2024-01984. Privacy Act of 1974; System of Records

AGENCY:

Veterans Health Administration (VHA), Department of Veterans Affairs (VA).

ACTION:

Notice of a modified system of records.

SUMMARY:

Pursuant to the Privacy Act of 1974, notice is hereby given that the Department of Veterans Affairs (VA) is modifying the system of records entitled, “Caregiver Support Program—Caregiver Record Management Application (CARMA)–VA” (197VA10). This system is used to administer, monitor and track services delivered through VA's Caregiver Support Program including documentation of calls to the Caregiver Support Line.

DATES:

Comments on this modified system of records must be received no later than 30 days after date of publication in the Federal Register . If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by VA, the modified system of records will become effective a minimum of 30 days after date of publication in the Federal Register . If VA receives public comments, VA shall review the comments to determine whether any changes to the notice are necessary.

ADDRESSES:

Comments may be submitted through www.Regulations.gov or mailed to VA Privacy Service, 810 Vermont Avenue NW, (005X6F), Washington, DC 20420. Comments should indicate that they are submitted in response to “Caregiver Support Program-Caregiver Record Management Application (CARMA)–VA” (197VA10). Comments received will be available at www.Regulations.gov for public viewing, inspection or copies.

FOR FURTHER INFORMATION CONTACT:

Stephania Griffin, Veterans Health Administration (VHA) Chief Privacy Officer, Department of Veterans Affairs, 810 Vermont Avenue NW, (105HIG) Washington, DC 20420, [e-mail], telephone [phone] (Note: This is not a toll-free number).

SUPPLEMENTARY INFORMATION:

VA is modifying this system of records to identify changes that will more accurately describe the records maintained in the system. Modifications have been made to the following titled sections: System Manager; Purposes of the System; Categories of Records in the System; Record Source Categories; Routine Uses of Records Maintained in the System; Policies and Practices for Retrievability of Records; Policies and Practices for Retention and Disposal of Records; Physical, Procedural, and Administrative Safeguards; Record Access Procedure; Contesting Record Procedure; and Notification Procedure. VA is republishing the system notice in its entirety.

The System Manager is being updated to replace Deputy Chief Officer, Patient Care Services Office (10P4C), with Colleen M. Richardson, Psy.D, Executive Director, Caregiver Support Program (12CSP).

The Purpose of the System is being modified to include the explanation that this system may also be used for improving health care operations, such as producing various management and patient follow-up reports; program monitoring for epidemiological research and other health care related or program impact studies; statistical analysis, resource allocation, and planning and process improvement; providing clinical and administrative support to patient medical care and services; determining entitlement and eligibility benefits; processing and adjudicating benefit claims; and general program oversight activities.

The Categories of Records in the System section has additional language regarding VA Form 10–305, “Your Rights to Seek Further Review of Program of Comprehensive Assistance for Family Caregivers (PCAFC) Decisions.”

The Record Source Categories section has been expanded to include the Board of Veterans' Appeals and other VA staff offices.

The section for Routine Uses of Records Maintained in the System for this VA system of records notice has been amended.

Standardized Routine Uses #16 through #18 have been added to this system of records notice.

The following standard routine use is added and will be Routine Use #16, Equal Employment Opportunity Commission (EEOC): To the EEOC in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or other functions of the Commission as authorized by law.

The following standard routine use is added and will be Routine Use #17, Federal Labor Relations Authority (FLRA): To the FLRA in connection with the investigation and resolution of allegations of unfair labor practices, the resolution of exceptions to arbitration awards when a question of material fact is raised, matters before the Federal Service Impasses Panel, and the investigation of representation petitions and the conduct or supervision of representation elections.

The following standard routine use is added and will be Routine Use #18, Merit Systems Protection Board (MSPB): To the MSPB in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by law.

Routine Use #19 is added to promulgate the use of information for VA research which states, Researchers, for Research: To epidemiological and other research facilities approved by the Under Secretary for Health for research purposes determined to be necessary and proper, provided that the names and addresses of Veterans, their dependents and caregivers will not be disclosed unless those names and addresses are first provided to VA by the facilities making the request.

The Policies and Practices for Retrievability of Records section is being modified to exclude the Social Security number as an identifier to retrieve records on an individual.

The Policies and Practices for Retention and Disposal of Records is being modified to state that CARMA records are disposed of in accordance with the schedule approved by the Archivist of the United States, VHA Records Control Schedule (RCS) 10–1, Item Number 7900, Temporary; Destroy 75 years after enrollment.

Physical, Procedural, and Administrative Safeguards has been amended to include Amazon Web Services as a procedural safeguard for sensitive information.

The Record Access Procedure, Contesting Record Procedure and Notification Procedure have been modified to reflect standard language across VA systems of records.

The Report of Intent to Modify a System of Records Notice and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of the Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.

Signing Authority

The Senior Agency Official for Privacy, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Kurt D. DelBene, Assistant Secretary for Information and Technology and Chief Information Officer, approved this document on December 18, 2023 for publication.

Dated: January 29, 2024.

Amy L. Rose,

Government Information Specialist, VA Privacy Service, Office of Compliance, Risk and Remediation, Office of Information and Technology, Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:

“Caregiver Support Program—Caregiver Record Management Application (CARMA)–VA” (197VA10)

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

The Caregiver Record Management Application (CARMA) system is hosted in the Salesforce Gov Cloud. The Salesforce's corporate address is 1 Market Street #300, San Francisco, CA 94105.

SYSTEM MANAGER(S):

Official responsible for policies and procedures: Colleen M. Richardson, Psy.D, Executive Director, Caregiver Support Program (12CSP), 810 Vermont Avenue NW, Washington, DC 20420, [e-mail], telephone number (202) 461–1635 (Note: This is not a toll-free number).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Caregivers and Veterans Omnibus Health Services Act of 2010, Public Law 111–163; 38 CFR 71.40; and 31 U.S.C. 3321.

PURPOSE(S) OF THE SYSTEM:

Records in this system of records are used to administer, monitor and track the services and benefits, sought and delivered through VA's Caregiver Support Program, including the documentation of telephone calls to the Caregiver Support Line. The system and data contained therein is used to fully support the Program of Comprehensive Assistance for Family Caregivers (PCAFC) and allows for data assessment and comprehensive monitoring. The CARMA workflow management system is being used for Social Security number matching and other data field requirements. In addition, information in this system of records is used to respond to Congressional and/or internal and external stakeholders on the performance of the VA Caregiver Support Program. This system may also be used for the purpose of improving health care operations such as producing various management and patient follow-up reports; program monitoring for epidemiological research and other health care related or program impact studies; statistical analysis, resource allocation, and planning and process improvement; providing clinical and administrative support to patient medical care and services; determining entitlement and eligibility benefits; processing and adjudicating benefit claims; and general program oversight activities.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The records include Veterans and caregivers inquiring about, applying for, participating in and those who have previously applied for or participated in the PCAFC or the Program of General Caregiver Support Services (PGCSS) established by the Caregivers and Veterans Omnibus Health Services Act of 2010, Public Law 111–163, as well as individuals who contact or are contacted by VA's Caregiver Support Line, Veterans, their spouses and dependents as provided for in other provisions of title 38 U.S.C.

CATEGORIES OF RECORDS IN THE SYSTEM:

Records in this system include: the Veteran and caregiver(s) name, Social Security number, gender, age, date of birth, address, phone number, and email address; VA eligibility related information, such as service connection, DD 214, “Certification of Release or Discharge from Active Duty”, Line of Duty documentation; PCAFC stipend payment information; written correspondence; VA Form 10–10CG, “Application for Comprehensive Assistance for Family Caregiver Program”; requests for information about PCAFC Decisions (VA Form 10–305, “Your Rights to Seek Further Review of Program of Comprehensive Assistance for Family Caregivers (PCAFC) Decisions”) and responses to such requests; Decision Notice Letters pertaining to eligibility for and participation in PCAFC and PGCSS; requests for further review and appeal of PCAFC decisions and related records in support of these claims and decisions, and correspondence with Caregiver Support Line, including referral information and VA staff remarks.

RECORD SOURCE CATEGORIES:

Records in this system of records may be provided by the applicant, applicant's spouse or other family members or accredited representatives or friends; Veterans, caregivers, and other interested parties seeking or receiving information, benefits or services about VA's Caregiver Support Program, including the Caregiver Support Line; VA employees; and VA systems including but not limited to Veterans Health Information System and Technology Architecture (VistA), VA Master Person Index, VHA Corporate Data Warehouse, and Enrollment System; Veterans Benefits Administration (VBA); the Board of Veterans' Appeals (BVA); other VA staff offices; and State and Federal agencies.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

To the extent that records contained in the system include information protected by 45 CFR parts 160 and 164, i.e., individually identifiable health information of VHA or any of its business associates, and 38 U.S.C. 7332, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia, or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific disclosure authority in both 38 U.S.C. 7332 and 45 CFR parts 160, 161, and 164.

1. Claims Representatives: To accredited service organizations, VA-approved claim agents, and attorneys acting under a declaration of representation, so that these individuals can aid claimants in the preparation, presentation, and prosecution of claims under the laws administered by VA upon the request of the claimant and provided that the disclosure is limited to information relevant to a claim, such as the name, address, the basis and nature of a claim, amount of benefit payment information, medical information, and military service and active duty separation information.

2. Law Enforcement: To a Federal, State, local, Territorial, Tribal, or foreign law enforcement authority or other appropriate entity charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing such law, provided that the disclosure is limited to information that, either alone or in conjunction with other information, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature. The disclosure of the names and addresses of Veterans and their dependents from VA records under this routine use must also comply with the provisions of 38 U.S.C. 5701.

3. Guardians, Courts, for Incompetent Veterans: To a court, magistrate, or administrative tribunal in matters of guardianship, inquests, and commitments; to private attorneys representing Veterans rated incompetent in conjunction with the issuance of Certificates of Incompetency; or to probation and parole officers in connection with court-required duties.

4. Guardians Ad Litem, for Representation: To a fiduciary or guardian ad litem in relation to his or her representation of a claimant in any legal proceeding as relevant and necessary to fulfill the duties of the fiduciary or guardian ad litem.

5. Attorneys, Insurers, Employers: To attorneys, insurance companies, employers, third parties liable or potentially liable under health plan contracts, and courts, boards, or commissions as relevant and necessary to aid VA in the preparation, presentation, and prosecution of claims authorized by law.

6. DoJ, Litigation, Administrative Proceeding: To the Department of Justice (DoJ), or in a proceeding before a court, adjudicative body, or other administrative body before which VA is authorized to appear, when:

(a) VA or any component thereof;

(b) Any VA employee in his or her official capacity;

(c) Any VA employee in his or her individual capacity where DoJ has agreed to represent the employee; or

(d) The United States, where VA determines that litigation is likely to affect the agency or any of its components is a party to such proceedings or has an interest in such proceedings, and VA determines that use of such records is relevant and necessary to the proceedings.

7. National Archives and Records Administration (NARA): To National Archives and Records Administration (NARA) in records management inspections conducted under 44 U.S.C. 2904 and 2906, or other functions authorized by laws and policies governing NARA operations and VA records management responsibilities.

8. Treasury, for Withholding: To the Department of the Treasury for the collection of title 38 benefit overpayments, overdue indebtedness, or costs of services provided to an individual not entitled to such services, by the withholding of all or a portion of the person's Federal income tax refund, provided that the disclosure is limited to information concerning an individual's indebtedness by virtue of a person's participation in a benefits program administered by VA.

9. Consumer Reporting Agencies: To a consumer reporting agency for the purpose of locating the individual, obtaining a consumer report to determine the ability of the individual to repay an indebtedness to the United States, or assisting in the collection of such indebtedness, provided that the provisions of 38 U.S.C. 5701(g)(2) and (4) have been met, provided that the disclosure is limited to information that is reasonably necessary to identify such individual or concerning that individual's indebtedness to the United States by virtue of the person's participation in a benefits program administered by the Department.

10. Contractors: To contractors, grantees, experts, consultants, students, and others performing or working on a contract, service, grant, cooperative agreement, or other assignment for VA, when reasonably necessary to accomplish an agency function related to the records.

11. Congress: To a Member of Congress or staff acting upon the Member's behalf when the Member or staff requests the information on behalf of, and at the request of, the individual who is the subject of the record.

12. Identity Theft Remediation, for Another Federal Agency: To other Federal agencies may be made to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs. This routine use permits disclosures by the Department to report a suspected incident of identity theft and provide information and/or documentation related to or in support of the reported incident.

13. Data Breach Response and Remediation, for VA: To appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records; (2) VA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, VA (including its information systems, programs, and operations), the Federal Government or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with VA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

14. Federal Agencies, for Computer Matches: To other Federal agencies for the purpose of conducting computer matches to obtain information to determine or verify eligibility of Veterans receiving VA benefits or medical care under title 38.

15. Data Breach Response and Remediation, for Another Federal Agency: To another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

16. Equal Employment Opportunity Commission (EEOC): To the EEOC in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or other functions of the Commission as authorized by law.

17. Federal Labor Relations Authority (FLRA): To the FLRA in connection with the investigation and resolution of allegations of unfair labor practices, the resolution of exceptions to arbitration awards when a question of material fact is raised, matters before the Federal Service Impasses Panel, and the investigation of representation petitions and the conduct or supervision of representation elections.

18. Merit Systems Protection Board (MSPB): To the MSPB in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by law.

19. Researchers, for Research: To epidemiological and other research facilities approved by the Under Secretary for Health for research purposes determined to be necessary and proper, provided that the names and addresses of Veterans, their dependents and caregivers will not be disclosed unless those names and addresses are first provided to VA by the facilities making the request.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

The CARMA system of records is hosted in the Salesforce Gov Cloud (GovCloud). The production environment (including application data) is backed up weekly to VA's Amazon Web Services (AWS) Cloud.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records in this system are retrieved by name, integration control number (ICN), correspondence tracking number, internal record number, facility number, or other assigned identifiers of the individuals on whom they are maintained.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records in this system are retained and disposed of in accordance with the schedule approved by the Archivist of the United States, VHA RCS 10–1, Item Number 7900, Temporary; Destroy 75 years after enrollment.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL, SAFEGUARDS:

1. On an annual basis, employees are required to sign a computer access agreement acknowledging their understanding of confidentiality requirements. In addition, all employees receive annual privacy awareness and information security training.

2. Access to electronic records is deactivated when no longer required for official duties. Recurring monitors are in place to ensure compliance with nationally and locally established security measures.

3. Strict control measures are enforced to ensure that access to and disclosure from all records are limited to VA and the contractor's employees whose official duties warrant access to those files.

4. Access to the records in CARMA is restricted and requires approval prior to access. Restricted access will be provided to enable workflow management to administer, monitor and track services delivered through VA's Caregiver Support Program including, but not limited to, documentation of calls to the Caregiver Support Line.

5. The records in CARMA are safeguarded by the AWS GovCloud infrastructure that has been authorized at the high-impact level under the Federal Risk and Authorization Management Program. The secure site-to-site encrypted network connection is limited to access via the VA trusted internet connection.

RECORD ACCESS PROCEDURE:

Individuals seeking information on the existence and content of records in this system pertaining to them should contact the system manager in writing as indicated above or inquire in person at the nearest VA facility. A request for access to records must contain the requester's name, address, telephone number, signed by the requester, and describes the records sought in sufficient detail to enable VA personnel to locate them with a reasonable amount of effort.

CONTESTING RECORD PROCEDURES:

Individuals seeking to contest or amend records in this system pertaining to them should contact the system manager in writing as indicated above or inquire in person at the nearest VA facility. A request to contest or amend records must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record.

NOTIFICATION PROCEDURES:

Generalized notice is provided by the publication of this notice. For specific notice, see Record Access Procedure, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

86 FR 18588 (April 9, 2021).