E9-20910. Privacy Act of 1974

AGENCY:

Department of Veterans Affairs (VA).

ACTION:

Notice of Amendment to System of Records.

SUMMARY:

The Privacy Act of 1974 (5 U.S.C. 552a(e)(4)) requires that all agencies publish in the Federal Register a notice of the existence and character of their system of records. Notice is hereby given that VA is amending the system of records entitled “Veteran, Employee and Citizen Health Care Facility Investigation Records-VA” (32VA00) as set forth in the Federal Register (58 FR 40852) dated July 30, 1993. VA is amending the system by revising the System Number, Routine Uses of Records Maintained in the System and System Manager and Address. VA is republishing the system notice in its entirety.

DATES:

Comments on the amendment of this system of records must be received no later than September 30, 2009. If no public comment is received, the amended system will become effective September 30, 2009.

ADDRESSES:

Written comments may be submitted through www.Regulations.gov;​; by mail or hand-delivery to Director, Regulations Management (02REG), Department of Veterans Affairs, 810 Vermont Avenue, NW., Room 1068, Washington, DC 20420; or by fax to [phone]. Comments received will be available for public inspection in the Office of Regulation Policy and Management, Room 1063B, between the hours of 8 a.m. and 4:30 p.m., Monday through Friday (except holidays). Please call [phone] (this is not a toll-free number) for an appointment. In addition, during the comment period, comments may be viewed online through the Federal Docket Management System (FDMS) at http://www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT:

Stephania H. Putt, Veterans Health Administration (VHA) Privacy Officer (19F2), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420, [phone].

SUPPLEMENTARY INFORMATION:

The System number is changed from 32VA00 to 32VA10Q to reflect the current organizational alignment.

Routine use 14 was added for the VA to disclose information from this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request for the information, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that release of the records to the DoJ is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA, on its own initiative, may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records.

Routine use 15 was added to disclose information to other Federal agencies that may be made to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs. This routine use permits disclosures by the Department to report a suspected incident of identity theft and provide information and/or documentation related to or in support of the reported incident.

Routine use 16 was added so that VA may, on its own initiative, disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise, there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the potentially compromised information; and (3) the disclosure is to agencies, entities, or persons whom VA determines are reasonably necessary to assist or carry out the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosures by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727.

Routine uses 17 was added to disclose relevant information made to individuals, organizations, private or public agencies, or other entities with whom VA has a contract or agreement or where there is a subcontract to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor or subcontractor to perform the services of the contract or agreement. This routine use is being added to allow for the disclosure of information to contractors when performing an agency function. VA must be able to share information with contractors.

The Report of Intent to Amend a System of Records Notice and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of the Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.

Approved: August 14, 2009.

John R. Gingrich,

Chief of Staff, Department of Veterans Affairs.

32VA10Q

SYSTEM NAME:

Veteran, Employee and Citizen Health Care Facility Investigation Records-VA

SYSTEM LOCATION(S):

Records are maintained at each of the VA health care facilities. Address locations are listed in VA Appendix 1 at the end of this document.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

1. Veterans, employees and private citizens who have been injured as a result of accident or assault.

2. Veterans who have died as a result of violence or accident, such as, suicide, homicide, reaction to anesthesia or drugs, assault, transfusion accident, blood incompatibility, error in treatment, neglect of patient, fire, firearms, explosion, etc.

3. Employees and private citizens who have died as a result of violence or accident.

4. Veterans who have left the health care facility without authorization.

5. Veterans, employees and private citizens who have alleged the loss of personal property, funds or valuables.

6. Veterans and private citizens who have alleged abuse by members of the health care facility staff.

7. Employees who have alleged discrimination, abuse or threats of violence by other employees, Veterans and private citizens.

8. Veterans, employees and visitors who have assaulted other individuals.

9. Veterans, employees or private citizens who have been involved in the sale of illegal drugs or alcohol within the health care facility.

10. Veterans, employees and private citizens who have been accused of stealing from other individuals or from the VA health care facility.

11. Employees who have been accused of improper and unethical conduct.

12. Veterans, employees and private citizens who have willfully or accidentally destroyed or damaged Federal property.

Categories of records in the system:

Copies of reports of investigations, findings, and follow-up concerning employees, patients and private citizens, injuries, property damage, accidents, thefts, assaults, discrimination, complaints, elopements, unethical conduct, etc.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Title 38, United States Code, Chapter 3, Section 210(c)(1), and Title 38, United States Code, Chapter 57, Section 3311.

PURPOSE(S):

The purpose of this system of records is to conduct statistical studies and analyses which will support the formulation of Departmental policies and plans by identifying the total current health care usage of the VA patient population. The records and information may be used by VA for audit and evaluation of Department programs and for determinations of eligibility for benefits. The information may be used to conduct research.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSE OF SUCH USES:

VA may disclose protected health information pursuant to the following routine uses where required by law, or required or permitted by 45 CFR Parts 160 and 164.

1. Transfer of required information to private insurance companies to determine whether payments of benefits are appropriate and determine liability.

2. Transfer of required information to local and State unemployment agencies to determine whether payments of benefits are appropriate.

3. Transfer of required information to the Office of Workers Compensation Program to determine whether payments of benefits are appropriate.

4. Transfer of required information to attorneys representing employees, Veterans or private citizens accused of unethical conduct to assist attorneys in representing their clients.

5. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal, State, local or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.

6. A record from this system of records may be disclosed to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the information is relevant and necessary to the requesting agency's decision on the matter.

7. A record from this system of records may be disclosed as a routine use to a Federal, State or local agency maintaining civil, criminal or other relevant information, such as current licenses, if necessary to obtain information relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other health, educational or welfare benefit.

8. Relevant information from this system of records, including the nature and amount of a financial obligation, may be disclosed as a routine use, in order to assist the Veterans Administration in the collection of unpaid financial obligations owed the VA, to a debtor's employing agency or commanding officer so that the debtor-employee may be counseled by his or her Federal employer or commanding officer. This purpose is consistent with 5 U.S.C. 55l4, 4 CFR 102.5, and section 206 of Executive Order 11222 of May 8, 1965 (30 FR 6469).

9. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.

10. Disclosure may be made to NARA (National Archives and Records Administration) GSA (General Services Administration) in records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.

11. Records from this system of records may be disclosed to a Federal Agency or to a State or local government licensing board and/or to the Federation of State Medical Boards or a similar nongovernment entity which maintains records concerning individuals' employment histories or concerning the issuance, retention or revocation of licenses, certifications, or registration necessary to practice an occupation, profession or specialty, in order for the Agency to obtain information relevant to an Agency decision concerning the hiring, retention or termination of an employee or to inform a Federal Agency or licensing boards or the appropriate nongovernment entities about the health care practices of a terminated, resigned or retired health care employee whose professional health care activity so significantly failed to conform to generally accepted standards of professional medical practice as to raise reasonable concern for the health and safety of patients in the private sector or from another Federal Agency. These records may also be disclosed as part of an ongoing computer matching program to accomplish these purposes.

12. Identifying information in this system, including name, address, social security number and other information as is reasonably necessary to identify such individual, may be disclosed to the National Practitioner Data Bank at the time of hiring or clinical privileging/reprivileging of health care practitioners, and other times as deemed necessary by VA, in order for VA to obtain information relevant to a Department decision concerning the hiring, privileging/reprivileging, retention or termination of the applicant or employee.

13. Relevant information from this system of records may be disclosed to the National Practitioner Data Bank and/or State Licensing Board in the State(s) in which a practitioner is licensed, in which the VA facility is located, or in which an act or omission occurred upon which a medical malpractice claim was based when VA reports information concerning: (1) Any payment for the benefit of a physician, dentist, or other licensed health care practitioner which was made as the result of a settlement or judgment of a claim of medical malpractice if an appropriate determination is made in accordance with agency policy that payment was related to substandard care, professional incompetence or professional misconduct on the part of the individual; (2) a final decision which relates to possible incompetence or improper professional conduct that adversely affects the clinical privileges of a physician or dentist for a period longer than 30 days; or, (3) the acceptance of the surrender of clinical privileges or any restriction of such privileges by a physician or dentist either while under investigation by the health care entity relating to possible incompetence or improper professional conduct, or in return for not conducting such an investigation or proceeding. These records may also be disclosed as part of a computer matching program to accomplish these purposes.

14. VA may disclose information from this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request for the information, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that release of the records to the DoJ is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA, on its own initiative, may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records.

15. Disclosure to other Federal agencies may be made to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs.

16. VA may, on its own initiative, disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise, there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the potentially compromised information; and (3) the disclosure is to agencies, entities, or persons whom VA determines are reasonably necessary to assist or carry out the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosures by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727.

17. Disclosure of relevant information may be made to individuals, organizations, private or public agencies, or other entities with whom VA has a contract or agreement or where there is a subcontract to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor or subcontractor to perform the services of the contract or agreement.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Paper documents and Photographs.

RETRIEVABILITY:

Alphabetically by name.

SAFEGUARDS:

Physical Security: Access to VA working space and medical record storage areas are restricted to VA employees on a “need to know” basis. Generally, VA file areas are locked after normal duty hours and are protected from outside access by the Federal Protective Service.

Employee file records and file records of public figures or otherwise sensitive medical record files are stored in separate locked files. Strict control measures are enforced to ensure that disclosure is limited to a “need to know” basis.

RETENTION AND DISPOSAL:

Disposed of 2 years after case is closed.

SYSTEM MANAGER AND ADDRESS:

Chief Officer, Office of Quality and Performance (10Q), Veterans Health Administration, Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420.

NOTIFICATION PROCEDURE:

Individuals seeking information concerning the existence and content of a record pertaining to themselves must submit a written request or apply in person to the appropriate VA health care facility. All inquiries must reasonably identify the incident involved and date of the incident. Inquiries should include the individual's full name and return address.

RECORDS ACCESS PROCEDURES:

Veterans, employees and private citizens or duly authorized representatives seeking information regarding access to and contesting of VA records may write, call or visit the appropriate VA health care facility.

CONTESTING RECORD PROCEDURES:

(See Records Access Procedures above.)

RECORD SOURCE CATEGORIES:

1. Veterans.

2. Employees of a VA health care facility.

3. Other VA health care facilities, private physicians and dentists, or private hospitals and clinics.

4. Private citizens involved in the incident.

5. Federal, State, local and foreign law enforcement agencies.

6. Private insurance companies.