(;,.

~

-.,~f.

DEPARTMENT OF HEALTH&. HUMAN SERVICES

Office of the Secretary

Washington. D.C 20201

Case No.: 2011-1031GD July 22, 2011 Anne Weismann Citizens for Responsibility and Ethics in Washington 1400 Eye Street N.W. Suite 450 Washington, DC 20005 Dear Ms. Weismann: This letter is in response to your June 24,2011, Freedom oflnformation Act (FOIA) request for HHS records management policies, data governance practices, and development regarding cloud computing technology and environment, and related to Request for Information (RFI) solicitation OS 64495. The Office of the Assistant Secretary for Administration (ASA) searched and located 951 pages of responsive records, of which 192 pages are enclosed on CD. I have determined to withhold portions of the released records under FOIA exemptions (b)(3), (b)(4), (b)(5), and (b)(6); 750 pages, in their entirety, under FOIA exemptions (b)(3) and (b)(4), which consist of vendor responses to the RFI; and nine pages, in their entirety, under FOIA exemption (b )(5). The ASA reports that HHS Cloud Computing Advisory Council (CCAC) has developed pot'icies and guidance for the development, purchase, and/or use of cloud base systems. In addition, HHS has developed and implemented comprehensive records management policies and guidance that require the owner of the official record(s) to manage the records appropriately. The policies are not dependent upon the system where the files are stored. Therefore, the policies and guidance apply to hard copy records as well as records stored on local PCs, network drives or in cloud environments. The HHS Records management policies are not system dependent and apply to all file management systems including cloud based systems. Furthermore, ASA reports that since system independence is inherent in the design of the policies no specific instructions were developed to determine how to manage official records in a cloud environment. The FOIA exemption (b)(3) permits the withholding of records which are specifically prohibited from disclosure by statutes other than the FOIA. In this case, the statute is the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (PL107-188). The FOIA exemption (b)(4) permits the withholding oftrade secrets and commercial or financial information that is privileged or confidential.

Page 2 of2 Anne Weismann 2011-1031GD

The FOIA exemption (b)(5) permits the withholding of intra-agency and/or inter-agency records, which document the deliberative process. The FOIA exemption (b)(6) permits the withholding of records which, if released, would constitute a clearly unwarranted invasion of personal privacy. If you we believe that the information withheld should not be exempt from disclosure, you have the right to appeal my denial of portions of the records responsive to your request. Your appeal must be sent 30 days from the date of receipt of this letter, to the Deputy Assistant Secretary for Public Affairs (Media), U.S. Department of Health and Human Services, Mary E. Switzer Building, 330 C Street, S.W., Room 2206, Washington, D.C. 20201. Clearly mark both the envelope and your letter "Freedom of Information Act Appeal."

Director FOI/Privacy Acts Division Office of Public Affairs

Sign up to vote on this title
UsefulNot useful