2023-10729. Privacy Act of 1974; System of Records

AGENCY:

Veterans Health Administration, Department of Veterans Affairs (VA).

ACTION:

Notice of a modified system of records.

SUMMARY:

As required by the Privacy Act of 1974, notice is hereby given that the Department of Veterans Affairs (VA) is modifying the system of records entitled, “National Prosthetic Patient Database (NPPD)–VA” (33VA113) as set forth in the Federal Register . This system is used to furnish administrative and clinical statistical procurement and prescription information, including total cost and summary of activity, including equipment usage, data to VA and other health care providers, both Federal and non-Federal, to aid in furthering the improvement of health care, research, and education.

DATES:

Comments on this modified system of records must be received no later than 30 days after date of publication in the Federal Register . If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by the VA, the modified system of records will become effective a minimum of 30 days after date of publication in the Federal Register . If VA receives public comments, VA shall review the comments to determine whether any changes to the notice are necessary.

ADDRESSES:

Comments may be submitted through www.Regulations.gov or mailed to VA Privacy Service, 810 Vermont Avenue NW, (005R1A), Washington, DC 20420. Comments should indicate that they are submitted in response to “National Prosthetic Patient Database (NPPD)–VA” (33VA113). Comments received will be available at regulations.gov for public viewing, inspection or copies.

FOR FURTHER INFORMATION CONTACT:

Stephania Griffin, Veterans Health Administration (VHA) Privacy Officer, Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420; [e-mail]; telephone [phone] (Note: this is not a toll-free number).

SUPPLEMENTARY INFORMATION:

VA is amending the system of records by revising the System Name; System Number; System Location, System Manager, Records Source Categories, Routine Uses of Records Maintained in the System, Policies and Practices for Retention and Disposal of Records, and Administrative, Technical and Physical Safeguards. VA is republishing the system notice in its entirety.

The System Name is being updated from “National Prosthetic Patient Database (NPPD)–VA” to “National Prosthetic Patient Records–VA”.

The System Number is being updated from 33VA113 to 33VA10 to reflect the current VHA organizational routing symbol.

The System Location and the Administrative, Technical and Physical Safeguards sections are being updated to replace Austin Automation Center (AAC) with Austin Information Technology Center (AITC).

The System Manager is updated to replace Chief Consultant, Prosthetic and Sensory Aids Service Strategic Healthcare Group (113), with Executive Director, Prosthetic and Sensory Aids Service.

The Records Source Categories is being updated to replace 79VA19 with 79VA10, and 24VA19 is replaced with 24VA10A7.

The language in Routine Use #6 is being updated. It previously stated that disclosure of the records to the Department of Justice (DoJ) is a use of the information contained in the records that is compatible with the purpose for which VA collected the records and that VA may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. This routine use will now state that DoJ, or in a proceeding before a court, adjudicative body, or other administrative body before which VA is authorized to appear, when:

(a) VA or any component thereof;

(b) Any VA employee in his or her official capacity;

(c) Any VA employee in his or her official capacity where DoJ has agreed to represent the employee; or

(d) The United States, where VA determines that litigation is likely to affect the agency or any of its components, is a party to such proceedings or has an interest in such proceedings, and VA determines that use of such records is relevant and necessary to the proceedings.

Routine use #11 is being added to state, “To another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.”

Policies and Practices for Retention and Disposal of Records is being updated to remove “Regardless of the record medium, records will be maintained and disposed of in accordance with the record disposition authority approved by the Archivist of the United States under National Archives Job No. N1–15–01–4.” This section is updated to state that NPPD records will be maintained and disposed of in accordance with Records Control Schedule (RCS) 10–1, 7700.4, temporary disposition; Cutoff at the end of fiscal year in which prosthetic procedure was concluded. Delete 3 years after cutoff. (N1–15–01–4, 11/17/03, item 1)

The Report of Intent to Amend a System of Records Notice and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of the Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.

Signing Authority

The Senior Agency Official for Privacy, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Kurt D. DelBene, Assistant Secretary for Information and Technology and Chief Information Officer, approved this document on April 5, 2023 for publication.

Dated: May 16, 2023.

Amy L. Rose,

Program Analyst, VA Privacy Service, Office of Information Security, Office of Information and Technology, Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:

“National Prosthetic Patient Records–VA” (33VA10)

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Records are located within Department of Veterans Affairs (VA) medical center databases. Extracts are maintained at the Austin Information Technology Center (AITC), Austin, Texas, and Hines Information Service Center, Hines, Illinois. VA health care facility address locations are listed in VA Appendix I of the Biennial Privacy Act Issuances publication.

SYSTEM MANAGER(S):

Official responsible for policies and procedures: Penny Nechanicky, Executive Director, Prosthetic and Sensory Aids Service, VA Central Office, 810 Vermont Avenue NW, Washington, DC 20420. Telephone number 202–461–4239 (this is not a toll-free number).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

38 U.S.C. 527.

PURPOSE(S) OF THE SYSTEM:

The purpose of these records is to furnish administrative and clinical statistical procurement and prescription information, including total cost and summary of activity, including equipment usage, data to VA and other health care providers, both Federal and non-Federal, to aid in furthering the improvement of health care, research, and education.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The records include information concerning contracted fabricators of prosthetic and orthotic appliances; vendors and manufacturers of durable medical equipment and sensory-neural aids; medical supply companies; VA beneficiaries; and VA employees.

CATEGORIES OF RECORDS IN THE SYSTEM:

The records may include information related to: VA field facility ordering the orthotic device; Patient Identification Number; Health Care Financing Administration Common Procedure Coding System (HCPCS); item purchased/issued to patient; cost; quantity; type of issue (initial/replace/repair/spare); patient eligibility category (service-connected, prisoner of war, aid and attendance); responsible VA procurement officer or representative; order creation date; order close/delivery date; calculated processing days; transaction/purchase order number; type of form used to purchase item (VAF 2421, PC2421, VAF 2529, VAF 2914, etc.); and vendor/contractor name. All other patient information, i.e., name, address, telephone number, can be retrieved by prosthetic program officials in VA Central Office by using the unique Patient Identification Number assigned to the patient in NPPD.

RECORD SOURCE CATEGORIES:

Record sources include Veterans Health Information System and Technology Architecture (VistA)–VA (79VA10), Patient Medical Records–VA (24VA10A7), and Veterans' records.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

To the extent that records contained in the system include information protected by 45 CFR parts 160 and 164, i.e., individually identifiable health information of VHA or any of its business associates, and 38 U.S.C. 7332; i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia, or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific statutory authority in both 38 U.S.C. 7332 and CFR parts 160 and 164 permitting disclosure.

1. Law Enforcement: To a Federal, state, local, territorial, tribal, or foreign law enforcement authority or other appropriate entity charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing such law, provided that the disclosure is limited to information that, either alone or in conjunction with other information, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature. The disclosure of the names and addresses of Veterans and their dependents from VA records under this routine use must also comply with the provisions of 38 U.S.C. 5701.

2. VA may disclose information to furnish administrative and clinical statistical procurement and prescription information, including total cost and summary of activity, including equipment usage, data to VA and other health care providers, both Federal and non-Federal, to aid in furthering the improvement of health care, research and education.

3. VA may disclose information to provide statistical and other information in response to legitimate and reasonable requests as approved by appropriate VA authorities.

4. Congress: To a Member of Congress or staff acting upon the Member's behalf when the Member or staff requests the information on behalf of, and at the request of, the individual who is the subject of the record.

5. NARA: To the National Archives and Records Administration (NARA) in records management inspections conducted under 44 U.S.C. 2904 and 2906, or other functions authorized by laws and policies governing NARA operations and VA records management responsibilities.

6. DOJ, Litigation, Administrative Proceeding: To the Department of Justice (DoJ), or in a proceeding before a court, adjudicative body, or other administrative body before which VA is authorized to appear, when:

(a) VA or any component thereof;

(b) Any VA employee in his or her official capacity;

(c) Any VA employee in his or her official capacity where DoJ has agreed to represent the employee; or

(d) The United States, where VA determines that litigation is likely to affect the agency or any of its components, is a party to such proceedings or has an interest in such proceedings, and VA determines that use of such records is relevant and necessary to the proceedings.

7. Contractors: To contractors, grantees, experts, consultants, students, and others performing or working on a contract, service, grant, cooperative agreement, or other assignment for VA, when reasonably necessary to accomplish an agency function related to the records.

8. Federal Agencies, Fraud and Abuse: To other Federal agencies to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs.

9. Data Breach Response and Remediation, for VA: To appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records; (2) VA has determined that as a result of the suspected or confirmed breach there is a risk to individuals, VA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, or persons is reasonably necessary to assist in connection with VA efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

10. Federal Agencies, Courts, Litigants, for Litigation or Administrative Proceedings: To another Federal agency, court, or party in litigation before a court or in an administrative proceeding conducted by a Federal agency, when the government is a party to the judicial or administrative proceeding.

11. Data Breach Response and Remediation, for Another Federal Agency: To another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are maintained on compact and magnetic disk.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records in this system are retrieved and indexed by Patient Identification Number for VA prosthetic personnel.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

NPPD records will be maintained and disposed of in accordance with Records Control Schedule (RCS) 10–1, 7700.4, temporary disposition; Cutoff at the end of fiscal year in which prosthetic procedure was concluded. Delete 3 years after cutoff. (N1–15–01–4, 11/17/03, item 1)

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

1. Access to VA working and storage areas is restricted to VA employees on a “need to know” basis. Generally, VA file areas are locked after normal duty hours and are protected from outside access by the Federal Protective Service. Strict control measures are enforced to ensure that disclosure is limited to a “need to know” basis. Physical access to the AITC is generally restricted to AITC staff, Central Office employees, custodial personnel, Federal Protective Service and authorized operational personnel through electronic locking devices. All other persons gaining access to the computer rooms are escorted.

2. Access to computer rooms at health care facilities is generally limited by appropriate locking devices and restricted to authorized VA employees and vendor personnel. Automated data processing peripheral devices are placed in secure areas (areas that are locked or have limited access) or are otherwise protected. Information in the VistA may be accessed by authorized VA employees. Access to file information is controlled at two levels; the systems recognize authorized employees by a series of individually-unique passwords/codes as a part of each data message, and the employees are limited to only that information in the file which is needed in the performance of their official duties. Access to information stored on automated storage media at other VA locations is controlled by individually-unique passwords/codes.

RECORD ACCESS PROCEDURES:

Individuals seeking information on the existence and content of a VA prosthetic-related record in this system pertaining to them should contact the system manager in writing as indicated above or may write or visit the VA facility location where they normally receive their care.

CONTESTING RECORD PROCEDURES:

Individuals seeking to contest or amend records in this system pertaining to them should contact the system manager in writing as indicated above or inquire in person at the VA health care facility they normally receive their care. A request to contest or amend records must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record.

NOTIFICATION PROCEDURES:

Generalized notice is provided by the publication of this notice. For specific notice, see Record Access Procedure, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

40 FR 38095 (August 26, 1975), 66 FR 20033 (April 18, 2001) 70 FR 3980 (January 27, 2005).