2015-11493. Privacy Act of 1974

AGENCY:

Department of Veteran Affairs

ACTION:

Notice of establishment of a new system of records.

SUMMARY:

The Privacy Act of 1974, (5 U.S.C. 552a(e)(4)) requires that all agencies publish in the Federal Register a notice of the existence and character of their systems of records. Notice is hereby given that the Department of Veterans Affairs (VA) is establishing a new system of records entitled “Inquiry Routing & Information System (IRIS)-VA” (151VA005OP6). This system was previously listed as 151VA005N and was published in the Federal Register/Vol. 73, No. 49/Wednesday, March 12, 2008/Notices. The time elapsed since its original publication requires that a new notice be published as 151VA005OP6.

DATES:

Comments on this new system of records must be received no later than June 12, 2015. If no public comment is received, the new system will become effective June 12, 2015.

ADDRESSES:

Written comments concerning the proposed new system of records may be submitted through www.Regulations.gov; by mail or hand delivery to the Director, Regulations Management (00REG), Department of Veterans Affairs, 810 Vermont Avenue NW., Room 1063B, Washington, DC 20420; or by fax to [phone] (This is not a toll free number). Copies of comments will be available for public inspection in the Office of Regulation Policy and Management, Room 1063B, between the hours of 8:00 a.m. and 4:30 p.m., Monday through Friday (except holidays). Please call [phone] (This is not a toll free number) for an appointment. In addition, during the comment period, comments may be viewed online through the Federal Docket Management System (FDMS) at www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT:

Ms. Diane Huber, Director, Enterprise Web Application Support (EWAS) 005Q3, Service Delivery and Engineering (SDE). Office Location: 1100 1st St. NE., Rm. 513, Washington, DC 20002-4221, telephone [phone] (This is not a toll free number).

SUPPLEMENTARY INFORMATION:

I. Description of the Proposed System of Records

The Department of Veterans Affairs (VA) receives and responds to questions, suggestions, compliments, complaints, requests for the status of claims and other information, collectively referred to as inquiries, received from veterans, their representatives and individuals and entities doing business with VA via a Web-based communications system known as the Inquiry Routing & Information System (IRIS). This system is also used by VA call center staff to enter inquiries on behalf of veterans and others doing business with the Department.

The IRIS is accessed by clicking on the “Contact Us” link that appears on VA Internet Web sites. Thousands of messages are received each month from VA beneficiaries and other veterans, veterans' family members and/or their representatives, health care professionals, clinicians, employees and managers of small businesses, vendors, funeral directors, mortgage companies, realtors, home buyers, researchers, small business owners, veterans' service organizations, other Federal agencies, State and local government employees, teachers, and other demographic groups representing every segment of the population both at home and abroad. Messages are routed throughout VA based on type of issue and topic as selected by the inquirer and also on the physical location of the inquirer, if provided. Messages go to designated mailgroups in Veterans Benefits Administration, Veterans Health Administration, National Cemetery Administration, and other VA program offices.

In November 2002, VA purchased and implemented a heavily customized version of a Web-based, commercial contact management product for use on VA's Internet Web site at www.va.gov and for use by VA call center personnel who enter inquiries on behalf of veterans or other callers. Visitors to the VA Web site and other inquirers may ask questions or provide VA with information by completing an approved form or having the form completed for them by call center staff. All personal data are captured and maintained within a database on a secure Web server running Secure Socket Layer (SSL) and Transport Layer Security (TLS). The Web server resides at the vendor's (Oracle) FedRamp-certified secure government cloud facility in Elk Grove, Illinois. The information that VA requests on the form is necessary for VA to adequately respond to the inquiries. The IRIS gives VA managers the ability to track inquiry traffic, to measure the quality and timeliness of responses, and to develop and post Frequently Asked Questions (FAQs) based on the analysis of messages received.

The use of the IRIS by VA Web site visitors and callers to VA call centers illustrates its utility for communications with VA. VA staff will search the IRIS database by personal identifier to provide a thorough response to the inquirer. The expansion of the search capability in the IRIS database enables VA to provide better service, associate communications from a single individual and provide more thorough responses to their inquiries. The new system of records will cover anyone who chooses to submit an inquiry in person, by calling a VA call center, or by submitting an electronic message directly to VA.

Information requested to process the request may include name, address, telephone number, email address, branch of service and service or claim number and Social Security number if provided by the inquirer. Inquirers are not required to provide personal or contact information; however, in some instances VA may need this information in order to respond to specific inquiries. The authority to maintain these records is title 38, United States Code, section 501.

II. Routine Uses of Records Maintained in the System, Including Categories of Users and the Purposes of Such Uses

Limitation on Routine Use Disclosures: To the extent that records contained in the system include information protected by 45 CFR parts 160 and 164, i.e., individually identifiable health information, and 38 U.S.C. 7332, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific statutory authority in 38 U.S.C. 7332 and regulatory authority in 45 CFR parts 160 and 164 permitting disclosure.

1. Contractors: Disclosure may be made to individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor, subcontractor, public or private agency, or other entity or individual with whom VA has an agreement or contract to perform the services of the contract or agreement. This routine use includes disclosures by the individual or entity performing the service for VA to any secondary entity or individual to perform an activity that is necessary for individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to provide the service to VA.

2. Equal Employment Opportunity Commission: To disclose information to the Equal Employment Opportunity Commission when requested in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or for other functions of the Commission as authorized by law or regulation.

3. Merit Systems Protection Board: To disclose information to officials of the Merit Systems Protection Board, or the Office of the Special Counsel, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be authorized by law.

4. Law enforcement: VA may disclose on its own initiative any information in this system, except the names and home addresses of veterans and their dependents, which is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal or regulatory in nature and whether arising by general or program statute or by regulation, rule or order issued pursuant thereto, to a Federal, State, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule or order. On its own initiative, VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto.

5. Credit risk analysis and services: VA may, on its own initiative, disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the potentially compromised information; and (3) the disclosure is to agencies, entities, or persons whom VA determines are reasonably necessary to assist or carry out the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosures by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727.

The Office of Management of Budget (OMB) recommended the inclusion of a routine use in all Privacy Act systems of records to allow for the appropriate mitigation of data breaches.

6. Litigation: VA may disclose information in this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request for the information, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that disclosure of the records to the Department of Justice is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA, on its own initiative, may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records.

7. Congressional Offices: Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. The constituent should sign a release of information statement for this purpose.

Individuals sometimes request the help of a Member of Congress in resolving some issues relating to a matter before VA. The Member of Congress then writes VA, and VA must be able to give sufficient information to be responsive to the inquiry. That response may include communications to VA from an individual that was received through the IRIS.

8. National Archives and Records Administration (NARA): Disclosure may be made to NARA in records management activities and inspections conducted under authority of title 44 United States Code.

NARA is responsible for archiving records no longer actively used, but which may be appropriate for preservation. NARA is responsible, in general, for the physical maintenance of the Federal government's records. VA must be able to turn records over to this Agency in order to determine the proper disposition of such records.

9. Other Federal Agencies: Disclosure to other Federal agencies may be made to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs.

III. Compatibility of the Routine Uses

The Privacy Act permits disclosure of information about individuals without their consent for a routine use when the information will be used for a purpose that is compatible with the purpose for which the information is collected. In all of the routine use disclosures described above, either the recipient of the information will use the information in connection with a matter relating to one of VA's programs; to provide a benefit to VA; or because disclosure is required by law.

The Report of Intent to Publish a New System of Records Notice and an advance copy of the system notice has been sent to the appropriate Congressional committees and to the Director of the Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act), as amended, and guidelines issued by OMB (65 FR 77677), December 12, 2000.

Signing Authority

The Secretary of Veterans Affairs, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Jose D. Riojas, Chief of Staff, approved this document on April 24, 2015, for publication.

Dated: April 28, 2015.

Kathleen M. Manwell,

VA Privacy Service, Office of Privacy and Records Management, Department of Veterans Affairs.

151VA005OP6

SYSTEM NAME:

Inquiry Routing & Information System (IRIS)-VA

SYSTEM LOCATION:

The system of records is located at Oracle's secure government cloud facility at Equnix Datacenter, 1905 Lunt Avenue, Elk Grove, Illinois 60007.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Individuals who contact VA via the VA Web site at www.va.gov or by contacting a VA call center including beneficiaries and other veterans, veterans' family members and/or their representatives, health care professionals, clinicians, employees and managers of small businesses, vendors, funeral directors, mortgage companies, realtors, home buyers, researchers, small business owners, veterans' service organizations, other Federal agencies, State and local government employees, teachers, and other demographic groups representing every segment of the population both at home and abroad.

CATEGORIES OF RECORDS IN THE SYSTEM:

The records include questions, complaints, suggestions, compliments, and/or requests for the status of claims and may also include name, address, phone number, email address, service or claim number, Social Security number, date of birth; branch of service; entered on active duty date and released from active duty date,

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Title 38, United States Code, Sections 501 and 7304.

PURPOSE:

The purpose of this system of records is to receive and respond to questions, complaints, suggestions, compliments, and requests for the status of claims and other information by gathering sufficient information from the senders of inquiries to provide thorough, accurate and timely responses. The IRIS gives VA the ability to track inquiry traffic, measure the quality and timeliness of responses, and develop and post Frequently Asked Questions (FAQs) based on the analysis of messages received. VA management also uses the information to quantify contacts, analyze issues pertaining to veterans and VA's mission, and to measure staff performance regarding the quality and timeliness of responses.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

To the extent that records contained in the system include information protected by 45 CFR parts 160 and 164, i.e., individually identifiable health information, and 38 U.S.C. 7332, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific statutory authority in 38 U.S.C. 7332 and regulatory authority in 45 CFR parts 160 and 164 permitting disclosure.

1. Disclosure may be made to individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor, subcontractor, public or private agency, or other entity or individual with whom VA has an agreement or contract to perform the services of the contract or agreement. This routine use includes disclosures by the individual or entity performing the service for VA to any secondary entity or individual to perform an activity that is necessary for individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement the to provide the service to VA.

2. To disclose information to the Equal Employment Opportunity Commission when requested in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or for other functions of the Commission as authorized by law or regulation.

3. To disclose information to officials of the Merit Systems Protection Board, or the Office of the Special Counsel, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be authorized by law.

4. VA may disclose on its own initiative any information in this system, except the names and home addresses of veterans and their dependents, which is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal or regulatory in nature and whether arising by general or program statute or by regulation, rule or order issued pursuant thereto, to a Federal, State, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule or order. On its own initiative, VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto.

5. VA may, on its own initiative, disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the potentially compromised information; and (3) the disclosure is to agencies, entities, or persons whom VA determines are reasonably necessary to assist or carry out the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosures by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727.

6. VA may disclose information in this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request for the information, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that disclosure of the records to the Department of Justice is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA, on its own initiative, may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records.

7. VA may disclose information to a member of Congress or a congressional staff member in response to an inquiry from the congressional office made at the request of that individual.

8. Disclosure may be made to National Archives and Records Administration (NARA) in records management activities and inspections conducted under authority of title 44 United States Code.

9. Disclosure may be made to other Federal agencies to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

The IRIS stores electronic and archived messages on the secure IRIS server at the Oracle's FedRamp-approved hosting facility in Elk Grove, Illinois.

RETRIEVABILITY:

All records in the IRIS are electronic only and are retrieved by system inquiry number, and/or name, and/or zip code, and/or email address, and/or Social Security number, and/or claim and/or service number.

SAFEGUARDS:

The IRIS runs on a Secure Socket Layer (SSL) and on Transport Layer Security (TLS) and can only be accessed by authorized persons employed by and/or contracted to VA with the use of unique usernames and passwords, consistent with VA security policy.

The server on which the IRIS software and database reside is located in a secure facility at Equnix Datacenter, 1905 Lunt Ave., Elk Grove, Illinois 60007. This facility is locked down at all times and has a security guard on duty at all times. Access to the computer room is restricted to specifically authorized VA staff or persons contracted to VA. In addition, these persons must have separate and authorized access to the IRIS server itself. All electronic data in this system are backed up nightly, with backups stored electronically and securely in the Elk Grove, Illinois location.

RETENTION AND DISPOSAL:

Records are maintained and disposed of with records disposition authority approved by the Archivist of the United States.

SYSTEM MANAGER(S) AND ADDRESS:

The IRIS system falls under the jurisdiction of the Director, Enterprise Web Applications Support (EWAS) 005Q3, Service Delivery and Engineering (SDE), Office of Information & Technology (OI&T) OI Field Office, 1100 1st St. NE., Room 513, Washington, DC 20002-4221.

NOTIFICATION PROCEDURES:

A person who wishes to determine whether a record is being maintained in this system under his or her name or other personal identifier or wishes to determine the contents of such records should submit a written request or apply in person to Enterprise Web Applications Support (EWAS) 005Q3, Service Delivery and Engineering (SDE), Office of Information & Technology (OI&T),OI Field Office, 1100 1st St. NE., Room 513, Washington, DC 20002-4221. Requests should contain full name, address and phone number of the person making this request.

RECORD ACCESS PROCEDURE:

Individuals seeking information regarding access to and amendment of records in this system may write, call or visit Enterprise Web Applications Support (EWAS)005Q3, Service Delivery and Engineering (SDE), Office of Information & Technology (OI&T), OI Field Office, 1100 1st St. NE., Room 513, Washington, DC 20002-4221. Requests should contain full name, address and phone number of the person making this request.

CONTESTING RECORD PROCEDURES:

(See Record Access Procedure above)

RECORD SOURCE CATEGORIES:

Individuals who contact VA via the VA Web site at www.va.gov or by using a VA call center include veterans, veterans' family members and/or their representatives, government employees (Federal, State and local), realtors and home buyers, small business owners, vendors, funeral directors, clinicians, teachers, researchers, employees of veterans' service organizations, member of the public and all other individuals and representatives of organizations.

RECORD SOURCE CATEGORIES:

Information contained in this system of records is provided by Veterans, beneficiaries, family members, and all other persons doing business with VA using Contact VA on department Web sites and utilizing 800 toll free numbers to reach VA call centers, regional offices, medical centers and other VA entities.