[Code of Federal Regulations]
[Title 6, Volume 1]
[Revised as of January 1, 2007]
From the U.S. Government Printing Office via GPO Access
[CITE: 6CFR5.22]

[Page 20-21]
 
                       TITLE 6--HOMELAND SECURITY
 
   CHAPTER I--DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY
 
PART 5_DISCLOSURE OF RECORDS AND INFORMATION--Table of Contents
 
                          Subpart B_Privacy Act
 
Sec.  5.22  Responsibility for responding to requests for access to 

records.

    (a) In general. Except as stated in paragraphs (c), (d), and (e) of 
this section, the component that first receives a request for access to 
a record, and has possession of that record, is the component 
responsible for responding to the request. In determining which records 
are responsive to a request, a component ordinarily shall include only 
those records in its possession as of the date the component begins its 
search for them. If any other date is used, the component shall inform 
the requester of that date.
    (b) Authority to grant or deny requests. The head of a component, or 
the component head's designee, is authorized to grant or deny any 
request for access or amendment to a record of that component.
    (c) Consultations and referrals. When a component receives a request 
for access to a record in its possession, it shall determine whether 
another component, or another agency of the Federal Government, is 
better able to determine whether the record is exempt from access under 
the Privacy Act. If the receiving component determines that it is best 
able to process the record in response to the request, then it shall do 
so. If the receiving component determines that it is not best able to 
process the record, then it shall either:
    (1) Respond to the request regarding that record, after consulting 
with the component or agency best able to determine whether the record 
is exempt from access and with any other component or agency that has a 
substantial interest in it; or
    (2) Refer the responsibility for responding to the request regarding 
that record to the component best able to determine whether it is exempt 
from access, or to another agency that originated the record (but only 
if that agency is subject to the Privacy Act). Ordinarily, the component 
or agency that originated a record will be presumed to be best able to 
determine whether it is exempt from access.
    (d) Law enforcement information. Whenever a request is made for 
access to a record containing information that relates to an 
investigation of a possible violation of law and that was originated by 
another component or agency, the receiving component shall either refer 
the responsibility for responding to the request regarding that 
information to that other component or agency or shall consult with that 
other component or agency.
    (e) Classified information. Whenever a request is made for access to 
a record containing information that has been classified by or may be 
appropriate for classification by another component or agency under 
Executive Order 12958 or any other executive order concerning the 
classification of records, the receiving component shall refer the 
responsibility for responding to the request regarding that information 
to the component or agency that classified the information, should 
consider the information for classification, or has the primary interest 
in it, as appropriate. Whenever a record contains information that has 
been derivatively classified by a component because it contains 
information classified by another component or agency, the component 
shall refer the responsibility for responding to the request regarding 
that information to the component or agency that classified the 
underlying information.
    (f) Release of Medical Records. Pursuant to 5 U.S.C. 552a(f)(3), 
where requests are made for access to medical records, including 
psychological

[[Page 21]]

records, the decision to release directly to the individual, or to 
withhold direct release, shall be made by a medical practitioner. Where 
the medical practitioner has ruled that direct release will cause harm 
to the individual who is requesting access, normal release through the 
individual's chosen medical practitioner will be recommended. Final 
review and decision on appeals of disapprovals of direct release will 
rest with the General Counsel.
    (g) Notice of referral. Whenever a component refers all or any part 
of the responsibility for responding to a request to another component 
or agency, it ordinarily shall notify the requester of the referral and 
inform the requester of the name of each component or agency to which 
the request has been referred and of the part of the request that has 
been referred.
    (h) Timing of responses to consultations and referrals. All 
consultations and referrals shall be handled according to the date the 
Privacy Act access request was initially received by the first component 
or agency, not any later date.
    (i) Agreements regarding consultations and referrals. Components may 
make agreements with other components or agencies to eliminate the need 
for consultations or referrals for particular types of records.