Privacy Act of 1974, 26192-26197 [E8-10230]
Download as PDF
26192
Federal Register / Vol. 73, No. 90 / Thursday, May 8, 2008 / Notices
Last name
First name
CHAN ...................................................................................
SHUM ...................................................................................
SERRA .................................................................................
LEE .......................................................................................
KARIBIAN .............................................................................
MOFFETT ............................................................................
LUND ....................................................................................
LUND ....................................................................................
MOSDOL ..............................................................................
CONNERTON ......................................................................
CONNERTON ......................................................................
LILY.
KEY ......................................................................................
VICTOR ................................................................................
EUGENE ..............................................................................
GEORGE .............................................................................
SARAH.
HENRY.
MARGARET.
KRISTINE .............................................................................
KATHERINE .........................................................................
TIMOTHY .............................................................................
Dated: April 14, 2008.
Angie Kaminski,
Manager Team 103, Examinations
Operations, Philadelphia Compliance
Services.
[FR Doc. E8–10193 FILED 5–7–08; 8:45 am]
BILLING CODE 4830–01–P
Authority: 31 U.S.C. 5111, 5112 & 9701.
Dated: May 5, 2008.
Edmund C. Moy,
Director, United States Mint.
[FR Doc. E8–10308 Filed 5–7–08; 8:45 am]
BILLING CODE 4810–02–P
Middle name/initials
ADA
LUIZ
YAPP
VAHAK
HELGELAND
M
P
Washington, DC 20220; or call 202–354–
7200.
Any member of the public interested
in submitting matters for the CCAC’s
consideration is invited to submit them
by fax to the following number: 202–
756–6830.
Authority: 31 U.S.C. 5135(b)(8)(C).
DEPARTMENT OF THE TREASURY
DEPARTMENT OF THE TREASURY
United States Mint
United States Mint
Notification of American Eagle
Platinum Uncirculated Coin Price
Increases
Notification of Citizens Coinage
Advisory Committee May 2008 Public
Meeting
Dated: May 2, 2008.
Edmund C. Moy,
Director, United States Mint.
[FR Doc. E8–10290 Filed 5–7–08; 8:45 am]
BILLING CODE 4810–02–P
SUMMARY: Pursuant to United States
Code, Title 31, section 5135(b)(8)(C), the
United States Mint announces the
Citizens Coinage Advisory Committee
(CCAC) public meeting scheduled for
May 20, 2008.
Date: May 20, 2008.
Time: Public meeting time: 9 a.m. to
12 p.m.
Location: United States Mint, 801 9th
Street, NW., Washington, DC 20220.
Subject: Review candidate designs for
the 2009 District of Columbia and
United States Territories Quarter
Program; and other general business.
Interested persons should call 202–
354–7502 for the latest update on
meeting time and room location.
In accordance with 31 U.S.C. 5135,
the CCAC:
• Advises the Secretary of the
Treasury on any theme or design
proposals relating to circulating coinage,
bullion coinage, Congressional Gold
Medals, and national and other medals.
• Advises the Secretary of the
Treasury with regard to the events,
Description
Price
persons, or places to be commemorated
by the issuance of commemorative coins
American Eagle Platinum Uncirculated Coins
in each of the five calendar years
One-ounce platinum coin .........
$2,189.95 succeeding the year in which a
One-tenth ounce platinum coin
244.95 commemorative coin designation is
made.
• Makes recommendations with
FOR FURTHER INFORMATION CONTACT:
respect to the mintage level for any
Gloria C. Eskridge, Associate Director
commemorative coin recommended.
for Sales and Marketing; United States
Mint; 801 Ninth Street, NW.,
FOR FURTHER INFORMATION CONTACT: Cliff
Washington, DC 20220; or call 202–354– Northup, United States Mint Liaison to
7500.
the CCAC; 801 9th Street, NW.,
The United States Mint is
adjusting prices for its American Eagle
Platinum Uncirculated One-Ounce
Coins and its American Eagle Platinum
Uncirculated One-Tenth Ounce Coins.
Pursuant to the authority that 31
U.S.C. 5111(a) and 5112(k) grant the
Secretary of the Treasury to mint and
issue platinum coins, and to prepare
and distribute numismatic items, the
United States Mint mints and issues
2007 American Eagle Uncirculated
Coins with the following weights: Oneounce and one-tenth ounce. In
accordance with 31 U.S.C. 9701(b)(2)(B),
the United States Mint is changing the
price of these coins to reflect the
increases in the market price of
platinum.
Accordingly, the United States Mint
will commence selling the following
2007 American Eagle Uncirculated
Coins according to the following price
schedule:
mstockstill on PROD1PC66 with NOTICES
SUMMARY:
VerDate Aug<31>2005
17:22 May 07, 2008
Jkt 214001
PO 00000
Frm 00119
Fmt 4703
Sfmt 4703
DEPARTMENT OF VETERANS
AFFAIRS
Privacy Act of 1974
AGENCY:
Department of Veterans Affairs
(VA).
Notice of Amendment of
Systems of Records.
ACTION:
SUMMARY: As required by the Privacy
Act of 1974, 5 U.S.C. 552a(e), notice is
hereby given that VA is amending its
system of records currently entitled
‘‘Healthcare Eligibility Records—VA’’
(89VA19) as established in the Federal
Register, 59 FR 8677 (Feb. 23, 1994),
and last amended at 66 FR 27752 (May
18, 2001). VA is amending the system
by renaming the system to ‘‘Income
Verification Records—VA’’ and
renumbering the system to 89VA16, as
well as revising the ‘‘Description of
Systems of Records’’; ‘‘Routine Use
Disclosures of Data in the System’’;
‘‘Categories of Records in the System’’;
‘‘Routine Uses of Records Maintained in
the System’’; and ‘‘Retrievability.’’ VA is
republishing the system notice in its
entirety at this time.
DATES: Comments on the amendment of
this system of records must be received
no later than June 9, 2008. If no public
comment is received during the period
allowed for comment or unless
otherwise published in the Federal
Register by VA, the amended system
will become effective June 9, 2008.
E:\FR\FM\08MYN1.SGM
08MYN1
Federal Register / Vol. 73, No. 90 / Thursday, May 8, 2008 / Notices
Written comments may be
submitted through https://
www.Regulations.gov; by mail or handdelivery to the Director, Regulations
Management (00REG), Department of
Veterans Affairs, 810 Vermont Ave.,
NW., Room 1068, Washington, DC
20420; or by fax to (202) 273–9026.
Copies of comments received will be
available for public inspection in the
Office of Regulation Policy and
Management, Room 1063B, between the
hours of 8 a.m. and 4:30 p.m. Monday
through Friday (except holidays). Please
call (202) 273–9515 for an appointment.
In addition, during the comment period,
comments may be viewed online
through the Federal Docket Management
System (FDMS) at www.regulations.gov.
FOR FURTHER INFORMATION CONTACT:
Stephania H. Putt, Veterans Health
Administration (VHA) Privacy Officer,
Department of Veterans Affairs, 810
Vermont Avenue, NW., Washington, DC
20420, telephone (704) 245–2492.
SUPPLEMENTARY INFORMATION:
ADDRESSES:
I. Description of Revised Systems of
Records
Public Law 101–508, the Omnibus
Budget Reconciliation Act of 1990,
provides VA the authority to verify
veterans’ income to determine eligibility
for medical benefits. VA’s Health
Eligibility Center (HEC) in Atlanta,
Georgia, originally established as the
Income Verification Match Center
(IVMC), has authority under section
8051 to verify veterans’ income with the
Internal Revenue Service (IRS) and
Social Security Administration (SSA).
With the establishment of a new system
of records, ‘‘Enrollment and Eligibility
Records—VA’’ (147VA16), for certain
purposes of ‘‘Health Eligibility
Records—VA’’ (89VA19), the latter is
being renamed to ‘‘Income Verification
Records—VA’’ and being revised to
better reflect the purpose and
description of the records and the
organizational location of the system of
records.
mstockstill on PROD1PC66 with NOTICES
II. Proposed Amendment to Routine
Use Disclosures of Data in the System
VA is amending the following routine
uses:
• VA is rewriting routine use number
three (3) in its entirety.
• VA is adding routine use number
sixteen (16) to allow for the disclosure
of information to other agencies,
entities, and persons to respond to a
data breach.
• VA is adding routine use number
(17) to allow for the disclosure of
information to officials of the Merit
Systems Protection Board, or the Office
VerDate Aug<31>2005
17:22 May 07, 2008
Jkt 214001
of Special Counsel when investigating
appeals.
• VA is adding routine use (18) to
allow for the disclosure of information
to the Federal Labor Relations Authority
when resolving unfair labor practices.
• VA is amending routine use
numbers two (2) through eleven (11)
and routine use number thirteen (13) to
reflect the exception of Federal Tax
Information (FTI) from the records that
may be disclosed pursuant to these
routine uses.
The Department has made minor edits
to the System Notice for grammar and
clarity purposes, including changes to
routine uses. These changes are not, and
are not intended to be, substantive, and
are not further discussed or enumerated.
III. Compatibility of the Proposed
Routine Uses
The Privacy Act permits VA to
disclose information about individuals
without their consent for a routine use
when the information will be used for
a purpose that is compatible with the
purpose for which we collected the
information. In all of the routine use
disclosures, the recipient of the
information will use the information in
connection with a matter relating to one
of VA’s programs, will use the
information to provide a benefit to VA,
or the disclosure is required by law.
Under section 264, Subtitle F of Title
II of the Health Insurance Portability
and Accountability Act of 1996 (HIPAA)
Public Law 104–191, 100 Stat. 1936,
2033–34 (1996), the United States
Department of Health and Human
Services (HHS) published a final rule, as
amended, establishing Standards for
Privacy of Individually-Identifiable
Health Information, 45 CFR Parts 160
and 164. VA may not disclose
individually identifiable health
information (as defined in HIPAA and
the Privacy Rule, 42 U.S.C. 1320(d)(6)
and 45 CFR 164.501) pursuant to a
routine use unless either: (a) The
disclosure is required by law, or (b) the
disclosure is also permitted or required
by the HHS Privacy Rule. The
disclosures of individually identifiable
health information contemplated in the
routine uses published in this amended
system of records notice are permitted
under the Privacy Rule or required by
law. However, to also have authority to
make such disclosures under the
Privacy Act, VA must publish these
routine uses. Consequently, VA is
publishing these routine uses and is
adding a preliminary paragraph to the
routine uses portion of the system of
records notice stating that any
disclosure pursuant to the routine uses
in this system of records notice must be
PO 00000
Frm 00120
Fmt 4703
Sfmt 4703
26193
either required by law or permitted by
the Privacy Rule before VA may disclose
the covered information.
The notice of intent to publish and an
advance copy of this revised system of
records notice have been sent to the
appropriate Congressional committees
and to the Director of Office of
Management and Budget (OMB) as
required by 5 U.S.C. 552a(r) (Privacy
Act) and guidelines issued by OMB (65
FR 77677), December 12, 2000.
Approved: April 25, 2008.
Gordon H. Mansfield,
Deputy Secretary of Veterans Affairs.
89VA19
SYSTEM NAME:
Income Verification Records—VA
(89VA19)
SYSTEM LOCATION:
Records are maintained at VA’s
Health Eligibility Center (HEC) in
Atlanta, Georgia, and Austin
Automation Center (AAC) in Austin,
Texas. Records are also stored at
contracted locations in McLean,
Virginia, and Atlanta, Georgia.
CATEGORIES OF INDIVIDUALS COVERED BY THIS
SYSTEM:
Veterans who have applied for or
have received VA health care benefits
under Title 38, United States Code,
Chapter 17; veterans’ spouses and other
dependents as provided for in other
provisions of Title 38, United States
Code.
CATEGORIES OF RECORDS IN THE SYSTEM
The category of records in the system
includes:
Federal Tax Information (FTI) and
social security information generated as
a result of computer matching activity
with records from the IRS and SSA. The
records may also include, but are not
limited to, correspondence between
HEC, veterans, their family members,
and veterans’ representatives such as
Veteran Service Officers (VSOs); copies
of death certificates; Notice of
Separation; disability award letters; IRS
documents (e.g., Form 1040s, Form
1099s, W–2s); workers compensation
forms; and various annual earnings
statements, as well as pay stubs and
miscellaneous receipts.
Note: VA may not disclose to any person
in any manner any document that contains
FTI received from IRS or SSA in accordance
with the Internal Revenue Code (IRC) 26
U.S.C. 6103(l)(7). In addition, VA may not
allow access to FTI by any contractor or
subcontractor.
E:\FR\FM\08MYN1.SGM
08MYN1
26194
Federal Register / Vol. 73, No. 90 / Thursday, May 8, 2008 / Notices
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Title 38, United States Code, Sections
501(a), 1705, 1710, 1722, and 5317.
PURPOSE(S):
Information in this system of records
is used to verify the household income
of certain veterans and, if relevant, their
spouses or dependents receiving VA
health care benefits. The information in
this system of records is also used to
validate veterans’ and their spouses’
social security numbers; provide
educational materials related to income
verification; respond to veteran and
non-veteran inquiries related to income
verification; and compile management
reports.
mstockstill on PROD1PC66 with NOTICES
ROUTINE USES OF RECORDS MAINTAINED IN THE
SYSTEM, INCLUDING CATEGORIES OF USERS AND
THE PURPOSES OF SUCH USES:
To the extent that records contained
in this system include information
protected by 26 U.S.C. 6103(p)(4), i.e.,
the nature, source and amount of
income, that information may not be
disclosed under a Routine Use set forth
absent specific authorization from the
IRS or the VA Office of General Counsel
(024).
VA may disclose protected health
information pursuant to the following
routine uses where required by law, or
required or permitted by 45 CFR Parts
160 and 164:
1. VA may disclose the record of an
individual who is covered by this
system to a member of Congress or staff
person acting for the member in
response to an inquiry made at the
request of that individual.
2. VA may disclose any information
in this system of records, except Federal
Tax Information (FTI), as deemed
necessary and proper to named
individuals serving as accredited service
organization representatives and other
individuals named as approved agents
or attorneys for a documented purpose,
period of time, or specific income year,
to aid beneficiaries in the preparation
and presentation of their cases during
the verification and/or due process
procedures and in the presentation and
prosecution of claims under laws
administered by VA.
3. VA may disclose, on its own
initiative, any information in this
system, except the names, home
addresses, or FTI of veterans and their
dependents, which is relevant to a
suspected or reasonably imminent
violation of law, whether civil, criminal
or regulatory in nature and whether
arising by general or program statute or
by regulation, rule or order issued
pursuant thereto, to a Federal, State,
local, or foreign agency charged with the
VerDate Aug<31>2005
17:22 May 07, 2008
Jkt 214001
responsibility of investigating or
prosecuting such violation, or charged
with enforcing or implementing the
statute, regulation, rule, or order.
Additionally, VA may also disclose the
names and addresses of veterans and
their dependents to a Federal agency
charged with the responsibility of
investigating or prosecuting civil,
criminal, or regulatory violations of law,
or charged with enforcing or
implementing the statute, regulation,
rule, or order issued pursuant thereto.
4. VA may disclose relevant
information in this system, except FTI,
in the course of presenting evidence to
a court, magistrate, or administrative
tribunal; in matters of guardianship,
inquests, and commitments; to private
attorneys representing veterans rated
incompetent in conjunction with
issuance of Certificates of
Incompetency; and to probation and
parole officers in connection with courtrequired duties.
5. VA may disclose information in
this system, except FTI, to a VA Federal
fiduciary or a guardian ad litem in
relation to his or her representation of
a veteran in any legal proceeding, but
only to the extent necessary to fulfill the
duties of the fiduciary or the guardian
ad litem.
6. VA may disclose relevant
information in this system, except FTI,
to attorneys, insurance companies,
employers, third parties liable or
potentially liable under health plan
contracts, and to courts, boards, or
commissions, but only to the extent
necessary to aid VA in the preparation,
presentation, and prosecution of claims
authorized under Federal, State, or local
laws, and regulations promulgated
thereunder.
7. VA may disclose information in
this system of records to the Department
of Justice (DoJ), either on VA’s initiative
or in response to DoJ’s request for the
information, after either VA or DoJ
determines that such information is
relevant to DoJ’s representation of the
United States or any of its components
in legal proceedings before a court or
adjudicative body, provided that, in
each case, the agency also determines
prior to disclosure that disclosure of the
records to the Department of Justice is
a use of the information contained in
the records that is compatible with the
purpose for which VA collected the
records. VA, on its own initiative, may
disclose records in this system of
records in legal proceedings before a
court or administrative body after
determining that the disclosure of the
records to the court or administrative
body is a use of the information
contained in the records that is
PO 00000
Frm 00121
Fmt 4703
Sfmt 4703
compatible with the purpose for which
VA collected the records.
8. VA may disclose any information
in this system, except FTI, to National
Archives and Records Administration
(NARA) and General Services
Administration (GSA) in records
management inspections conducted
under Title 44 of United States Code.
9. VA may disclose information in
this system, except FTI, to a third party,
except consumer reporting agencies, in
connection with any proceeding for the
collection of an amount owed to the
United States by virtue of a person’s
participation in any benefit program
administered by VA, but only to the
extent that it is reasonably necessary to
(a) assist VA in the collection of costs
of services provided individuals not
entitled to such services; and (b) initiate
civil or criminal legal actions for
collecting amounts owed to the United
States and/or for prosecuting
individuals who willfully or
fraudulently obtained or seek to obtain
Title 38 medical benefits. This
disclosure is consistent with 38 U.S.C.
5701(b)(6).
10. VA may disclose the names and
address of veterans or their dependents
and other information as is reasonably
necessary to identify such individual
concerning that individual’s
indebtedness to the United States by
virtue of the person’s participation in a
benefits program administered by VA to
a consumer reporting agency for
purposes of assisting in the collection of
such indebtedness, provided that the
provisions of 38 U.S.C. 5701(g)(4) have
been met.
11. VA may disclose information from
this system, except FTI, or information
security review purposes to other source
Federal agencies who are parties to
computer matching agreements
involving the information maintained in
this system, but only to the extent that
the information is necessary and
relevant to the review.
12. VA may disclose the name and
other identifying information of
veterans and their spouses to reported
payers of earned or unearned income in
order to verify the identifier provided,
address, income paid, period of
employment, and health insurance
information provided on the means test,
and to confirm income and
demographic data provided by other
Federal agencies during income
verification computer matching.
13. VA may disclose identifying
information other than FTI, such as
veterans’ and their dependents’ social
security numbers, to other Federal
agencies for purposes of conducting
computer matches to obtain valid
E:\FR\FM\08MYN1.SGM
08MYN1
Federal Register / Vol. 73, No. 90 / Thursday, May 8, 2008 / Notices
identifying, demographic, and income
information and to verify eligibility of
certain veterans who are receiving VA
medical benefits under Title 38, United
States Code, or for the purpose of
conducting a computer match to obtain
information to validate social security
numbers maintained in VA records.
14. VA may disclose the name and
social security number of a veteran,
spouse and dependents, and other
identifying information as is reasonably
necessary to the Social Security
Administration, Department of Health
and Human Services, for the purpose of
conducting a computer match to obtain
information to validate the social
security numbers maintained in VA
records.
15. VA may disclose relevant
information from this system to
individuals, organizations, private or
public agencies, etc., with whom VA
has a contract or agreement to perform
such services as VA may deem
practicable for the purposes of laws
administered by VA in order for the
contractor or subcontractor to perform
the services of the contract or
agreement.
mstockstill on PROD1PC66 with NOTICES
Note: This routine use does not authorize
disclosure of FTI received from the Internal
Revenue Service or the Social Security
Administration to contractors or
subcontractors.
16. VA may, on its own initiative,
disclose any information or records to
appropriate agencies, entities, and
persons when (1) VA suspects or has
confirmed that the integrity or
confidentiality of information in the
system of records has been
compromised; (2) the Department has
determined that as a result of the
suspected or confirmed compromise
there is a risk of embarrassment or harm
to the reputations of the record subjects,
harm to economic or property interests,
identity theft or fraud, or harm to the
security, confidentiality, or integrity of
this system or other systems or
programs (whether maintained by the
Department or another agency or entity)
that rely upon the potentially
compromised information; and (3) the
disclosure is to agencies, entities, or
persons whom VA determines are
reasonably necessary to assist or carry
out the Department’s efforts to respond
to the suspected or confirmed
compromise and prevent, minimize, or
remedy such harm. This routine use
permits disclosures by the Department
to respond to a suspected or confirmed
data breach, including the conduct of
any risk analysis or provision of credit
protection services as provided in 38
VerDate Aug<31>2005
17:22 May 07, 2008
Jkt 214001
U.S.C. 5724, as the terms are defined in
38 U.S.C. 5727.
17. VA may disclose information to
officials of the Merit Systems Protection
Board, or the Office of Special Counsel,
when requested in connection with
appeals, special studies of the civil
service and other merit systems, review
of rules and regulations, investigation of
alleged or possible prohibited personnel
practices, and such other functions,
promulgated in 5 U.S.C. 1205 and 1206,
or as may be authorized by law.
18. VA may disclose information to
the Federal Labor Relations Authority
(including its General Counsel)
information related to the establishment
of jurisdiction, the investigation and
resolution of allegations of unfair labor
practices, or information in connection
with the resolution of exceptions to
arbitration awards when a question of
material fact is raised; to disclose
information in matters properly before
the Federal Services Impasses Panel,
and to investigate representation
petitions and conduct or supervise
representation elections.
POLICIES AND PRACTICES FOR STORING,
RETRIEVING, ACCESSING, RETAINING AND
DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
Records are maintained on magnetic
tape, magnetic disk, optical disk, and
paper.
RETRIEVABILITY:
Records (or information contained in
records) maintained on paper
documents are indexed and accessed by
the applicant’s name, social security
number or case number and filed in case
order number. Automated records are
indexed and retrieved by the veteran’s
name, social security number, ICN, or
case number. The spouse’s name or
social security number may be retrieved
from the automated income verification
record.
ACCESS:
1. In accordance with national and
locally established data security
procedures, access to the HEC Legacy
system and the Enrollment Database is
controlled by unique entry codes (access
and verification codes). The user’s
verification code is set to be changed
automatically every 90 days. User access
to data is controlled by role-based
access as determined necessary by
supervisory and information security
staff as well as by management of option
menus available to the employee.
Determination of such access is based
upon the role or position of the
employee and functionality necessary to
perform the employee’s assigned duties.
PO 00000
Frm 00122
Fmt 4703
Sfmt 4703
26195
2. On an annual basis, employees are
required to sign a computer access
agreement acknowledging their
understanding of confidentiality
requirements. In addition, all employees
receive annual privacy awareness and
information security training. Access to
electronic records is deactivated when
no longer required for official duties.
Recurring monitors are in place to
ensure compliance with nationally and
locally established security measures.
3. Access to the AAC is generally
restricted to AAC staff, VA Headquarters
employees, custodial personnel, Federal
Protective Service and authorized
operational personnel through
electronic locking devices.
4. Specific key staffs are authorized
access to HEC computer room and all
other persons gaining access to the
computer rooms are escorted.
Programmer access to the information
systems is restricted only to staff whose
official duties require that level of
access.
SAFEGUARDS:
1. Electronic data transmissions
between VA health care facilities, HEC,
and AAC are safeguarded by using VA’s
secure wide area network. The
transmission of electronic data between
SSA and AAC is safeguarded through
the use of a secured, encrypted
connection. Back-up of magnetic media
containing FTI is transported between
AAC and the off-site location in a
locked storage container by an off-site
vendor. Vendor personnel do not have
key access to the locked container. The
locked storage container is stored in a
safe in a secured room at the off-site
storage location. Access to the secured
room and the safe is limited to
authorized VA IT staff only.
2. The software programs at HEC,
AAC, and VA health care facilities
automatically flag records or events for
transmission via electronic messages
based upon functionality requirements.
The recipients of the messages are
controlled and/or assigned to the mail
group based on their role or position.
Server jobs at each facility run
continuously to check for incoming and
outgoing data to be transmitted which
needs to be parsed to files on the
receiving end. All messages containing
data transmissions include header
information that is used for validation
purposes. Consistency checks in the
software are used to validate the
transmission, and electronic
acknowledgment messages are returned
to the sending application. The VA
Office of Cyber Security has oversight
responsibility for planning and
implementing computer security.
E:\FR\FM\08MYN1.SGM
08MYN1
mstockstill on PROD1PC66 with NOTICES
26196
Federal Register / Vol. 73, No. 90 / Thursday, May 8, 2008 / Notices
3. Working spaces and record storage
areas at the HEC are secured during all
business hours, as well as during nonbusiness hours. All entrance doors
require an electronic pass card, issued
by the HEC Security Officer, for entry
when unlocked, and entry doors are
locked outside normal business hours.
Visitors are required to present
identification and sign-in at a specified
location. Visitors are issued a pass card
which restricts access to non-sensitive
areas and are escorted by staff through
restricted areas. At the end of the visit,
visitors are required to turn in their
badge. The building is equipped with an
intrusion alarm system which is
activated during non-business hours.
This alarm system is monitored by a
private security service vendor. The
office space occupied by employees
with access to veteran records is secured
with an electronic locking system,
which requires a card for entry and exit
of that office space. Access to the AAC
is generally restricted to AAC staff, VA
Headquarters employees, custodial
personnel, Federal Protective Service
and authorized operational personnel
through electronic locking devices. All
other persons gaining access to the
computer rooms are escorted.
4. A number of other security
measures are implemented to enhance
security and safeguard of electronic
records such as automatic timeout after
a short period of inactivity and device
locking after a pre-set number of invalid
logon attempts, for example.
5. Electronic data, except FTI, is
transmitted from HEC and AAC to VA
health care facilities over the
Department’s secure wide area network.
6. Employees at the health care
facility level do not have access to FTI,
nor do they have the ability to edit or
view income tests received from HEC as
a result of the income match with IRS.
7. Only specific key staff and the
Information Security Officer are
authorized access to the computer room.
Programmer access to AAC and HEC
databases, which contain FTI, is
restricted only to staff whose official
duties require that level of access.
Contractor staff is not authorized access
to the production database.
8. On-line data, including FTI, reside
on magnetic media in HEC and AAC
computer rooms which are highly
secured. Backup media are stored in a
combination lock safe in a secured room
within the same building and access to
the safe is restricted to the information
technology staff. Backup media are
stored by an off-site media storage
vendor who picks up the media on a
weekly basis from HEC and AAC and
returns the media to the off-site storage
VerDate Aug<31>2005
17:22 May 07, 2008
Jkt 214001
via a locked storage container. Vendor
personnel do not have key access to the
locked container.
9. Any sensitive information that may
be downloaded to a personal computer
or printed to hard copy format is
provided the same level of security as
the electronic records. All paper
documents and informal notations
containing sensitive data are shredded
prior to disposal. All magnetic media
(primary computer system) and personal
computer disks are degaussed prior to
disposal or released off site for repair.
10. HEC and AAC fully comply with
the Tax Information Security Guidelines
for Federal, State and Local Agencies
(Department of Treasury IRS Publication
1075) as it relates to access and
protection of such data. These
guidelines define the management of
magnetic media, paper and electronic
records, and physical and electronic
security of the data.
11. All new HEC employees receive
initial information security and privacy
training and refresher training is
provided to all employees on an annual
basis. HEC’s Information Security
Officer performs an annual information
security audit. This annual audit
includes the primary computer
information system, the
telecommunication system, and local
area networks. Additionally, the IRS
performs periodic on-site inspections to
ensure the appropriate level of security
is maintained for FTI. HEC and AAC’s
Information Security Officer and AIS
administrator additionally perform
periodic reviews to ensure security of
the system and databases.
12. Identification codes and codes
used to access HEC automated
communications systems and records
systems, as well as security profiles and
possible security violations, are
maintained on magnetic media in a
secure environment at the Center. For
contingency purposes, database backups on removable magnetic media are
stored off-site by a licensed and bonded
media storage vendor.
13. VA field facilities do not receive
FTI from AAC or HEC.
14. Contractors and subcontractors are
required to adhere to HEC’s safeguard
and security requirements.
RETENTION AND DISPOSAL:
Depending on the record medium,
records are destroyed by either
shredding or degaussing. Paper records
are destroyed after they have been
accurately scanned on optical disks.
Optical disks or other electronic
medium are deleted when all phases of
the veteran’s appeal rights have ended
(ten years after the income year for
PO 00000
Frm 00123
Fmt 4703
Sfmt 4703
which the means test verification was
conducted). Electronic data and
magnetic media received at AAC from
SSA and IRS are destroyed 30 days after
the data have been validated as being a
true copy of the original data. Summary
reports and other output reports are
destroyed when no longer needed for
current operation. Records are disposed
of in accordance with the records
retention standards approved by the
Archivist of the United States, National
Archives and Records Administration,
and published in the VHA Records
Control Schedule 10–1. Regardless of
the record medium, no records will be
retired to a Federal records center.
SYSTEM MANAGER(S) AND ADDRESSES:
Official responsible for policies and
procedures: Chief Business Office (16),
VA Central Office, 810 Vermont
Avenue, NW., Washington, DC 20420.
Official maintaining the system:
Director, Health Eligibility Center, 2957
Clairmont Road, Atlanta, Georgia 30329.
NOTIFICATION PROCEDURE:
Any individual who wishes to
determine whether a record is being
maintained in this system under his or
her name or other personal identifier or
wants to determine the contents of such
record should submit a written request
or apply in person to the Health
Eligibility Center. All inquiries must
reasonably identify the records
requested. Inquiries should include the
individual’s full name, social security
number, and return address.
RECORD ACCESS PROCEDURES:
Individuals seeking information
regarding access to and contesting of
income verification records may write to
the Director, Health Eligibility Center,
2957 Clairmont Road, Suite 200,
Atlanta, Georgia 30329.
CONTESTING RECORD PROCEDURES:
(See Record Access procedures
above).
RECORD SOURCE CATEGORIES:
Information in this systems of records
may be provided by the applicant,
applicant’s spouse or other family
members; accredited representatives or
friends; employers and other payers of
earned income; financial institutions
and other payers of unearned income;
health insurance carriers; other Federal
agencies; the ‘‘Patient Medical
Records—VA’’ (24VA19) and the
‘‘Enrollment and Eligibility Records—
VA’’ (147VA16) systems of records; and
Veterans Benefits Administration
automated record systems (including
the ‘‘Veterans and Beneficiaries
Identification and Records Location
E:\FR\FM\08MYN1.SGM
08MYN1
Federal Register / Vol. 73, No. 90 / Thursday, May 8, 2008 / Notices
Subsystem—VA’’ (38VA23) and the
‘‘Compensation, Pension, Education and
Rehabilitation Records—VA’’ (58VA21/
22).
[FR Doc. E8–10230 Filed 5–7–08; 8:45 am]
mstockstill on PROD1PC66 with NOTICES
BILLING CODE 8320–01–P
VerDate Aug<31>2005
17:22 May 07, 2008
Jkt 214001
PO 00000
Frm 00124
Fmt 4703
Sfmt 4703
E:\FR\FM\08MYN1.SGM
08MYN1
26197
Agencies
[Federal Register Volume 73, Number 90 (Thursday, May 8, 2008)]
[Notices]
[Pages 26192-26197]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-10230]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF VETERANS AFFAIRS
Privacy Act of 1974
AGENCY: Department of Veterans Affairs (VA).
ACTION: Notice of Amendment of Systems of Records.
-----------------------------------------------------------------------
SUMMARY: As required by the Privacy Act of 1974, 5 U.S.C. 552a(e),
notice is hereby given that VA is amending its system of records
currently entitled ``Healthcare Eligibility Records--VA'' (89VA19) as
established in the Federal Register, 59 FR 8677 (Feb. 23, 1994), and
last amended at 66 FR 27752 (May 18, 2001). VA is amending the system
by renaming the system to ``Income Verification Records--VA'' and
renumbering the system to 89VA16, as well as revising the ``Description
of Systems of Records''; ``Routine Use Disclosures of Data in the
System''; ``Categories of Records in the System''; ``Routine Uses of
Records Maintained in the System''; and ``Retrievability.'' VA is
republishing the system notice in its entirety at this time.
DATES: Comments on the amendment of this system of records must be
received no later than June 9, 2008. If no public comment is received
during the period allowed for comment or unless otherwise published in
the Federal Register by VA, the amended system will become effective
June 9, 2008.
[[Page 26193]]
ADDRESSES: Written comments may be submitted through https://
www.Regulations.gov; by mail or hand-delivery to the Director,
Regulations Management (00REG), Department of Veterans Affairs, 810
Vermont Ave., NW., Room 1068, Washington, DC 20420; or by fax to (202)
273-9026. Copies of comments received will be available for public
inspection in the Office of Regulation Policy and Management, Room
1063B, between the hours of 8 a.m. and 4:30 p.m. Monday through Friday
(except holidays). Please call (202) 273-9515 for an appointment. In
addition, during the comment period, comments may be viewed online
through the Federal Docket Management System (FDMS) at
www.regulations.gov.
FOR FURTHER INFORMATION CONTACT: Stephania H. Putt, Veterans Health
Administration (VHA) Privacy Officer, Department of Veterans Affairs,
810 Vermont Avenue, NW., Washington, DC 20420, telephone (704) 245-
2492.
SUPPLEMENTARY INFORMATION:
I. Description of Revised Systems of Records
Public Law 101-508, the Omnibus Budget Reconciliation Act of 1990,
provides VA the authority to verify veterans' income to determine
eligibility for medical benefits. VA's Health Eligibility Center (HEC)
in Atlanta, Georgia, originally established as the Income Verification
Match Center (IVMC), has authority under section 8051 to verify
veterans' income with the Internal Revenue Service (IRS) and Social
Security Administration (SSA). With the establishment of a new system
of records, ``Enrollment and Eligibility Records--VA'' (147VA16), for
certain purposes of ``Health Eligibility Records--VA'' (89VA19), the
latter is being renamed to ``Income Verification Records--VA'' and
being revised to better reflect the purpose and description of the
records and the organizational location of the system of records.
II. Proposed Amendment to Routine Use Disclosures of Data in the System
VA is amending the following routine uses:
VA is rewriting routine use number three (3) in its
entirety.
VA is adding routine use number sixteen (16) to allow for
the disclosure of information to other agencies, entities, and persons
to respond to a data breach.
VA is adding routine use number (17) to allow for the
disclosure of information to officials of the Merit Systems Protection
Board, or the Office of Special Counsel when investigating appeals.
VA is adding routine use (18) to allow for the disclosure
of information to the Federal Labor Relations Authority when resolving
unfair labor practices.
VA is amending routine use numbers two (2) through eleven
(11) and routine use number thirteen (13) to reflect the exception of
Federal Tax Information (FTI) from the records that may be disclosed
pursuant to these routine uses.
The Department has made minor edits to the System Notice for
grammar and clarity purposes, including changes to routine uses. These
changes are not, and are not intended to be, substantive, and are not
further discussed or enumerated.
III. Compatibility of the Proposed Routine Uses
The Privacy Act permits VA to disclose information about
individuals without their consent for a routine use when the
information will be used for a purpose that is compatible with the
purpose for which we collected the information. In all of the routine
use disclosures, the recipient of the information will use the
information in connection with a matter relating to one of VA's
programs, will use the information to provide a benefit to VA, or the
disclosure is required by law.
Under section 264, Subtitle F of Title II of the Health Insurance
Portability and Accountability Act of 1996 (HIPAA) Public Law 104-191,
100 Stat. 1936, 2033-34 (1996), the United States Department of Health
and Human Services (HHS) published a final rule, as amended,
establishing Standards for Privacy of Individually-Identifiable Health
Information, 45 CFR Parts 160 and 164. VA may not disclose individually
identifiable health information (as defined in HIPAA and the Privacy
Rule, 42 U.S.C. 1320(d)(6) and 45 CFR 164.501) pursuant to a routine
use unless either: (a) The disclosure is required by law, or (b) the
disclosure is also permitted or required by the HHS Privacy Rule. The
disclosures of individually identifiable health information
contemplated in the routine uses published in this amended system of
records notice are permitted under the Privacy Rule or required by law.
However, to also have authority to make such disclosures under the
Privacy Act, VA must publish these routine uses. Consequently, VA is
publishing these routine uses and is adding a preliminary paragraph to
the routine uses portion of the system of records notice stating that
any disclosure pursuant to the routine uses in this system of records
notice must be either required by law or permitted by the Privacy Rule
before VA may disclose the covered information.
The notice of intent to publish and an advance copy of this revised
system of records notice have been sent to the appropriate
Congressional committees and to the Director of Office of Management
and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and
guidelines issued by OMB (65 FR 77677), December 12, 2000.
Approved: April 25, 2008.
Gordon H. Mansfield,
Deputy Secretary of Veterans Affairs.
89VA19
SYSTEM NAME:
Income Verification Records--VA (89VA19)
SYSTEM LOCATION:
Records are maintained at VA's Health Eligibility Center (HEC) in
Atlanta, Georgia, and Austin Automation Center (AAC) in Austin, Texas.
Records are also stored at contracted locations in McLean, Virginia,
and Atlanta, Georgia.
CATEGORIES OF INDIVIDUALS COVERED BY THIS SYSTEM:
Veterans who have applied for or have received VA health care
benefits under Title 38, United States Code, Chapter 17; veterans'
spouses and other dependents as provided for in other provisions of
Title 38, United States Code.
CATEGORIES OF RECORDS IN THE SYSTEM
The category of records in the system includes:
Federal Tax Information (FTI) and social security information
generated as a result of computer matching activity with records from
the IRS and SSA. The records may also include, but are not limited to,
correspondence between HEC, veterans, their family members, and
veterans' representatives such as Veteran Service Officers (VSOs);
copies of death certificates; Notice of Separation; disability award
letters; IRS documents (e.g., Form 1040s, Form 1099s, W-2s); workers
compensation forms; and various annual earnings statements, as well as
pay stubs and miscellaneous receipts.
Note: VA may not disclose to any person in any manner any
document that contains FTI received from IRS or SSA in accordance
with the Internal Revenue Code (IRC) 26 U.S.C. 6103(l)(7). In
addition, VA may not allow access to FTI by any contractor or
subcontractor.
[[Page 26194]]
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Title 38, United States Code, Sections 501(a), 1705, 1710, 1722,
and 5317.
PURPOSE(S):
Information in this system of records is used to verify the
household income of certain veterans and, if relevant, their spouses or
dependents receiving VA health care benefits. The information in this
system of records is also used to validate veterans' and their spouses'
social security numbers; provide educational materials related to
income verification; respond to veteran and non-veteran inquiries
related to income verification; and compile management reports.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
To the extent that records contained in this system include
information protected by 26 U.S.C. 6103(p)(4), i.e., the nature, source
and amount of income, that information may not be disclosed under a
Routine Use set forth absent specific authorization from the IRS or the
VA Office of General Counsel (024).
VA may disclose protected health information pursuant to the
following routine uses where required by law, or required or permitted
by 45 CFR Parts 160 and 164:
1. VA may disclose the record of an individual who is covered by
this system to a member of Congress or staff person acting for the
member in response to an inquiry made at the request of that
individual.
2. VA may disclose any information in this system of records,
except Federal Tax Information (FTI), as deemed necessary and proper to
named individuals serving as accredited service organization
representatives and other individuals named as approved agents or
attorneys for a documented purpose, period of time, or specific income
year, to aid beneficiaries in the preparation and presentation of their
cases during the verification and/or due process procedures and in the
presentation and prosecution of claims under laws administered by VA.
3. VA may disclose, on its own initiative, any information in this
system, except the names, home addresses, or FTI of veterans and their
dependents, which is relevant to a suspected or reasonably imminent
violation of law, whether civil, criminal or regulatory in nature and
whether arising by general or program statute or by regulation, rule or
order issued pursuant thereto, to a Federal, State, local, or foreign
agency charged with the responsibility of investigating or prosecuting
such violation, or charged with enforcing or implementing the statute,
regulation, rule, or order. Additionally, VA may also disclose the
names and addresses of veterans and their dependents to a Federal
agency charged with the responsibility of investigating or prosecuting
civil, criminal, or regulatory violations of law, or charged with
enforcing or implementing the statute, regulation, rule, or order
issued pursuant thereto.
4. VA may disclose relevant information in this system, except FTI,
in the course of presenting evidence to a court, magistrate, or
administrative tribunal; in matters of guardianship, inquests, and
commitments; to private attorneys representing veterans rated
incompetent in conjunction with issuance of Certificates of
Incompetency; and to probation and parole officers in connection with
court-required duties.
5. VA may disclose information in this system, except FTI, to a VA
Federal fiduciary or a guardian ad litem in relation to his or her
representation of a veteran in any legal proceeding, but only to the
extent necessary to fulfill the duties of the fiduciary or the guardian
ad litem.
6. VA may disclose relevant information in this system, except FTI,
to attorneys, insurance companies, employers, third parties liable or
potentially liable under health plan contracts, and to courts, boards,
or commissions, but only to the extent necessary to aid VA in the
preparation, presentation, and prosecution of claims authorized under
Federal, State, or local laws, and regulations promulgated thereunder.
7. VA may disclose information in this system of records to the
Department of Justice (DoJ), either on VA's initiative or in response
to DoJ's request for the information, after either VA or DoJ determines
that such information is relevant to DoJ's representation of the United
States or any of its components in legal proceedings before a court or
adjudicative body, provided that, in each case, the agency also
determines prior to disclosure that disclosure of the records to the
Department of Justice is a use of the information contained in the
records that is compatible with the purpose for which VA collected the
records. VA, on its own initiative, may disclose records in this system
of records in legal proceedings before a court or administrative body
after determining that the disclosure of the records to the court or
administrative body is a use of the information contained in the
records that is compatible with the purpose for which VA collected the
records.
8. VA may disclose any information in this system, except FTI, to
National Archives and Records Administration (NARA) and General
Services Administration (GSA) in records management inspections
conducted under Title 44 of United States Code.
9. VA may disclose information in this system, except FTI, to a
third party, except consumer reporting agencies, in connection with any
proceeding for the collection of an amount owed to the United States by
virtue of a person's participation in any benefit program administered
by VA, but only to the extent that it is reasonably necessary to (a)
assist VA in the collection of costs of services provided individuals
not entitled to such services; and (b) initiate civil or criminal legal
actions for collecting amounts owed to the United States and/or for
prosecuting individuals who willfully or fraudulently obtained or seek
to obtain Title 38 medical benefits. This disclosure is consistent with
38 U.S.C. 5701(b)(6).
10. VA may disclose the names and address of veterans or their
dependents and other information as is reasonably necessary to identify
such individual concerning that individual's indebtedness to the United
States by virtue of the person's participation in a benefits program
administered by VA to a consumer reporting agency for purposes of
assisting in the collection of such indebtedness, provided that the
provisions of 38 U.S.C. 5701(g)(4) have been met.
11. VA may disclose information from this system, except FTI, or
information security review purposes to other source Federal agencies
who are parties to computer matching agreements involving the
information maintained in this system, but only to the extent that the
information is necessary and relevant to the review.
12. VA may disclose the name and other identifying information of
veterans and their spouses to reported payers of earned or unearned
income in order to verify the identifier provided, address, income
paid, period of employment, and health insurance information provided
on the means test, and to confirm income and demographic data provided
by other Federal agencies during income verification computer matching.
13. VA may disclose identifying information other than FTI, such as
veterans' and their dependents' social security numbers, to other
Federal agencies for purposes of conducting computer matches to obtain
valid
[[Page 26195]]
identifying, demographic, and income information and to verify
eligibility of certain veterans who are receiving VA medical benefits
under Title 38, United States Code, or for the purpose of conducting a
computer match to obtain information to validate social security
numbers maintained in VA records.
14. VA may disclose the name and social security number of a
veteran, spouse and dependents, and other identifying information as is
reasonably necessary to the Social Security Administration, Department
of Health and Human Services, for the purpose of conducting a computer
match to obtain information to validate the social security numbers
maintained in VA records.
15. VA may disclose relevant information from this system to
individuals, organizations, private or public agencies, etc., with whom
VA has a contract or agreement to perform such services as VA may deem
practicable for the purposes of laws administered by VA in order for
the contractor or subcontractor to perform the services of the contract
or agreement.
Note: This routine use does not authorize disclosure of FTI
received from the Internal Revenue Service or the Social Security
Administration to contractors or subcontractors.
16. VA may, on its own initiative, disclose any information or
records to appropriate agencies, entities, and persons when (1) VA
suspects or has confirmed that the integrity or confidentiality of
information in the system of records has been compromised; (2) the
Department has determined that as a result of the suspected or
confirmed compromise there is a risk of embarrassment or harm to the
reputations of the record subjects, harm to economic or property
interests, identity theft or fraud, or harm to the security,
confidentiality, or integrity of this system or other systems or
programs (whether maintained by the Department or another agency or
entity) that rely upon the potentially compromised information; and (3)
the disclosure is to agencies, entities, or persons whom VA determines
are reasonably necessary to assist or carry out the Department's
efforts to respond to the suspected or confirmed compromise and
prevent, minimize, or remedy such harm. This routine use permits
disclosures by the Department to respond to a suspected or confirmed
data breach, including the conduct of any risk analysis or provision of
credit protection services as provided in 38 U.S.C. 5724, as the terms
are defined in 38 U.S.C. 5727.
17. VA may disclose information to officials of the Merit Systems
Protection Board, or the Office of Special Counsel, when requested in
connection with appeals, special studies of the civil service and other
merit systems, review of rules and regulations, investigation of
alleged or possible prohibited personnel practices, and such other
functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be
authorized by law.
18. VA may disclose information to the Federal Labor Relations
Authority (including its General Counsel) information related to the
establishment of jurisdiction, the investigation and resolution of
allegations of unfair labor practices, or information in connection
with the resolution of exceptions to arbitration awards when a question
of material fact is raised; to disclose information in matters properly
before the Federal Services Impasses Panel, and to investigate
representation petitions and conduct or supervise representation
elections.
POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
Records are maintained on magnetic tape, magnetic disk, optical
disk, and paper.
RETRIEVABILITY:
Records (or information contained in records) maintained on paper
documents are indexed and accessed by the applicant's name, social
security number or case number and filed in case order number.
Automated records are indexed and retrieved by the veteran's name,
social security number, ICN, or case number. The spouse's name or
social security number may be retrieved from the automated income
verification record.
ACCESS:
1. In accordance with national and locally established data
security procedures, access to the HEC Legacy system and the Enrollment
Database is controlled by unique entry codes (access and verification
codes). The user's verification code is set to be changed automatically
every 90 days. User access to data is controlled by role-based access
as determined necessary by supervisory and information security staff
as well as by management of option menus available to the employee.
Determination of such access is based upon the role or position of the
employee and functionality necessary to perform the employee's assigned
duties.
2. On an annual basis, employees are required to sign a computer
access agreement acknowledging their understanding of confidentiality
requirements. In addition, all employees receive annual privacy
awareness and information security training. Access to electronic
records is deactivated when no longer required for official duties.
Recurring monitors are in place to ensure compliance with nationally
and locally established security measures.
3. Access to the AAC is generally restricted to AAC staff, VA
Headquarters employees, custodial personnel, Federal Protective Service
and authorized operational personnel through electronic locking
devices.
4. Specific key staffs are authorized access to HEC computer room
and all other persons gaining access to the computer rooms are
escorted. Programmer access to the information systems is restricted
only to staff whose official duties require that level of access.
SAFEGUARDS:
1. Electronic data transmissions between VA health care facilities,
HEC, and AAC are safeguarded by using VA's secure wide area network.
The transmission of electronic data between SSA and AAC is safeguarded
through the use of a secured, encrypted connection. Back-up of magnetic
media containing FTI is transported between AAC and the off-site
location in a locked storage container by an off-site vendor. Vendor
personnel do not have key access to the locked container. The locked
storage container is stored in a safe in a secured room at the off-site
storage location. Access to the secured room and the safe is limited to
authorized VA IT staff only.
2. The software programs at HEC, AAC, and VA health care facilities
automatically flag records or events for transmission via electronic
messages based upon functionality requirements. The recipients of the
messages are controlled and/or assigned to the mail group based on
their role or position. Server jobs at each facility run continuously
to check for incoming and outgoing data to be transmitted which needs
to be parsed to files on the receiving end. All messages containing
data transmissions include header information that is used for
validation purposes. Consistency checks in the software are used to
validate the transmission, and electronic acknowledgment messages are
returned to the sending application. The VA Office of Cyber Security
has oversight responsibility for planning and implementing computer
security.
[[Page 26196]]
3. Working spaces and record storage areas at the HEC are secured
during all business hours, as well as during non-business hours. All
entrance doors require an electronic pass card, issued by the HEC
Security Officer, for entry when unlocked, and entry doors are locked
outside normal business hours. Visitors are required to present
identification and sign-in at a specified location. Visitors are issued
a pass card which restricts access to non-sensitive areas and are
escorted by staff through restricted areas. At the end of the visit,
visitors are required to turn in their badge. The building is equipped
with an intrusion alarm system which is activated during non-business
hours. This alarm system is monitored by a private security service
vendor. The office space occupied by employees with access to veteran
records is secured with an electronic locking system, which requires a
card for entry and exit of that office space. Access to the AAC is
generally restricted to AAC staff, VA Headquarters employees, custodial
personnel, Federal Protective Service and authorized operational
personnel through electronic locking devices. All other persons gaining
access to the computer rooms are escorted.
4. A number of other security measures are implemented to enhance
security and safeguard of electronic records such as automatic timeout
after a short period of inactivity and device locking after a pre-set
number of invalid logon attempts, for example.
5. Electronic data, except FTI, is transmitted from HEC and AAC to
VA health care facilities over the Department's secure wide area
network.
6. Employees at the health care facility level do not have access
to FTI, nor do they have the ability to edit or view income tests
received from HEC as a result of the income match with IRS.
7. Only specific key staff and the Information Security Officer are
authorized access to the computer room. Programmer access to AAC and
HEC databases, which contain FTI, is restricted only to staff whose
official duties require that level of access. Contractor staff is not
authorized access to the production database.
8. On-line data, including FTI, reside on magnetic media in HEC and
AAC computer rooms which are highly secured. Backup media are stored in
a combination lock safe in a secured room within the same building and
access to the safe is restricted to the information technology staff.
Backup media are stored by an off-site media storage vendor who picks
up the media on a weekly basis from HEC and AAC and returns the media
to the off-site storage via a locked storage container. Vendor
personnel do not have key access to the locked container.
9. Any sensitive information that may be downloaded to a personal
computer or printed to hard copy format is provided the same level of
security as the electronic records. All paper documents and informal
notations containing sensitive data are shredded prior to disposal. All
magnetic media (primary computer system) and personal computer disks
are degaussed prior to disposal or released off site for repair.
10. HEC and AAC fully comply with the Tax Information Security
Guidelines for Federal, State and Local Agencies (Department of
Treasury IRS Publication 1075) as it relates to access and protection
of such data. These guidelines define the management of magnetic media,
paper and electronic records, and physical and electronic security of
the data.
11. All new HEC employees receive initial information security and
privacy training and refresher training is provided to all employees on
an annual basis. HEC's Information Security Officer performs an annual
information security audit. This annual audit includes the primary
computer information system, the telecommunication system, and local
area networks. Additionally, the IRS performs periodic on-site
inspections to ensure the appropriate level of security is maintained
for FTI. HEC and AAC's Information Security Officer and AIS
administrator additionally perform periodic reviews to ensure security
of the system and databases.
12. Identification codes and codes used to access HEC automated
communications systems and records systems, as well as security
profiles and possible security violations, are maintained on magnetic
media in a secure environment at the Center. For contingency purposes,
database back-ups on removable magnetic media are stored off-site by a
licensed and bonded media storage vendor.
13. VA field facilities do not receive FTI from AAC or HEC.
14. Contractors and subcontractors are required to adhere to HEC's
safeguard and security requirements.
RETENTION AND DISPOSAL:
Depending on the record medium, records are destroyed by either
shredding or degaussing. Paper records are destroyed after they have
been accurately scanned on optical disks. Optical disks or other
electronic medium are deleted when all phases of the veteran's appeal
rights have ended (ten years after the income year for which the means
test verification was conducted). Electronic data and magnetic media
received at AAC from SSA and IRS are destroyed 30 days after the data
have been validated as being a true copy of the original data. Summary
reports and other output reports are destroyed when no longer needed
for current operation. Records are disposed of in accordance with the
records retention standards approved by the Archivist of the United
States, National Archives and Records Administration, and published in
the VHA Records Control Schedule 10-1. Regardless of the record medium,
no records will be retired to a Federal records center.
SYSTEM MANAGER(S) AND ADDRESSES:
Official responsible for policies and procedures: Chief Business
Office (16), VA Central Office, 810 Vermont Avenue, NW., Washington, DC
20420. Official maintaining the system: Director, Health Eligibility
Center, 2957 Clairmont Road, Atlanta, Georgia 30329.
NOTIFICATION PROCEDURE:
Any individual who wishes to determine whether a record is being
maintained in this system under his or her name or other personal
identifier or wants to determine the contents of such record should
submit a written request or apply in person to the Health Eligibility
Center. All inquiries must reasonably identify the records requested.
Inquiries should include the individual's full name, social security
number, and return address.
RECORD ACCESS PROCEDURES:
Individuals seeking information regarding access to and contesting
of income verification records may write to the Director, Health
Eligibility Center, 2957 Clairmont Road, Suite 200, Atlanta, Georgia
30329.
CONTESTING RECORD PROCEDURES:
(See Record Access procedures above).
RECORD SOURCE CATEGORIES:
Information in this systems of records may be provided by the
applicant, applicant's spouse or other family members; accredited
representatives or friends; employers and other payers of earned
income; financial institutions and other payers of unearned income;
health insurance carriers; other Federal agencies; the ``Patient
Medical Records--VA'' (24VA19) and the ``Enrollment and Eligibility
Records--VA'' (147VA16) systems of records; and Veterans Benefits
Administration automated record systems (including the ``Veterans and
Beneficiaries Identification and Records Location
[[Page 26197]]
Subsystem--VA'' (38VA23) and the ``Compensation, Pension, Education and
Rehabilitation Records--VA'' (58VA21/22).
[FR Doc. E8-10230 Filed 5-7-08; 8:45 am]
BILLING CODE 8320-01-P