Privacy Act of 1974, 13277-13280 [E8-4895]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 73, Number 49 (Wednesday, March 12, 2008)]
[Notices]
[Pages 13277-13280]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-4895]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974

AGENCY: Department of Veterans Affairs.

ACTION: Notice of establishment of a new system of records.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974, (5 U.S.C. 552a(e)(4)) requires that 
all agencies publish in the Federal Register a notice of the existence 
and character of their systems of records. Notice is hereby given that 
the Department of Veterans Affairs (VA) is establishing a new system of 
records entitled ``Inquiry Routing & Information System (IRIS)-VA'' 
(151VA005N).

DATES: Comments on this new system of records must be received no later 
than April 11, 2008. If no public comment is received, the new system 
will become effective April 11, 2008.

ADDRESSES: Written comments concerning the proposed new system of 
records may be submitted through https://www.Regulations.gov; by mail or 
hand delivery to the Director, Regulations Management (00REG), 
Department of Veterans Affairs, 810 Vermont Avenue, NW., Room 1063B, 
Washington, DC 20420; or by fax to (202) 273-9026 (This is not a toll 
free number). Copies of comments will be available for public 
inspection in the Office of Regulation Policy and Management, Room 
1063B, between the hours of 8 a.m. and 4:30 p.m., Monday through Friday 
(except holidays). Please call (202) 273-9515 (This is not a toll free 
number) for an appointment. In addition, during the comment period, 
comments may be viewed online through the Federal Docket Management 
System (FDMS) at https://www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT: Ms. Diane Huber, Director, VA Web 
Solutions, Office of Information & Technology (005), 1335 East-West 
Highway, Silver Spring, Maryland 20910, telephone (301) 734-0189 (This 
is not a toll free number).

SUPPLEMENTARY INFORMATION:

I. Description of the Proposed System of Records

    The Department of Veterans Affairs (VA) receives and responds to 
questions, suggestions, compliments, complaints, requests for the 
status of claims and other information, collectively referred to as 
inquiries, received from veterans, their representatives and 
individuals and entities doing business with VA via a Web-based 
communications system known as the Inquiry Routing & Information System 
(IRIS). This system is also used by VA call center staff to enter 
inquiries on behalf of veterans and others doing business with the 
Department.
    The IRIS is accessed by clicking on the ``Contact VA'' link that 
appears on VA Internet Web sites. Thousands of messages are received 
each month from VA beneficiaries and other veterans, veterans' family 
members and/or their representatives, health care professionals, 
clinicians, employees and managers of small businesses, vendors, 
funeral directors, mortgage companies, realtors, home buyers, 
researchers, small business owners, veterans' service organizations, 
other Federal agencies, State and local government employees, teachers, 
and other demographic groups representing every segment of the 
population both at home and abroad. Messages are routed throughout VA 
based on type of issue and topic as selected by the inquirer and also 
on the physical location of the inquirer, if provided. Messages go to 
designated mailgroups in Veterans Benefits Administration, Veterans 
Health Administration, National Cemetery Administration, and other VA 
program offices.
    In November 2002, VA purchased and implemented a heavily customized 
version of a Web-based, commercial contact management product for use 
on VA's Internet Web site at https://www.va.gov and for use by VA call 
center personnel who enter inquiries on behalf of veterans or other 
callers. Visitors to the VA Web site and other inquirers may ask 
questions or provide VA with information by completing an approved form 
or having the form completed for them by call center staff. All 
personal data are captured and maintained within a database on a secure 
Web server running Secure Socket Layer (SSL). The information that VA 
requests on the form is necessary for VA to adequately respond to the 
inquiries. The IRIS gives VA managers the ability to track inquiry 
traffic, to measure the quality and timeliness of responses, and to 
develop and post Frequently Asked Questions (FAQs) based on the 
analysis of messages received.
    The use of the IRIS by VA Web site visitors and callers to VA call 
centers illustrates its utility for communications with VA. VA staff 
will search the IRIS database by personal identifier to provide a 
thorough response to the inquirer. The expansion of the search 
capability in the IRIS database enables VA to provide better service, 
associate communications from a single individual and provide more 
thorough responses to their inquiries. The new system of records will 
cover anyone who chooses to submit an inquiry in person, by calling a 
VA call center, or by submitting an electronic message directly to VA.
    Information requested to process the request may include name, 
address, phone number, e-mail address, and service or claim number and 
Social Security number if provided by the inquirer. Inquirers are not 
required to provide personal or contact information; however, in some 
instances VA may need this information in order to respond to specific 
inquiries. The authority to maintain these records is title 38, United 
States Code, section 501.

II. Routine Uses of Records Maintained in the System, Including 
Categories of Users and the Purposes of Such Uses

    Limitation on Routine Use Disclosures: To the extent that records 
contained in the system include information protected by 45 CFR Parts 
160 and 164, i.e., individually identifiable health information, and 38 
U.S.C. 7332, i.e., medical treatment information related to drug abuse, 
alcoholism or alcohol abuse, sickle cell anemia or infection with the 
human immunodeficiency virus, that information cannot be disclosed 
under a routine use unless there is also specific statutory authority 
in 38 U.S.C. 7332 and regulatory authority in 45 CFR Parts 160 and 164 
permitting disclosure.
    1. Contractors: Disclosure may be made to individuals, 
organizations, private or public agencies, or other entities or 
individuals with whom VA has a contract or agreement to perform such 
services as VA may deem practicable for the purposes of laws 
administered by VA, in order for the contractor, subcontractor, public 
or private agency, or other entity or individual with whom VA has an 
agreement or contract to perform the services of the contract or 
agreement. This routine use includes disclosures by the individual or 
entity performing the service for VA to any secondary entity or 
individual to perform an activity that

[[Page 13278]]

is necessary for individuals, organizations, private or public 
agencies, or other entities or individuals with whom VA has a contract 
or agreement to provide the service to VA.
    2. Equal Employment Opportunity Commission: To disclose information 
to the Equal Employment Opportunity Commission when requested in 
connection with investigations of alleged or possible discriminatory 
practices, examination of Federal affirmative employment programs, or 
for other functions of the Commission as authorized by law or 
regulation.
    3. Merit Systems Protection Board: To disclose information to 
officials of the Merit Systems Protection Board, or the Office of the 
Special Counsel, when requested in connection with appeals, special 
studies of the civil service and other merit systems, review of rules 
and regulations, investigation of alleged or possible prohibited 
personnel practices, and such other functions, promulgated in 5 U.S.C. 
1205 and 1206, or as may be authorized by law.
    4. Law Enforcement: VA may disclose on its own initiative any 
information in this system, except the names and home addresses of 
veterans and their dependents, which is relevant to a suspected or 
reasonably imminent violation of law, whether civil, criminal or 
regulatory in nature and whether arising by general or program statute 
or by regulation, rule or order issued pursuant thereto, to a Federal, 
State, local, tribal, or foreign agency charged with the responsibility 
of investigating or prosecuting such violation, or charged with 
enforcing or implementing the statute, regulation, rule or order. On 
its own initiative, VA may also disclose the names and addresses of 
veterans and their dependents to a Federal agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto.
    5. Credit Risk Analysis and Services: VA may, on its own 
initiative, disclose any information or records to appropriate 
agencies, entities, and persons when (1) VA suspects or has confirmed 
that the integrity or confidentiality of information in the system of 
records has been compromised; (2) the Department has determined that as 
a result of the suspected or confirmed compromise there is a risk of 
embarrassment or harm to the reputations of the record subjects, harm 
to economic or property interests, identity theft or fraud, or harm to 
the security, confidentiality, or integrity of this system or other 
systems or programs (whether maintained by the Department or another 
agency or entity) that rely upon the potentially compromised 
information; and (3) the disclosure is to agencies, entities, or 
persons whom VA determines are reasonably necessary to assist or carry 
out the Department's efforts to respond to the suspected or confirmed 
compromise and prevent, minimize, or remedy such harm. This routine use 
permits disclosures by the Department to respond to a suspected or 
confirmed data breach, including the conduct of any risk analysis or 
provision of credit protection services as provided in 38 U.S.C. 5724, 
as the terms are defined in 38 U.S.C. 5727.
    The Office of Management of Budget (OMB) recommended the inclusion 
of a routine use in all Privacy Act systems of records to allow for the 
appropriate mitigation of data breaches.
    6. Litigation: VA may disclose information in this system of 
records to the Department of Justice (DoJ), either on VA's initiative 
or in response to DoJ's request for the information, after either VA or 
DoJ determines that such information is relevant to DoJ's 
representation of the United States or any of its components in legal 
proceedings before a court or adjudicative body, provided that, in each 
case, the agency also determines prior to disclosure that disclosure of 
the records to the Department of Justice is a use of the information 
contained in the records that is compatible with the purpose for which 
VA collected the records. VA, on its own initiative, may disclose 
records in this system of records in legal proceedings before a court 
or administrative body after determining that the disclosure of the 
records to the court or administrative body is a use of the information 
contained in the records that is compatible with the purpose for which 
VA collected the records.
    7. Congressional Offices: Disclosure may be made to a congressional 
office from the record of an individual in response to an inquiry from 
the congressional office made at the request of that individual. The 
constituent should sign a release of information statement for this 
purpose.
    Individuals sometimes request the help of a Member of Congress in 
resolving some issues relating to a matter before VA. The Member of 
Congress then writes VA, and VA must be able to give sufficient 
information to be responsive to the inquiry. That response may include 
communications to VA from an individual that was received through the 
IRIS.
    8. National Archives and Records Administration (NARA): Disclosure 
may be made to NARA in records management activities and inspections 
conducted under authority of title 44 United States Code.
    NARA is responsible for archiving records no longer actively used, 
but which may be appropriate for preservation. NARA is responsible, in 
general, for the physical maintenance of the Federal government's 
records. VA must be able to turn records over to this Agency in order 
to determine the proper disposition of such records.
    9. Other Federal Agencies: Disclosure to other Federal agencies may 
be made to assist such agencies in preventing and detecting possible 
fraud or abuse by individuals in their operations and programs.

 III. Compatibility of the Routine Uses

    The Privacy Act permits disclosure of information about individuals 
without their consent for a routine use when the information will be 
used for a purpose that is compatible with the purpose for which the 
information is collected. In all of the routine use disclosures 
described above, either the recipient of the information will use the 
information in connection with a matter relating to one of VA's 
programs; to provide a benefit to VA; or because disclosure is required 
by law.
    The Report of Intent to Publish a New System of Records Notice and 
an advance copy of the system notice has been sent to the appropriate 
Congressional committees and to the Director of the Office of 
Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy 
Act), as amended, and guidelines issued by OMB (65 FR 77677), December 
12, 2000.

    Approved: February 25, 2008.
Gordon H. Mansfield,
Deputy Secretary of Veterans Affairs.
151VA005N

SYSTEM NAME:
    Inquiry Routing & Information System (IRIS)--VA.

SYSTEM LOCATION:
    The system of records is located in the Department of Veterans 
Affairs (VA) Data Center, 882 T. J. Jackson Drive, Falling Waters, West 
Virginia.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Individuals who contact VA via the VA Web site at https://www.va.gov 
or by contacting a VA call center including beneficiaries and other 
veterans, veterans' family members and/or their

[[Page 13279]]

representatives, health care professionals, clinicians, employees and 
managers of small businesses, vendors, funeral directors, mortgage 
companies, realtors, home buyers, researchers, small business owners, 
veterans' service organizations, other Federal agencies, State and 
local government employees, teachers, and other demographic groups 
representing every segment of the population both at home and abroad.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The records include questions, complaints, suggestions, 
compliments, and/or requests for the status of claims and may also 
include name, address, phone number, e-mail address, service or claim 
number, Social Security number, date of birth; branch of service; 
entered on active duty date and released from active duty date.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Title 38, United States Code, section 501 and chapters 11, 13, 15, 
17, 18, 19, 21, 23, 24, 30, 31, 32, 34, 35, 37, 39, 41, 42, and 43.

PURPOSE:
    The purpose of this system of records is to receive and respond to 
questions, complaints, suggestions, compliments, and requests for the 
status of claims and other information by gathering sufficient 
information from the senders of inquiries to provide thorough, accurate 
and timely responses. The IRIS gives VA the ability to track inquiry 
traffic, measure the quality and timeliness of responses, and develop 
and post Frequently Asked Questions (FAQs) based on the analysis of 
messages received. VA management also uses the information to quantify 
contacts, analyze issues pertaining to veterans and VA's mission, and 
to measure staff performance regarding the quality and timeliness of 
responses.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 45 CFR Parts 160 and 164, i.e., individually 
identifiable health information, and 38 U.S.C. 7332, i.e., medical 
treatment information related to drug abuse, alcoholism or alcohol 
abuse, sickle cell anemia or infection with the human immunodeficiency 
virus, that information cannot be disclosed under a routine use unless 
there is also specific statutory authority in 38 U.S.C. 7332 and 
regulatory authority in 45 CFR Parts 160 and 164 permitting disclosure.
    1. Disclosure may be made to individuals, organizations, private or 
public agencies, or other entities or individuals with whom VA has a 
contract or agreement to perform such services as VA may deem 
practicable for the purposes of laws administered by VA, in order for 
the contractor, subcontractor, public or private agency, or other 
entity or individual with whom VA has an agreement or contract to 
perform the services of the contract or agreement. This routine use 
includes disclosures by the individual or entity performing the service 
for VA to any secondary entity or individual to perform an activity 
that is necessary for individuals, organizations, private or public 
agencies, or other entities or individuals with whom VA has a contract 
or agreement to provide the service to VA.
    2. To disclose information to the Equal Employment Opportunity 
Commission when requested in connection with investigations of alleged 
or possible discriminatory practices, examination of Federal 
affirmative employment programs, or for other functions of the 
Commission as authorized by law or regulation.
    3. To disclose information to officials of the Merit Systems 
Protection Board, or the Office of the Special Counsel, when requested 
in connection with appeals, special studies of the civil service and 
other merit systems, review of rules and regulations, investigation of 
alleged or possible prohibited personnel practices, and such other 
functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be 
authorized by law.
    4. VA may disclose on its own initiative any information in this 
system, except the names and home addresses of veterans and their 
dependents, which is relevant to a suspected or reasonably imminent 
violation of law, whether civil, criminal or regulatory in nature and 
whether arising by general or program statute or by regulation, rule or 
order issued pursuant thereto, to a Federal, State, local, tribal, or 
foreign agency charged with the responsibility of investigating or 
prosecuting such violation, or charged with enforcing or implementing 
the statute, regulation, rule or order. On its own initiative, VA may 
also disclose the names and addresses of veterans and their dependents 
to a Federal agency charged with the responsibility of investigating or 
prosecuting civil, criminal or regulatory violations of law, or charged 
with enforcing or implementing the statute, regulation, rule or order 
issued pursuant thereto.
    5. VA may, on its own initiative, disclose any information or 
records to appropriate agencies, entities, and persons when (1) VA 
suspects or has confirmed that the integrity or confidentiality of 
information in the system of records has been compromised; (2) the 
Department has determined that as a result of the suspected or 
confirmed compromise there is a risk of embarrassment or harm to the 
reputations of the record subjects, harm to economic or property 
interests, identity theft or fraud, or harm to the security, 
confidentiality, or integrity of this system or other systems or 
programs (whether maintained by the Department or another agency or 
entity) that rely upon the potentially compromised information; and (3) 
the disclosure is to agencies, entities, or persons whom VA determines 
are reasonably necessary to assist or carry out the Department's 
efforts to respond to the suspected or confirmed compromise and 
prevent, minimize, or remedy such harm. This routine use permits 
disclosures by the Department to respond to a suspected or confirmed 
data breach, including the conduct of any risk analysis or provision of 
credit protection services as provided in 38 U.S.C. 5724, as the terms 
are defined in 38 U.S.C. 5727.
    6. VA may disclose information in this system of records to the 
Department of Justice (DoJ), either on VA's initiative or in response 
to DoJ's request for the information, after either VA or DoJ determines 
that such information is relevant to DoJ's representation of the United 
States or any of its components in legal proceedings before a court or 
adjudicative body, provided that, in each case, the agency also 
determines prior to disclosure that disclosure of the records to the 
Department of Justice is a use of the information contained in the 
records that is compatible with the purpose for which VA collected the 
records. VA, on its own initiative, may disclose records in this system 
of records in legal proceedings before a court or administrative body 
after determining that the disclosure of the records to the court or 
administrative body is a use of the information contained in the 
records that is compatible with the purpose for which VA collected the 
records.
    7. Disclosure may be made to a congressional office from the record 
of an individual in response to an inquiry from the congressional 
office made at the request of that individual if the individual has 
signed a release statement.
    8. Disclosure may be made to National Archives and Records 
Administration (NARA) in records management activities and inspections 
conducted under authority of title 44 United States Code.

[[Page 13280]]

    9. Disclosure may be made to other Federal agencies to assist such 
agencies in preventing and detecting possible fraud or abuse by 
individuals in their operations and programs.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    The IRIS stores electronic messages on the IRIS server and archives 
to secure storage media that is approved for use by VA.

RETRIEVABILITY:
    All records in the IRIS are electronic only and are retrieved by 
system inquiry number, name, residence address, e-mail address, Social 
Security number, and claim or service number.

SAFEGUARDS:
    The IRIS runs on a Secure Socket Layer (SSL) and can only be 
accessed by authorized persons employed by and/or contracted to VA with 
the use of unique usernames and passwords, consistent with VA security 
policy.
    The server on which the IRIS software and database reside is 
located in a secure facility at 882 T. J. Jackson Drive, Falling 
Waters, West Virginia. This facility is locked down at all times and 
has a security guard on duty at all times. Access to the computer room 
is restricted to specifically authorized VA staff or persons contracted 
to VA. In addition, these persons must have separate and authorized 
access to the IRIS server itself. All electronic data in this system 
are backed up nightly, with backups stored electronically and securely 
in the Falling Waters, West Virginia location.

RETENTION AND DISPOSAL:
    Records are maintained and disposed of in accordance with the 
records disposition authority approved by the Archivist of the United 
States. At the current time, the Office of Information & Technology 
does not have records disposition authority for these records that has 
been approved by the Archivist of the United States. The System Manager 
has initiated action to seek and obtain such disposition authority in 
accordance with VA Handbook 6300.1, Records Management Procedures. The 
records will not be destroyed until VA obtains a NARA-approved records 
disposition authority. Once VA has obtained NARA-approved records 
disposition authority, VA OGC will amend this notice to reflect that 
authority, and any destruction of electronic records will occur when no 
longer needed for administrative, legal, audit, or other operational 
purposes.

SYSTEM MANAGER(S) AND ADDRESS:
    The IRIS system falls under the jurisdiction of the Director, VA 
Web Solutions, Office of Information & Technology (OI&T) (005Q3), OI 
Field Office, 1335 East-West Highway, Silver Spring, Maryland 20910.

NOTIFICATION PROCEDURES:
    A person who wishes to determine whether a record is being 
maintained in this system under his or her name or other personal 
identifier or wishes to determine the contents of such records should 
submit a written request or apply in person to VA Web Solutions, Office 
of Information & Technology (OI&T) (005Q3), OI Field Office, 1335 East-
West Highway, Silver Spring, Maryland 20910. Requests should contain 
full name, address and phone number of the person making this request.

RECORD ACCESS PROCEDURE:
    Individuals seeking information regarding access to and amendment 
of records in this system may write, call or visit VA Web Solutions, 
Office of Information & Technology (OI&T) (005Q3), OI Field Office, 
1335 East-West Highway, Silver Spring, Maryland 20910. Requests should 
contain full name, address and phone number of the person making this 
request.

CONTESTING RECORD PROCEDURES:
    (See Record Access Procedure above.)

RECORD SOURCE CATEGORIES:
    Individuals who contact VA via the VA Web site at https://www.va.gov 
or by using a VA call center include veterans, veterans' family members 
and/or their representatives, government employees (Federal, State and 
local), realtors and home buyers, small business owners, vendors, 
funeral directors, clinicians, teachers, researchers, employees of 
veterans' service organizations, members of the public and all other 
individuals and representatives of organizations.

EXEMPTIONS CLAIMED FOR SYSTEM:
    No exemptions claimed for this system.

[FR Doc. E8-4895 Filed 3-11-08; 8:45 am]
BILLING CODE 8320-01-P