Privacy Act of 1974; System of Records, 3980-3982 [05-1541]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 70, Number 17 (Thursday, January 27, 2005)]
[Notices]
[Pages 3980-3982]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 05-1541]


-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Department of Veterans Affairs (VA).

ACTION: Notice of amendment to system of records.

-----------------------------------------------------------------------

SUMMARY: As required by the Privacy Act of 1974, 5 U.S.C. 552a(e), 
notice is hereby given that the Department of Veterans Affairs (VA) is 
amending the system of records entitled ``National Prosthetic Patient 
Database (NPPD)-VA'' (33VA113) as set forth in the Federal Register, 40 
FR 38095 (Aug. 26, 1975) and last amended in the Federal Register, 66 
FR 20033-34 (Apr. 18, 2001). VA is amending the Routine Uses of Records 
Maintained in the System, including Categories of Users and the 
Purposes of Such Uses. VA is republishing the system notice in its 
entirety.

DATES: Comments on the amendment of this system of records must be 
received no later than February 28, 2005. If no public comment is 
received, the amended system will become effective February 28, 2005.

ADDRESSES: Written comments concerning the proposed amended system of 
records may be submitted by: Mail or hand-delivery to Director, 
Regulations Management (00REG1), Department of Veterans Affairs, 810 
Vermont Avenue, NW., Room 1068, Washington, DC 20420; fax to (202) 273-
9026; or e-mail to VAregulations@mail.va.gov. All comments received 
will be available for public inspection in the Office of Regulation 
Policy and Management, Room 1063B, between the hours of 8 a.m. and 4:30 
p.m., Monday through Friday (except holidays). Please call (202) 273-
9515 for an appointment.

FOR FURTHER INFORMATION CONTACT: Veterans Health Administration (VHA) 
Privacy Act Officer (19F2), Department of Veterans Affairs, 810 Vermont 
Avenue, NW., Washington, DC 20420, (727) 320-1839.

SUPPLEMENTARY INFORMATION: Information in this system of records is 
used to furnish administrative and clinical statistical procurement and 
prescription information, including total cost and summary of activity, 
including equipment usage, data to VA and other health care providers, 
both Federal and non-Federal, to aid in furthering the improvement of 
health care, research and education. The National Prosthetic Patient 
Database (NPPD) will generate data to provide ad-hoc reporting for 
clinical and management departments; provide insight into stations' 
purchasing practices and utilization of contracts; improve budget 
management; conduct reviews of prescribing practices/best practices; 
help to develop consistency in the way that service is provided; and 
help to establish consistent policies and procedures.
    VA is amending the following routine use disclosures of information 
to be maintained in the system:
     Routine use number one (1) is being amended in its 
entirety. VA must be able to disclose information within its possession 
on its own initiative that pertains to a violation of law to the 
appropriate authorities in order for them to investigate and enforce 
those laws. VA may disclose the names and home addresses of veterans 
and their dependents only to Federal entities with law enforcement 
responsibilities under 38 U.S.C. 5701(a) and (f). Accordingly, VA has 
so limited this routine use as follows:

    VA may disclose information on its own initiative any 
information in this system, except the names and home addresses of 
veterans and their dependents, which is relevant to a suspected or 
reasonably imminent violation of law, whether civil, criminal or 
regulatory in nature and whether arising by general or program 
statute or by regulation, rule or order issued pursuant thereto, to 
a Federal, state, local, tribal or foreign agency charged with the 
responsibility of investigating or prosecuting such violations, or 
charged with enforcing or implementing the statute, regulation, rule 
or order. On its own initiative, VA may also disclose the names and 
addresses of veterans and their dependents to a Federal agency 
charged with the responsibility of investigating or prosecuting 
civil, criminal or regulatory violations of law, or charged with 
enforcing or implementing the statute, regulation, rule or order 
issued pursuant thereto.

    The Privacy Act permits VA to disclose information about 
individuals without their consent for a routine use when the 
information will be used for a purpose that is compatible with the 
purpose for which we collected the information. In the routine use 
disclosure described above, the recipient of the information will use 
the information in connection with a matter relating to one of VA's 
programs or to provide a benefit to VA, or, alternatively, disclosure 
is required by law or would permit VA to notify appropriate entities 
about conduct of individuals in this system of records.
    Under section 264, Subtitle F of Title II of the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-191, 
100 Stat. 1936, 2033-34 (1996), the United States Department of Health 
and Human Services (HHS) published a final rule, as amended, 
establishing Standards for Privacy of Individually-Identifiable Health 
Information, 45 CFR Parts 160 and 164. VHA may not disclose 
individually-identifiable health information (as defined in HIPAA, 42 
U.S.C. 1320(d)(6), and corresponding Privacy Rule, 45 CFR 164.501) 
pursuant to a routine use unless either: (a) The disclosure is required 
by law, or (b) the disclosure is also permitted or required by the HHS 
Privacy Rule. The disclosures of individually-identifiable health 
information contemplated in the routine uses published in this amended 
system of records notice are permitted under the Privacy Rule. However, 
to also have authority to make such disclosures under the Privacy Act, 
VA

[[Page 3981]]

must publish these routine uses. Consequently, VA is publishing these 
routine uses and is adding a preliminary paragraph to the routine uses 
portion of the system of records notice stating that any disclosure 
pursuant to the routine uses in this system of records notice must be 
either required by law or permitted by the Privacy Rule before VHA may 
disclose the covered information.
    The Report of Intent to Publish an Amended System of Records Notice 
and an advance copy of the system notice have been sent to the 
appropriate Congressional committees and to the Director of the Office 
of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy 
Act) and guidelines issued by OMB, 61 FR 6428, (Feb. 20, 1996).

    Approved: January 7, 2005.
Anthony J. Principi,
Secretary of Veterans Affairs.
33VA113

SYSTEM NAME:
    National Prosthetic Patient Database (NPPD)-VA.

SYSTEM LOCATION:
    Records are maintained in Department of Veterans Affairs (VA) 
medical center databases. Extracts are maintained at the Austin 
Automation Center (AAC), Austin, Texas, and Hines Information Service 
Center, Hines, Illinois. VA health care facility address locations are 
listed in VA Appendix I of the Biennial Privacy Act Issuances 
publication.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Contracted fabricators of prosthetic and orthotic appliances; 
vendors and manufacturers of durable medical equipment and sensory-
neural aids; medical supply companies; VA beneficiaries; and VA 
employees.

CATEGORIES OF RECORDS IN THE SYSTEM:
    VA field facility ordering the orthotic device; Patient 
Identification Number; Health Care Financing Administration Common 
Procedure Coding System (HCPCS); item purchased/issued to patient; 
cost; quantity; type of issue (initial/replace/repair/spare); patient 
eligibility category (service-connected, prisoner of war, aid and 
attendance); responsible VA procurement officer or representative; 
order creation date; order close/delivery date; calculated processing 
days; transaction/purchase order number; type of form used to purchase 
item (VAF 2421, PC2421, VAF 2529, VAF 2914, etc.); and vendor/
contractor name. All other patient information, i.e., name, address, 
telephone number, can be retrieved by prosthetic program officials in 
VA Central Office by using the unique Patient Identification Number 
assigned to the patient in NPPD.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Title 38, United States Code, Section 527.

PURPOSE(S):
    The records or information in this system will be used to furnish 
administrative and clinical statistical procurement and prescription 
information, including total cost and summary of activity, including 
equipment usage, data to VA and other health care providers, both 
Federal and non-Federal, to aid in furthering the improvement of health 
care, research and education.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    VA may disclose protected health information pursuant to the 
following routine uses where required by law, or required or permitted 
by 45 CFR Parts 160 and 164.
    1. VA may disclose on its own initiative any information in this 
system, except the names and home addresses of veterans and their 
dependents, which is relevant to a suspected or reasonably imminent 
violation of law, whether civil, criminal or regulatory in nature and 
whether arising by general or program statute or by regulation, rule or 
order issued pursuant thereto, to a Federal, State, local, tribal, or 
foreign agency charged with the responsibility of investigating or 
prosecuting such violation, or charged with enforcing or implementing 
the statute, regulation, rule or order. On its own initiative, VA may 
also disclose the names and addresses of veterans and their dependents 
to a Federal agency charged with the responsibility of investigating or 
prosecuting civil, criminal or regulatory violations of law, or charged 
with enforcing or implementing the statute, regulation, rule or order 
issued pursuant thereto.
    2. To furnish administrative and clinical statistical procurement 
and prescription information, including total cost and summary of 
activity, including equipment usage, data to VA and other health care 
providers, both Federal and non-Federal, to aid in furthering the 
improvement of health care, research and education.
    3. To provide statistical and other information in response to 
legitimate and reasonable requests as approved by appropriate VA 
authorities.
    4. Disclosure may be made to a Congressional office from the record 
of an individual in response to an inquiry from the Congressional 
office made at the request of that individual.
    5. Disclosure may be made to National Archives and Records 
Administration (NARA) and General Services Administration (GSA) in 
records management inspections conducted under authority of Title 44 
United States Code.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Compact and magnetic disk.

RETRIEVABILITY:
    Indexed by Patient Identification Number for VA prosthetic 
personnel.

SAFEGUARDS:
    1. Access to VA working and storage areas is restricted to VA 
employees on a ``need to know'' basis. Generally, VA file areas are 
locked after normal duty hours and are protected from outside access by 
the Federal Protective Service. Strict control measures are enforced to 
ensure that disclosure is limited to a ``need to know'' basis. Physical 
access to the AAC is generally restricted to AAC staff, Central Office 
employees, custodial personnel, Federal Protective Service and 
authorized operational personnel through electronic locking devices. 
All other persons gaining access to the computer rooms are escorted.
    2. Access to computer rooms at health care facilities is generally 
limited by appropriate locking devices and restricted to authorized VA 
employees and vendor personnel. Automated data processing peripheral 
devices are placed in secure areas (areas that are locked or have 
limited access) or are otherwise protected. Information in the Veterans 
Health Information System and Technology Architecture (VistA) may be 
accessed by authorized VA employees. Access to file information is 
controlled at two levels; the systems recognize authorized employees by 
a series of individually-unique passwords/codes as a part of each data 
message, and the employees are limited to only that information in the 
file which is needed in the performance of their official duties. 
Access to information stored on automated storage media at other VA 
locations is controlled by individually-unique passwords/codes.

[[Page 3982]]

RETENTION AND DISPOSAL:
    Regardless of the record medium, records will be maintained and 
disposed of in accordance with the record disposition authority 
approved by the Archivist of the United States under National Archives 
Job No. N1-15-01-4.

SYSTEM MANAGER(S) AND ADDRESS:
    Chief Consultant, Prosthetic and Sensory Aids Service Strategic 
Healthcare Group (113), Department of Veterans Affairs, 810 Vermont 
Avenue, NW., Washington, DC 20420.

NOTIFICATION PROCEDURE:
    Individuals seeking information concerning the existence and 
content of a record pertaining to themselves must submit a written 
request or apply in person to the VA health care facility where they 
received the orthotic/prosthetic device/appliance/equipment. All 
inquiries must reasonably identify the records involved and the 
approximate date that medical care was provided. Inquiries should 
include the individual's full name, and identifying characteristics.

RECORD ACCESS PROCEDURES:
    Individuals seeking information regarding access to and contesting 
of a VA prosthetic-related record may write, call, or visit the VA 
facility where medical care was provided.

CONTESTING RECORD PROCEDURES:
    (See Record Access Procedures above.)

RECORD SOURCE CATEGORIES:
    VistA-VA (79VA19), Patient Medical Records-VA (24VA19), and 
veterans' records.

[FR Doc. 05-1541 Filed 1-26-05; 8:45 am]
BILLING CODE 8320-01-P