E8-4895. Privacy Act of 1974

AGENCY:

Department of Veterans Affairs.

ACTION:

Notice of establishment of a new system of records.

SUMMARY:

The Privacy Act of 1974, (5 U.S.C. 552a(e)(4)) requires that all agencies publish in the Federal Register a notice of the existence and character of their systems of records. Notice is hereby given that the Department of Veterans Affairs (VA) is establishing a new system of records entitled “Inquiry Routing & Information System (IRIS)-VA” (151VA005N).

DATES:

Comments on this new system of records must be received no later than April 11, 2008. If no public comment is received, the new system will become effective April 11, 2008.

ADDRESSES:

Written comments concerning the proposed new system of records may be submitted through http://www.Regulations.gov; by mail or hand delivery to the Director, Regulations Management (00REG), Department of Veterans Affairs, 810 Vermont Avenue, NW., Room 1063B, Washington, DC 20420; or by fax to [phone] (This is not a toll free number). Copies of comments will be available for public inspection in the Office of Regulation Policy and Management, Room 1063B, between the hours of 8 a.m. and 4:30 p.m., Monday through Friday (except holidays). Please call [phone] (This is not a toll free number) for an appointment. In addition, during the comment period, comments may be viewed online through the Federal Docket Management System (FDMS) at http://www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT:

Ms. Diane Huber, Director, VA Web Solutions, Office of Information & Technology (005), 1335 East-West Highway, Silver Spring, Maryland 20910, telephone [phone] (This is not a toll free number).

SUPPLEMENTARY INFORMATION:

I. Description of the Proposed System of Records

The Department of Veterans Affairs (VA) receives and responds to questions, suggestions, compliments, complaints, requests for the status of claims and other information, collectively referred to as inquiries, received from veterans, their representatives and individuals and entities doing business with VA via a Web-based communications system known as the Inquiry Routing & Information System (IRIS). This system is also used by VA call center staff to enter inquiries on behalf of veterans and others doing business with the Department.

The IRIS is accessed by clicking on the “Contact VA” link that appears on VA Internet Web sites. Thousands of messages are received each month from VA beneficiaries and other veterans, veterans' family members and/or their representatives, health care professionals, clinicians, employees and managers of small businesses, vendors, funeral directors, mortgage companies, realtors, home buyers, researchers, small business owners, veterans' service organizations, other Federal agencies, State and local government employees, teachers, and other demographic groups representing every segment of the population both at home and abroad. Messages are routed throughout VA based on type of issue and topic as selected by the inquirer and also on the physical location of the inquirer, if provided. Messages go to designated mailgroups in Veterans Benefits Administration, Veterans Health Administration, National Cemetery Administration, and other VA program offices.

In November 2002, VA purchased and implemented a heavily customized version of a Web-based, commercial contact management product for use on VA's Internet Web site at http://www.va.gov and for use by VA call center personnel who enter inquiries on behalf of veterans or other callers. Visitors to the VA Web site and other inquirers may ask questions or provide VA with information by completing an approved form or having the form completed for them by call center staff. All personal data are captured and maintained within a database on a secure Web server running Secure Socket Layer (SSL). The information that VA requests on the form is necessary for VA to adequately respond to the inquiries. The IRIS gives VA managers the ability to track inquiry traffic, to measure the quality and timeliness of responses, and to develop and post Frequently Asked Questions (FAQs) based on the analysis of messages received.

The use of the IRIS by VA Web site visitors and callers to VA call centers illustrates its utility for communications with VA. VA staff will search the IRIS database by personal identifier to provide a thorough response to the inquirer. The expansion of the search capability in the IRIS database enables VA to provide better service, associate communications from a single individual and provide more thorough responses to their inquiries. The new system of records will cover anyone who chooses to submit an inquiry in person, by calling a VA call center, or by submitting an electronic message directly to VA.

Information requested to process the request may include name, address, phone number, e-mail address, and service or claim number and Social Security number if provided by the inquirer. Inquirers are not required to provide personal or contact information; however, in some instances VA may need this information in order to respond to specific inquiries. The authority to maintain these records is title 38, United States Code, section 501.

II. Routine Uses of Records Maintained in the System, Including Categories of Users and the Purposes of Such Uses

Limitation on Routine Use Disclosures: To the extent that records contained in the system include information protected by 45 CFR Parts 160 and 164, i.e., individually identifiable health information, and 38 U.S.C. 7332, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific statutory authority in 38 U.S.C. 7332 and regulatory authority in 45 CFR Parts 160 and 164 permitting disclosure.

1. Contractors: Disclosure may be made to individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor, subcontractor, public or private agency, or other entity or individual with whom VA has an agreement or contract to perform the services of the contract or agreement. This routine use includes disclosures by the individual or entity performing the service for VA to any secondary entity or individual to perform an activity that is necessary for individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to provide the service to VA.

2. Equal Employment Opportunity Commission: To disclose information to the Equal Employment Opportunity Commission when requested in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or for other functions of the Commission as authorized by law or regulation.

3. Merit Systems Protection Board: To disclose information to officials of the Merit Systems Protection Board, or the Office of the Special Counsel, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be authorized by law.

4. Law Enforcement: VA may disclose on its own initiative any information in this system, except the names and home addresses of veterans and their dependents, which is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal or regulatory in nature and whether arising by general or program statute or by regulation, rule or order issued pursuant thereto, to a Federal, State, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule or order. On its own initiative, VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto.

5. Credit Risk Analysis and Services: VA may, on its own initiative, disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the potentially compromised information; and (3) the disclosure is to agencies, entities, or persons whom VA determines are reasonably necessary to assist or carry out the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosures by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727.

The Office of Management of Budget (OMB) recommended the inclusion of a routine use in all Privacy Act systems of records to allow for the appropriate mitigation of data breaches.

6. Litigation: VA may disclose information in this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request for the information, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that disclosure of the records to the Department of Justice is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA, on its own initiative, may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records.

7. Congressional Offices: Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. The constituent should sign a release of information statement for this purpose.

Individuals sometimes request the help of a Member of Congress in resolving some issues relating to a matter before VA. The Member of Congress then writes VA, and VA must be able to give sufficient information to be responsive to the inquiry. That response may include communications to VA from an individual that was received through the IRIS.

8. National Archives and Records Administration (NARA): Disclosure may be made to NARA in records management activities and inspections conducted under authority of title 44 United States Code.

NARA is responsible for archiving records no longer actively used, but which may be appropriate for preservation. NARA is responsible, in general, for the physical maintenance of the Federal government's records. VA must be able to turn records over to this Agency in order to determine the proper disposition of such records.

9. Other Federal Agencies: Disclosure to other Federal agencies may be made to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs.

III. Compatibility of the Routine Uses

The Privacy Act permits disclosure of information about individuals without their consent for a routine use when the information will be used for a purpose that is compatible with the purpose for which the information is collected. In all of the routine use disclosures described above, either the recipient of the information will use the information in connection with a matter relating to one of VA's programs; to provide a benefit to VA; or because disclosure is required by law.

The Report of Intent to Publish a New System of Records Notice and an advance copy of the system notice has been sent to the appropriate Congressional committees and to the Director of the Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act), as amended, and guidelines issued by OMB (65 FR 77677), December 12, 2000.

Approved: February 25, 2008.

Gordon H. Mansfield,

Deputy Secretary of Veterans Affairs.

151VA005N

SYSTEM NAME:

Inquiry Routing & Information System (IRIS)—VA.

SYSTEM LOCATION:

The system of records is located in the Department of Veterans Affairs (VA) Data Center, 882 T. J. Jackson Drive, Falling Waters, West Virginia.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Individuals who contact VA via the VA Web site at http://www.va.gov or by contacting a VA call center including beneficiaries and other veterans, veterans' family members and/or their representatives, health care professionals, clinicians, employees and managers of small businesses, vendors, funeral directors, mortgage companies, realtors, home buyers, researchers, small business owners, veterans' service organizations, other Federal agencies, State and local government employees, teachers, and other demographic groups representing every segment of the population both at home and abroad.

CATEGORIES OF RECORDS IN THE SYSTEM:

The records include questions, complaints, suggestions, compliments, and/or requests for the status of claims and may also include name, address, phone number, e-mail address, service or claim number, Social Security number, date of birth; branch of service; entered on active duty date and released from active duty date.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Title 38, United States Code, section 501 and chapters 11, 13, 15, 17, 18, 19, 21, 23, 24, 30, 31, 32, 34, 35, 37, 39, 41, 42, and 43.

PURPOSE:

The purpose of this system of records is to receive and respond to questions, complaints, suggestions, compliments, and requests for the status of claims and other information by gathering sufficient information from the senders of inquiries to provide thorough, accurate and timely responses. The IRIS gives VA the ability to track inquiry traffic, measure the quality and timeliness of responses, and develop and post Frequently Asked Questions (FAQs) based on the analysis of messages received. VA management also uses the information to quantify contacts, analyze issues pertaining to veterans and VA's mission, and to measure staff performance regarding the quality and timeliness of responses.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

To the extent that records contained in the system include information protected by 45 CFR Parts 160 and 164, i.e., individually identifiable health information, and 38 U.S.C. 7332, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific statutory authority in 38 U.S.C. 7332 and regulatory authority in 45 CFR Parts 160 and 164 permitting disclosure.

1. Disclosure may be made to individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor, subcontractor, public or private agency, or other entity or individual with whom VA has an agreement or contract to perform the services of the contract or agreement. This routine use includes disclosures by the individual or entity performing the service for VA to any secondary entity or individual to perform an activity that is necessary for individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to provide the service to VA.

2. To disclose information to the Equal Employment Opportunity Commission when requested in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or for other functions of the Commission as authorized by law or regulation.

3. To disclose information to officials of the Merit Systems Protection Board, or the Office of the Special Counsel, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be authorized by law.

4. VA may disclose on its own initiative any information in this system, except the names and home addresses of veterans and their dependents, which is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal or regulatory in nature and whether arising by general or program statute or by regulation, rule or order issued pursuant thereto, to a Federal, State, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule or order. On its own initiative, VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto.

5. VA may, on its own initiative, disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the potentially compromised information; and (3) the disclosure is to agencies, entities, or persons whom VA determines are reasonably necessary to assist or carry out the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosures by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727.

6. VA may disclose information in this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request for the information, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that disclosure of the records to the Department of Justice is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA, on its own initiative, may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records.

7. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual if the individual has signed a release statement.

8. Disclosure may be made to National Archives and Records Administration (NARA) in records management activities and inspections conducted under authority of title 44 United States Code.

9. Disclosure may be made to other Federal agencies to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

The IRIS stores electronic messages on the IRIS server and archives to secure storage media that is approved for use by VA.

RETRIEVABILITY:

All records in the IRIS are electronic only and are retrieved by system inquiry number, name, residence address, e-mail address, Social Security number, and claim or service number.

SAFEGUARDS:

The IRIS runs on a Secure Socket Layer (SSL) and can only be accessed by authorized persons employed by and/or contracted to VA with the use of unique usernames and passwords, consistent with VA security policy.

The server on which the IRIS software and database reside is located in a secure facility at 882 T. J. Jackson Drive, Falling Waters, West Virginia. This facility is locked down at all times and has a security guard on duty at all times. Access to the computer room is restricted to specifically authorized VA staff or persons contracted to VA. In addition, these persons must have separate and authorized access to the IRIS server itself. All electronic data in this system are backed up nightly, with backups stored electronically and securely in the Falling Waters, West Virginia location.

RETENTION AND DISPOSAL:

Records are maintained and disposed of in accordance with the records disposition authority approved by the Archivist of the United States. At the current time, the Office of Information & Technology does not have records disposition authority for these records that has been approved by the Archivist of the United States. The System Manager has initiated action to seek and obtain such disposition authority in accordance with VA Handbook 6300.1, Records Management Procedures. The records will not be destroyed until VA obtains a NARA-approved records disposition authority. Once VA has obtained NARA-approved records disposition authority, VA OGC will amend this notice to reflect that authority, and any destruction of electronic records will occur when no longer needed for administrative, legal, audit, or other operational purposes.

SYSTEM MANAGER(S) AND ADDRESS:

The IRIS system falls under the jurisdiction of the Director, VA Web Solutions, Office of Information & Technology (OI&T) (005Q3), OI Field Office, 1335 East-West Highway, Silver Spring, Maryland 20910.

NOTIFICATION PROCEDURES:

A person who wishes to determine whether a record is being maintained in this system under his or her name or other personal identifier or wishes to determine the contents of such records should submit a written request or apply in person to VA Web Solutions, Office of Information & Technology (OI&T) (005Q3), OI Field Office, 1335 East-West Highway, Silver Spring, Maryland 20910. Requests should contain full name, address and phone number of the person making this request.

RECORD ACCESS PROCEDURE:

Individuals seeking information regarding access to and amendment of records in this system may write, call or visit VA Web Solutions, Office of Information & Technology (OI&T) (005Q3), OI Field Office, 1335 East-West Highway, Silver Spring, Maryland 20910. Requests should contain full name, address and phone number of the person making this request.

CONTESTING RECORD PROCEDURES:

(See Record Access Procedure above.)

RECORD SOURCE CATEGORIES:

Individuals who contact VA via the VA Web site at http://www.va.gov or by using a VA call center include veterans, veterans' family members and/or their representatives, government employees (Federal, State and local), realtors and home buyers, small business owners, vendors, funeral directors, clinicians, teachers, researchers, employees of veterans' service organizations, members of the public and all other individuals and representatives of organizations.

EXEMPTIONS CLAIMED FOR SYSTEM:

No exemptions claimed for this system.