Appendix G The Law Relating to HEW Introduction The Federal law bearing on collection, storage, handling, dissemination, and other use of information about individuals (hereinafter often referred to as "personal information activities”) is a large and varied assortment of statutes, regulations, Executive orders, and other directives. Little of this law applies generally to all agencies of the Federal government, and still less has general application to personal information activities of organizations outside the Federal government. This paper discusses the law that governs the behavior of the Department of Health, Education, and Welfare1 (hereinafter referred to as "the Department" or "HEW") and its grantees and contractors in the conduct of personal information activities. Three statutes of general application throughout the Federal government are discussed with special reference to their HEW effects: the Federal Reports Act, 44 U.S.C. 3501 et seq.; the so-called "Freedom of Information Act", 5 U.S.C. 552; and a 'The Department comprises a number of organizational components through which its operational programs and activities are carried out, viz.: the Public Health Service (PHS), consisting of the Food and Drug Administration (FDA), the Health Services and Mental Health Administration (HSMHA) and the National Institutes of Health (NIH); the Education Division, consisting of the National Institute of Education (NIE) and the Office criminal statute forbidding government officers and employees from making unauthorized disclosures of information. 18 U.S.C. 1905. This paper focuses on personal information and does not cover the law relating to trade secrets or commercial information. The statutory sources of authority relating to HEW's conduct of personal information activities may be categorized as follows: (1) broad authority to administer and manage HEW; (2) authority for HEW to carry out particular program activities, including research, whether conducted by HEW or by others with support from HEW; (3) authority for HEW information (or personal information) activities; (4) authority (sometimes by Executive order rather than by statute) which, though not directly conferring authority on HEW, gives rise indirectly to obligations imposed on HEW, commonly along with other government departments, to obtain, provide, and/or report personal information for its own purposes or to other government departments or agencies (e.g., Civil Service Commission, Internal Revenue Service) to the Congress, or to the public. Except in category (3), these sources of authority generally make no explicit reference to information (or personal information) activities, but it is a reasonable and necessary interpretation of the authority to include such activities. Sources of authority for HEW's personal information activities are legion, resulting particularly from the necessity of interpreting such authority to exist in all statutes concerning program activities and research covered by category (2). This paper seeks to present a complete compilation of the sources of authority for HEW's personal information activities in categories (1), (3), and (4). With respect to category (2) it discusses only statutes that have special significance in relation to personal information activities or contain a provision relating specifically to personal information activity. It should be noted that in order to perform statutory program duties, it is often necessary to conduct personal information activities, particularly in programs that provide direct services to individuals, for example, the repatriation assistance programs of the Social and of Education (OE); the Social and Rehabilitation Service (SRS); the Social Security Administration (SSA); and the Office of the Secretary (OS), consisting in part of the Office for Civil Rights (OCR), and the Office of Human Development, which includes the Administration on Aging (AoA), the Office of Child Development (OCD), and the Office of Youth Development (OYD). (Effective July 1, 1973, the operating agency constituents of the Public Health Service will be reorganized to consist of the Food Drug Administration, the Center for Disease Control, the Health Resources Administration, the Health Services Administration, and the National Institutes of Health.) Rehabilitation Service, 24 U.S.C. 321-29, and section 1113 of the Social Security Act, 42 U.S.C. 1313. In addition, authorized research activities, for example in the health fields, frequently require extensive information about individuals. Examples of authority for the "conduct and support" of research activities include the statutes authorizing the research institutes of the National Institutes of Health. Public Health Service Act sections 402 (Cancer, 42 U.S.C. 282), 412 (Heart Diseases, 42 U.S.C. 287a), 422 (Dental Diseases, 42 U.S.C. 288a), 431 (Arthritis, Rheumatism, and Metabolic Diseases, Neurological Diseases and Stroke, and other particular diseases and groups of diseases, 42 U.S.C. 289a), 441 (Child Health and Human Development, 42 U.S.C. 289d), 442 (General Medical Sciences, 42 U.S.C. 289e), 451 (Eye Diseases and Visual Disorders, 42 U.S.C. 289i). Because the statutes deal sparingly with personal information activities, one must also turn to regulations that have been issued to implement statutes to get a fuller understanding of the authority that governs such activities. We have sought to identify and discuss the principal regulations that have operational significance for the conduct of personal information activities, including all that are Departmental in scope (i.e., apply to all operating agencies of the Department) and those that apply throughout a particular operating agency. Of regulations limited in application to a particular program or activity, we have attempted to include only those that contain specific provisions about personal information activities. Guidance as to HEW personal information activities appears also in program materials issued at the operating level which are more detailed than statutes or regulations but which may lack the force of law. The discussion of such materials in this paper is limited to a few examples. The law relating to personal information activities carried out in connection with HEW personnel administration is treated separately, because the legal requirements and operational considerations involved are distinctive. Authority to Collect Information GENERAL The Department was created by Reorganization Plan No. 1 of 1953 which became effective on April 11, 1953 (67 Stat. 18) and is recognized as an executive department in 5 U.S.C. 101. The Plan provides that the Department shall be administered under the supervision and direction of the Secretary. A general grant of power enables the Secretary to act as he finds necessary in order to carry out his responsibilities in the areas of health, welfare, social security, and education. An opinion of the Attorney General, discussing general Secretarial powers, emphasized that express statutory authority is not required for every administrative act. 28 Op. Atty. Gen. 549 (January 5, 1911). The Secretary's responsibilities are further defined in part in 5 U.S.C. 301 which states: The head of an Executive department... may prescribe regulations for the government of his department, the conduct of its employees, the distribution and performance of its business, and the custody, use, and preservation of its records, papers, and property. See also section 215(b) of the Public Health Service Act, 42 U.S.C. 216(b), setting forth similar authority to promulgate regulations for administration of the Public Health Service, including regulations relating to custody, use and preservation of records. In addition to the Secretary's general authority to manage the Department, there are numerous specific statutory provisions authorizing collection of information by HEW. The authority for the conduct of programs characteristically requires that HEW make periodic reports on the conduct and status of those programs. In addition, where HEW is authorized to contract with or grant money to States, localities, and private institutions for the conduct of programs, the legislation generally requires them to make periodic reports to the Department or its agencies. See, e.g., Elementary and Secondary Education Act, section 142(a) (3), 20 U.S.C. 241f(a) (3), (periodic reports to the Commissioner of Education evaluating effectiveness of Title I payments). EDUCATION Perhaps the broadest grant of authority for collection of information is the Organic Act of 1867, 14 Stat. 434, which established a "Department of Education" ....for the purpose of collecting such statistics and facts as shall show the condition and progress of education in the several States and Territories, and of diffusing such information respecting the organization and management of schools and school systems, and methods of teaching, as shall aid the people of the United States in the establishment and maintenance of efficient school systems, and otherwise promote the cause of education throughout the country. See 20 U.S.C. 1. Under more recent education laws the Commissioner of Education is charged specifically with collecting and disseminating information. Section 422(a) of the General Education Provisions Act provides: The Commissioner shall (1) prepare and disseminate to State and local educational agencies and institutions information concerning applicable programs and cooperate with other Federal officials who administer programs affecting education in disseminating information concerning such programs; (2) inform the public on federally supported education programs; (3) collect data and information on applicable programs for the purpose of obtaining objective measurements of the effectiveness of such programs in achieving their purposes; and (4) prepare and publish an annual report (to be referred to as "the Commissioner's annual report") on (A) the condition of education in the nation, (B) developments in the administration, utilization, and impact of applicable programs, (C) results of investigations and activities by the Office of Education, and (D) such facts and recommendations as will serve the purpose for which the Office of Education is established (as set forth in section 403 of this Act). 20 U.S.C. 1231a(a). Other provisions relating to collection of information are found in section 417 of the General Education Provisions Act, 20 U.S.C. 1231f, and in section 501 of the Education Professions Development Act, 20 U.S.C. 1091. The former gives the Commissioner authority to furnish various information to, and to make special statistical compilations and surveys for, State or local officials, |