85 FR 26 pgs. 7401-7404 - Privacy Act of 1974; System of Records
Type: NOTICEVolume: 85Number: 26Pages: 7401 - 7404
Pages: 7401, 7402, 7403, 7404FR document: [FR Doc. 2020-02479 Filed 2-6-20; 8:45 am]
Agency: Veterans Affairs Department
Official PDF Version: PDF Version
[top]
DEPARTMENT OF VETERANS AFFAIRS
Privacy Act of 1974; System of Records
AGENCY:
Department of Veterans Affairs (VA).
ACTION:
Notice of a modified system of records.
SUMMARY:
As required by the Privacy Act of 1974, notice is hereby given that the Department of Veterans Affairs (VA) is amending the system of records entitled, "Spinal Cord Injury and Disorders Outcomes-Repository (SCIDO-R)-VA" (108VA11S) as set forth in 77 FR 22632. VA is amending the system of records by revising the System Name; System Number; System Location; Purpose of the System; Categories of Individuals Covered by the System; Categories of Records in the System; Record Source Categories; Routine Uses of Records Maintained in the System; Policies and Practices for Retention and Disposal of Records; Administrative, Technical, and Physical Safeguards; and Record Accord Procedure. VA is republishing the system notice in its entirety.
DATES:
Comments on this amended system of records must be received no later than March 9, 2020. If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by VA, the amended system will become effective March 9, 2020.
ADDRESSES:
Written comments may be submitted through www.Regulations.gov; by mail or hand-delivery to Director, Regulation Policy and Management (00REG), Department of Veterans Affairs, 810 Vermont Avenue NW, Room 1064, Washington, DC 20420; or by fax to (202) 273-9026 (not a toll-free number). Comments should indicate that they are submitted in response to "Spinal Cord Injury and Disorders Outcomes-Repository (SCIDO-R)-VA". Copies of comments received will be available for public inspection in the Office of Regulation Policy and Management, Room 1063B, between the hours of 8:00 a.m. and 4:30 p.m., Monday through Friday (except holidays). Please call (202) 461-4902 for an appointment. (This is not a toll-free number.) In addition, comments may be viewed online at www.Regulations.gov.
FOR FURTHER INFORMATION CONTACT:
Veterans Health Administration Privacy Act Officer, Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420; telephone (704) 245-2492. (This is not a toll-free number.)
SUPPLEMENTARY INFORMATION:
The System Name is being changed from "Spinal Cord Injury and Disorders Outcomes-Repository (SCIDO-R)-VA" to "Spinal Cord Injuries and Disorders (SCI/D) Registry and Outcomes Program-VA".
The System Number is being changed from 108VA11S to 108VA10NC9 to reflect the current organizational alignment.
The System Location has been amended to remove paper records being maintained at the VA Austin Information Technology Center (AITC). Being removed, "Address locations for VA facilities are listed in VA Appendix 1 of the biennial publication of VA Privacy Act Issuances" and replaced with "Address locations for VA facilities may be found at https://www.va.gov/directory/guide/home.asp. " Also, SCIDO application and the VA databases housed at the AITC are being replaced with data transmissions occurring between the local Spinal Cord Injuries (SCI) Centers and the VA SCI/D National Program Office.
The Purpose of the System is being amended to replace the SCIDO Registry with Spinal Cord Injuries and Disorders (SCI/D) Registry and Outcomes Program. The Regional SCIDO Repositories are being replaced with the local SCI/D Centers.
The Categories of Individuals Covered by the System and The Categories of Records in the System are being amended to change Spinal Cord Injury and Disorders Outcomes (SCIDO) Repository to Spinal Cord Injuries and Disorders (SCI/D) Registry and Outcomes Program.
The Record Source Categories are being amended to replace 24VA19 with 24VA10P2.
The Routine Uses of Records Maintained in the System is amending the language in Routine Use #11 which states that disclosure of the records to the DoJ is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. This routine use will now state that release of the records to the DoJ is limited to circumstances where relevant and necessary to the litigation. VA may disclose records in this system of records in legal proceedings before a court or administrative body after determining that release of the records to the court or administrative body is limited to circumstances where relevant and necessary to the litigation.
Routine Use #13 is being amended by clarifying the language to state, "VA may disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records; (2) VA has determined that as a result of the suspected or confirmed breach there is a risk to individuals, VA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, or persons is reasonably necessary to assist in connection with VA efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm."
Routine use #16 is being added to state, "VA may disclose information from this system to another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach." VA needs this routine use for the data breach response and remedial efforts with another Federal agency.
[top] The Policies and Practices for Retention and Disposal of Records is being amended to remove, "Records will be maintained and disposed of in accordance with record disposition authority approved by the Archivist of the United States. Depending on the record medium, records are destroyed by either shredding or degaussing. Optical disks or other electronic media are deleted when no longer required for official duties." VA has submitted a request for records disposition authority to the National Archives and Records Administration (NARA) for approval. Upon approval by NARA, VA will publish an amendment to this System of Records. In the interim, no records will be destroyed. This section will now state that "Records are under the following records schedule; Record Control Schedule (RCS) 10-1 item 6270. Master Files within a centralized database; Temporary; cutoff at the last unique patient entry or the death of a particular patient. Delete 75 years after
The Administrative, Technical, and Physical Safeguards are being amended to 1. Add the SCI/D National Program Office protected network folders. Also, added the use of Computerized Patient Record System (CPRS) security modules. 2. AITC is being replaced with the National Program Office.
The Record Access Procedure is amended to include the Program Office in which requests for services were made.
The Report of Intent to Amend a System of Records Notice and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.
Signing Authority: The Senior Agency Official for Privacy, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. James P. Gfrerer, Assistant Secretary for Information and Technology and Chief Information Officer, Department of Veterans Affairs, approved this document on November 25, 2019 for publication.
Dated: February 4, 2020.
Amy L. Rose,
Program Analyst, VA Privacy Service, Department of Veterans Affairs.
SYSTEM NAME AND NUMBER:
"Spinal Cord Injuries and Disorders (SCI/D) Registry and Outcomes Program-VA" (108VA10NC9)
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
All electronic records are maintained at the Austin Information Technology Center (AITC), Department of Veterans Affairs (VA), 1615 Woodward Street, Austin, Texas 78772, and address locations for VA facilities may be found at https://www.va.gov/directory/guide/home.asp. Each Spinal Cord Injury Center has a Spinal Cord Injury and Disorders Outcome (SCIDO) application deployment. Data transmissions occur between the local Spinal Cord Injury (SCI) Centers and the VA Spinal Cord Injuries and Disorders (SCI/D) National Program Office databases housed in the Department's wide area network.
SYSTEM MANAGER(S):
Official responsible for Spinal Cord Injury and Disorders Outcomes-Repository (SCIDO-R) design, development, and maintenance: SCIDO Program Specialist (128N), 1660 South Columbian Way, Seattle, Washington 98108.
Official responsible for policies and procedures: Chief Consultant, Spinal Cord Injury and Disorders Services (128N), 1660 South Columbian Way, Seattle, Washington 98108.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Title 38, United States Code (U.S.C.), Section 501 and 7304.
PURPOSE(S) OF THE SYSTEM:
The SCI/D Registry and Outcomes Program provides a registry of Veterans with SCI/D. This registry contains pertinent information on Veterans with SCI/D and enables better coordination of care among Veterans Health Administration (VHA) staff. The purpose of the SCI/D Registry and Outcomes Program is to assist clinicians, administrators, and researchers in identifying and tracking services for Veterans with spinal cord dysfunction resulting from trauma or diseases. The SCI/D Registry and Outcomes Program can also facilitate clinical, administrative, and research reports for medical center use. Local SCI/D Centers provide data extracts to the SCI/D National Program Office which then uses the data to provide a VA-wide review of Veteran demographics and clinical aspects of injuries and disorders.
CATEGORIES OF INDIVIDUALS COVERED BY THIS SYSTEM:
Veterans identified with SCI/D that have applied for VA healthcare services are included in the system. Occasionally, non-Veterans who have received VA healthcare or rehabilitation services under sharing agreements, contracted care, or humanitarian emergencies will also have information recorded in the SCI/D Registry and Outcomes Program.
CATEGORIES OF RECORDS IN THE SYSTEM:
These records contain identifying information including name, social security number, date of birth, and registration date in the SCI/D Registry and Outcomes Program. Registration information may include information about whether individuals are receiving services from VA's spinal cord system of care, neurologic level of injury, etiology, date of onset, type of cause, completeness of injury, and annual evaluation dates offered and received. The SCI/D Registry and Outcomes Program also stores outcome measures of impairment, activity, social role participation, and satisfaction with life. A registrant may have multiple outcome entries.
RECORD SOURCE CATEGORIES:
Various automated record systems providing clinical and managerial support to VA healthcare facilities, the Veteran, family members, accredited representatives or friends, and "Patient Medical Records-VA" (24VA10P2) system of records.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:
To the extent that records contained in the system include information protected by 45 CFR parts 160 and 164, i.e., individually-identifiable health information, and 38 U.S.C. 7332; i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific statutory authority in 38 U.S.C. 7332 and regulatory authority in 45 CFR parts 160 and 164 permitting disclosure.
1. The record of an individual who is covered by a system of records may be disclosed to a Member of Congress, or a staff person acting for the Member, when the Member or staff person requests the record on behalf of and at the written request of the individual.
2. Disclosure of records covered by this system, as deemed necessary and proper to named individuals serving as accredited Veterans service organization representatives, and other individuals named as approved agents or attorneys for a documented purpose and period of time. These agents/attorneys must be aiding beneficiaries in the preparation/presentation of their cases during verification and/or due process procedures or in the presentation/prosecution of claims under laws administered by VA.
3. A record containing the name(s) and address(es) of present or former members of the armed services and/or their dependents may be released from this system of records under certain circumstances:
[top] a. To any nonprofit organization if the release is directly connected with the conduct of programs and the utilization of benefits under Title 38, and
b. To any criminal or civil law enforcement governmental agency or instrumentality charged under applicable law with the protection of the public health or safety if a qualified representative of such organization, agency or instrumentality has made a written request that such name(s) or address(es) be provided for a purpose authorized by law; provided, further, that the record(s) will not be used for any purpose other than that stated in the request and that the organization, agency or instrumentality is aware of the penalty provision of 38 U.S.C. 5701(f).
4. Disclosure may be made to the National Archives and Records Administration and the General Services Administration in records management inspections conducted under authority of Title 44, Chapter 29, of the United States Code.
5. Disclosure of information, excluding name and address (unless name and address is furnished by the requester) for research purposes determined to be necessary and proper, to epidemiological and other research facilities approved by the Under Secretary for Health.
6. In order to conduct Federal research necessary to accomplish a statutory purpose of an agency, at the written request of the head of the agency, or designee of the head of that agency, the name(s) and address(es) of present or former personnel or the armed services and/or their dependents may be disclosed;
a. To a Federal department or agency; or
b. Directly to a contractor of a Federal department or agency. When a disclosure of this information is to be made directly to the contractor, VA may impose applicable conditions on the department, agency, and/or contractor to ensure the appropriateness of the disclosure to the contractor.
7. VA may disclose any information in this system, except the names and home addresses of Veterans and their dependents, that is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal, or regulatory in nature and whether arising by general or program statute or by regulation, rule or order issued pursuant thereto, to a Federal, state, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule, or order. VA may also disclose the names and addresses of Veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal, or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule, or order issued pursuant thereto.
8. For program review purposes and the seeking of accreditation and/or certification, disclosure may be made to survey teams of the Rehabilitation Accreditation Commission, The Joint Commission, College of American Pathologists, American Association of Blood Banks, and similar national accreditation agencies or boards with whom VA has a contract or agreement to conduct such reviews, but only to the extent that the information is necessary and relevant to the review.
9. Records from this system of records may be disclosed in a proceeding before a court, adjudicative body, or other administrative body when the Department, or any Department component or employee (in his or her official capacity as a VA employee), is a party to litigation; when the Department determines that litigation is likely to affect the Department, any of its components or employees, or the United States has an interest in the litigation, and such records are deemed to be relevant and necessary to the legal proceedings; provided, however, that the disclosure is compatible with the purpose for which the records were collected.
10. Disclosure may be made to individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor, subcontractor, public or private agency, or other entity or individual with whom VA has an agreement or contract to perform the services of the contract or agreement.
11. VA may disclose information in this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request for the information, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that release of the records to the DoJ is limited to circumstances where relevant and necessary to the litigation. VA may disclose records in this system of records in legal proceedings before a court or administrative body after determining that release of the records to the court or administrative body is limited to circumstances where relevant and necessary to the litigation.
12. Disclosure to other Federal agencies may be made to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs.
13. VA may disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records; (2) VA has determined that as a result of the suspected or confirmed breach there is a risk to individuals, VA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, or persons is reasonably necessary to assist in connection with VA efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.
14. VA may disclose identifying information, including social security number, concerning Veterans, spouses of Veterans, and the beneficiaries of Veterans to other Federal agencies for the purpose of conducting computer matches to obtain information to determine or verify eligibility of Veterans receiving VA medical care under Title 38, U.S.C.
15. VA may disclose patient identifying information to Federal agencies and VA and government-wide third-party insurers responsible for payment of the cost of medical care for the identified patients, in order for VA to seek recovery of the medical care costs. These records may also be disclosed as part of a computer matching program to accomplish this purpose.
16. VA may disclose information from this system to another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
[top] Magnetic tapes/disks and optical discs. Electronic data are maintained on Direct Access Storage Devices at the AITC. The AITC stores registry tapes for disaster backup at a secure, off-site
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are indexed by name of Veteran, social security number, unique patient identifiers.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records are under the following records schedule; Record Control Schedule (RCS) 10-1 item 6270. Master Files within a centralized database; Temporary; cutoff at the last unique patient entry or the death of a particular patient. Delete 75 years after cutoff. (N1-015-05-1, Item 1). Local Files (SCI centers and clinics); Temporary; delete when replaced by a subsequent file or 75 years after date of last activity for a particular patient. (N1-015-05-1, Item 2). Backup Files; Temporary; delete when master files have been deleted or replaced with a subsequent backup file. (N1-015-05-1, Item 3).
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
1. Data transmissions between VA healthcare facilities and the VA SCI/D National Program Office protected network folders. The SCI/D-Repository program and other programs at the respective facilities automatically flag records or events for transmission based upon functionality requirements. VA healthcare facilities control access to data by using VHA's VistA and Computerized Patient Record System (CPRS) security modules. The Department's Telecommunications Support Service has oversight responsibility for planning, security, and management of the wide area network.
2. Access to records at VA healthcare facilities is only authorized to VA personnel on a "need-to-know" basis. Records are maintained in staffed rooms during working hours. During nonworking hours, there is limited access to the building with visitor control by security personnel. Access to the National Program Office staff is generally restricted to SCI/D staff, VA Central Office employees, custodial personnel, Federal Protective Service, and authorized operational personnel through electronic locking devices. All other persons gaining access to the computer rooms are escorted. Backup records stored off-site for both the National Program Office and VA Central Office are safeguarded in secured storage areas.
3. Strict control measures are enforced to ensure that access to and disclosure from all records including electronic files and Veteran-specific data elements are limited to VHA employees whose official duties warrant access to those files. The automated record system recognizes authorized users by keyboard entry of unique passwords, access, and verify codes.
RECORD ACCESS PROCEDURE:
An individual who seeks access to records maintained under his or her name may write or visit the Program Office in which requests for services were made, the nearest VA facility, or write to the Chief Consultant, Spinal Cord Injury and Disorders Services (128N), 1660 South Columbian Way, Seattle, Washington 98108.
CONTESTING RECORD PROCEDURES:
(See Record Access procedures above).
NOTIFICATION PROCEDURE:
An individual who wishes to determine whether a record is being maintained in this system under his or her name or other personal identifier, or wants to determine the contents of such record, should submit a written request or apply in person to the last VA facility where medical care was provided or submit a written request to the Chief Consultant, Spinal Cord Injury and Disorders Services (128N), 1660 South Columbian Way, Seattle, Washington 98108. Inquiries should include the Veteran's name, social security number, and return address.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
Last full publication provided in 77 FR 73 dated April 16, 2012.
[FR Doc. 2020-02479 Filed 2-6-20; 8:45 am]
BILLING CODE 8320-01-P