[Federal Register Volume 59, Number 177 (Wednesday, September 14, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-22669]
[[Page Unknown]]
[Federal Register: September 14, 1994]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF VETERANS AFFAIRS
38 CFR Part 14
RIN 2900-AH01
Expanded Remote Access to Computerized Veterans Claims Records by
Accredited Representatives
AGENCY: Department of Veterans Affairs.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Department of Veterans Affairs (VA) is establishing
policy, procedures and criteria governing when, and under what
circumstances, VA will grant authorized claimants' representatives
read-only access to the automated claims records of claimants whom they
represent from approved office locations away from the VA Regional
Offices of jurisdiction for the claimants' records. Access will be
granted only for the purpose of representing those claimants before VA
on claims-related matters. In order to help safeguard the
confidentiality of claimants' automated claims records, the rules also
set out responsibilities and restrictions on claimants' representatives
in exercising their remote access to VA's automated claims records.
These procedures and criteria will provide for better and more timely
representation of claimants in claims matters by allowing their
representatives to have faster, easier and more efficient access to the
claimants' records than they currently have when they have to travel to
the Regional Offices. The regulations will also lead to more efficient
use of VA resources in meeting the agency mission in that VA employees
will have to spend less time providing access to those representatives
who do not have their own computers in Regional Offices.
EFFECTIVE DATE: October 14, 1994.
FOR FURTHER INFORMATION CONTACT: David G. Spivey, Chief, Authorization
Procedures Staff (213B), Compensation and Pension Service, Veterans
Benefits Administration, Department of Veterans Affairs, 810 Vermont
Avenue, NW., Washington, DC 20420, (202) 273-7258 or Jeffrey C.
Corzatt, Staff Attorney (024H2), Office of General Counsel, Department
of Veterans Affairs, 810 Vermont Avenue, NW, Washington, DC, 20420,
(202) 273-6381. Questions concerning applying for remote access should
be addressed to the Director of the Veterans Benefits Administration
Regional Office with jurisdiction for the claim for which remote access
is sought.
SUPPLEMENTARY INFORMATION:
Background
On July 20, 1994, the Department of Veterans Affairs published a
notice of proposed rulemaking (NPRM) (59 FR 37008, July 20, 1994) to
promulgate regulations at 38 CFR part 14 establishing policies,
criteria and procedures governing access to certain Veterans Benefits
Administration (VBA) computerized claimants records by individuals and
organizations which represent those claimants from locations away from
the Regional Offices of jurisdiction for those claimants records. As VA
noted in its NPRM, the rules concern when, and under what
circumstances, VA will grant access, the responsibilities of those
granted access, and the bases to revoke or suspend access.
Discussion of Comments
Five comments were submitted in response to the NPRM. All the
comments endorsed the regulations. Three veterans service organizations
had no suggested changes.
Another commenter suggested, in essence, that the regulations be
clarified to expressly provide that those individuals approved by the
Department to represent veterans in claims for title 38 benefits in
accordance with 38 CFR 14.629 are treated equally for purposes of being
granted read-only remote access to the automated claims records of
their clients. As was stated in the NPRM, it is the Department's
intention to provide the same on-line, remote access capability to all
individuals and organizations accredited under 38 CFR 14.626-14.635 who
represent claimants on VA claims for benefits and who request such
access. Moreover, this purpose is expressly stated in the regulations
at Sec. 14.641(a)(1) which provides that an applicant for read-only
access must be an organizations, representative, attorney or agent
approved or accredited by VA under 38 CFR 14.626 through 14.635. The
commenter's suggestion reflects what is already stated expressly in the
regulations.
The last commenter noted a typographical error which the Department
has corrected. That commenter also suggested that the regulations
should clarify that the Regional Office Director, or the Regional
Office Director's designee, is the VA official who may revoke an
individual's or organization's access privileges under 38 CFR
14.643(b). Paragraphs (a) and (e) of Sec. 14.643 refer to the Regional
Office Director or the Regional Office Director's designee as the VA
official responsible for decisions concerning the grant, denial,
suspension or revocation of remote access privileges. VA similarly
intended those officials to make any revocation decisions under
Sec. 14.643(b), and to avoid possible confusion on this issue, VA will
clarify this point. VA accepts this suggestion, and the regulation is
modified accordingly.
The fifth commenter suggested also that the Department clarify that
38 CFR 38.643(c) applies to proceedings under 38 CFR 14.643(b). VA also
accepts this suggestion, and the regulation is changed accordingly.
The fifth commenter also suggested that Sec. 14.643(c) should be
modified to expressly refer only to accredited representatives of
service organizations. However, attorneys and claims agents also
represent veterans. These individuals may work for a law firm or some
other organization which is not a veterans service organization. The
proposed change would exclude some of the individuals covered by the
regulations. Accordingly, the proposal is not adopted.
Finally, the commenter suggested that the proposed regulations set
forth the procedures which would be followed by the Department in any
revocation of access proceedings under Sec. 14.643(b). The matter
merits further consideration, and, accordingly, VA will consider
whether to amend this rule to incorporate such procedures.
Following consideration of the comments submitted in response to
the NPRM, as well as further consideration of the reasoning and
analysis in the proposed regulation published at 59 FR 37008, the
Secretary has decided to implement the regulations as proposed, for the
reasons contained in that Federal Register notice, with the changes
discussed above.
Regulatory Flexibility Act
The Secretary of Veterans Affairs has certified that these rules
will not have a significant economic impact on a substantial number of
small entities as they are defined in the Regulatory Flexibility Act, 5
U.S.C. 601-612. Pursuant to 5 U.S.C. 605(b), the regulations,
therefore, are exempt from the initial and final regulatory flexibility
analyses requirements of sections 603 and 604.
This certification can be made because the regulations facilitate
representative access to their claimants' information while imposing
little in the way of cost or administrative burden. Further, the rules
affect only the small number of entities and individuals which
represent claimants in claims before VA.
This regulation is subject to review under Executive Order 12866.
There are no Catalog of federal Domestic Assistance numbers for
this program.
List of Subjects in 38 CFR Part 14
Government employees, Lawyers, Legal services, Veterans.
Approved: September 1, 1994.
Jesse Brown,
Secretary of Veterans Affairs.
38 CFR part 14, Legal Services, General Counsel, is proposed to be
amended as follows:
PART 14--LEGAL SERVICES, GENERAL COUNSEL
1. The authority citation for part 14 continues to read as follows:
Authority: 38 U.S.C. 5903.
2. In Part 14, Secs. 14.640 through 14.646 and an undesignated
center heading prior to Sec. 14.640 are added to read as follows:
Expanded Remote Access to Computerized Veterans Claims Records by
Accredited Representatives
Sec.
14.640 Purpose.
14.641 Qualifications for access.
14.642 Utilization of access.
14.643 Disqualification.
Expanded Remote Access to Computerized Veterans Claims Records by
Accredited Representatives
Sec. 14.640 Purpose.
(a) Sections 14.640 through 14.643 establish policy, assign
responsibilities and prescribe procedures with respect to:
(1) When, and under what circumstances, VA will grant authorized
claimants' representatives read-only access to the automated Veterans
Benefits Administration (VBA) claims records of those claimants whom
they represent;
(2) The exercise of authorized access by claimants'
representatives; and
(3) The bases and procedures for disqualification of a
representative for violating any of the requirements for access.
(b) VBA will grant access to its automated claimants' claims
records from locations outside Regional Offices under the following
conditions. Access will be provided:
(1) Only to individuals and organizations granted access to
automated claimants' records under Secs. 14.640 through 14.643;
(2) Only to the claims records of VA claimants whom the
organization or individual represents as reflected in the claims file;
(3) Solely for the purpose of the representative assisting the
individual claimant whose records are accessed in a claim for benefits
administered by VA; and
(4) On a read-only basis. Individuals authorized access to VBA
automated claims records under Secs. 14.640 through 14.643 will not be
permitted to modify the data.
(c)(1) Access will be authorized only to the inquiry commands of
the Benefits Delivery Network which provide access to the following
categories of data:
(i) Beneficiary identification data such as name, social security
number, sex, date of birth, service number and related service data;
and
(ii) Claims history and processing data such as folder location,
claim status, claim establishment date, claim processing history, award
data, rating data, including service-connected medical conditions,
income data, dependency data, deduction data, payment data, educational
facility and program data (except chapter 32 benefits), and education
program contribution and delimiting data (except chapter 32 benefits).
(2) Access to this information will currently be through the
inquiry commands of BINQ (BIRLS (Beneficiaries Identification and
Records Location Subsystem) Inquiry), SINQ (Status Inquiry), MINQ
(Master Record Inquiry), PINQ (Pending Issue Inquiry) and TINQ (Payment
History Inquiry). The identifying information received from BIRLS to
representative inquiries will be limited to file number, veteran's
name, date of death, folder location and transfer date of folder,
insurance number, insurance type, insurance lapse date and insurance
folder jurisdiction.
(d) Sections 14.640 through 14.643 are not intended to, and do not:
(1) Waive the sovereign immunity of the United States; or
(2) Create, and may not be relied upon to create, any right or
benefit, substantive or procedural, enforceable at law against the
United States or the Department of Veterans Affairs.
Sec. 14.641 Qualifications for access.
(a) An applicant for read-only access to VBA automated claims
records from a location other than a VA Regional Office must be:
(1) An organization, representative, attorney or agent approved or
accredited by VA under Secs. 14.626 through 14.635; or
(2) An attorney of record for a claimant in proceedings before the
Court of Veterans Appeals or subsequent proceedings who requests access
to the claimant's automated claims records as part of the
representation of the claimant.
(b) The hardware, modem and software utilized to obtain access, as
well as their location, must be approved in advance by VBA.
(c) Each individual and organization approved for access must sign
and return a notice provided by the Regional Office Director (or the
Regional Office Director's designee) of the Regional Office of
jurisdiction for the claim. The notice will specify the applicable
operational and security requirements for access and an acknowledgment
that the breach of any of these requirements is grounds for
disqualification from access.
Sec. 14.642 Utilization of access.
(a) Once an individual or organization has been issued the
necessary passwords to obtain read-only access to the automated claims
records of individuals represented, access will be exercised in
accordance with the following requirements:
(1) The individual or organization will obtain access only from
equipment and software approved in advance by the Regional Office from
the location where the individual or organization primarily conducts
its representation activities which also has been approved in advance;
(2) The individual will use only his or her assigned password to
obtain access;
(3) The individual will not reveal his or her password to anyone
else, or allow anyone else to use his or her password;
(4) The individual will access only the VBA automated claims
records of VA claimants who are represented by the person obtaining
access or by the organization employing the person obtaining access;
(5) The individual will access a claimant's automated claims record
solely for the purpose of representing that claimant in a claim for
benefits administered by VA;
(6) Upon receipt of the password, the individual will destroy the
hard copy; no written or printed record containing the password will be
retained; and
(7) The individual and organization will comply with all security
requirements VBA deems necessary to ensure the integrity and
confidentiality of the data and VBA's automated computer systems.
(b) An organization granted access shall ensure that all employees
provided access in accordance with these regulations will receive
regular, adequate training on proper security, including the items
listed in Sec. 14.643(a). Where an individual such as an attorney or
registered agent is granted access, he or she will regularly review the
security requirements for the system as set forth in these regulations
and in any additional materials provided by VBA.
(c) VBA may, at any time without notice:
(1) Inspect the computer hardware and software utilized to obtain
access and their location;
(2) Review the security practices and training of any individual or
organization granted access under these regulations; and
(3) Monitor an individual's or organization's access activities. By
applying for, and exercising, the access privileges under Secs. 14.640
through 14.643, the applicant expressly consents to VBA monitoring the
access activities of the applicant at any time.
Sec. 14.643 Disqualification.
(a) The Regional Office Director or the Regional Office Director's
designee may revoke an individual's or an organization's access
privileges to a particular claimant's records because the individual or
organization no longer represents the claimant, and, therefore, the
beneficiary's consent is no longer in effect. The individual or
organization is no longer entitled to access as a matter of law under
the Privacy Act, 5 U.S.C. 552a, and 38 U.S.C. 5701 and 7332. Under
these circumstances, the individual or organization is not entitled to
any hearing or to present any evidence in opposition to the revocation.
(b) The Regional Office Director or the Regional Office Director's
designee may revoke an individual's or an organization's access
privileges either to an individual claimant's records or to all
claimants' records in the VBA automated claims benefits systems if the
individual or organization:
(1) Violates any of the provisions of Secs. 14.640 through 14.643;
(2) Accesses or attempts to access data for a purpose other than
representation of an individual veteran;
(3) Accesses or attempts to access data other than the data
specified in these regulations;
(4) Accesses or attempts to access data on a VA beneficiary who is
not represented either by the individual who obtains access or by the
organization employing the individual who obtains access;
(5) Utilizes unapproved computer hardware or software to obtain or
attempt to obtain access to VBA computer systems;
(6) Modifies or attempts to modify data in the VBA computer
systems.
(c) If VBA is considering revoking an individual's access under
Sec. 14.643(b), and that individual works for an organization, the
Regional Office of jurisdiction will notify the organization of the
pendency of the action.
(d) After an individual's access privileges are revoked, if the
conduct which resulted in revocation was such that it merits reporting
to an appropriate governmental licensing organization such as a State
bar, the VBA Regional Office of jurisdiction will immediately inform
the licensing organization in writing of the fact that the individual's
access privileges were revoked and the reasons why.
(e) The VBA Regional Office of jurisdiction may temporarily suspend
access privileges prior to any determination on the merits of the
proposed revocation where the Regional Office Director or the
Director's designee determines that such immediate suspension is
necessary in order to protect the integrity of the system or
confidentiality of the data in the system from a reasonably foreseeable
compromise. However, in such case, the Regional Office shall offer the
individual or organization an opportunity to respond to the charges
immediately after the temporary suspension.
[FR Doc. 94-22669 Filed 9-13-94; 8:45 am]
BILLING CODE 8320-01-P
