01-1112. Privacy Act of 1974; System of Records

AGENCY:

Department of Veterans Affairs.

ACTION:

Report of New System of Records—Consolidated Data Information System—VA (97VA105).

SUMMARY:

The Privacy Act of 1974 (5 U.S.C. 552(e)(4)) requires that all agencies publish in the Federal Register a notice of the existence and character of their system of records. Notice is hereby given that VA is adding a new system of records entitled “Consolidated Data Information System—VA” (97VA105).

DATES:

Comments on the establishment of the new system of records must be received no later than February 15, 2001. If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by VA, the system will become effective February 15, 2001.

ADDRESSES:

Comments may be submitted to Director, Office of Regulations Management (02D), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420. Comments will be available for public inspection at the above address in the Office of Regulations Management, Room 1176, between the hours of 8:00 a.m. and 4:30 p.m., Monday through Friday, excluding Federal holidays.

FOR FURTHER INFORMATION CONTACT:

Veterans Health Administration Privacy Act Officer (193B2), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420, [phone].

SUPPLEMENTARY INFORMATION:

Under Section 527 of Title 38, U.S.C., and the Government Performance and Results Act of 1993, Pub. L. 103-62, VA is required to measure and evaluate, on an ongoing basis, the effectiveness of VA benefit programs and services. In performing this required function, VA must collect, collate and analyze full statistical data regarding participation, provision of services, categories of beneficiaries, and planning of expenditures for all VA programs. For this reason, VA is establishing a new system of records, which combines information from several existing systems of records with information from non-VA sources. This combined database is necessary for VA to accurately and timely assess the current health care usage by the patient population served by VA, to forecast future demand for VA medical care by individuals currently eligible for service by VA medical facilities, and to understand the numerous implications of cross-utilization between VA and non-VA health care systems.

Records from the Patient Medical Record System (24VA136), the Patient Fee Basis Medical and Pharmacy Records (23VA136), Veterans and Beneficiaries Identification and Records Location Subsystem (38VA23), Compensation, Pension, Education and Rehabilitation Records (58VA21/22), and Automated Medication Processing Records (56VA119) will be incorporated into this new system of records. Specific request files will be created for use in submitting requests for veteran-specific data from the Health Care Financing Administration (HCFA), the Department of Defense (DoD), and other non-VA data sources including state Medicaid databases. The new database will be created by including Medicare data records on utilization and enrollment for all VA users, enrollees and special category veterans. Utilization and enrollment data will also be extracted from the DoD military personnel system of records in order to supplement VA's database. This system will not be used by VA to make any determinations as to individual veteran's benefits. Because the exchange of data among VA, HCFA, DoD, and any other non-VA agencies will be only for the purpose of identifying current health care usage and forecasting future health care usage by VA beneficiaries, the computer matching provision of the Privacy Act does not apply.

VA will maintain the system of records in electronic form at VA Management Science Group, Bedford, Massachusetts, and VA Information Resource Center, Hines, Illinois. Copies or parts of these records may be maintained at VA Automation Center, Austin, Texas, and VA Allocation Resource Center, Braintree, Massachusetts. Multiple sites are needed because VA data files will be drawn from multiple locations and merged data files will be very large. Data in the system of records will include names, social security numbers (SSNs), demographic and health services utilization data for all VHA users and special veteran populations; inpatient, outpatient, physician supplier, nursing home, hospice, home care, and durable medical equipment data form HCFA; and utilization and enrollment data from DoD. The new database will be used to produce reports for statistical analyses on, for example: (1) The number of Medicare-eligible users who obtain health care services from VA, Medicare, and both VA and Medicare providers (dual use); (2) the number of “dual use” veterans by specific disease categories; and (3) the inpatient, outpatient, and total costs associated with VA services and Medicare covered services by “dual use” veterans. Statistical reports will not contain individually identifiable health information.

We are proposing to establish the following routine use disclosures of information which will be maintained in the system:

1. To Federal, State, and local agencies for the purpose of better identifying the total current health care usage of the patient population by VA, to forecast future demand for VA medical care, and as part of statistical matching programs.

VA needs to obtain information from other agencies in order to collect full statistical data regarding participation and provision of services to the patient population served by VA as well as non-VA health care systems. The records may also be disclosed as part of statistical matching programs to accomplish these purposes.

2. To Federal, State and local government agencies and national health organizations in order to assist in the development of programs that will be beneficial to claimants and to protect their rights under law and assure that they are receiving all benefits to which they are entitled.

VA needs to obtain information from other agencies in order to measure and evaluate, on an ongoing basis, the effectiveness of VA benefit programs and services.

3. To a Federal, State, or local agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto. The names and addresses of veterans may only be disclosed:

• To a Federal agency when it is relevant to a suspected violation or reasonably imminent violation of law; and
• To a State or local agency under a written request when it is relevant to a suspected violation or reasonably imminent violation of law concerning public health or safety.

VA must be able to comply with the requirements of agencies charged with enforcing the law, and investigations of violations or possible violations of law. VA must also be able to provide information to State or local agencies charged with protecting the public health as set forth in State law.

4. To epidemiological and other research facilities approved by the Under Secretary for Health for research purposes (disclosure excludes names and addresses).

VA must be able to disclose information for research purposes approved by the Under Secretary for Health.

5. To a Federal department or agency or to a contractor of a Federal department or agency in order to conduct Federal research necessary to accomplish a statutory purpose of an agency.

VA must be able to disclose information for research purposes needed to accomplish a statutory purpose of a Federal agency.

6. To the National Archives and Record Administration (NARA) in records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.

NARA is responsible for archiving old records no longer actively used, but which may be appropriate for preservation; they are responsible in general for the physical maintenance of the Federal government's records. VA must be able to turn records over to this agency in order to determine the proper disposition of such records.

7. To the Department of Justice or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear when the Agency, or any component thereof; or any employee of the Agency in his or her official capacity; where the Department of Justice or the Agency has agreed to represent the employee; or the U.S. when the Agency determines that litigation is likely to affect the Agency or any of its components, is a party to litigation, and has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that the disclosure is compatible with the purpose for which the records were collected.

Whenever VA is involved in litigation, or occasionally when another party is involved in litigation and VA policies or operations could be affected by the outcome of the litigation, VA would be able to disclose information to the court or parties involved. A determination would be made in each instance that, under the circumstances involved, the purpose served by the use of the information in the particular litigation is compatible with a purpose for which VA collects the information.

8. To individuals, organizations, private or public agencies, etc., with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor or subcontractor to perform the services of the contract or agreement.

VA must be able to provide information to contractors or subcontractors with whom VA has a contract or agreement in order to perform the services of the contract or agreement.

Release of information from these records will be made only in accordance with the provisions of the Privacy Act of 1974 for investigative, judicial and administrative uses. The Privacy Act permits us to disclose information about individuals without their consent for a routine use when the information will be used for a purpose that is compatible with the purpose for which we collected the information. In all of the routine use disclosures described above, either the recipient of the information will use the information in connection with a matter relating to one of VA's programs, will use the information to provide a benefit to VA, or disclosure is required by law. VA has determined that release of information for these purposes is a necessary and proper use of information and that specific routine uses for transfer of this information are appropriate.

Approved: December 15, 2000.

Hershel W. Gober,

Acting Secretary of Veterans Affairs.

97VA105

SYSTEM NAME:

Consolidated Data Information System-VA.

SYSTEM LOCATION(S):

Records will be maintained at the following computer site locations: VA Management Science Group, 200 Springs Road, Bedford, Massachusetts 01730; and VA Information Resource Center, 5th Avenue & Roosevelt Road, Hines, Illinois 60141. Copies or parts of these records may be maintained at the following computer site locations: VA Automation Center, 1615 Woodward Street, Austin, Texas 78722; and VA Allocation Resource Center, 100 Grandview Road, Braintree, Massachusetts 02184.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The records include information concerning active duty military personnel, veterans, their spouses and their dependents, and individuals who are not VA beneficiaries, but who receive health care services from VHA.

CATEGORIES OF RECORDS IN THE SYSTEM:

The categories of records in the system will include veterans' names, addresses, dates of birth, VA claim numbers, SSNs, and military service information; medical benefit application and eligibility information; code sheets and follow-up notes; sociological, diagnostic, counseling, rehabilitation, drug and alcohol, dietetic, medical, surgical, dental, psychological, and/or psychiatric medical information; prosthetic, pharmacy, nuclear medicine, social work, clinical laboratory and radiology information; patient scheduling information; family information such as next of kin, spouse and dependents; names, addresses, social security numbers and dates of birth; family medical history, employment information; financial information; third-party health plan information; information related to ionizing radiation and Agent Orange; date of death; VA claim and insurance file numbers; travel benefits information; military decorations; disability or pension payment information; information on indebtedness arising from 38 U.S.C. benefits; medical and dental treatment in the Armed Forces and claim information; applications for compensation, pension, education and rehabilitation benefits; information related to incarceration in a penal institution; medication profile such as name, quantity, prescriber, dosage, manufacturer, lot number, cost and administration instruction; pharmacy dispensing information such as pharmacy name and address.

The records will include information on DoD military personnel from two categories of DoD files: (1) Utilization files that contain inpatient and outpatient records, and (2) eligibility files from the Defense Eligibility Enrollment Reporting System (DEERS) containing data on all military personnel including those discharged from the Armed Services since 1972.

The records will include information on Medicare beneficiaries from HCFA databases: Denominator file (identifies the population being studied); Standard Analytical files (inpatient, outpatient, physician supplier, nursing home, hospice, home care, durable medical equipment); and Group Health Plan.

The records include information on Medicaid beneficiaries' utilization and enrollment from state databases.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Section 527 of 38 U.S.C. and the Government Performance and Results Act of 1993, Pub. L. 103-62.

PURPOSE(S):

The purpose of this system of records is to conduct statistical studies and analyses which will support the formulation of Departmental policies and plans by identifying the total current health care usage of the VA patient population.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSE OF SUCH USES:

Information from this system of records may be disclosed in accordance with the following routine uses:

1. Disclosure of identifying information, such as names, SSNs, demographic and utilization data, may be made to Federal, State, local, or tribal agencies such as the DoD, HCFA, and Medicare Payment Advisory Commission (MedPAC), as part of statistical matching programs for the purpose of better identifying the total current health care usage of the patient population served by VA in order to forecast future demand for VA medical care by VA medical facilities.

2. Disclosure may be made to Federal, State, local, and tribal government agencies and national health organizations in order to assist in the development of programs that will be beneficial to claimants and assure that they are receiving all benefits to which they are entitled.

3. Disclosure may be made of information relevant to or indicating a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, to Federal, State, local, or tribal agencies charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order listed pursuant thereto.

4. Disclosure may be made, excluding name and address (unless name and address are furnished by the requestor) for research purposes determined to be necessary and proper, to epidemiological and other research facilities approved by the Under Secretary for Health.

5. In order to conduct Federal research necessary to accomplish a statutory purpose of an agency, at the written request of the recipient agency, the name (s) and address (s) of present or former personnel of the Armed Services and/or their dependents may be disclosed (a) To a Federal department or agency or (b) directly to a contractor of a Federal department or agency. When disclosure of this information is to be made directly to the contractor, VA may impose applicable conditions on the department, agency and/or contractor to insure the appropriateness of the disclosure to the contractor.

6. Disclosure may be made to National Archives and Records Administration (NARA), General Services Administration (GSA) in records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.

7. Records from this system of records may be disclosed to the Department of Justice or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear when: The Agency, or any component thereof; or any employee of the Agency in his or her official capacity; where the Department of Justice or the Agency has agreed to represent the employee; or the U.S. when the Agency determines that litigation is likely to affect the Agency or any of its components, is a party to litigation, and has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that the disclosure is compatible with the purpose for which the records were collected.

8. Disclosure may be made to individuals, organizations, private or public agencies, etc., with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor or subcontractor to perform the services of the contract or agreement.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Data are maintained on magnetic tape, disk, or laser optical media.

RETRIEVABILITY:

Records may be retrieved by name, name and one or more criteria (e.g., dates of birth, death and service), SSN or VA claim number.

SAFEGUARDS:

1. Access to and use of these records is limited to those persons whose official duties require such access. Personnel screening is employed to prevent unauthorized disclosure.

2. Access to Automated Data Processing files is controlled at two levels: (1) Terminals, central processing units, and peripheral devices are generally placed in secure areas (areas that are locked or have limited access) or are otherwise protected; and (2) the system recognizes authorized users by means of an individually unique password entered in combination with an individually unique user identification code.

3. Access to automated records concerning identification codes and codes used to access various VA automated communications systems and records systems, as well as security profiles and possible security violations is limited to designated automated systems security personnel who need to know the information in order to maintain and monitor the security of VA's automated communications and veterans' claim records systems. Access to these records in automated form is controlled by individually unique passwords/codes. Agency personnel may have access to the information on a need to know basis when necessary to advise agency security personnel or for use to suspend or revoke access privileges or to make disclosures authorized by a routine use.

4. Access to VA facilities where identification codes, passwords, security profiles and possible security violations are maintained is controlled at all hours by the Federal Protective Service, VA or other security personnel and security access control devices.

RETENTION AND DISPOSAL:

Copies of back-up computer files will be maintained at VA Management Science Group, Bedford, Massachusetts, and VA Information Resource Center, Hines, Illinois.

Records will be maintained and disposed of in accordance with the records disposal authority approved by the Archivist of the United States, the National Archives and Records Administration, and published in Agency Records Control Schedules.

SYSTEM MANAGER AND ADDRESS:

Director, Management Science Group, VA Medical Center, 200 Springs Road, Bedford, Massachusetts 01730.

NOTIFICATION PROCEDURE:

Individuals wishing to inquire whether this system of records contains information about them should submit a signed written request to the Director, Management Science Group, VA Medical Center, 200 Springs Road, Bedford, Massachusetts 01730.

RECORDS ACCESS PROCEDURES:

An individual who seeks access to records maintained under his or her name or other personal identifier may write the System Manager named above and specify the information being contested.

CONTESTING RECORD PROCEDURES:

(See Records Access Procedures above.)

RECORD SOURCE CATEGORIES:

Information may be obtained from the Patient Medical Records System (24VA136); Patient Fee Basis Medical and Pharmacy Records (23VA136); Veterans and Beneficiaries Identification and Records Location Subsystem (38VA23); Compensation, Pension, Education and Rehabilitation Records (58VA21/22); and Automated Medication Processing Records (56VA119); DoD utilization files and DEERS files; and HCFA Denominator file, Standard Analytical files (inpatient, outpatient, physician supplier, nursing home, hospice, home care, durable medical equipment) and Group Health Plan, and State Medicaid beneficiaries' utilization and enrollment databases.