E6-16843. Privacy Act of 1974

AGENCY:

Department of Veterans Affairs (VA).

ACTION:

Notice of New System of Records.

SUMMARY:

The Privacy Act of 1974 (5 U.S.C. 552(e)(4)) requires all agencies to publish in the Federal Register a notice of the existence and character of their systems of records. Notice is hereby given that the Department of Veterans Affairs (VA) is establishing a new system of records entitled “Enterprise Project Management (EPM) Tool—VA” (122VA005P3).

DATES:

Comments on this new system of records must be received by November 13, 2006. If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by VA, the new system of records will become effective November 13, 2006.

ADDRESSES:

Written comments concerning the proposed new system of records may be submitted by: mail or hand-delivery to Director, Office of Regulations Management (00REG1), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420; fax to [phone]; or e-mail to [e-mail]. All comments received will be available for public inspection at the above address in the Office of Regulation Policy and Management, Room 1063B, between the hours of 8 a.m. and 4:30 p.m., Monday through Friday (except holidays). Please call [phone] for an appointment.

FOR FURTHER INFORMATION CONTACT:

Mr. Charles Warner, Director, Information Technology Program and Project Management Service, 810 Vermont Avenue, NW., Washington, DC 20420-0001 at [phone].

SUPPLEMENTARY INFORMATION:

I. Description of Proposed Systems of Records

The Clinger-Cohen Information Technology Management Reform Act, which states the “Director shall develop, as part of the budget process, a process for analyzing, tracking, and evaluating the risks and results of all major capital investments made by an executive agency for information systems,” outlines numerous requirements for managing and tracking information technology systems. In an effort to meet these requirements, VA is using the EPM Tool to manage, track, and report on IT projects.

The EPM Tool is an enterprise project, process, and resource management software tool that provides overall visibility into priorities, progress, and staffing. This will allow VA to make informed decisions and deliver projects on time through the capture and re-use of best practices by integrating project management capabilities into a unified information system for all project stakeholders in an easy-to-use, collaborative environment. The EPM Tool will also unite project, resource, and process management and give project managers and senior management clear visibility and insight into VA projects.

Once the project manager establishes a project in the EPM Project Manager Module Tool, a project schedule may be created using the functionalities within the EPM Tool. Resources, or individuals working on the project, are then assigned to each activity or task, based on area of expertise, e.g., computer specialist, training expert, etc. Resources may be assigned directly to the activity or task by name or by role, e.g., computer specialist, training expert, etc., and are responsible for reporting the amount of time spent working on an activity in the EPM Tool. Project resource costs may be calculated by several methods, including (1) Resource base salary plus a percentage for benefits/incidentals; (2) exact salary of the resource; or (3) average salary. Average salary is based on the resource's grade at Step 5. Contractor and subcontractor salaries may be tracked based on exact or blended rates for time and material contracts.

The records contain information on current and former VA employees, contractors, and subcontractors acting in the capacity of project managers and project team members. In particular, the records include information related to:

1. Identifying information, including name, title, and other unique identifier (not Social Security Number);

2. Project work activities;

3. Hours of effort spent on project activities/tasks;

4. Hours of effort spent on non-project activities, such as administrative duties and assignments;

5. A generic leave category or specific vacation and/or sick time; and

6. Salaries of project managers and team members.

Because this information is retrieved by the name or other unique identifier of a VA employee, contractor, or subcontractor, VA must establish the EPM Tool as a new system of records.

The authority for maintaining the EPM Tool is found in 38 United States Code, Section 501. Records are maintained at the Hines Office of Information Field Office, Hines, IL. Data will be stored on a central server, currently located at Hines. While the central server in Hines is considered to be the “production” database, information stored on this central server can be exported to a stand-alone version of tool on the client computers. This allows the project managers to do “what if” scenarios without corrupting the information in the production database. In addition, at the central processing site, backup media are created and stored.

II. Proposed Routine Use Disclosures of Data in the System

VA is proposing to establish the following routine use disclosures of information maintained in the system:

1. VA may disclose information to a Congressional office from the record of an individual in response to an inquiry from the Congressional office made on behalf and at the written request of that individual.

Individuals sometimes request the help of a Member of Congress in resolving some issue relating to a matter before VA. When the Member of Congress writes VA, VA must be able to provide sufficient information to be responsive to the inquiry.

2. VA may disclose information to the National Archives and Records Administration (NARA) in records management inspections conducted under authority of Title 44, United States Code.

NARA is responsible for archiving records no longer actively used but may be appropriate for preservation, and is responsible in general for the physical maintenance of the Federal Government's records. VA must be able to turn records over to NARA in order to determine the proper disposition of such records.

3. VA may disclose information to the Department of Justice (DOJ), including United States Attorneys, or in a proceeding before a court, adjudicative body, or other administrative body when the litigation or adjudicative or administrative process is likely to affect VA, its employees, or any of its components; or when VA, its employees, or any of its components is a party to the litigation or process, or has an interest in the litigation or process; and the use of these records is deemed by VA to be relevant and necessary to the litigation or process, provided that the disclosure is compatible with a purpose for which the records were collected.

When VA is involved in litigation or an adjudicative or administrative process, or occasionally when another party is involved in litigation or an adjudicative or administrative process, and VA policies or operations could be affected by the outcome of the litigation or process, VA must be able to disclose information to the court, adjudicative or administrative bodies, or parties involved. A determination would be made in each instance that, under the circumstances involved, the purpose served by the use of the information in the particular litigation or process is compatible with a purpose for which VA collected the information. This routine use would not constitute authority to disclose records in response to a subpoena unless signed by a judge, a court order under Privacy Act subsection (b)(11), 5 U.S.C. 552(b)(11), or any other provision of Privacy Act subsection (b) because of the Court's analysis in Doe v. DiGenova, 779 F.2d 74, 78-84 (D.C. Cir. 1985) and Doe v. Stephens, 851 F.2d 1457, 1465-67 (DC Cir. 1988).

4. VA may disclose information to individuals, organizations, private or public agencies, or other entities with which VA has a contract or agreement, or where there is a subcontract to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor or subcontractor to perform the services of the contract or agreement.

VA must be able to provide information to contractors or subcontractors with which VA has a contract or agreement in order to perform the services of the contract or agreement.

5. VA may disclose information to the Office of Management and Budget (OMB) in order for them to perform their statutory responsibilities for evaluating Federal programs. VA must be able to provide information to OMB in order for it to carry out its responsibilities for evaluating Federal programs.

6. VA may disclose on its own initiative any information in this system, except the names of veterans and their dependents, which is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal, or regulatory in nature and whether arising by general or program statute or by regulation, rule, or order issued pursuant thereto, to a Federal, State, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule, or order. VA may also disclose on its own initiative the names of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal, or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule, or order issued pursuant thereto.

VA must be able to disclose information within its possession on its own initiative that pertains to a violation of law to the appropriate authorities in order for them to investigate and enforce those laws. VA may disclose the names of veterans and their dependents only to Federal entities with law enforcement responsibilities under 38 U.S.C. 5701(a) and (f). Accordingly, VA has so limited this routine use.

7. VA may disclose information to the Federal Labor Relations Authority (FLRA), including its General Counsel, when requested in connection with the investigation and resolution of allegations of unfair labor practices, in connection with the resolution of exceptions to arbitrator awards when a question of material fact is raised, in connection with matters before the Federal Service Impasses Panel, and to investigate representation petitions and conduct or supervise representation elections.

VA must be able to disclose information to FLRA to comply with the statutory mandate under which FLRA operates.

8. VA may disclose information to officials of labor organizations recognized under 5 U.S.C. chapter 71 when relevant and necessary to their duties of exclusive representation concerning personnel policies, practices, and matters affecting working conditions.

VA must be able to disclose information to officials of labor organizations to assist them in fulfilling their responsibilities in representing employees. This routine use is intended to provide no greater authority to release records to officials of labor unions than provided under 5 U.S.C. 7114(b)(4).

9. VA may disclose information to offices of the Merit Systems Protection Board (MSPB), including the Office of the Special Counsel, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be authorized by law.

VA must be able to disclose information to the MSPB to assist it in fulfilling its responsibilities regarding Federal employees.

10. VA may disclose information to the Equal Employment Opportunity Commission (EEOC) when requested in connection with investigations of alleged or possible discrimination practices, examination of Federal affirmative employment programs, compliance with the Uniform Guidelines of Employee Selection Procedures, or other functions vested in the Commission by the President's Reorganization Plan No. 1 of 1978.

VA must be able to disclose information to the EEOC to assist it in fulfilling its responsibilities to protect employee rights.

III. Compatibility of the Proposed Routine Uses

The Privacy Act permits VA to disclose information about individuals without their consent for a routine use when the information will be used for a purpose that is compatible with the purpose for which VA collected the information. In all of the routine use disclosures described above, the recipient of the information will use the information in connection with a matter relating to one of VA's programs or to provide a benefit to VA, or disclosure is required by law.

A report of the new system of records has been submitted to the Senate Committee on Homeland Security and Government Affairs, the House Committee on Government Reform, and the Office of Management and Budget (OMB), pursuant to the Privacy Act, 5 U.S.C. 552a(r), as amended, and Appendix I to OMB Circular No. 1-130, “Federal Agency Responsibilities for Maintaining Records about Individuals,” as amended on 61 FR 1996 (Feb. 20, 1996)

Approved: September 26, 2006.

Gordon H. Mansfield,

Deputy Secretary of Veterans Affairs.

122VA005P3

SYSTEM NAME:

Enterprise Project Management Tool.

SYSTEM LOCATION:

Records will be maintained at the Hines Office of Information Field Office, Edward Hines, Jr. Hospital, Bldg. 37, Hines, IL 60141.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Current and former VA employees, contractors, or subcontractors acting in the capacity of project managers and project team members on Information Technology (IT) projects.

CATEGORIES OF RECORDS IN THE SYSTEM:

The records may include information related to: names and other identifying information, project work activities, hours of effort spent on project activities/tasks and on non-project activities, generic leave category or specific vacation and/or sick time, and salaries of project managers and team members.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Title 38, United States Code, section 501.

PURPOSE (S):

The records will be used to track, manage, and report on the development of IT systems within VA in order to make informed decisions and deliver projects on time through the capture and re-use of best practices.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

1. VA may disclose information to a Congressional office from the record of an individual in response to an inquiry from the Congressional office made on behalf and at the written request of that individual.

2. VA may disclose information to the National Archives and Records Administration in records management inspections conducted under authority of Title 44, United States Code.

3. VA may disclose information to the Department of Justice (DOJ), including United States Attorneys, or in a proceeding before a court, adjudicative body, or other administrative body when the litigation or adjudicative or administrative process is likely to affect VA, its employees, or any of its components, or when VA, its employees, or any of its components is a party to the litigation or process, or has an interest in the litigation or process and the use of these records is deemed by VA to be relevant and necessary to the litigation or process, provided that the disclosure is compatible with the purpose for which the records were collected.

4. VA may disclose information to individuals, organizations, private or public agencies, or other entities with which VA has a contract or agreement or where there is a subcontract to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor or subcontractor to perform the services of the contract or agreement.

5. VA may disclose information to the Office of Management and Budget in order for them to perform their statutory responsibilities for evaluating Federal programs.

6. VA may disclose on its own initiative any information in this system, except the names of veterans and their dependents, which is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal, or regulatory in nature and whether arising by general or program statute or by regulation, rule, or order issued pursuant thereto, to a Federal, State, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule, or order. VA may also disclose on its own initiative the names of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal, or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule, or order issued pursuant thereto.

7. VA may disclose information to the Federal Labor Relations Authority (FLRA), including its General Counsel, when requested in connection with the investigation and resolution of allegations of unfair labor practices, in connection with the resolution of exceptions to arbitrator awards when a question of material fact is raised, in connection with matters before the Federal Service Impasses Panel, and to investigate representation petitions and conduct or supervise representation elections.

8. VA may disclose information to officials of labor organizations recognized under 5 U.S.C. chapter 71 when relevant and necessary to their duties of exclusive representation concerning personnel policies, practices, and matters affecting working conditions.

9. VA may disclose information to offices of the Merit Systems Protection Board, including the Office of the Special Counsel, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be authorized by law.

10. VA may disclose information to the Equal Employment Opportunity Commission when requested in connection with investigations of alleged or possible discrimination practices, examination of Federal affirmative employment programs, compliance with the Uniform Guidelines of Employee Selection Procedures, or other functions vested in the Commission by the President's Reorganization Plan No. 1 of 1978.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM

STORAGE:

Records are maintained on electronic storage media, such as disks, drives, or more specifically, the IT Project Office database.

RETRIEVABILITY:

Records are retrieved by individual name or other unique identifier (not Social Security number).

SAFEGUARDS:

1. Access to VA working and storage areas is restricted to VA personnel, including contractors or subcontractors, on a “need-to-know” basis; strict control measures are enforced to ensure that disclosure to these individuals is also based on this same principle. Generally, VA file areas are locked after normal duty hours, and the facilities are protected from outside access by the Federal Protective Service or other security personnel.

2. Physical access to the Hines Office of Information Field Office is restricted to Center personnel, custodial personnel, the Federal Protective Service or other security personnel, and authorized operational personnel through electronic locking devices. All other persons gaining access to computer rooms are escorted.

3. Access to computer rooms is generally limited by appropriate locking devices and restricted to authorized VA personnel. IT peripheral devices are placed in secure areas that are locked, with limited access, or otherwise protected. Access to information stored on automated storage media at other VA locations is controlled by individually unique passwords/codes, which must be changed periodically by the user. Access by authorized VA employees at remote locations, including VA field offices and health care facilities, Information Systems Centers, and VA Central Office, who may access information stored in the computer, is controlled in the same manner.

RETENTION AND DISPOSAL:

Records are disposed of in accordance with the National Archives and Records Administration (NARA) General Records Schedule (GRS) 14, which specifies that information service project case files in formally designated information offices be maintained for one year after close of file or completion of project.

SYSTEM MANAGER(S) AND ADDRESS:

Official responsible for policies and procedures is: Director, Information Technology Program and Project Management Service, 810 Vermont Avenue, NW., Washington, DC 20420-0001, [phone].

NOTIFICATION PROCEDURE:

Individuals seeking information on the existence and content of a record pertaining to them should contact the VA facility at which they are or were employed, or have or made contact. Inquiries should include the person's full name, project name, dates of work on the project, and return address.

RECORD ACCESS PROCEDURE:

Individuals seeking information on access to and contesting of a record in this system may contact the VA facility where they are or were employed, or have or made contact. Inquiries should include the person's full name, project name, dates of the project, and return address.

CONTESTING RECORD PROCEDURE:

(See Record Access Procedures above.)

RECORD SOURCE CATEGORIES:

Information in this system of records is provided by VA employees, contractors, and subcontractors.