2026-23010NoticeWallet

NIH Updates Library Privacy Files, Somehow Without Extra Costs

Published Date: 11/12/2026

Notice

Summary

The National Institutes of Health (NIH) is updating its Privacy Act system that manages library user records to keep things current and clear. These changes affect who’s covered, what info is kept, where it’s stored, and how long it’s kept. You’ve got until December 14, 2026, to share your thoughts, and no extra costs are involved—just smoother privacy rules for NIH library users!

Analyzed Economic Effects

5 provisions identified: 1 benefits, 2 costs, 2 mixed.

Authors added to covered individuals

The system now explicitly covers "authors and other responsible individuals associated with works in the NLM and NIH Library collections" — meaning people whose names appear in NIH or NLM catalogs, archival, or descriptive records are included. This change is part of the revisions published November 12, 2026.

Types of records changed (photos removed)

The categories of records were updated to add citation and bibliographic information for works and to remove record types that are no longer collected, specifically user codes and photographs. The change is part of the SORN modifications published November 12, 2026.

Records retention schedules updated

Retention and disposal rules were updated: records are retained indefinitely pending National Archives approval; master bibliographic records are permanent and should be transferred to NARA when no longer needed; database change history and audit records are destroyed 10 years after superseded. These retention rules appear in the notice published November 12, 2026.

New breach disclosure routine uses; billing use removed

The SORN removes the routine use tied to billing because the NIH Library system no longer provides billing, and it explicitly includes HHS-wide Routine Uses (added in 2018) that allow disclosures to other agencies or entities to respond to suspected or confirmed breaches (e.g., Routine Uses describing disclosures when there is a risk of harm and disclosures to other federal agencies to assist breach response).

Identity verification for record requests tightened

To request notification or access to records, you must verify your identity by either providing a notarization of the request or a written certification that you are who you claim to be; the notice reiterates that knowingly requesting a record under false pretenses is a criminal offense subject to a $5,000 fine. These procedures are in the November 12, 2026 notice.

Personalized for You

How does this regulation affect your finances?

Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Key Dates

Published Date
11/12/2026

Department and Agencies

Department
Independent Agency
Agency
Health and Human Services Department
National Institutes of Health
Source: View HTML

Related Federal Register Documents

Previous / Next Documents

Back to Federal Register