[Federal Register Volume 59, Number 138 (Wednesday, July 20, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-17358]
[[Page Unknown]]
[Federal Register: July 20, 1994]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF VETERANS AFFAIRS
38 CFR Part 14
RIN 2900-AH01
Expanded Remote Access to Computerized Veterans Claims Records by
Accredited Representatives
AGENCY: Department of Veterans Affairs.
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: The Department of Veterans Affairs (VA) is proposing to
establish policy, procedures and criteria governing when, and under
what circumstances, VA will grant authorized claimants' representatives
read-only access to the automated claims records of claimants whom they
represent from approved office locations away from the VA Regional
Offices of jurisdiction for the claimants' records. Access will be
granted only for the purpose of representing those claimants before VA
on claims-related matters. In order to help safeguard the
confidentiality of claimants' automated claims records, the proposed
rules also set out responsibilities and restrictions on claimants'
representatives in exercising their remote access to VA's automated
claims records. These procedures and criteria will provide for better
and more timely representation of claimants in claims matters by
allowing their representatives to have faster, easier and more
efficient access to the claimants' records than they currently have
when they have to travel to the Regional Offices. The proposed
regulations will also ensure more efficient use of VA resources in
meeting the agency mission in that VA employees will have to spend less
time providing access to those representatives who do not have their
own computers in Regional Offices.
DATES: Comments must be received on or before August 19, 1994. Comments
will be available for public inspection until August 29, 1994.
ADDRESSES: Send written comments to: Secretary of Veterans Affairs
(271A), Department of Veterans Affairs, 810 Vermont Avenue NW.,
Washington, DC, 20420. All written comments received will be available
for public inspection only in the Veterans Services Unit, room 119 of
the above address between the hours of 8 a.m. to 4:30 p.m., Monday
through Friday except holidays until August 29, 1994.
FOR FURTHER INFORMATION CONTACT: David G. Spivey, Chief, Authorization
Procedures Staff (213B), Compensation and Pension Service, Veterans
Benefits Administration, Department of Veterans Affairs, 810 Vermont
Avenue, NW., Washington, DC, 20420, (202) 273-7258 or Jeffrey C.
Corzatt, Staff Attorney (024H2), Office of General Counsel, Department
of Veterans Affairs, 810 Vermont Avenue NW., Washington, DC, 20420,
(202) 273-6381.
SUPPLEMENTARY INFORMATION: VA is proposing to incorporate into its
regulations policies, criteria and procedures governing access to
certain Veterans Benefits Administration (VBA) computerized claimants'
records by individuals and organizations which represent those
claimants from locations away from the Regional Offices of jurisdiction
for those claimants' records.
Currently, accredited representatives of veterans service
organizations who hold a valid, current, VA power of attorney to assist
claimants in the presentation of claims for benefits administered by VA
may have on-line, remote access to certain information about those
claimants contained in VA's automated claims records if the
representatives and their computers are located in office space
provided within VBA Regional Offices under 38 U.S.C. Sec. 5902(a)(2).
Accredited veterans' representatives not located at a VBA Regional
Office who do not have such remote, on-line access are expected to go
to the Regional Office and arrange with VA employees using VA computers
to view a veteran's automated claims records.
VA has decided to provide the same on-line, remote access
capability to all individuals and organizations accredited under 38 CFR
14.626-.635 who represent claimants on VA claims for benefits and who
request such access. Access will also be provided to attorneys of
record for claimants before the Court of Veterans Appeals who request
such access.
The proposed rules concern when, and under what circumstances, VA
will grant access, the responsibilities of those granted access, and
the bases to revoke or suspend access. VA will grant no more than read-
only access to authorized claimants' representatives for the purpose of
assisting claimants for whom they hold a valid power of attorney (or
equivalent designation) in presenting their claims for VA benefits.
Read-only access necessarily includes the ability to print or down-load
the information.
Qualified representatives will be granted access by the Regional
Office of jurisdiction for the particular claimant's records. In order
for VBA to grant access, the Regional Office must first approve the
equipment and software the applicant will use to obtain access, as well
as the location from which the representative will access the VBA
computer system. Approval of the hardware and software is intended to
ensure that access can be accomplished while maintaining the necessary
security. Approval of the location is intended to ensure that access is
only from the representative's customary and usual or primary place of
representation, and not from other locations. This avoids the use of
unapproved equipment and limits the possibility of unauthorized access
to the data by individuals not approved for access by VA. The applicant
must also sign a notice that contains the security requirements
applicable to the system.
Certain confidentiality statutes, namely, the Privacy Act, 5 U.S.C.
Sec. 552a, and 38 U.S.C. Secs. 5701 and 7332 generally govern the VA's
disclosure of claimants' records, whether paper or automated, to their
representatives. Accredited representatives and agents may see the
claims folders of those individuals whom they represent for two
reasons: the claimant has indicated in advance in writing to the
Department that the named individual or organization represents him or
her on a claim for benefits, and the claimant has given prior written
consent to VA's release of information to the claimant's
representative. Attorneys, as officers of the court, need only file
documentation that they represent the claimant. A routine use then
permits the disclosure.
These requirements also are designed to provide audit and
accountability records for those who access the system, as well as
ensuring the integrity and confidentiality of the system and data from
unauthorized access.
In order to oversee access activities properly which provide for
the security of the data and system, VBA may, without notice, inspect
the accessor's computer systems, review its security procedures, and
monitor its access activities.
VBA may revoke access privileges in two circumstances. The first is
based on applicable confidentiality statutes, e.g., the Privacy Act, 5
U.S.C. Sec. 552a, and 38 U.S.C. Secs. 5701 and 7332. Whenever an
individual or organization is no longer entitled to access a particular
claimant's records as a matter of law under the applicable
confidentiality statutes, VA will terminate that individual's access
privileges to that particular claimant's automated claims records. VA
may also revoke access privileges based upon failure to comply with the
regulations.
Regulatory Flexibility Act
The Secretary of Veterans Affairs has certified that these proposed
rules, if promulgated, will not have a significant economic impact on a
substantial number of small entities as they are defined in the
Regulatory Flexibility Act, 5 U.S.C. 601-612. Pursuant to 5 U.S.C.
605(b), the regulations, therefore, are exempt from the initial and
final regulatory flexibility analyses requirements of sections 603 and
604.
This certification can be made because the regulations facilitate
representative access to their claimants' information while imposing
little in the way of cost or administrative burden. Further, the rules
affect only the small number of entities and individuals which
represent claimants in claims before VA.
This regulation is subject to review under Executive Order 12866.
There are no Catalog of federal Domestic Assistance numbers for
this program.
List of Subjects in 38 CFR Part 14
Government employees, Lawyers, Legal services, Veterans.
Approved: June 13, 1994.
Jesse Brown,
Secretary of Veterans Affairs.
38 CFR part 14, Legal Services, General Counsel, is proposed to be
amended as follows:
PART 14--LEGAL SERVICES, GENERAL COUNSEL
1. The authority citation for part 14 continues to read as follows:
Authority: 38 U.S.C. 5903.
2. In part 14, Secs. 14.640 through 14.643 and an undesignated
center heading prior to Sec. 14.640 are added to read as follows:
Expanded Remote Access to Computerized Veterans Claims Records by
Accredited Representatives
Sec.
14.640 Purpose.
14.641 Qualifications for access.
14.642 Utilization of access.
14.643 Disqualification.
Expanded Remote Access to Computerized Veterans Claims Records by
Accredited Representatives
Sec. 14.640 Purpose.
(a) Sections 14.640 through 14.643 establish policy, assign
responsibilities and prescribe procedures with respect to:
(1) When, and under what circumstances, VA will grant authorized
claimants' representatives read-only access to the automated Veterans
Benefits Administration (VBA) claims records of those claimants whom
they represent;
(2) The exercise of authorized access by claimants'
representatives; and
(3) The bases and procedures for disqualification of a
representative for violating any of the requirements for access.
(b) VBA will grant access to its automated claimants' claims
records from locations outside Regional Offices under the following
conditions. Access will be provided:
(1) Only to individuals and organizations granted access to
automated claimants' records under Secs. 14.460 through 14.643;
(2) Only to the claims records of VA claimants whom the
organization or individual represents as reflected in the claims file;
(3) Solely for the purpose of the representative assisting the
individual claimant whose records are accessed in a claim for benefits
administered by VA; and
(4) On a read-only basis. Individuals authorized access to VBA
automated claims records under Secs. 14.640 through 14.643 will not be
permitted to modify the data.
(c)(1) Access will be authorized only to the inquiry commands of
the Benefits Delivery Network which provide access to the following
categories of data:
(i) Beneficiary identification data such as name, social security
number, sex, date of birth, service number and related service data;
and
(ii) Claims history and processing data such as folder location,
claim status, claim establishment date, claim pro-cessing history,
award data, rating data, including service-connected medical
conditions, income data, dependency data, deduction data, payment data,
educational facility and program data (except chapter 32 benefits), and
education program contribution and delimiting data (except chapter 32
benefits).
(2) Access to this information will currently be through the
inquiry commands of BINQ (BIRLS (Beneficiaries Identification and
Records Location Subsystem) Inquiry), SINQ (Status Inquiry), MINQ
(Master Record Inquiry), PINQ (Pending Issue Inquiry) and TINQ (Payment
History Inquiry). The identifying information received from BIRLS to
representative inquiries will be limited to file number, veteran's
name, date of death, folder location and transfer date of folder,
insurance number, insurance type, insurance lapse date and insurance
folder jurisdiction.
(d) Sections 14.640 through 14.643 are not intended to, and do not:
(1) Waive the sovereign immunity of the United States; or
(2) Create, and may not be relied upon to create, any right or
benefit, substantive or procedural, enforceable at law against the
United States or the Department of Veterans Affairs.
Sec. 14.641 Qualifications for access.
(a) An applicant for read-only access to VBA automated claims
records from a location other than a VA Regional Office must be:
(1) An organization, representative, attorney or agent approved or
accredited by VA under 38 CFR 14.626 through 14.635; or
(2) An attorney of record for a claimant in proceedings before the
Court of Veterans Appeals or subsequent proceedings who requests access
to the claimant's automated claims records as part of the
representation of the claimant.
(b) The hardware, modem and software utilized to obtain access, as
well as their location, must be approved in advance by VBA.
(c) Each individual and organization approved for access must sign
and return a notice provided by the Regional Office Director (or the
Regional Office Director's designee) of the Regional Office of
jurisdiction for the claim. The notice will specify the applicable
operational and security requirements for access and an acknowledgment
that the breach of any of these requirements is grounds for
disqualification from access.
Sec. 14.642 Utilization of access.
(a) Once an individual or organization has been issued the
necessary passwords to obtain read-only access to the automated claims
records of individuals represented, access will be exercised in
accordance with the following requirements:
(1) The individual or organization will obtain access only from
equipment and software approved in advance by the Regional Office from
the location where the individual or organization primarily conducts
its representation activities which also has been approved in advance;
(2) The individual will use only his or her assigned password to
obtain access;
(3) The individual will not reveal his or her password to anyone
else, or allow anyone else to use his or her password;
(4) The individual will access only the VBA automated claims
records of VA claimants who are represented by the person obtaining
access or by the organization employing the person obtaining access;
(5) The individual will access a claimant's automated claims record
solely for the purpose of representing that claimant in a claim for
benefits administered by VA.
(6) Upon receipt of the password, the individual will destroy the
hard copy; no written or printed record containing the password will be
retained; and
(7) The individual and organization will comply with all security
requirements VBA deems necessary to ensure the integrity and
confidentiality of the data and VBA's automated computer systems.
(b) An organization granted access shall ensure that all employees
provided access in accordance with these regulations will receive
regular, adequate training on proper security, including the items
listed in Sec. 14.643(a). Where an individual such as an attorney or
registered agent is granted access, he or she will regularly review the
security requirements for the system as set forth in these regulations
and in any additional materials provided by VBA.
(c) VBA may, at any time without notice:
(1) Inspect the computer hardware and software utilized to obtain
access and their location;
(2) Review the security practices and training of any individual or
organization granted access under these regulations; and
(3) Monitor an individual's or organization's access activities. By
applying for, and exercising, the access privileges under Secs. 14.640
through 14.643, the applicant expressly consents to VBA monitoring the
access activities of the applicant at any time.
Sec. 14.643 Disqualification.
(a) The Regional Office Director or the Regional Office Director's
designee may revoke an individual's or an organization's access
privileges to a particular claimant's records because the individual or
organization no longer represents the claimant, and, therefore, the
beneficiary's consent is no longer in effect. The individual or
organization is no longer entitled to access as a matter of law under
the Privacy Act, 5 U.S.C. Sec. 552a, and 38 U.S.C. Secs. 5701 and 7332.
Under these circumstances, the individual or organization is not
entitled to any hearing or to present any evidence in opposition to the
revocation.
(b) An individual or organization granted access privileges to VBA
automated claims benefits systems may have such access privileges
revoked either to an individual claimant's records or to all claimants'
records if the individual or organization:
(1) Violates any of the provisions of Secs. 14.640 through 14.643;
(2) Accesses or attempts to access data for a purpose other than
representation of an individual veteran;
(3) Accesses or attempts to access data other than the data
specified in these regulations;
(4) Accesses or attempts to access data on a VA beneficiary who is
not represented either by the individual who obtains access or by the
organization employing the individual who obtains access;
(5) Utilizes unapproved computer hardware or software to obtain or
attempt to obtain access to VBA computer systems;
(6) Modifies or attempts to modify data in the VBA computer
systems.
(c) If VBA is considering revoking an individual's access, and that
individual works for an organization, the Regional Office of
jurisdiction will notify the organization of the pendency of the
action.
(d) After an individual's access privileges are revoked, if the
conduct which resulted in revocation was such that it merits reporting
to an appropriate governmental licensing organization such as a State
bar, the VBA Regional Office of jurisdiction will immediately inform
the licensing organization in writing of the fact that the individual's
access privileges were revoked and the reasons why.
(e) The VBA Regional Office of jurisdiction may temporarily suspend
access privileges prior to any determination on the merits of the
proposed revocation where the Regional Office Director or the
Director's designee determines that such immediate suspension is
necessary in order to protect the integrity of the system or
confidentiality of the data in the system from a reasonably foreseeable
compromise. However, in such case, the Regional Office shall offer the
individual or organization an opportunity to respond to the charges
immediately after the temporary suspension.
[FR Doc. 94-17358 Filed 7-19-94; 8:45 am]
BILLING CODE 8320-01-P
