2023-01438. Privacy Act of 1974; System of Records

AGENCY:

Office of the Chief Human Capital Officer, Department of Veterans Affairs (VA).

ACTION:

Notice of a modified system of records.

SUMMARY:

Pursuant to the Privacy Act of 1974, notice is hereby given that the Department of Veterans Affairs (VA) is modifying the system of records entitled, “Employee Medical File System Records (Title 38)-VA” (08VA05). This system of records supports the Department by tracking employee health. The records are maintained for a variety of purposes, including: meeting the mandates of law, Executive Orders or regulations ( e.g., Department of Labor Occupational Safety and Health Administration, Department of Justice, National Archives and Records Administration, and Office of Workers' Compensation Programs (OWCP) regulations.

DATES:

Comments on this modified system of records must be received no later than 30 days after date of publication in the Federal Register . If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by the VA, the modified system of records will become effective a minimum of 30 days after date of publication in the Federal Register . If VA receives public comments, VA shall review the comments to determine whether any changes to the notice are necessary.

ADDRESSES:

Comments may be submitted through www.Regulations.gov or mailed to VA Privacy Service, 810 Vermont Avenue NW, (005R1A), Washington, DC 20420. Comments should indicate that they are submitted in response to “Employee Medical File System Records (Title 38)-VA” (08VA05). Comments received will be available at regulations.gov for public viewing, inspection or copies.

FOR FURTHER INFORMATION CONTACT:

Matt Gentil, Privacy Officer, Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420; [e-mail]; telephone [phone] (Note: this is not a toll-free number).

SUPPLEMENTARY INFORMATION:

The System has been updated to include the following:

• Update records located in VA National Data Centers and VA Information Technology (IT) systems in VA Central Office.
• Update the System Manager position title to “The Chief Human Capital Officer (05).”
• Update the Authority for Maintenance of the System to add Executive Orders 12196 and correct the 38 U.S.C. citations.
• Update the Purpose of the System to reflect the purposes outlined in OPM/GOVT-10, Employee Medical File System Records for title 5 federal employees. The Purpose of the System includes a variety of purposes for which the records maintained are used.
• Update Categories of Individuals Covered by the System to correct all of the legal citations for referenced 38 U.S.C. sections and add title 38 Hybrid employees.
• Update Categories of Records in the System to add “(6) Other records, forms or reports containing health information for compliance with vaccination mandates for federal employees” as a new category of records to address the collection of health information required to meet Executive Order 14043, “Requiring Coronavirus Disease 2019 Vaccination for Federal Employees.”
• Update Record Source Categories to add VA IT systems as a source of information.
• Update Routine Use 27-28 to align with OPM/GOVT-10.
• Update Routine Uses #27 to state, “VA may disclose the results of a drug test of a Federal employee pursuant to an order of a court of competent jurisdiction where required by the United States Government to defend against any challenge against any adverse personnel action.”
• Update Routine Use #28 to state, “VA may disclose information to evaluate and report on the effectiveness of health and wellness programs by agency staff or third parties under contract with the agency to conduct such evaluations.”
• Update The Policies and Practices for Storage of Records to replace the reference to information in the Decentralized Hospital Computer Program (DHCP) system with “Electronic Records are maintained in VA IT systems.”
• Update The Policies and Practices for Retrieval of Records to add medical record number and, employee's VA email address.
• Update The Policies and Practices for Retention and Disposal of Records to indicate that “Records in this system are retained and disposed of in accordance with the schedule approved by the Archivist of the United States, VA RCS 10-1, Item 3015, excluding Item 3015.9.”
• Update The Administrative, Technical, and Physical Safeguards section to remove all reference to DHCP and replace it with VA IT systems.

Update Record Access Procedures to clarify where requests should be submitted and to replace the need for the Social Security Number with only “last four of social security number” to allow for adequate identification while protecting individual's information. Notification procedures is being revised to also replace the need for the Social Security Number with only “last four of social security number.” VA is republishing the system notice in its entirety.

Signing Authority

The Senior Agency Official for Privacy, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Kurt D. DelBene, Assistant Secretary for Information and Technology and Chief Information Officer, approved this document on December 13, 2022 for publication.

Dated: January 20, 2023.

Amy L. Rose,

Program Analyst, VA Privacy Service, Office of Information Security, Office of Information and Technology, Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:

Employee Medical File System Records (Title 38)—VA, (08VA05).

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

For current employees, records are located in VA medical, personnel, dispensary, health, safety or other designated offices at Central Office and field facilities (see Appendix 1); in VA National Data Centers; in VA information technology (IT) systems within VA Central Office; with another agency providing such services for the VA; or with private sector contractors.

For former employees, most records will be located in an Employee Medical Folder (EMF) stored in Federal records centers operated by the National Archives and Records Administration (NARA). Paper record abstract information is stored in automated storage media records that are maintained at the health care facilities.

SYSTEM MANAGER(S):

The Chief Human Capital Officer (05), Tracey Therit, VA Central Office, 810 Vermont Avenue NW, Washington, DC 20420, phone: [phone], email: [e-mail].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Executive Orders 12196 and 12564; Urgent Relief for the Homeless Supplemental Appropriations Act of 1987, Public Law 100-71, Section 503, 101 Stat. 468 (1987); 38 U.S.C, Chapter 3, §§ 501(a)-(b); Chapter 73 and Chapter 75, § 7802.

PURPOSE(S) OF THE SYSTEM:

Records in this system of records are maintained for the following purposes:

a. To ensure that records required to be retained on a long-term basis to meet the mandates of law, Executive Order, or regulations ( e.g., the Department of Labor's Occupational Safety and Health Administration (OSHA) and Office of Workers' Compensation Program regulations), are so maintained.

b. To provide data necessary for proper medical evaluations and diagnoses, to ensure that proper treatment is administered, and to maintain continuity of medical care.

c. To provide an accurate medical history of the total health care and medical treatment received by the individual as well as job and/or hazard exposure documentation and health monitoring in relation to health status and claims of the individual.

d. To enable the planning for further care of the employee/individual.

e. To provide a record of communications among members of the health care team who contribute to the employee/individual's care.

f. To provide a legal document describing the health care administered and any exposure incident.

g. To provide a method for evaluating quality of health care rendered and job health-protection including engineering protection provided, protective equipment worn, workplace monitoring, and medical exam monitoring required by OSHA or by good practice.

h. To ensure that all relevant, necessary, accurate, and timely data are available to support any medically related employment decisions affecting the subject of the records ( e.g., in connection with fitness-for-duty and disability retirement decisions).

i. To document claims filed with and the decisions reached by the Office of Workers' Compensation Program and the individual's possible reemployment rights under statutes governing that program.

j. To document employee's reporting of on-the-job injuries or unhealthy or unsafe working conditions, including the reporting of such conditions to the OSHA and actions taken by that agency or by the employing agency.

k. To ensure proper and accurate operation of the agency's employee drug testing program under Executive Order 12564.

l. To facilitate communication among members of an on-site health and wellness program and to the employee/individual participating in the program.

m. To enable evaluation of the effectiveness of on-site health and wellness programs.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The following categories of individuals are covered by this system: current or former VA employees appointed under title 38 includes employees appointed to occupations identified in 38 U.S.C. 7306, 7401(1), and 7401(3); and employees in those occupations who are appointed under 38 U.S.C. 7405 and 7406.

CATEGORIES OF RECORDS IN THE SYSTEM:

Records maintained in this system include: (1) Medical records, forms, and reports completed or obtained when an individual applies for a Federal job and is subsequently employed; (2) Medical records, forms, and reports completed during employment as a condition of employment, either by the VA or by another agency, State or local government entity, or a private sector entity under contract to the VA; (3) Records resulting from the testing of the employee for use of illegal drugs under Executive Order 12564. Such records may be retained by the VA ( e.g., by the VA Medical Review Official) or by a contractor laboratory. This includes records of negative results, confirmed or unconfirmed positive test results, and lists of who has been tested, who failed to report for testing, and related documents. Records maintained by a VA dispensary are included in the system only when they are the result of a condition of employment or related to an on-the-job occurrence. (4) Files containing reports of on-the-job injuries and medical records, forms, and reports generated as a result of the filing of a claim for Workers' Compensation, whether the claim is accepted or not. (The official compensation claim file, maintained by the Department of Labor's Office of Workers' Compensation Program (OWCP) is part of that agency's system of records and not covered by this notice.) (5) All other medical records, forms, and reports created on an employee during his or her period of employment, including records retained on a short term/temporary basis ( i.e., those designated to be retained only while the employee is with the VA) and records designated for long-term retention ( i.e., those retained for the employee's duration of Federal service and for some period of time thereafter). (6) Records resulting from participation in agency-sponsored health promotion and wellness activities, including health risk appraisals, biometric testing, health coaching, disease management, behavioral management, preventive services, fitness programs, and any other activities that could be considered part of a comprehensive worksite health and wellness program.

RECORD SOURCE CATEGORIES:

Records in this system are obtained from: the individual to whom the records pertain, VA employee health unit staff, Federal and private sector medical practitioners and treatment facilities, supervisors/managers and other VA officials, testimony of witness, and other VA records and VA IT systems.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

1. To a Member of Congress or staff acting upon the Member's behalf when the Member or staff requests the information on behalf of, and at the request of, the individual who is the subject of the record.

2. To appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records,· (2) VA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, VA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with VA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

3. To another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

4. To a Federal, state, local, territorial, tribal, or foreign law enforcement authority or other appropriate entity charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing such law, provided that the disclosure is limited to information that, either alone or in conjunction with other information, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature. The disclosure of the names and addresses of veterans and their dependents from VA records under this routine use must also comply with the provisions of 38 U.S.C. 5701.

5. To the Department of Justice (DoJ), or in a proceeding before a court, adjudicative body, or other administrative body before which VA is authorized to appear, when:

(a) VA or any component there of;

(b) Any VA employee in his or her official capacity;

(c) Any VA employee in his or her individual capacity where DoJ has agreed to represent the employee; or

(d) The United States, where VA determines that litigation is likely to affect the agency or any of its components is a party to such proceedings or has an interest in such proceedings, and VA determines that use of such records is relevant and necessary to the proceedings.

6. To contractors, grantees, experts, consultants, students, and others performing or working on a contract, service, grant, cooperative agreement, or other assignment for VA, when reasonably necessary to accomplish an agency function related to the records.

7. To the Office of Personnel Management (OPM) in connection with the application or effect of civil service laws, rules, regulations, or OPM guidelines in particular situations.

8. To the Equal Employment Opportunity Commission (EEOC) in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or other functions of the Commission as authorized by law.

9. To the Federal Labor Relations Authority (FLRA) in connection with the investigation and resolution of allegations of unfair labor practices, the resolution of exceptions to arbitration awards when a question of material fact is raised, matters before the Federal Service Impasses Panel, and the investigation of representation petitions and the conduct or supervision of representation elections.

10. To the Merit Systems Protection Board (MSPB) in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by law.

11. To the National Archives and Records Administration (NARA) in records management inspections conducted under 44 U.S.C. 2904 and 2906, or other functions authorized by laws and policies governing NARA operations and VA records management responsibilities.

12. VA may disclose information to Office of Management and Budget (OMB) at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19.

13. VA may disclose information to survey teams of the Joint Commission on Accreditation of Healthcare Organizations, College of American Pathologists, American Association of Blood Banks, and similar national accreditation agencies or boards with which VA has a contract or agreement to conduct such reviews, as relevant and necessary for the purpose of program review or the seeking of accreditation or certification.

14. VA may disclose information to disclose to health insurance carriers contracting with the OPM to provide a health benefits plan under the Federal Employee Health Benefits Program, information necessary to verify eligibility for payment of a claim for health benefits or to carry out the coordination of audit of benefit provisions of such contracts.

15. VA may disclose information to locate individuals for health research or survey response and in the production of summary descriptive statistics and analytical studies ( e.g., epidemiological studies) in support of the function for which the records are collected and maintained. While published statistics and studies do not contain individual identifiers, in some instances the selection of elements of data included in the study might be structured in such a way as to make the data individually identifiable by inference.

16. VA may disclose information to the Office of Federal Employees Group Life Insurance that is relevant and necessary to verify election, declination, or waiver of regular and/or optional life insurance coverage or eligibility for payment of a claim for life insurance.

17. VA may disclose information when an individual to whom a record pertains is mentally incompetent or under other legal disability, to any person who is responsible for the care of the individual, to the extent necessary.

18. VA may disclose information to the agency-appointed representative of an employee all notices, determinations, decisions, or other written communications issued to the employee, in connection with an examination ordered by the agency under: (a) Medical evaluation (formerly Fitness for Duty) examinations procedures, or (b) agency-filed disability retirement procedures.

19. VA may disclose information to a requesting agency, organization, or individual the home address and other information concerning those individuals who it is reasonably believed might have contracted an illness or been exposed to or suffered from a health hazard while employed in the Federal work force.

20. VA may disclose information to a Federal agency, in response to its request or at the initiation of the VA, in connection with the retention of an employee, the issuance of a security clearance, the conducting of a suitability or security investigation of an individual, the letting of a contract, or the issuance of a license, grant, or other benefit by the other agency, or the lawful statutory, administrative or investigative purpose of the agency to the extent that the information is relevant and necessary to the other agency's decision on the matter.

21. VA may disclose information to any Federal, State, or local government agency, in response to its request or at the initiation of the VA, information relevant and necessary to the lawful, statutory, administrative, or investigatory purpose as it relates to the conduct of job-related epidemiological research or the assurance of compliance with Federal, State, or local government laws on health and safety in the work environment.

22. VA may disclose to officials of labor organizations recognized under 5 U.S.C. Chapter 71, analyses using exposure or medical records and employee exposure records, in accordance with the record access rules of the OSHA, Department of Labor, and subject to the limitations of 29 CFR 1910.20(e)(2)(iii)(B).

23. VA may disclose information to a Federal Agency or to a State or local government licensing board and/or to the Federation of State Medical Boards or a similar nongovernment entity which maintains records concerning individuals' employment histories or concerning the issuance, retention or revocation of licenses, certifications, or registrations necessary to practice an occupation, profession or specialty, in order for the Agency to obtain information relevant to an Agency decision concerning the hiring, retention or termination of an employee or to inform a Federal Agency or licensing boards or the appropriate nongovernment entities about the health care practices of a terminated, resigned or retired health care employee whose professional health care activity so significantly failed to conform to generally accepted standards of professional medical practice as to raise reasonable concern for the health and safety of patients in the private sector or from another Federal Agency. These records may also be disclosed as part of an ongoing computer matching program to accomplish these purposes.

24. VA may disclose information to a State or local government entity which has the legal authority to make decisions concerning the issuance, retention or revocation of licenses, certifications or registrations required to practice a health care profession, when requested in writing by an investigator or supervisory official of the licensing entity for the purpose of making a decision concerning the issuance, retention or revocation of the license, certification or registration of a named health care professional.

25. VA may disclose information to the National Practitioner Data Bank at the time of hiring or clinical privileging/re-privileging of health care practitioners, and other times as deemed necessary by VA, in order for VA to obtain information relevant to a Department decision concerning the hiring, privileging/re-privileging, retention, or termination of the applicant or employee.

26. VA may disclose information to the National Practitioner Data Bank or a state licensing board in the state in which a practitioner is licensed, in which the VA facility is located, or in which an act or omission occurred upon which a medical malpractice claim was based when VA reports information concerning: (1) Any payment for the benefit of a physician, dentist, or other licensed health care practitioner that was made as the result of a settlement or judgment of a claim of medical malpractice, if an appropriate determination is made in accordance with Department policy that payment was related to substandard care, professional incompetence, or professional misconduct on the part of the individual; (2) a final decision that relates to possible incompetence or improper professional conduct that adversely affects the clinical privileges of a physician or dentist for a period longer than 30 days; or (3) the acceptance of the surrender of clinical privileges or any restriction of such privileges by a physician or dentist, either while under investigation by the health care entity relating to possible incompetence or improper professional conduct, or in return for not conducting such an investigation or proceeding. These records may also be disclosed as part of a computer matching program to accomplish these purposes.

27. VA may disclose the results of a drug test of a Federal employee pursuant to an order of a court of competent jurisdiction where required by the United States Government to defend against any challenge against any adverse personnel action.

28. VA may disclose information to evaluate and report on the effectiveness of health and wellness programs by agency staff or third parties under contract with the agency to conduct such evaluations.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are stored in paper folders, microfiche, magnetic discs, magnetic tape, and on file cards, X-rays, or other medical reports and forms. These records are stored in VA medical, personnel, dispensary, health, safety or other designated offices at Central Office and field facilities. Electronic records are maintained in VA IT systems.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by the employee/individual's name, date of birth, medical record number, employee/individual's VA email address, last four of the employee/individual's social security number, or any combination of those identifiers.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records in this system are retained and disposed of in accordance with the schedule approved by the Archivist of the United States, VA RCS 10-1, Item 3015, excluding Item 3015.9.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Paper records are stored in locked file cabinets or locked rooms. Generally, file areas are locked after normal duty hours. Automated records are protected by restricted access procedures and audit trails. Access to Employee Medical File System records is strictly limited to VA or contractor officials with a bona fide need for access to the records. Strict control measures are enforced to ensure that access to and disclosure from these records are limited to a “need-to-know basis.” In VA Central Office these paper records are maintained in staffed rooms during working hours. During nonworking hours, there is limited access to the building with visitor control by security personnel. Access to VA computer rooms within VA facilities is generally limited by appropriate locking devices and restricted to authorized VA employees/individuals and vendor personnel. Automated data processing peripheral devices are generally placed in secure areas (areas that are locked or have limited access) or are otherwise protected. Information in VA National Data Centers and VA IT systems may be accessed by authorized VA employees/individuals. Access to file information is controlled at two levels; the system recognizes authorized employees/individuals by a series of individually unique passwords/codes as a part of each message, and the employees/individuals are limited to only that information in the file which is needed in the performance of their official duties. Drug testing records will be maintained in accordance with the Urgent Relief for the Homeless Supplemental Appropriations Act of 1987, Public Law No. 100-71, Section 503, 101 Stat. 468 (1987). Contractor laboratories are subject to the same restrictions as VA employees/individuals.

RECORD ACCESS PROCEDURES:

Individuals requesting access to and contesting the contents of records must submit to the Human Resources Management Office at the facility where last employed the following information for their records to be located and identified: (1) Full name, (2) date of birth, (3) last four of social security number, (4) name and location of VA facility where last employed and dates of employment, and (5) signature.

CONTESTING RECORD PROCEDURES:

Individuals seeking to contest or amend records in this system pertaining to them should contact the Human Resources Management Office at the facility where last employed in writing as indicated above. A request to contest or amend records must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record.

NOTIFICATION PROCEDURES:

Generalized notice is provided by the publication of this notice. For specific notice, see Record Access Procedure, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

Last full publication was prior to 1995.