Privacy Act of 1974; System of Records, 16103-16108 [E8-6144]

Download as PDF Federal Register / Vol. 73, No. 59 / Wednesday, March 26, 2008 / Notices RECORD ACCESS PROCEDURES: Individuals seeking information regarding access to and contesting of records in this system may write, call or visit the VA facility location where they made application for employment or appointment, or are or were employed. CONTESTING RECORDS PROCEDURES: (See Record Access Procedures). RECORD SOURCE CATEGORIES: Information in this system of records is provided by the applicant/employee, or obtained from State licensing boards, Federation of State Medical Boards, National Council of State Boards of Nursing, National Practitioner Data Bank, Health Integrity and Protection Data Bank, professional societies, national certifying bodies, current or previous employers, other health care facilities and staff, references, educational institutions, medical schools, VA staff, patient, visitors, and VA patient medical records. [FR Doc. E8–6143 Filed 3–25–08; 8:45 am] BILLING CODE 8320–01–P DEPARTMENT OF VETERANS AFFAIRS Privacy Act of 1974; System of Records AGENCY: Department of Veterans Affairs (VA). Notice of Amendment of Systems of Records Notice ‘‘National Patient Databases-VA.’’ pwalker on PROD1PC71 with NOTICES ACTION: SUMMARY: As required by the Privacy Act of 1974 (5 U.S.C. 552a(e)(4)), notice is hereby given that the Department of Veterans Affairs (VA) is amending the system of records entitled ‘‘National Patient Databases-VA’’ (121VA19) as set forth in 69 FR 18436. VA is amending the system of records by revising the System Location, Categories of Records in the System, Purpose(s), Routine Uses of Records Maintained in the System, Including Categories of Users and the Purposes of Such Uses, and Appendix 4. VA is republishing the system notice in its entirety. DATES: Comments on this amended system of records must be received no later than April 25, 2008. If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by VA, the amended system will become effective April 25, 2008. ADDRESSES: Written comments concerning the proposed amended system of records may be submitted through www.Regulations.gov; by mail VerDate Aug<31>2005 18:52 Mar 25, 2008 Jkt 214001 or hand-delivery to Director, Regulations Management (00REG1), Department of Veterans Affairs, 810 Vermont Avenue, NW., Room 1068, Washington, DC 20420; by fax to (202) 273–9026; or by e-mail to: ‘‘VAregulations@mail.va.gov’’. All comments received will be available for public inspection in the Office of Regulation Policy and Management, Room 1063B, between the hours of 8 a.m. and 4:30 p.m., Monday through Friday (except holidays). Please call (202) 273–9515 for an appointment. In addition, during the comment period, comments may be viewed online through the Federal Docket Management System (FDMS) at: https:// www.Regulations.gov. FOR FURTHER INFORMATION CONTACT: Stephania H. Putt, Veterans Health Administration (VHA) Privacy Officer, Department of Veterans Affairs, 810 Vermont Avenue NW., Washington, DC 20420, telephone (704) 245–2492. SUPPLEMENTARY INFORMATION: Background: VHA is the largest health care provider in the country. In order to maintain this organization, VHA collects health care information from its local facilities to evaluate quality of services, clinical resource utilization, and patient safety, as well as to distribute medical information, such as alerts or recalls, track specific diseases, and monitor patients. National-level information is also needed for other activities, such as medical research and the development of National Best Clinical Practice Guidelines and National Quality Standards. VHA gathers this information from a wide variety of sources, including directly from a veteran; from information systems located at VHA medical centers, Veterans Integrated Service Networks (VISN), other VHA facilities, such as the Health Eligibility Center; and Federal departments and agencies such as the U.S. Department of Defense and the Food and Drug Administration. As the data is collected, VHA stores it in several national patient databases. In this system of records the Category of Records in the System is amended to reflect the data Office of Quality and Performance (OQP) is collecting, and to include the Survey of the Healthcare Experiences of Patients and External Peer Review data capture. These data include any patient-level records created for evaluation as directed by the VHA Performance Management Program or accreditation purposes as defined by the Joint Commission. This information is collected so that OQP can assess, without organizational bias, the adherence of its treatment centers to PO 00000 Frm 00139 Fmt 4703 Sfmt 4703 16103 established clinical protocol for providing care to veterans and to monitor the satisfaction of its patient customers. The Purpose in this system of records is being amended to reflect that the records and information may be used for statistical analysis to produce various management, workload tracking, and follow-up reports; to track and evaluate the ordering and delivery of equipment, services and patient care; for the planning, distribution and utilization of resources; to monitor the performance of Veterans Integrated Service Networks (VISN); and to allocate clinical and administrative support to patient medical care. The data may be used for VA’s extensive research programs in accord with VA policy. In addition, the data may be used to assist in workload allocation for patient treatment services including provider panel management, nursing care, clinic appointments, surgery, prescription processing, diagnostic and therapeutic procedures; to plan and schedule training activities for employees; for audits, reviews and investigations conducted by the Network Directors Office and VA Central Office; for quality assurance audits, reviews and investigations; for law enforcement investigations; and for personnel management, evaluation and employee ratings, and performance evaluations. Survey data will be collected for the purpose of measuring and monitoring National, VISN and Facility-Level performance on VHA’s Veteran Health Care Service Standards (VHSS). The VHSS are designed to measure levels of patient satisfaction in areas that patients have defined as important in receiving quality, patientcentered healthcare. Results of the survey data analysis are shared throughout the VHA system. The External Peer Review Program (EPRP) data is collected in order to provide medical centers and outpatient clinics with diagnosis and procedure-specific quality of care information. EPRP is a contracted review of care, specifically designated to collect data to be used to improve the quality of care. Routine Uses of Records Maintained in the System, Including Categories of Users and the Purposes of Such Uses is being amended to reflect the addition of protecting 38 U.S.C. 5705 Quality Assurance Records, which may not be disclosed under a routine use unless there is also specific statutory authority permitting the disclosure. Routine uses numbers 1, 5, 10, 12, 13, 14, 15, and 17 have been revised for ease of readability and clarification. Routine use 19 was added to allow for the disclosure of information to another E:\FR\FM\26MRN1.SGM 26MRN1 pwalker on PROD1PC71 with NOTICES 16104 Federal Register / Vol. 73, No. 59 / Wednesday, March 26, 2008 / Notices Federal agency for the purpose of conducting research. Routine use 20 was added to allow for the disclosure of limited identification information to another Federal agency in order to obtain information to carry out any purpose outlined in this system of records. Routine use number 21 was added to allow for records to be disclosed to appropriate agencies, entities, and persons under the following circumstances: when (1) it is suspected or confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the compromised information; and (3) the disclosure is made to such agencies, entities, and persons who are reasonably necessary to assist in connection with the Department’s efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use allows disclosure by the agency to respond to a suspected or confirmed data breach, including the conduct of any risks analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727. Routine use 22 was added to accommodate the disclosure of Primary Care Management Module (PCMM) data to the general public. Appendix 4 has been amended to include Cardiac Assessment Tracking and Reporting for Cardiac Cauterization Laboratories, Corporate Data Warehouse, CMOP Centralized Database System, Bidirectional Health Information Exchange, Financial Clinical Data Mart, Care Management Information System, Parkinson’s Disease Research, Education and Clinical Centers Registry, Pharmacy Benefits Management, VA Vital Status File, Short Form Health Survey for Veterans and Office of Quality Performance Data Center. Also, the KLF Menu was renamed to Veterans Integrated Service Network Support Service Center Database. Immunology Case Registry was removed and Clinical Case Registry was changed to Registries to represent the Immunology Case Registry (ICR) and Hepatitis C. There was also removal of VerDate Aug<31>2005 18:52 Mar 25, 2008 Jkt 214001 the National Patient Care Database (NPCD), Patient Treatment File (PTF) and the National Health Care Practitioner Database (NHCPD) which are now entered as a single system called National Medical Information System (NMIS). The notice of amendment and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000. Approved: March 12, 2008. Gordon H. Mansfield, Deputy Secretary of Veterans Affairs. information related to medical examination or treatment (e.g., location of VA medical facility providing examination or treatment, treatment dates, medical conditions treated or noted on examination); information related to military service and status; 3. Medical benefit and eligibility information; 4. Patient aggregate workload data such as admissions, discharges, and outpatient visits; resource utilization such as laboratory tests, x-rays; 5. Patient Satisfaction Survey Data which include questions and responses; and 6. External Peer Review Program (EPRP) data capture. AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 121VA19 Title 38, United States Code, Section 501. SYSTEM NAME: PURPOSE(S): National Patient Databases—VA. SYSTEM LOCATION: Records are maintained at Department of Veterans Affairs (VA) medical centers, VA data processing centers, veterans integrated service networks (VISN) and office of information (OI) field offices. Address location for each VA national patient database is listed in VA Appendix 4 at the end of this document. CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM: The records contain information for all individuals (1) Receiving health care from the Veterans Health Administration (VHA), and (2) Providing the health care. Individuals encompass veterans and their immediate family members, members of the armed services, current and former employees, trainees, contractors, subcontractors, consultants, volunteers, and other individuals working collaboratively with VA. CATEGORIES OF RECORDS IN THE SYSTEM: The records may include information and health information related to: 1. Patient medical record abstract information including information from Patient Medical Record—VA (24VA19). 2. Identifying information (e.g., name, birth date, death date, admission date, discharge date, gender, Social Security number, taxpayer identification number); address information (e.g., home and/or mailing address, home telephone number, emergency contact information such as name, address, telephone number, and relationship); prosthetic and sensory aid serial numbers; medical record numbers; integration control numbers; PO 00000 Frm 00140 Fmt 4703 Sfmt 4703 The records and information may be used for statistical analysis to produce various management, workload tracking, and follow-up reports; to track and evaluate the ordering and delivery of equipment, services and patient care; for the planning, distribution and utilization of resources; to monitor the performance of Veterans Integrated Service Networks (VISN); and to allocate clinical and administrative support to patient medical care. The data may be used for VA’s extensive research programs in accord with VA policy. In addition, the data may be used to assist in workload allocation for patient treatment services including provider panel management, nursing care, clinic appointments, surgery, prescription processing, diagnostic and therapeutic procedures; to plan and schedule training activities for employees; for audits, reviews and investigations conducted by the network directors office and VA Central Office; for quality assurance audits, reviews and investigations; for law enforcement investigations; and for personnel management, evaluation and employee ratings, and performance evaluations. Survey data will be collected for the purpose of measuring and monitoring national, VISN and facility-Level performance on VHA’s Veteran Health Care Service Standards (VHSS) pursuant to Executive Order 12862 and the Veterans Health Administration Customer Service Standards Directive. The VHSS are designed to measure levels of patient satisfaction in areas that patients have defined as important in receiving quality, patient-centered healthcare. Results of the survey data analysis are shared throughout the VHA system. The External Peer Review E:\FR\FM\26MRN1.SGM 26MRN1 Federal Register / Vol. 73, No. 59 / Wednesday, March 26, 2008 / Notices Program (EPRP) data are collected in order to provide medical centers and outpatient clinics with diagnosis and procedure-specific quality of care information. EPRP is a contracted review of care, specifically designated to collect data to be used to improve the quality of care. pwalker on PROD1PC71 with NOTICES ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES: To the extent that records contained in the system include information protected by 38 U.S.C. 7332, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus; information protected by 38 U.S.C 5705, i.e., quality assurance records; or information protected by 45 C.F.R. Parts 160 and 164, i.e., individually identifiable health information, such information cannot be disclosed under a routine use unless there is also specific statutory authority permitting the disclosure. VA may disclose protected health information pursuant to the following routine uses where required or permitted by law. 1. VA may disclose on its own initiative any information in this system, except the names and home addresses of veterans and their dependents, that is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal or regulatory in nature and whether arising by general or program statute or by regulation, rule or order issued pursuant thereto, to a Federal, State, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule or order. On its own initiative, VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto. 2. Disclosure may be made to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose(s) of the request, and identify the type of information requested), when necessary to obtain information relevant to an individual’s eligibility, care history, or other benefits. 3. Disclosure may be made to an agency in the executive, legislative, or judicial branch, or the District of VerDate Aug<31>2005 18:52 Mar 25, 2008 Jkt 214001 Columbia government in response to its request or at the initiation of VA, in connection with disease tracking, patient outcomes or other health information required for program accountability. 4. Disclosure may be made to National Archives and Records Administration (NARA) for it to perform its records management inspections responsibilities in its role as Archivist of United States under authority of title 44 United States Code (USC). 5. VA may disclose information in this system of records to the Department of Justice (DoJ), either on VA’s initiative or in response to DoJ’s request for the information, after either VA or DoJ determines that such information is relevant to DoJ’s representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that disclosure of the records to the Department of Justice is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA, on its own initiative, may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. 6. Records from this system of records may be disclosed to a Federal agency or to a State or local government licensing board and/or to the Federation of State Medical Boards or a similar nongovernment entity that maintains records concerning individuals’ employment histories or concerning the issuance, retention or revocation of licenses, certifications, or registration necessary to practice an occupation, profession or specialty, in order for the agency to obtain information relevant to an agency decision concerning the hiring, retention or termination of an employee. 7. Records from this system of records may be disclosed to inform a Federal agency, licensing boards or the appropriate non-government entities about the health care practices of a terminated, resigned or retired health care employee whose professional health care activity so significantly failed to conform to generally accepted standards of professional medical practice as to raise reasonable concern for the health and safety of patients receiving medical care in the private sector or from another Federal agency. PO 00000 Frm 00141 Fmt 4703 Sfmt 4703 16105 8. For program review purposes and the seeking of accreditation and/or certification, disclosure may be made to survey teams of the Joint Commission, College of American Pathologists, American Association of Blood Banks, and similar national accreditation agencies or boards with whom VA has a contract or agreement to conduct such reviews but only to the extent that the information is necessary and relevant to the review. 9. Disclosure may be made to a national certifying body that has the authority to make decisions concerning the issuance, retention or revocation of licenses, certifications or registrations required to practice a health care profession, when requested in writing by an investigator or supervisory official of the national certifying body for the purpose of making a decision concerning the issuance, retention or revocation of the license, certification or registration of a named health care professional. 10. Records from this system that contain information listed in 5 U.S.C. 7114(b)(4) may be disclosed to officials of labor organizations recognized under 5 U.S.C. Chapter 71 when relevant and necessary to their duties of exclusive representation concerning personnel policies, practices, and matters affecting working conditions. 11. Disclosure may be made to the representative of an employee of all notices, determinations, decisions, or other written communications issued to the employee in connection with an examination ordered by VA under medical evaluation (formerly fitness-forduty) examination procedures or Department-filed disability retirement procedures. 12. VA may disclose information to officials of the Merit Systems Protection Board, or the Office of Special Counsel, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be authorized by law. 13. VA may disclose information to the Equal Employment Opportunity Commission when requested in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or for other functions of the Commission as authorized by law or regulation. 14. VA may disclose information to the Federal Labor Relations Authority (including its General Counsel) information related to the establishment E:\FR\FM\26MRN1.SGM 26MRN1 pwalker on PROD1PC71 with NOTICES 16106 Federal Register / Vol. 73, No. 59 / Wednesday, March 26, 2008 / Notices of jurisdiction, the investigation and resolution of allegations of unfair labor practices, or information in connection with the resolution of exceptions to arbitration awards when a question of material fact is raised; to disclose information in matters properly before the Federal Services Impasses Panel, and to investigate representation petitions and conduct or supervise representation elections. 15. Disclosure of medical record data, excluding name and address, unless name and address are furnished by the requester, may be made to non-Federal research facilities for research purposes determined to be necessary and proper when approved in accordance with VA policy. 16. Disclosure of name(s) and address(s) of present or former personnel of the Armed Services, and/ or their dependents, may be made to: (a) A Federal department or agency, at the written request of the head or designee of that agency; or (b) directly to a contractor or subcontractor of a Federal department or agency, for the purpose of conducting Federal research necessary to accomplish a statutory purpose of an agency. When disclosure of this information is made directly to a contractor, VA may impose applicable conditions on the department, agency, and/or contractor to insure the appropriateness of the disclosure to the contractor. 17. Disclosure may be made to individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor, subcontractor, public or private agency, or other entity or individual with whom VA has an agreement or contract to perform the services of the contract or agreement. This routine use includes disclosures by the individual or entity performing the service for VA to any secondary entity or individual to perform an activity that is necessary for individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to provide the service to VA. 18. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. 19. VA may disclose information to a Federal agency for the conduct of research and data analysis to perform a statutory purpose of that Federal agency upon the prior written request of that VerDate Aug<31>2005 18:52 Mar 25, 2008 Jkt 214001 agency, provided that there is legal authority under all applicable confidentiality statutes and regulations to provide the data and the VHA Office of Information (OI) has determined prior to the disclosure that VHA data handling requirements are satisfied. 20. Disclosure of limited individual identification information may be made to another Federal agency for the purpose of matching and acquiring information held by that agency for VHA to use for the purposes stated for this system of records. 21. VA may, on its own initiative, disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the potentially compromised information; and (3) the disclosure is to agencies, entities, or persons whom VA determines are reasonably necessary to assist or carry out the Department’s efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosures by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727. 22. On its own initiative, the VA may disclose to the general public via an Internet Website, PCMM information, including the names of its providers, provider panel sizes and reports on provider performance measures of quality when approved in accordance with VA policy. identifiers of the individuals on whom they are maintained. SAFEGUARDS: POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM: 1. Access to and use of national patient databases are limited to those persons whose official duties require such access, and VA has established security procedures to ensure that access is appropriately limited. Information security officers and system data stewards review and authorize data access requests. VA regulates data access with security software that authenticates users and requires individually unique codes and passwords. VA provides information security training to all staff and instructs staff on the responsibility each person has for safeguarding data confidentiality. 2. VA maintains Business Associate Agreements (BAA) and Non-Disclosure Agreements with contracted resources in order to maintain confidentiality of the information. 3. Physical access to computer rooms housing national patient databases is restricted to authorized staff and protected by a variety of security devices. Unauthorized employees, contractors, and other staff are not allowed in computer rooms. The Federal Protective Service or other security personnel provide physical security for the buildings housing computer rooms and data centers. 4. Data transmissions between operational systems and national patient databases maintained by this system of record are protected by state-of-the-art telecommunication software and hardware. This may include firewalls, encryption, and other security measures necessary to safeguard data as it travels across the VA Wide Area Network. Data may be transmitted via a passwordprotected spreadsheet and placed on the secured share point Web portal by the user that has been provided access to their secure file. Data can only be accessed by authorized personnel from each facility within the Polytrauma System of Care and the Physical Medicine and Rehabilitation Program Office. 5. In most cases, copies of back-up computer files are maintained at off-site locations. STORAGE: RETENTION AND DISPOSAL: Records are maintained on electronic storage media including magnetic tape, disk, laser optical media. The records are disposed of in accordance with GRS 20, item 4. Item 4 provides for deletion of data files when the agency determines that the files are no longer needed for administrative, legal, audit, or other operational purposes. RETRIEVABILITY: Records are retrieved by name, Social Security number or other assigned PO 00000 Frm 00142 Fmt 4703 Sfmt 4703 E:\FR\FM\26MRN1.SGM 26MRN1 Federal Register / Vol. 73, No. 59 / Wednesday, March 26, 2008 / Notices SYSTEMS AND MANAGER(S) AND ADDRESS: Officials responsible for policies and procedures; Chief Information Officer (19), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420. Officials maintaining this system of records; Director, National Data Systems (19F4), Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. NOTIFICATION PROCEDURE: Individuals who wish to determine whether this system of records contains information about them should contact the Director of National Data Systems (19F4), Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Inquiries should include the person’s full name, Social Security number, location and dates of employment or location and dates of treatment, and their return address. RECORD ACCESS PROCEDURE: Individuals seeking information regarding access to and contesting of records in this system may write or call the Director of National Data Systems (19F4), Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772, or call the VA Austin Automation Center Help Desk and ask to speak with the VHA Director of National Data Systems at 512–326–6780. CONTESTING RECORD PROCEDURES: (See Record Access Procedures above.) RECORD SOURCE CATEGORIES: Information in this system of records is provided by veterans, VA employees, 16107 VA computer systems, Veterans Health Information Systems and Technology Architecture (VistA), VA medical centers, VA Health Eligibility Center, VA program offices, VISNs, VA Austin Automation Center, the Food and Drug Administration, the Department of Defense, Survey of Healthcare Experiences of Patients, External Peer Review Program, and the following Systems Of Records: ‘‘Patient Medical Records—VA’’ (24VA19), ‘‘National Prosthetics Patient Database—VA’’ (33VA113), ‘‘Healthcare Eligibility Records—VA’’ (89VA16), VA Veterans Benefits Administration automated record systems (including the Veterans and Beneficiaries Identification and Records Location Subsystem—VA (38VA23)), and subsequent iterations of those systems of records. VA APPENDIX 4 Database name Location Addiction Severity Index ........................................................................... Veteran Affairs Medical Center, 7180 Highland Drive, Pittsburgh, PA 15206. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. VA Medical Center, 1055 Clermont Street, Denver, CO. Bidirectional Health Information Exchange .............................................. Cardiac Assessment Tracking and Reporting for Cardiac Cauterization Laboratories. Care Management Information System ................................................... Clinical Case Registries ........................................................................... CMOP Centralized Database System ...................................................... Continuous Improvement in Cardiac Surgery .......................................... Corporate Data Warehouse ..................................................................... Creutzfeldt-Jakob Disease Lookback Dataset ......................................... Decision Support System ......................................................................... Eastern Pacemaker Surveillance Center Database ................................. Emerging Pathogens Initiative .................................................................. Federal Health Information Exchange ...................................................... Financial Clinical Data Mart ..................................................................... Former Prisoner of War Statistical Tracking System ............................... Functional Status and Outcome Database .............................................. Home Based Primary Care ...................................................................... Mammography Quality Standards VA ...................................................... Master Patient Index ................................................................................ Medical SAS File (MDP) (Medical District Planning (MEDIPRO)) ........... Missing Patient Register ........................................................................... pwalker on PROD1PC71 with NOTICES National Mental Health Database System ............................................... National Medical Information System ....................................................... National Survey of Veterans .................................................................... Office of Quality and Performance (OQP) ............................................... VerDate Aug<31>2005 18:52 Mar 25, 2008 Jkt 214001 PO 00000 Frm 00143 Fmt 4703 Veterans Affairs Medical Center, University and Woodland Aves., Philadelphia, PA 19104. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Southwest CMOP, 3675 East Britannia Drive, Tucson, AZ 85706. Veteran Affairs Medical Center, 820 Clermont Street, Denver, CO 80220. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Veteran Affairs Medical Center, 3200 Vine St., Cincinnati, Ohio 45220. Austin Automation Center, 1615 Woodward Street, Austin, TX 78772. Veteran Affairs Medical Center, 50 Irving Street, NW., Washington, DC 20422. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Veteran Affairs Medical Center, 508 Fulton Street, Durham, NC 27705. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Veteran Affairs Medical Center, 7180 Highland Drive, Pittsburgh, PA 15206. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. (OQP) Data Center, 601 Keystone Park Drive, Suite 800, Morrisville, NC 27560. Sfmt 4703 E:\FR\FM\26MRN1.SGM 26MRN1 16108 Federal Register / Vol. 73, No. 59 / Wednesday, March 26, 2008 / Notices VA APPENDIX 4—Continued Database name Location Parkinson’s Disease Research, Education and Clinical Centers Registry. Patient Assessment File ........................................................................... Veterans Affairs Medical Center, 4150 Clement St., San Francisco, CA 94121. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Veterans Affairs Medical Center, 5th Avenue and Roosevelt Road, Hines, IL 60141. Office of Information Field Office, 1335 East/West Hwy, Silver Spring MD 20910. Denver Distribution Center, 155 Van Gordon Street, Lakewood, CO 80228–1709. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Veterans Affairs Medical Center, 200 Springs Rd., Bedford, MA 01730. Veteran Affairs Medical Center, 4500 South Lancaster Road, Dallas, TX 75216. Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Veteran Affairs Medical Center, 50 Irving Street, NW., Washington, DC 20422. Austin Automation Center, 1615 Woodward Street, Austin, TX 78772. Pharmacy Benefits Management ............................................................. Radiation Exposure Inquiries Database ................................................... Remote Order Entry System .................................................................... Resident Assessment Instrument/Minimum Data Set .............................. Short Form Health Survey for Veterans ................................................... VA National Clozapine Registry ............................................................... VA Vital Status File .................................................................................. Veterans Central Cancer Registry ........................................................... Veterans Integrated Service Network Support Service Center Databases. [FR Doc. E8–6144 Filed 3–25–08; 8:45 am] pwalker on PROD1PC71 with NOTICES BILLING CODE 8320–01–P VerDate Aug<31>2005 18:52 Mar 25, 2008 Jkt 214001 PO 00000 Frm 00144 Fmt 4703 Sfmt 4703 E:\FR\FM\26MRN1.SGM 26MRN1

Agencies

[Federal Register Volume 73, Number 59 (Wednesday, March 26, 2008)]
[Notices]
[Pages 16103-16108]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-6144]


-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Department of Veterans Affairs (VA).

ACTION: Notice of Amendment of Systems of Records Notice ``National 
Patient Databases-VA.''

-----------------------------------------------------------------------

SUMMARY: As required by the Privacy Act of 1974 (5 U.S.C. 552a(e)(4)), 
notice is hereby given that the Department of Veterans Affairs (VA) is 
amending the system of records entitled ``National Patient Databases-
VA'' (121VA19) as set forth in 69 FR 18436. VA is amending the system 
of records by revising the System Location, Categories of Records in 
the System, Purpose(s), Routine Uses of Records Maintained in the 
System, Including Categories of Users and the Purposes of Such Uses, 
and Appendix 4. VA is republishing the system notice in its entirety.

DATES: Comments on this amended system of records must be received no 
later than April 25, 2008. If no public comment is received during the 
period allowed for comment or unless otherwise published in the Federal 
Register by VA, the amended system will become effective April 25, 
2008.

ADDRESSES: Written comments concerning the proposed amended system of 
records may be submitted through www.Regulations.gov; by mail or hand-
delivery to Director, Regulations Management (00REG1), Department of 
Veterans Affairs, 810 Vermont Avenue, NW., Room 1068, Washington, DC 
20420; by fax to (202) 273-9026; or by e-mail to: 
``VAregulations@mail.va.gov''. All comments received will be available 
for public inspection in the Office of Regulation Policy and 
Management, Room 1063B, between the hours of 8 a.m. and 4:30 p.m., 
Monday through Friday (except holidays). Please call (202) 273-9515 for 
an appointment. In addition, during the comment period, comments may be 
viewed online through the Federal Docket Management System (FDMS) at: 
https://www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT: Stephania H. Putt, Veterans Health 
Administration (VHA) Privacy Officer, Department of Veterans Affairs, 
810 Vermont Avenue NW., Washington, DC 20420, telephone (704) 245-2492.

SUPPLEMENTARY INFORMATION:
    Background: VHA is the largest health care provider in the country. 
In order to maintain this organization, VHA collects health care 
information from its local facilities to evaluate quality of services, 
clinical resource utilization, and patient safety, as well as to 
distribute medical information, such as alerts or recalls, track 
specific diseases, and monitor patients. National-level information is 
also needed for other activities, such as medical research and the 
development of National Best Clinical Practice Guidelines and National 
Quality Standards. VHA gathers this information from a wide variety of 
sources, including directly from a veteran; from information systems 
located at VHA medical centers, Veterans Integrated Service Networks 
(VISN), other VHA facilities, such as the Health Eligibility Center; 
and Federal departments and agencies such as the U.S. Department of 
Defense and the Food and Drug Administration. As the data is collected, 
VHA stores it in several national patient databases.
    In this system of records the Category of Records in the System is 
amended to reflect the data Office of Quality and Performance (OQP) is 
collecting, and to include the Survey of the Healthcare Experiences of 
Patients and External Peer Review data capture. These data include any 
patient-level records created for evaluation as directed by the VHA 
Performance Management Program or accreditation purposes as defined by 
the Joint Commission. This information is collected so that OQP can 
assess, without organizational bias, the adherence of its treatment 
centers to established clinical protocol for providing care to veterans 
and to monitor the satisfaction of its patient customers.
    The Purpose in this system of records is being amended to reflect 
that the records and information may be used for statistical analysis 
to produce various management, workload tracking, and follow-up 
reports; to track and evaluate the ordering and delivery of equipment, 
services and patient care; for the planning, distribution and 
utilization of resources; to monitor the performance of Veterans 
Integrated Service Networks (VISN); and to allocate clinical and 
administrative support to patient medical care. The data may be used 
for VA's extensive research programs in accord with VA policy. In 
addition, the data may be used to assist in workload allocation for 
patient treatment services including provider panel management, nursing 
care, clinic appointments, surgery, prescription processing, diagnostic 
and therapeutic procedures; to plan and schedule training activities 
for employees; for audits, reviews and investigations conducted by the 
Network Directors Office and VA Central Office; for quality assurance 
audits, reviews and investigations; for law enforcement investigations; 
and for personnel management, evaluation and employee ratings, and 
performance evaluations. Survey data will be collected for the purpose 
of measuring and monitoring National, VISN and Facility-Level 
performance on VHA's Veteran Health Care Service Standards (VHSS). The 
VHSS are designed to measure levels of patient satisfaction in areas 
that patients have defined as important in receiving quality, patient-
centered healthcare. Results of the survey data analysis are shared 
throughout the VHA system. The External Peer Review Program (EPRP) data 
is collected in order to provide medical centers and outpatient clinics 
with diagnosis and procedure-specific quality of care information. EPRP 
is a contracted review of care, specifically designated to collect data 
to be used to improve the quality of care.
    Routine Uses of Records Maintained in the System, Including 
Categories of Users and the Purposes of Such Uses is being amended to 
reflect the addition of protecting 38 U.S.C. 5705 Quality Assurance 
Records, which may not be disclosed under a routine use unless there is 
also specific statutory authority permitting the disclosure. Routine 
uses numbers 1, 5, 10, 12, 13, 14, 15, and 17 have been revised for 
ease of readability and clarification.
    Routine use 19 was added to allow for the disclosure of information 
to another

[[Page 16104]]

Federal agency for the purpose of conducting research.
    Routine use 20 was added to allow for the disclosure of limited 
identification information to another Federal agency in order to obtain 
information to carry out any purpose outlined in this system of 
records.
    Routine use number 21 was added to allow for records to be 
disclosed to appropriate agencies, entities, and persons under the 
following circumstances: when (1) it is suspected or confirmed that the 
integrity or confidentiality of information in the system of records 
has been compromised; (2) the Department has determined that as a 
result of the suspected or confirmed compromise there is a risk of 
embarrassment or harm to the reputations of the record subjects, harm 
to economic or property interests, identity theft or fraud, or harm to 
the security, confidentiality, or integrity of this system or other 
systems or programs (whether maintained by the Department or another 
agency or entity) that rely upon the compromised information; and (3) 
the disclosure is made to such agencies, entities, and persons who are 
reasonably necessary to assist in connection with the Department's 
efforts to respond to the suspected or confirmed compromise and 
prevent, minimize, or remedy such harm. This routine use allows 
disclosure by the agency to respond to a suspected or confirmed data 
breach, including the conduct of any risks analysis or provision of 
credit protection services as provided in 38 U.S.C. 5724, as the terms 
are defined in 38 U.S.C. 5727.
    Routine use 22 was added to accommodate the disclosure of Primary 
Care Management Module (PCMM) data to the general public.
    Appendix 4 has been amended to include Cardiac Assessment Tracking 
and Reporting for Cardiac Cauterization Laboratories, Corporate Data 
Warehouse, CMOP Centralized Database System, Bidirectional Health 
Information Exchange, Financial Clinical Data Mart, Care Management 
Information System, Parkinson's Disease Research, Education and 
Clinical Centers Registry, Pharmacy Benefits Management, VA Vital 
Status File, Short Form Health Survey for Veterans and Office of 
Quality Performance Data Center. Also, the KLF Menu was renamed to 
Veterans Integrated Service Network Support Service Center Database. 
Immunology Case Registry was removed and Clinical Case Registry was 
changed to Registries to represent the Immunology Case Registry (ICR) 
and Hepatitis C. There was also removal of the National Patient Care 
Database (NPCD), Patient Treatment File (PTF) and the National Health 
Care Practitioner Database (NHCPD) which are now entered as a single 
system called National Medical Information System (NMIS).
    The notice of amendment and an advance copy of the system notice 
have been sent to the appropriate Congressional committees and to the 
Director of Office of Management and Budget (OMB) as required by 5 
U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 
77677), December 12, 2000.

    Approved: March 12, 2008.
Gordon H. Mansfield,
Deputy Secretary of Veterans Affairs.
121VA19

SYSTEM NAME:
    National Patient Databases--VA.

SYSTEM LOCATION:
    Records are maintained at Department of Veterans Affairs (VA) 
medical centers, VA data processing centers, veterans integrated 
service networks (VISN) and office of information (OI) field offices. 
Address location for each VA national patient database is listed in VA 
Appendix 4 at the end of this document.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The records contain information for all individuals (1) Receiving 
health care from the Veterans Health Administration (VHA), and (2) 
Providing the health care. Individuals encompass veterans and their 
immediate family members, members of the armed services, current and 
former employees, trainees, contractors, sub-contractors, consultants, 
volunteers, and other individuals working collaboratively with VA.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The records may include information and health information related 
to:
    1. Patient medical record abstract information including 
information from Patient Medical Record--VA (24VA19).
    2. Identifying information (e.g., name, birth date, death date, 
admission date, discharge date, gender, Social Security number, 
taxpayer identification number); address information (e.g., home and/or 
mailing address, home telephone number, emergency contact information 
such as name, address, telephone number, and relationship); prosthetic 
and sensory aid serial numbers; medical record numbers; integration 
control numbers; information related to medical examination or 
treatment (e.g., location of VA medical facility providing examination 
or treatment, treatment dates, medical conditions treated or noted on 
examination); information related to military service and status;
    3. Medical benefit and eligibility information;
    4. Patient aggregate workload data such as admissions, discharges, 
and outpatient visits; resource utilization such as laboratory tests, 
x-rays;
    5. Patient Satisfaction Survey Data which include questions and 
responses; and
    6. External Peer Review Program (EPRP) data capture.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Title 38, United States Code, Section 501.

PURPOSE(S):
    The records and information may be used for statistical analysis to 
produce various management, workload tracking, and follow-up reports; 
to track and evaluate the ordering and delivery of equipment, services 
and patient care; for the planning, distribution and utilization of 
resources; to monitor the performance of Veterans Integrated Service 
Networks (VISN); and to allocate clinical and administrative support to 
patient medical care. The data may be used for VA's extensive research 
programs in accord with VA policy. In addition, the data may be used to 
assist in workload allocation for patient treatment services including 
provider panel management, nursing care, clinic appointments, surgery, 
prescription processing, diagnostic and therapeutic procedures; to plan 
and schedule training activities for employees; for audits, reviews and 
investigations conducted by the network directors office and VA Central 
Office; for quality assurance audits, reviews and investigations; for 
law enforcement investigations; and for personnel management, 
evaluation and employee ratings, and performance evaluations. Survey 
data will be collected for the purpose of measuring and monitoring 
national, VISN and facility-Level performance on VHA's Veteran Health 
Care Service Standards (VHSS) pursuant to Executive Order 12862 and the 
Veterans Health Administration Customer Service Standards Directive. 
The VHSS are designed to measure levels of patient satisfaction in 
areas that patients have defined as important in receiving quality, 
patient-centered healthcare. Results of the survey data analysis are 
shared throughout the VHA system. The External Peer Review

[[Page 16105]]

Program (EPRP) data are collected in order to provide medical centers 
and outpatient clinics with diagnosis and procedure-specific quality of 
care information. EPRP is a contracted review of care, specifically 
designated to collect data to be used to improve the quality of care.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 38 U.S.C. 7332, i.e., medical treatment 
information related to drug abuse, alcoholism or alcohol abuse, sickle 
cell anemia or infection with the human immunodeficiency virus; 
information protected by 38 U.S.C 5705, i.e., quality assurance 
records; or information protected by 45 C.F.R. Parts 160 and 164, i.e., 
individually identifiable health information, such information cannot 
be disclosed under a routine use unless there is also specific 
statutory authority permitting the disclosure. VA may disclose 
protected health information pursuant to the following routine uses 
where required or permitted by law.
    1. VA may disclose on its own initiative any information in this 
system, except the names and home addresses of veterans and their 
dependents, that is relevant to a suspected or reasonably imminent 
violation of law, whether civil, criminal or regulatory in nature and 
whether arising by general or program statute or by regulation, rule or 
order issued pursuant thereto, to a Federal, State, local, tribal, or 
foreign agency charged with the responsibility of investigating or 
prosecuting such violation, or charged with enforcing or implementing 
the statute, regulation, rule or order. On its own initiative, VA may 
also disclose the names and addresses of veterans and their dependents 
to a Federal agency charged with the responsibility of investigating or 
prosecuting civil, criminal or regulatory violations of law, or charged 
with enforcing or implementing the statute, regulation, rule or order 
issued pursuant thereto.
    2. Disclosure may be made to any source from which additional 
information is requested (to the extent necessary to identify the 
individual, inform the source of the purpose(s) of the request, and 
identify the type of information requested), when necessary to obtain 
information relevant to an individual's eligibility, care history, or 
other benefits.
    3. Disclosure may be made to an agency in the executive, 
legislative, or judicial branch, or the District of Columbia government 
in response to its request or at the initiation of VA, in connection 
with disease tracking, patient outcomes or other health information 
required for program accountability.
    4. Disclosure may be made to National Archives and Records 
Administration (NARA) for it to perform its records management 
inspections responsibilities in its role as Archivist of United States 
under authority of title 44 United States Code (USC).
    5. VA may disclose information in this system of records to the 
Department of Justice (DoJ), either on VA's initiative or in response 
to DoJ's request for the information, after either VA or DoJ determines 
that such information is relevant to DoJ's representation of the United 
States or any of its components in legal proceedings before a court or 
adjudicative body, provided that, in each case, the agency also 
determines prior to disclosure that disclosure of the records to the 
Department of Justice is a use of the information contained in the 
records that is compatible with the purpose for which VA collected the 
records. VA, on its own initiative, may disclose records in this system 
of records in legal proceedings before a court or administrative body 
after determining that the disclosure of the records to the court or 
administrative body is a use of the information contained in the 
records that is compatible with the purpose for which VA collected the 
records.
    6. Records from this system of records may be disclosed to a 
Federal agency or to a State or local government licensing board and/or 
to the Federation of State Medical Boards or a similar non-government 
entity that maintains records concerning individuals' employment 
histories or concerning the issuance, retention or revocation of 
licenses, certifications, or registration necessary to practice an 
occupation, profession or specialty, in order for the agency to obtain 
information relevant to an agency decision concerning the hiring, 
retention or termination of an employee.
    7. Records from this system of records may be disclosed to inform a 
Federal agency, licensing boards or the appropriate non-government 
entities about the health care practices of a terminated, resigned or 
retired health care employee whose professional health care activity so 
significantly failed to conform to generally accepted standards of 
professional medical practice as to raise reasonable concern for the 
health and safety of patients receiving medical care in the private 
sector or from another Federal agency.
    8. For program review purposes and the seeking of accreditation 
and/or certification, disclosure may be made to survey teams of the 
Joint Commission, College of American Pathologists, American 
Association of Blood Banks, and similar national accreditation agencies 
or boards with whom VA has a contract or agreement to conduct such 
reviews but only to the extent that the information is necessary and 
relevant to the review.
    9. Disclosure may be made to a national certifying body that has 
the authority to make decisions concerning the issuance, retention or 
revocation of licenses, certifications or registrations required to 
practice a health care profession, when requested in writing by an 
investigator or supervisory official of the national certifying body 
for the purpose of making a decision concerning the issuance, retention 
or revocation of the license, certification or registration of a named 
health care professional.
    10. Records from this system that contain information listed in 5 
U.S.C. 7114(b)(4) may be disclosed to officials of labor organizations 
recognized under 5 U.S.C. Chapter 71 when relevant and necessary to 
their duties of exclusive representation concerning personnel policies, 
practices, and matters affecting working conditions.
    11. Disclosure may be made to the representative of an employee of 
all notices, determinations, decisions, or other written communications 
issued to the employee in connection with an examination ordered by VA 
under medical evaluation (formerly fitness-for-duty) examination 
procedures or Department-filed disability retirement procedures.
    12. VA may disclose information to officials of the Merit Systems 
Protection Board, or the Office of Special Counsel, when requested in 
connection with appeals, special studies of the civil service and other 
merit systems, review of rules and regulations, investigation of 
alleged or possible prohibited personnel practices, and such other 
functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be 
authorized by law.
    13. VA may disclose information to the Equal Employment Opportunity 
Commission when requested in connection with investigations of alleged 
or possible discriminatory practices, examination of Federal 
affirmative employment programs, or for other functions of the 
Commission as authorized by law or regulation.
    14. VA may disclose information to the Federal Labor Relations 
Authority (including its General Counsel) information related to the 
establishment

[[Page 16106]]

of jurisdiction, the investigation and resolution of allegations of 
unfair labor practices, or information in connection with the 
resolution of exceptions to arbitration awards when a question of 
material fact is raised; to disclose information in matters properly 
before the Federal Services Impasses Panel, and to investigate 
representation petitions and conduct or supervise representation 
elections.
    15. Disclosure of medical record data, excluding name and address, 
unless name and address are furnished by the requester, may be made to 
non-Federal research facilities for research purposes determined to be 
necessary and proper when approved in accordance with VA policy.
    16. Disclosure of name(s) and address(s) of present or former 
personnel of the Armed Services, and/ or their dependents, may be made 
to: (a) A Federal department or agency, at the written request of the 
head or designee of that agency; or (b) directly to a contractor or 
subcontractor of a Federal department or agency, for the purpose of 
conducting Federal research necessary to accomplish a statutory purpose 
of an agency. When disclosure of this information is made directly to a 
contractor, VA may impose applicable conditions on the department, 
agency, and/or contractor to insure the appropriateness of the 
disclosure to the contractor.
    17. Disclosure may be made to individuals, organizations, private 
or public agencies, or other entities or individuals with whom VA has a 
contract or agreement to perform such services as VA may deem 
practicable for the purposes of laws administered by VA, in order for 
the contractor, subcontractor, public or private agency, or other 
entity or individual with whom VA has an agreement or contract to 
perform the services of the contract or agreement. This routine use 
includes disclosures by the individual or entity performing the service 
for VA to any secondary entity or individual to perform an activity 
that is necessary for individuals, organizations, private or public 
agencies, or other entities or individuals with whom VA has a contract 
or agreement to provide the service to VA.
    18. Disclosure may be made to a congressional office from the 
record of an individual in response to an inquiry from the 
congressional office made at the request of that individual.
    19. VA may disclose information to a Federal agency for the conduct 
of research and data analysis to perform a statutory purpose of that 
Federal agency upon the prior written request of that agency, provided 
that there is legal authority under all applicable confidentiality 
statutes and regulations to provide the data and the VHA Office of 
Information (OI) has determined prior to the disclosure that VHA data 
handling requirements are satisfied.
    20. Disclosure of limited individual identification information may 
be made to another Federal agency for the purpose of matching and 
acquiring information held by that agency for VHA to use for the 
purposes stated for this system of records.
    21. VA may, on its own initiative, disclose any information or 
records to appropriate agencies, entities, and persons when (1) VA 
suspects or has confirmed that the integrity or confidentiality of 
information in the system of records has been compromised; (2) the 
Department has determined that as a result of the suspected or 
confirmed compromise there is a risk of embarrassment or harm to the 
reputations of the record subjects, harm to economic or property 
interests, identity theft or fraud, or harm to the security, 
confidentiality, or integrity of this system or other systems or 
programs (whether maintained by the Department or another agency or 
entity) that rely upon the potentially compromised information; and (3) 
the disclosure is to agencies, entities, or persons whom VA determines 
are reasonably necessary to assist or carry out the Department's 
efforts to respond to the suspected or confirmed compromise and 
prevent, minimize, or remedy such harm. This routine use permits 
disclosures by the Department to respond to a suspected or confirmed 
data breach, including the conduct of any risk analysis or provision of 
credit protection services as provided in 38 U.S.C. 5724, as the terms 
are defined in 38 U.S.C. 5727.
    22. On its own initiative, the VA may disclose to the general 
public via an Internet Website, PCMM information, including the names 
of its providers, provider panel sizes and reports on provider 
performance measures of quality when approved in accordance with VA 
policy.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Records are maintained on electronic storage media including 
magnetic tape, disk, laser optical media.

RETRIEVABILITY:
    Records are retrieved by name, Social Security number or other 
assigned identifiers of the individuals on whom they are maintained.

SAFEGUARDS:
    1. Access to and use of national patient databases are limited to 
those persons whose official duties require such access, and VA has 
established security procedures to ensure that access is appropriately 
limited. Information security officers and system data stewards review 
and authorize data access requests. VA regulates data access with 
security software that authenticates users and requires individually 
unique codes and passwords. VA provides information security training 
to all staff and instructs staff on the responsibility each person has 
for safeguarding data confidentiality.
    2. VA maintains Business Associate Agreements (BAA) and Non-
Disclosure Agreements with contracted resources in order to maintain 
confidentiality of the information.
    3. Physical access to computer rooms housing national patient 
databases is restricted to authorized staff and protected by a variety 
of security devices. Unauthorized employees, contractors, and other 
staff are not allowed in computer rooms. The Federal Protective Service 
or other security personnel provide physical security for the buildings 
housing computer rooms and data centers.
    4. Data transmissions between operational systems and national 
patient databases maintained by this system of record are protected by 
state-of-the-art telecommunication software and hardware. This may 
include firewalls, encryption, and other security measures necessary to 
safeguard data as it travels across the VA Wide Area Network. Data may 
be transmitted via a password-protected spreadsheet and placed on the 
secured share point Web portal by the user that has been provided 
access to their secure file. Data can only be accessed by authorized 
personnel from each facility within the Polytrauma System of Care and 
the Physical Medicine and Rehabilitation Program Office.
    5. In most cases, copies of back-up computer files are maintained 
at off-site locations.

RETENTION AND DISPOSAL:
    The records are disposed of in accordance with GRS 20, item 4. Item 
4 provides for deletion of data files when the agency determines that 
the files are no longer needed for administrative, legal, audit, or 
other operational purposes.

[[Page 16107]]

SYSTEMS AND MANAGER(S) AND ADDRESS:
    Officials responsible for policies and procedures; Chief 
Information Officer (19), Department of Veterans Affairs, 810 Vermont 
Avenue, NW., Washington, DC 20420. Officials maintaining this system of 
records; Director, National Data Systems (19F4), Austin Automation 
Center, 1615 Woodward Street, Austin, Texas 78772.

NOTIFICATION PROCEDURE:
    Individuals who wish to determine whether this system of records 
contains information about them should contact the Director of National 
Data Systems (19F4), Austin Automation Center, 1615 Woodward Street, 
Austin, Texas 78772. Inquiries should include the person's full name, 
Social Security number, location and dates of employment or location 
and dates of treatment, and their return address.

RECORD ACCESS PROCEDURE:
    Individuals seeking information regarding access to and contesting 
of records in this system may write or call the Director of National 
Data Systems (19F4), Austin Automation Center, 1615 Woodward Street, 
Austin, Texas 78772, or call the VA Austin Automation Center Help Desk 
and ask to speak with the VHA Director of National Data Systems at 512-
326-6780.

CONTESTING RECORD PROCEDURES:
    (See Record Access Procedures above.)

RECORD SOURCE CATEGORIES:
    Information in this system of records is provided by veterans, VA 
employees, VA computer systems, Veterans Health Information Systems and 
Technology Architecture (VistA), VA medical centers, VA Health 
Eligibility Center, VA program offices, VISNs, VA Austin Automation 
Center, the Food and Drug Administration, the Department of Defense, 
Survey of Healthcare Experiences of Patients, External Peer Review 
Program, and the following Systems Of Records: ``Patient Medical 
Records--VA'' (24VA19), ``National Prosthetics Patient Database--VA'' 
(33VA113), ``Healthcare Eligibility Records--VA'' (89VA16), VA Veterans 
Benefits Administration automated record systems (including the 
Veterans and Beneficiaries Identification and Records Location 
Subsystem--VA (38VA23)), and subsequent iterations of those systems of 
records.

                              VA Appendix 4
------------------------------------------------------------------------
             Database name                           Location
------------------------------------------------------------------------
Addiction Severity Index...............  Veteran Affairs Medical Center,
                                          7180 Highland Drive,
                                          Pittsburgh, PA 15206.
Bidirectional Health Information         Austin Automation Center, 1615
 Exchange.                                Woodward Street, Austin, Texas
                                          78772.
Cardiac Assessment Tracking and          VA Medical Center, 1055
 Reporting for Cardiac Cauterization      Clermont Street, Denver, CO.
 Laboratories.
Care Management Information System.....  Veterans Affairs Medical
                                          Center, University and
                                          Woodland Aves., Philadelphia,
                                          PA 19104.
Clinical Case Registries...............  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
CMOP Centralized Database System.......  Southwest CMOP, 3675 East
                                          Britannia Drive, Tucson, AZ
                                          85706.
Continuous Improvement in Cardiac        Veteran Affairs Medical Center,
 Surgery.                                 820 Clermont Street, Denver,
                                          CO 80220.
Corporate Data Warehouse...............  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Creutzfeldt-Jakob Disease Lookback       Veteran Affairs Medical Center,
 Dataset.                                 3200 Vine St., Cincinnati,
                                          Ohio 45220.
Decision Support System................  Austin Automation Center, 1615
                                          Woodward Street, Austin, TX
                                          78772.
Eastern Pacemaker Surveillance Center    Veteran Affairs Medical Center,
 Database.                                50 Irving Street, NW.,
                                          Washington, DC 20422.
Emerging Pathogens Initiative..........  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Federal Health Information Exchange....  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Financial Clinical Data Mart...........  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Former Prisoner of War Statistical       Austin Automation Center, 1615
 Tracking System.                         Woodward Street, Austin, Texas
                                          78772.
Functional Status and Outcome Database.  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Home Based Primary Care................  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Mammography Quality Standards VA.......  Veteran Affairs Medical Center,
                                          508 Fulton Street, Durham, NC
                                          27705.
Master Patient Index...................  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Medical SAS File (MDP) (Medical          Austin Automation Center, 1615
 District Planning (MEDIPRO)).            Woodward Street, Austin, Texas
                                          78772.
Missing Patient Register...............  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
National Mental Health Database System.  Veteran Affairs Medical Center,
                                          7180 Highland Drive,
                                          Pittsburgh, PA 15206.
National Medical Information System....  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
National Survey of Veterans............  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Office of Quality and Performance (OQP)  (OQP) Data Center, 601 Keystone
                                          Park Drive, Suite 800,
                                          Morrisville, NC 27560.

[[Page 16108]]

 
Parkinson's Disease Research, Education  Veterans Affairs Medical
 and Clinical Centers Registry.           Center, 4150 Clement St., San
                                          Francisco, CA 94121.
Patient Assessment File................  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Pharmacy Benefits Management...........  Veterans Affairs Medical
                                          Center, 5th Avenue and
                                          Roosevelt Road, Hines, IL
                                          60141.
Radiation Exposure Inquiries Database..  Office of Information Field
                                          Office, 1335 East/West Hwy,
                                          Silver Spring MD 20910.
Remote Order Entry System..............  Denver Distribution Center, 155
                                          Van Gordon Street, Lakewood,
                                          CO 80228-1709.
Resident Assessment Instrument/Minimum   Austin Automation Center, 1615
 Data Set.                                Woodward Street, Austin, Texas
                                          78772.
Short Form Health Survey for Veterans..  Veterans Affairs Medical
                                          Center, 200 Springs Rd.,
                                          Bedford, MA 01730.
VA National Clozapine Registry.........  Veteran Affairs Medical Center,
                                          4500 South Lancaster Road,
                                          Dallas, TX 75216.
VA Vital Status File...................  Austin Automation Center, 1615
                                          Woodward Street, Austin, Texas
                                          78772.
Veterans Central Cancer Registry.......  Veteran Affairs Medical Center,
                                          50 Irving Street, NW.,
                                          Washington, DC 20422.
Veterans Integrated Service Network      Austin Automation Center, 1615
 Support Service Center Databases.        Woodward Street, Austin, TX
                                          78772.
------------------------------------------------------------------------


 [FR Doc. E8-6144 Filed 3-25-08; 8:45 am]
BILLING CODE 8320-01-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.