (Final Rule)]

Food and Drug Administration (FDA) Exempt Systems of Records

• 09-10-0002 Regulated Industry Employee Enforcement Records
  SORN history: 51 FR 42524 (11/24/86); updated 53 FR 9815 (3/25/88), 54 FR 47912 (11/17/89), 59 FR 67087 (12/28/94), 79 FR 36536 (6/27/14), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsections (j)(2), (k)(2), and (k)(5) of the Privacy Act (5 USC 552a(j)(2),(k)(2), and (k)(5)); see 40 FR 47406 (10/8/75) (Final Rule) & 40 FR 41140 (9/5/75) (NPRM) and exemption rationales in 40 FR 39388 (8/27/75) (NPRM) at paragraphs 31 through 36]
• 09-10-0010 Bioresearch Monitoring Information System
  SORN history: 77 FR 1073 (1/9/12); updated 79 FR 36536 (6/27/14), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsections (j)(2), (k)(2), and (k)(5) of the Privacy Act (5 USC 552a(j)(2),(k)(2), and (k)(5)); see 40 FR 47406 (10/8/75) (Final Rule) & 40 FR 41140 (9/5/75) (NPRM) and exemption rationales in 40 FR 39388 (8/27/75) (NPRM) at paragraphs 31 through 35]
• 09-10-0013 Employee Conduct Investigative Records
  SORN history: 51 FR 42524 (11/24/86); updated 56 FR 1331 (1/11/91), 57 FR 62828 (12/31/92), 59 FR 67087 (12/28/94), 79 FR 36536 (6/27/14), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsections (j)(2), (k)(2), and (k)(5) of the Privacy Act (5 USC 552a(j)(2),(k)(2), and (k)(5)); see 40 FR 47406 (10/8/75) (Final Rule) & 40 FR 41140 (9/5/75) (NPRM) and exemption rationales in 40 FR 39388 (8/27/75) (NPRM) at paragraphs 31 through 35]
• 09-10-0020 FDA Records Related to Research Misconduct Proceedings
  SORN history: 77 FR 52036 (8/28/12); updated  79 FR 36536 (6/27/14), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsections(k)(2) and (k)(5) of the Privacy Act (5 USC 552a(k)(2) and (k)(5)); see 78 FR 39184 (7/1/13) (Final Rule)]

Health Resources and Services Administration (HRSA) Exempt System of Records

• 09-15-0054 National Practitioner Data Bank (NPDB) 
  SORN history: 88 FR 17854 (3/24/23)
  [Exempt from certain requirements of the Privacy Act pursuant to subsection (k)(2) of the Privacy Act (5 USC 552a(k)(2)); see 76 FR 72325 (11/23/11) (Final Rule), corrected by 78 FR 47210 (Aug. 5, 2013)]

National Institutes of Health (NIH) Exempt Systems of Records

• 09-25-0165 NIH Loan Repayment Records
  SORN history: 86 FR 2677 (1/13/21)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(5) of the Privacy Act (5 USC 552a(k)(5)); see 86 FR 2633 (1/13/21) (NPRM) & 87 FR 8957 (2/17/22) (Final Rule)]
• 09-25-0213 Administration: Employee Conduct Investigative Records
  SORN history: 67 FR 60742 (9/26/02), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsections (k)(2) and (k)(5) of the Privacy Act (5 USC 552a(k)(2) & (5)); see 65 FR 37288 (6/14/00) (Final Rule)]
• 09-25-0223 NIH Records Related to Research Misconduct Proceedings
  SORN history: 77 FR 52043 (8/28/12), *83 FR 6591 (2/14/18)
  [Exempt from certain Privacy Act requirements pursuant to subsections (k)(2) and (k)(5) of the Privacy Act (5 USC 552a(k)(2) & (5)); see 78 FR 39186 (7/1/13) (Final Rule)]
• 09-25-0224 NIH Police Records
  SORN history: 89 FR 48654 (6/7/24)
  [Exempt from certain Privacy Act requirements pursuant to subsections (j)(2) and (k)(2) of the Privacy Act (5 USC 552a(j)(2) and (k)(2)); see 89 FR 48536 (6/7/24) (NPRM) & 90 FR 4673 (1/16/25) (Final Rule); effective date delayed to 5/5/25 – see 90 FR 13416 (3/24/25)]
• 09-25-0225 NIH Electronic Research Administration (eRA)
  SORN history: 84 FR 49540 (9/20/19)
  [Exempt from certain Privacy Act requirements pursuant to subsection (k)(5) of the Privacy Act (5 USC 552a(k)(5)); see 81 FR 88637 (12/8/16) (NPRM) & 83 FR 14183 (4/3/18) (Final Rule)]