$5.64 Exemption three: Records exempted by other statutes.

We are not required to release records if another statute specifically allows us to withhold them. We may use another statute to justify withholding only if it absolutely prohibits disclosure or if it sets forth criteria to guide our decision on releasing or identifies particular types of material to be withheld.

$5.65 Exemption four: Trade secrets and confidential commercial or financial information.

We will withhold trade secrets and commercial or financial information that is obtained from a person and is privileged or confidential.

(a) Trade secrets. A trade secret is a secret, commercially valuable plan, formula, process, or device that is used for the making, preparing, compounding, or processing of trade commodities and that can be said to be the end product of either innovation or substantial effort. There must be a direct relationship between the trade secret and the productive process.

(b) Commercial or financial information. We will not disclose records whose information is "commercial or financial," is obtained from a person, and is "privileged or confidential."

(1) Information is "commercial or financial" if it relates to businesses, commerce, trade, employment, profits, or finances (including personal finances). We interpret this category broadly.

(2) Information is "obtained from a person" if HHS or another agency has obtained it from someone outside the Federal Government or from someone within the Government who has a commercial or financial interest in the information. "Person" includes an individual, partnership, corporation, association, state or foreign government, or other organization. Information is not "obtained from a person" if it is generated by HHS or another federal agency. However, information is "obtained from a person" if it is provided by someone, including but not limited to an agency employee, who retains a commercial or financial interest in the information.

(3) Information is "privileged" if it would ordinarily be protected from disclosure in civil discovery by a recognized evidentiary privilege, such as the attorney-client privilege or the work product privilege. Information may be privileged for this purpose under a privilege belonging to a person outside the government, unless the providing of the information to the government rendered the information no longer protectable in civil discovery.

(4) Information is "confidential" if it meets one of the following tests:

(i) Disclosure may impair the government's ability to obtain necessary information in the future;

(ii) Disclosure would substantially harm the competitive position of the person who submitted the information;

(iii) Disclosure would impair other government interests, such as program effectiveness and compliance; or

(iv) Disclosure would impair other private interests, such as an interest in controlling availability of intrinsically valuable records, which are sold in the market by their owner.

The following questions may be relevant in analyzing whether a record meets one or more of the above tests: Is the information of a type customarily held in strict confidence and not disclosed to the public by the person to whom it belongs? What is the general custom or usage with respect to such information in the relevant occupation or business? How many, and what types of, individuals have access to the information? What kind and degree of financial injury can be expected if the information is disclosed?

(c) Designation of certain confidential information. A person who submits records to the government may designate part or all of the information in such records as exempt from disclosure under Exemption 4 of the FOIA. The person may make this designation either at the time the records are submitted to the government or within a reasonable time thereafter. The designation must be in writing. Where a legend is required by a request for proposals or request for quotations, pursuant to 48 CFR 352.215-12, then that legend is necessary for this purpose. Any such designation will expire ten years

after the records were submitted to the government.

(d) Predisclosure notification. The procedures in this paragraph apply to records on which the submitter has designated information as provided in paragraph (c) of this section. They also apply to records that were submitted to the government where we have substantial reason to believe that information in the records could reasonably be considered exempt under Exemption 4. Certain exceptions to these procedures are stated in paragraph (e) of this section.

(1) When we receive a request for such records, and we determine that we may be required to disclose them, we will make reasonable efforts to notify the submitter about these facts. The notice will include a copy of the request, and it will inform the submitter about the procedures and time limits for submission and consideration of objections to disclosure. If we must notify a large number of submitters, we may do this by posting or publishing a notice in a place where the submitters are reasonably likely to become aware of it.

(2) The submitter has five working days from receipt of the notice to object to disclosure of any part of the records and to state all bases for its objections.

(3) We will give consideration to all bases that have been timely stated by the submitter. If we decide to disclose the records, we will notify the submitter in writing. This notice will briefly explain why we did not sustain its objections. We will include with the notice a copy of the records about which the submitter objected, as we propose to disclose them. The notice will state that we intend to disclose the records five working days after the submitter receives the notice unless we are ordered by a United States District Court not to release them.

(4) When a requester files suit under the FOIA to obtain records covered by this paragraph, we will promptly notify the submitter.

(5) Whenever we send a notice to a submitter under paragraph (d)(1) of this section, we will notify the requester that we are giving the submitter a notice and an opportunity to

object. Whenever we send a notice to a submitter under paragraph (d)(3) of this section, we will notify the requester of this fact.

(e) Exceptions to predisclosure notification. The notice requirements in paragraph (d) of this section do not apply in the following situations:

(1) We decided not to disclose the records;

(2) The information has previously been published or made generally available;

(3) Disclosure is required by a regulation, issued after notice and opportunity for public comment, that specifies narrow categories of records that are to be disclosed under the FOIA, but in this case a submitter may still designate records as described in paragraph (c) of this section, and in exceptional cases, we may, at our discretion, follow the notice procedures in paragraph (d) of this section; or

(4) The designation appears to be obviously frivolous, but in this case we will still give the submitter the written notice required by paragraph (d)(3) of this section (although this notice need not explain our decision or include a copy of the records), and we will notify the requester as described in paragraph (d)(5) of this section.

$5.66 Exemption five: Internal memo

randa.

This exemption covers internal government communications and notes that fall within a generally recognized evidentiary privilege. Internal government communications include an agency's communications with an outside consultant or other outside person, with a court, or with Congress, when those communications are for a purpose similar to the purpose of privileged intra-agency communications. Some of the most-commonly applicable privileges are described in the following paragraphs.

(a) Deliberative process privilege. This privilege protects predecisional deliberative communications. A communication is protected under this privilege if it was made before a final decision was reached on some question of policy and if it expressed recommendations or opinions on that question. The purpose of the privilege is to prevent

injury to the quality of the agency decisionmaking process by encouraging open and frank internal policy discussions, by avoiding premature disclosure of policies not yet adopted, and by avoiding the public confusion that might result from disclosing reasons that were not in fact the ultimate grounds for an agency's decision. Purely factual material in a deliberative document is within this privilege only if it is inextricably intertwined with the deliberative portions so that it cannot reasonably be segregated, if it would reveal the nature of the deliberative portions, or if its disclosure would in some other way make possible an intrusion into the decisionmaking process. We will release purely factual material in a deliberative document unless that material is otherwise exempt. The privilege continues to protect predecisional documents even after a decision is made.

(b) Attorney work product privilege. This privilege protects documents prepared by or for an agency, or by or for its representative (typically, HHS attorneys) in anticipation of litigation or for trial. It includes documents prepared for purposes of administrative adjudications as well as court litigation. It includes documents prepared by program offices as well as by attorneys. It includes factual material in such documents as well as material revealing opinions and tactics. Finally, the privilege continues to protect the documents even after the litigation is closed.

(c) Attorney-client communication privilege. This privilege protects confidential communications between a lawyer and an employee or agent of the government where there is an attorney-client relationship between them (typically, where the lawyer is acting as attorney for the agency and the employee is communicating on behalf of the agency) and where the employee has communicated information to the attorney in confidence in order to obtain legal advice or assistance.

$5.67 Exemption six: Clearly unwar

ranted invasion of personal privacy. (a) Documents affected. We may withhold records about individuals if disclosure would constitute a clearly unwar

ranted invasion of their personal privacy.

(b) Balancing test. In deciding whether to release records to you that contain personal or private information about someone else, we weigh the foreseeable harm of invading that person's privacy against the public benefit that would result from the release. If you were seeking information for a purely commercial venture, for example, we might not think that disclosure would primarily benefit the public and we would deny your request. On the other hand, we would be more inclined to release information if you were working on a research project that gave promise of providing valuable information to a wide audience. However, in our evaluation of requests for records we attempt to guard against the release of information that might involve a violation of personal privacy because of a requester being able to "read between the lines" or piece together items that would constitute information that normally would be exempt from mandatory disclosure under Exemption Six.

(c) Examples. Some of the information that we frequently withhold under Exemption Six is: Home addresses, ages, and minority group status of our employees or former employees; social security numbers; medical information about individuals participating in clinical research studies; names and addresses of individual beneficiaries of our programs, or benefits such individuals receive; earning records, claim files, and other personal information maintained by the Social Security Administration, the Public Health Service, and theCenters for Medicare & Medicaid Services.

$5.68 Exemption seven: Law enforce

ment.

We are not required to disclose information or records that the government has compiled for law enforcement purposes. The records may apply to actual or potential violations of either criminal or civil laws or regulations. We can withhold these records only to the extent that releasing them would cause harm in at least one of the following situations:

(a) Enforcement proceedings. We may withhold information whose release

could reasonably be expected to interfere with prospective or ongoing law enforcement proceedings. Investigations of fraud and mismanagement, employee misconduct, and civil rights violations may fall into this category. In certain cases such as when a fraud investigation is likely-we may refuse to confirm or deny the existence of records that relate to the violations in order not to disclose that an investigation is in progress, or may be conducted.

(b) Fair trial or impartial adjudication. We may withhold records whose release would deprive a person of a fair trial or an impartial adjudication because of prejudicial publicity.

(c) Personal privacy. We are careful not to disclose information that could reasonably be expected to constitute an unwarranted invasion of personal privacy. When a name surfaces in an investigation, that person is likely to be vulnerable to innuendo, rumor, harassment, and retaliation.

(d) Confidential sources and information. We may withhold records whose release could reasonably be expected to disclose the identity of a confidential source of information. A confidential source may be an individual; a state, local, or foreign government agency; or any private organization. The exemption applies whether the source provides information under an express promise of confidentiality or under circumstances from which such an assurance could be reasonably inferred. Also, where the record, or information in it, has been compiled by a criminal law enforcement authority conducting a criminal investigation, or by an agency conducting a lawful national security investigation, the exemption also protects all information supplied by a confidential source. Also protected from mandatory disclosure is any information which, if disclosed, could reasonably be expected to jeopardize the system of confidentiality that assures a flow of information from sources to investigatory agencies.

(e) Techniques and procedures. We may withhold records reflecting special techniques or procedures of investigation or prosecution, not otherwise generally known to the public. In some cases, it is not possible to describe even

in general terms those techniques without disclosing the very material to be withheld. We may also withhold records whose release would disclose guidelines for law enforcement investigations or prosecutions if this disclosure could reasonably be expected to create a risk that someone could circumvent requirements of law or of regulation.

(f) Life and physical safety. We may withhold records whose disclosure could reasonably be expected to endanger the life or physical safety of any individual. This protection extends to threats and harassment as well as to physical violence.

$5.69 Exemptions 8 and 9: Records on financial institutions; records on wells.

Exemption eight permits us to withhold records about regulation or supervision of financial institutions. Exemption nine permits the withholding of geological and geophysical information and data, including maps, concerning wells.

§ 5b.1

Definitions.

As used in this part:

(a) Access means availability of a record to a subject individual.

(b) Agency means the Department of Health and Human Services.

(c) Department means the Department of Health and Human Services.

(d) Disclosure means the availability or release of a record to anyone other than the subject individual.

(e) Individual means a living person who is a citizen of the United States or an alien lawfully admitted for permanent residence. It does not include persons such as sole proprietorships, partnerships, or corporations. A business firm which is identified by the name of one or more persons is not an individual within the meaning of this part.

(f) Maintain means to maintain, collect, use, or disseminate when used in connection with the term "record"; and, to have control over or responsibility for a system of records when used in connection with the term "system of records."

(g) Notification means communication to an individual whether he is a subject individual.

(h) Record means any item, collection, or grouping of information about an individual that is maintained by the Department, including but not limited to the individual's education, financial transactions, medical history, and criminal or employment history and that contains his name, or an identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph. When used in this part, record means only a record which is in a system of records.

(i) Responsible Department official means that officer who is listed in a notice of a system of records as the system manager for a given system of records or another individual listed in the notice of a system of records to whom requests may be made, or the designee of either such officer or individual.

(j) Routine use means the disclosure of a record outside the Department, without the consent of the subject individual, for a purpose which is compatible with the purpose for which the record was collected. It includes disclo

sures required to be made by statute other than the Freedom of Information Act, 5 U.S.C. 552. It does not include disclosures which are permitted to be made without the consent of the subject individual which are not compatible with the purpose for which it was collected such as disclosures to the Bureau of the Census, the General Accounting Office, or to Congress.

(k) Secretary means the Secretary of Health and Human Services, or his designee.

(1) Statistical record means a record maintained for statistical research or reporting purposes only and not maintained to make determinations about a particular subject individual.

(m) Subject individual means that individual to whom a record pertains.

(n) System of records means any group of records under the control of the Department from which a record is retrieved by personal identifier such as the name of the individual, number, symbol or other unique retriever assigned to the individual. Single records or groups of records which are not retrieved by a personal identifier are not part of a system of records. Papers maintained by individual employees of the Department which are prepared, maintained, or discarded at the discretion of the employee and which are not subject to the Federal Records Act, 44 U.S.C. 2901, are not part of a system of records; Provided, That such personal papers are not used by the employee or the Department to determine any rights, benefits, or privileges of individuals.

§ 5b.2 Purpose and scope.

(a) This part implements section 3 of the Privacy Act of 1974, 5 U.S.C. 552a (hereinafter referred to as the Act), by establishing agency policies and procedures for the maintenance of records. This part also establishes agency policies and procedures under which a subject individual may be given notification of or access to a record pertaining to him and policies and procedures under which a subject individual may have his record corrected or amended if he believes that his record is not accurate, timely, complete, or relevant or necessary to accomplish a Department function.