Privacy Act of 1974, 4377-4382 [2014-01497]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 79, Number 17 (Monday, January 27, 2014)]
[Notices]
[Pages 4377-4382]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2014-01497]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974

AGENCY: Department of Veterans Affairs (VA).

ACTION: Notice of new system of records.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974 (5 U.S.C. 552(e)(4)) requires that all 
agencies publish in the Federal Register a notice of the existence and 
character of their systems of records. Notice is hereby given that the 
Department of Veterans Affairs (VA) is establishing a new system of 
records entitled ``VHA Corporate Data Warehouse-VA'' (172VA10P2).

DATES: Comments on this new system of records must be received no later 
than February 26, 2014. If no public comment is received during the 
period allowed for comment or unless otherwise published in the Federal 
Register by VA, the new system will become effective February 26, 2014.

ADDRESSES: Written comments concerning the proposed amended system of 
records may be submitted by: mail or hand-delivery to Director, 
Regulations Management (02REG), Department of Veterans Affairs, 810 
Vermont Avenue NW., Room 1068, Washington, DC 20420; fax to (202) 273-
9026; or email to https://www.Regulations.gov. All comments received 
will be available for public inspection in the Office of Regulation 
Policy and Management, Room 1063B, between the hours of 8 a.m. and 4:30 
p.m., Monday through Friday (except holidays). Please call (202) 461-
4902 (this is not a toll-free number) for an appointment.

FOR FURTHER INFORMATION CONTACT: Veterans Health Administration (VHA) 
Privacy Officer, Department of Veterans Affairs, 810 Vermont Avenue 
NW., Washington, DC 20420; telephone (704) 245-2492.

SUPPLEMENTARY INFORMATION: Background: VHA is the largest health care 
provider in the country. In order to maintain this organization, VHA 
collects patient health data, financial data, employee data, and 
patient entered data for patient care, decision support, population 
studies, research, behavior profiling, workflow integration and other 
business intelligence applications. The data is entered and stored in 
the appropriate system of record.
    I. Description of Proposed Systems of Records: The proposed system 
of record identifies data warehouses that contains health information 
such as patient assessments, diagnoses, treatments, tests, and 
pharmaceutical data. The records include information created or 
collected during the course of normal clinical and administrative work 
and is provided by employees, students, volunteers, caregivers, 
contractors, subcontractors, and consultants. It also contains patient 
self-entered data and patient financial information provided by 
patients or other governmental agencies.
    All data collected by the organization and centrally stored in the 
Corporate Data Warehouse (CDW) provides a central source of data that 
supports the delivery of health care, supports management decision 
making, allows for performance measurement, and provides a rich 
resource for VHA research. The CDW is located in Austin, Texas. VA 
delivers information technology support by dividing the United States 
into four regions. Each region contains a regional data warehouse (RDW) 
that may contain some or all of the CDW content.
    VHA uses data stored in data warehouses to prepare various 
management, tracking, and follow-up reports necessary for the effective 
operation of VHA as it plans for and then delivers quality health care, 
which includes evaluating patient eligibility, benefits and care 
services; monitoring the distribution and utilization of resources 
including provider panel management; tracking disease and patient 
outcomes; program review, accreditation and licensing; quality 
assurance audits and investigations; law enforcement investigations; 
and measuring Veterans Integrated Service Network (VISN) performance. 
The data may be used to validate labor policies and practices and be 
extracted or interrogated by VA researchers in accordance with 
established protocols. The data warehouses covered by this system of 
records are identified and listed with their physical location in 
Appendix A.
    II. Proposed Routine Use Disclosures of Data in the System: To the 
extent that records contained in the system include information 
protected by 38 U.S.C. 7332, (i.e., medical treatment information 
related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia 
or infection with the human immunodeficiency virus), that information 
cannot be disclosed under a routine use unless there is also specific 
statutory authority permitting disclosure.
    VHA is proposing the following routine use disclosures of 
information to be maintained in the system:
    1. On its own initiative, VA may disclose information, except for 
the names and home addresses of veterans and their dependents, to a 
Federal, State, local, tribal, or foreign agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto. On its 
own initiative, VA may also disclose the names and addresses of 
veterans and their dependents to a Federal agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto. VA must 
be able to comply with the requirements of agencies charged with 
enforcing the law and conducting investigations. VA must also be able 
to provide information to State or local agencies charged with 
protecting the public's health as set forth in State law.

[[Page 4378]]

    2. Disclosure may be made to any source from which additional 
information is requested (to the extent necessary to identify the 
individual, inform the source of the purpose(s) of the request, and to 
identify the type of information requested), when necessary to obtain 
information relevant to an individual's eligibility, care history, or 
other benefits.
    3. Disclosure may be made to an agency in the executive, 
legislative, or judicial branch, or the District of Columbia's 
government in response to its request or at the initiation of VA, in 
connection with disease-tracking, patient outcomes, bio-surveillance, 
or other health information required for program accountability.
    4. The record of an individual who is covered by a system of 
records may be disclosed to a Member of Congress, or a staff person 
acting for the Member, when the Member or staff person requests the 
record on behalf of and at the written request of the individual. 
Individuals sometimes request the help of a Member of Congress in 
resolving some issues relating to a matter before VA. The Member of 
Congress then writes to VA, and VA must be able to give sufficient 
information to give an appropriate response to the inquiry.
    5. Disclosure may be made to the National Archives and Records 
Administration (NARA) and the General Services Administration (GSA) in 
records management inspections conducted under authority of Title 44, 
Chapter 29, U.S.C. NARA and GSA are responsible for management of old 
records no longer actively used, but which may be appropriate for 
preservation, and for the physical maintenance of the Federal 
Government's records. VA must be able to provide the records to NARA 
and GSA in order to determine the proper disposition of such records.
    6. VA may disclose information from this system of records to the 
Department of Justice (DOJ), either on VA's initiative or in response 
to DOJ's request for the information, after either VA or DOJ determines 
that such information is relevant to DOJ's representation of the United 
States or any of its components in legal proceedings before a court or 
adjudicative body, provided that, in each case, the agency also 
determines prior to disclosure that release of the records to the DOJ 
is a use of the information contained in the records that is compatible 
with the purpose for which VA collected the records. VA, on its own 
initiative, may disclose records in this system of records in legal 
proceedings before a court or administrative body after determining 
that the disclosure of the records to the court or administrative body 
is a use of the information contained in the records that is compatible 
with the purpose for which VA collected the records.
    7. Records from this system of records may be disclosed to a 
Federal agency or to a State or local government licensing board and/or 
to the Federation of State Medical Boards or a similar non-government 
entity which maintains records concerning individuals' employment 
histories or concerning the issuance, retention or revocation of 
licenses, certifications, or registration necessary to practice an 
occupation, profession or specialty, in order for the agency to obtain 
information relevant to an agency decision concerning the hiring, 
retention or termination of an employee.
    8. Records from this system of records may be disclosed to inform a 
Federal agency, licensing boards or the appropriate non-government 
entities about the health care practices of a terminated, resigned or 
retired health care employee whose professional health care activity so 
significantly failed to conform to generally accepted standards of 
professional medical practice as to raise reasonable concern for the 
health and safety of patients receiving medical care in the private 
sector or from another Federal agency.
    9. For program review purposes and the seeking of accreditation 
and/or certification, disclosure may be made to survey teams of the 
Joint Commission (JC), College of American Pathologists, American 
Association of Blood Banks, and similar national accreditation agencies 
or boards with whom VA has a contract or agreement to conduct such 
reviews but only to the extent that the information is necessary and 
relevant to the review. VA health care facilities undergo certification 
and accreditation by several national accreditation agencies or boards 
to comply with regulations and good medical practices. VA must be able 
to disclose information for program review purposes and the seeking of 
accreditation and/or certification of health care facilities and 
programs.
    10. Disclosure may be made to a national certifying body which has 
the authority to make decisions concerning the issuance, retention or 
revocation of licenses, certifications or registrations required to 
practice a health care profession, when requested in writing by an 
investigator or supervisory official of the national certifying body 
for the purpose of making a decision concerning the issuance, retention 
or revocation of the license, certification or registration of a named 
health care professional. VA must be able to report information 
regarding the care a health care practitioner provides to a national 
certifying body charged with maintaining the health and safety of 
patients by making a decision about a health care professional's 
license, certification or registration, such as issuance, retention, 
revocation, suspension or other actions.
    11. Disclosure may be made to officials of labor organizations 
recognized under 5 U.S.C. chapter 71 when relevant and necessary to 
their duties of exclusive representation concerning personnel policies, 
practices, and matters affecting working conditions.
    12. Disclosure may be made to the VA-appointed representative of an 
employee of all notices, determinations, decisions, or other written 
communications issued to the employee in connection with an examination 
ordered by VA under medical evaluation (formerly fitness-for-duty) 
examination procedures or Department-filed disability retirement 
procedures.
    13. VA may disclose information to officials of the Merit Systems 
Protection Board (MSPB), or the Office of Special Counsel, when 
requested in connection with appeals, special studies of the civil 
service and other merit systems, review of rules and regulations, 
investigation of alleged or possible prohibited personnel practices, 
and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as 
authorized by law.
    14. VA may disclose information to the Equal Employment Opportunity 
Commission (EEOC) when requested in connection with investigations of 
alleged or possible discriminatory practices, examination of Federal 
affirmative employment programs, or for other functions of the EEOC as 
authorized by law or regulation. VA must be able to provide information 
to the EEOC to assist it in fulfilling its duties to protect employee's 
rights, as required by statute and regulation.
    15. VA may disclose to the Fair Labor Relations Authority (FLRA) 
(including its General Counsel) information related to the 
establishment of jurisdiction, the investigation and resolution of 
allegations of unfair labor practices, or information in connection 
with the resolution of exceptions to arbitration awards when a question 
of material fact is raised; to disclose information in matters properly 
before the Federal Services Impasse Panel, and to investigate 
representation petitions and conduct or supervise representation 
elections. VA must be able to provide information to FLRA to comply 
with the

[[Page 4379]]

statutory mandate under which it operates.
    16. Disclosure of health record data, excluding name and address, 
unless name and address is furnished by the requester, may be made to 
epidemiological and other research facilities for research purposes 
determined to be necessary and proper when approved in accordance with 
VA policy.
    17. Disclosure of name(s) and address(s) of present or former 
personnel of the armed services, and/or their dependents, may be made 
to: (a) A Federal department or agency, at the written request of the 
head or designee of that agency; or (b) directly to a contractor or 
subcontractor of a Federal department or agency, for the purpose of 
conducting Federal research necessary to accomplish a statutory purpose 
of an agency. When disclosure of this information is made directly to a 
contractor, VA may impose applicable conditions on the department, 
agency, and/or contractor to ensure the appropriateness of the 
disclosure to the contractor.
    18. Disclosures of relevant information may be made to individuals, 
organizations, private or public agencies, or other entities with whom 
VA has a contract or agreement, or where there is a subcontract to 
perform the services as VA may deem practicable for the purposes of 
laws administered by VA, in order for the contractor or subcontractor 
to perform the services of the contract or agreement. This routine use 
includes disclosures by the individual or entity performing the service 
for VA to any secondary entity or individual to perform an activity 
that is necessary for individuals, organizations, private or public 
agencies, or other entities or individuals with whom VA has a contract 
or agreement to provide service to VA.
    19. Disclosure to other Federal agencies may be made to assist such 
agencies in preventing and detecting possible fraud or abuse by 
individuals in their operations and programs.
    20. VA may, on its own initiative, disclose any information or 
records to appropriate agencies, entities, and persons when: (1) VA 
suspects or has confirmed that the integrity or confidentiality of 
information in the system of records has been compromised; (2) VA has 
determined that as a result of the suspected or confirmed compromise, 
there is a risk of embarrassment or harm to the reputations of the 
record subjects, harm to economic or property interests, identity theft 
or fraud, or harm to the security, confidentiality, or integrity of 
this system or other systems or programs (whether maintained by VA or 
another agency or entity) that rely upon the potentially compromised 
information; and (3) the disclosure is to agencies, entities, or 
persons whom VA determines are reasonably necessary to assist or carry 
out VA's efforts to respond to the suspected or confirmed compromise 
and prevent, minimize, or remedy such harm. This routine use permits 
disclosures by VA to respond to a suspected or confirmed data breach, 
including the conduct of any risk analysis or provision of credit 
protection services as provided in 38 U.S.C. 5724, as the terms are 
defined in 38 U.S.C. 5727.
    21. VA may disclose information from this system to a Federal 
agency for the purpose of conducting research and data analysis to 
perform a statutory purpose of that Federal agency upon the prior 
written request of that agency, provided that there is legal authority 
under all applicable confidentiality statutes and regulations to 
provide the data and VA has determined prior to the disclosure that VA 
data handling requirements are satisfied.
    22. VA may disclose information from this system of records to the 
Office of Management and Budget (OMB) for the performance of its 
statutory responsibilities for evaluating Federal programs. VA must be 
able to provide information to OMB to assist it in fulfilling its 
duties as required by statute and regulation.
    23. VA may disclose this information to the Department of Defense 
(DoD) for joint ventures between the two Departments to promote 
improved patient care, better health care resource utilization, and 
formal research studies.
    III. Compatibility of the Proposed Routine Uses: The Privacy Act 
permits VA to disclose information about individuals without their 
consent for a routine use, when the information will be used for a 
purpose that is compatible with the purpose for which VA collected the 
information. In all of the routine use disclosures described above, 
either the recipient of the information will use the information in 
connection with a matter relating to one of VA's programs, will use the 
information to provide a benefit to VA, or disclosure is required by 
law.
    The notice of intent to publish an advance copy of the system 
notice have been sent to the appropriate Congressional committees and 
to the Director of the Office of Management and Budget (OMB) as 
required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB 
(65 FR 77677), December 12, 2000.

    Approved: December 20, 2013.
Jose D. Riojas,
Chief of Staff, Department of Veterans Affairs.
172VA10P2

SYSTEM NAME:
    ``VHA Corporate Data Warehouse-VA''

SYSTEM LOCATION:
    CDW is located at the VA Corporate Data Center Operations, Austin 
Information Technology Center, 1615 Woodward Street, Austin, TX 78772.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The records contain information for all individuals
    (1) receiving health care from VHA;
    (2) receiving health care from DoD;
    (3) providing the health care;
    (4) or working for VA or DoD.
    Individuals encompass Veterans, members of the armed services, 
current and former employees, trainees, caregivers, contractors, sub-
contractors, consultants, volunteers, and other individuals working 
collaboratively with VA.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The records may include information related to:
    1. Patient health record detailed information, including 
information from Patient Health Record--VA (24VA10P2) and Patient 
National Databases--VA (121VA10P2).
    2. The record may include identifying information (e.g., name, 
birth date, death date, admission date, discharge date, gender, social 
security number, taxpayer identification number); address information 
(e.g., home and/or mailing address, home telephone number, emergency 
contact information such as name, address, telephone number, and 
relationship); prosthetic and sensory aid serial numbers; health record 
numbers; integration control numbers; information related to medical 
examination or treatment (e.g., location of VA medical facility 
providing examination or treatment, treatment dates, medical conditions 
treated or noted on examination); information related to military 
service and status;
    3. Patient health insurance information; including information from 
Revenue Program Billing and Collection Records--VA (114VA16)
    4. Medical benefit and eligibility information; including 
information from Revenue Program Billing and Collection Records--VA 
(114VA16)

[[Page 4380]]

    5. Patient aggregate workload data such as admissions, discharges, 
and outpatient visits; resource utilization such as laboratory tests, 
x-rays, pharmaceuticals, prosthetics and sensory aids; employee 
workload and productivity data;
    6. Information on services or products needed in the provision of 
medical care (i.e. pacemakers, prosthetics, dental implants, hearing 
aids, etc.) data collected may include vendor name and address, details 
about and/or evaluation of service or product, price/fee, dates 
purchased and delivered;
    7. Health care practitioners' identification number;
    8. Employees salary and benefit information;
    9. Financial Information from the Financial Management System;
    10. Human resource information including employee grade, salary, 
and tour of duty;
    11. Compensation and pension determinations, Veteran eligibility, 
and other information associated administering Veteran benefits by the 
Veterans Benefit Administration;
    12. Data from other Federal agencies;
    13. Patient self-entered data (online forms, etc).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Title 38, United States Code, Section 501.

PURPOSE(S):
    The records and information may be used for clinical decision 
support, mobile applications presenting patient data, statistical 
analysis to produce various management, workload tracking, and follow-
up reports; to track and evaluate the ordering and delivery of 
equipment, services and patient care; for the planning, distribution 
and utilization of resources; to monitor the performance of VISNs; and 
to allocate clinical and administrative support to patient medical 
care. The data may be used for VA's extensive research programs in 
accordance with VA policy and to monitor for bio-terrorist activity. In 
addition, the data may be used to assist in workload allocation for 
patient treatment services including provider panel management, nursing 
care, clinic appointments, surgery, diagnostic and therapeutic 
procedures; to plan and schedule training activities for employees; for 
audits, reviews and investigations conducted by the Network Directors 
Office and VA Central Office; for quality assurance audits, reviews and 
investigations; for law enforcement investigations; and for personnel 
management, evaluation and employee ratings, and performance 
evaluations.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 38 U.S.C. 7332, i.e., medical treatment 
information related to drug abuse, alcoholism or alcohol abuse, sickle 
cell anemia or infection with the human immunodeficiency virus, that 
information cannot be disclosed under a routine use unless there is 
also specific statutory authority permitting disclosure.
    1. On its own initiative, VA may disclose information, except for 
the names and home addresses of veterans and their dependents, to a 
Federal, State, local, tribal or foreign agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto. On its 
own initiative, VA may also disclose the names and addresses of 
veterans and their dependents to a Federal agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto.
    2. Disclosure may be made to any source from which additional 
information is requested (to the extent necessary to identify the 
individual, inform the source of the purpose(s) of the request, and to 
identify the type of information requested), when necessary to obtain 
information relevant to an individual's eligibility, care history, or 
other benefits.
    3. Disclosure may be made to an agency in the executive, 
legislative, or judicial branch, or the District of Columbia's 
government in response to its request or at the initiation of VA, in 
connection with disease-tracking, patient outcomes, bio-surveillance, 
or other health information required for program accountability.
    4. The record of an individual who is covered by a system of 
records may be disclosed to a Member of Congress, or a staff person 
acting for the Member, when the Member or staff person requests the 
record on behalf of and at the written request of the individual. 
Individuals sometimes request the help of a Member of Congress in 
resolving some issues relating to a matter before VA.
    5. Disclosure may be made to NARA and GSA in records management 
inspections conducted under authority of Title 44, Chapter 29, of the 
U.S.C. NARA and GSA are responsible for management of old records no 
longer actively used, but which may be appropriate for preservation, 
and for the physical maintenance of the Federal Government's records.
    6. VA may disclose information from this system of records to the 
DOJ, either on VA's initiative or in response to DOJ's request for the 
information, after either VA or DOJ determines that such information is 
relevant to DOJ's representation of the United States or any of its 
components in legal proceedings before a court or adjudicative body, 
provided that, in each case, the agency also determines prior to 
disclosure that release of the records to the DOJ is a use of the 
information contained in the records that is compatible with the 
purpose for which VA collected the records.
    7. Records from this system of records may be disclosed to a 
Federal agency or to a State or local government licensing board and/or 
to the Federation of State Medical Boards or a similar non-government 
entity which maintains records concerning individuals' employment 
histories or concerning the issuance, retention or revocation of 
licenses, certifications, or registration necessary to practice an 
occupation, profession or specialty, in order for the agency to obtain 
information relevant to an agency decision concerning the hiring, 
retention or termination of an employee.
    8. Records from this system of records may be disclosed to inform a 
Federal agency, licensing boards or the appropriate non-government 
entities about the health care practices of a terminated, resigned or 
retired health care employee whose professional health care activity so 
significantly failed to conform to generally accepted standards of 
professional medical practice, as to raise reasonable concern for the 
health and safety of patients receiving medical care in the private 
sector or from another Federal agency.
    9. For program review purposes and the seeking of accreditation 
and/or certification, disclosure may be made to survey teams of the JC, 
College of American Pathologists, American Association of Blood Banks, 
and similar national accreditation agencies or boards with whom VA has 
a contract or agreement to conduct such reviews but only to the extent 
that the information is necessary and relevant to the review. VA health 
care facilities undergo certification and accreditation by several 
national accreditation agencies or boards to comply with regulations 
and good medical practices.

[[Page 4381]]

    10. Disclosure may be made to a national certifying body which has 
the authority to make decisions concerning the issuance, retention or 
revocation of licenses, certifications or registrations required to 
practice a health care profession, when requested in writing by an 
investigator or supervisory official of the national certifying body 
for the purpose of making a decision concerning the issuance, retention 
or revocation of the license, certification or registration of a named 
health care professional.
    11. Disclosure may be made to officials of labor organizations 
recognized under 5 U.S.C. Chapter 71, when relevant and necessary to 
their duties of exclusive representation concerning personnel policies, 
practices, and matters affecting working conditions.
    12. Disclosure may be made to the VA-appointed representative of an 
employee of all notices, determinations, decisions, or other written 
communications issued to the employee in connection with an examination 
ordered by VA under medical evaluation (formerly fitness-for-duty) 
examination procedures or Department-filed disability retirement 
procedures.
    13. VA may disclose information to officials of the MSPB, or the 
Office of Special Counsel, when requested in connection with appeals, 
special studies of the civil service and other merit systems, review of 
rules and regulations, investigation of alleged or possible prohibited 
personnel practices, and such other functions, promulgated in 5 U.S.C. 
1205 and 1206, or as authorized by law.
    14. VA may disclose information to the EEOC when requested in 
connection with investigations of alleged or possible discriminatory 
practices, examination of Federal affirmative employment programs, or 
for other functions of the EEOC as authorized by law or regulation.
    15. VA may disclose to the FLRA (including its General Counsel) 
information related to the establishment of jurisdiction, the 
investigation and resolution of allegations of unfair labor practices, 
or information in connection with the resolution of exceptions to 
arbitration awards when a question of material fact is raised; to 
disclose information in matters properly before the Federal Services 
Impasse Panel, and to investigate representation petitions and conduct 
or supervise representation elections.
    16. Disclosure of health record data, excluding name and address, 
unless name and address is furnished by the requester, may be made to 
epidemiological and other research facilities for research purposes 
determined to be necessary and proper when approved in accordance with 
VA policy.
    17. Disclosure of name(s) and address(s) of present or former 
personnel of the armed services, and/or their dependents, may be made 
to: (a) A Federal department or agency, at the written request of the 
head or designee of that agency; or (b) directly to a contractor or 
subcontractor of a Federal department or agency, for the purpose of 
conducting Federal research necessary to accomplish a statutory purpose 
of an agency. When disclosure of this information is made directly to a 
contractor, VA may impose applicable conditions on the department, 
agency, and/or contractor to insure the appropriateness of the 
disclosure to the contractor.
    18. Disclosures of relevant information may be made to individuals, 
organizations, private or public agencies, or other entities with whom 
VA has a contract or agreement or where there is a subcontract to 
perform the services as VA may deem practicable for the purposes of 
laws administered by VA, in order for the contractor or subcontractor 
to perform the services of the contract or agreement. This routine use 
includes disclosures by the individual or entity performing the service 
for VA to any secondary entity or individual to perform an activity 
that is necessary for individuals, organizations, private or public 
agencies, or other entities or individuals with whom VA has a contract 
or agreement to provide the service to VA.
    19. Disclosure to other Federal agencies may be made to assist such 
agencies in preventing and detecting possible fraud or abuse by 
individuals in their operations and programs.
    20. VA may, on its own initiative, disclose any information or 
records to appropriate agencies, entities, and persons when: (1) VA 
suspects or has confirmed that the integrity or confidentiality of 
information in the system of records has been compromised; (2) VA has 
determined that as a result of the suspected or confirmed compromise, 
there is a risk of embarrassment or harm to the reputations of the 
record subjects, harm to economic or property interests, identity theft 
or fraud, or harm to the security, confidentiality, or integrity of 
this system or other systems or programs (whether maintained by VA or 
another agency or entity) that rely upon the potentially compromised 
information; and (3) the disclosure is to agencies, entities, or 
persons whom VA determines are reasonably necessary to assist or carry 
out VA's efforts to respond to the suspected or confirmed compromise 
and prevent, minimize, or remedy such harm. This routine use permits 
disclosures by VA to respond to a suspected or confirmed data breach, 
including the conduct of any risk analysis or provision of credit 
protection services as provided in 38 U.S.C. 5724, as the terms are 
defined in 38 U.S.C. 5727.
    21. VA may disclose information from this system to a Federal 
agency for the purpose of conducting research and data analysis to 
perform a statutory purpose of that Federal agency upon the prior 
written request of that agency, provided that there is legal authority 
under all applicable confidentiality statutes and regulations to 
provide the data and VA has determined prior to the disclosure that VA 
data handling requirements are satisfied.
    22. VA may disclose information from this system of records to OMB 
for the performance of its statutory responsibilities for evaluating 
Federal programs. VA must be able to provide information to OMB to 
assist it in fulfilling its duties as required by statute and 
regulation.
    23. VA may disclose this information to the DoD for joint ventures 
between the two Departments to promote improved patient care, better 
health care resource utilization, and formal research studies.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Records are maintained on Storage Area Networks.

RETRIEVABILITY:
    Records are retrieved by name, social security number, or other 
assigned identifiers of the individuals on whom they are maintained.

SAFEGUARDS:
    1. Access to and use of data warehouses are limited to those 
persons whose official duties require such access, and the VA has 
established security procedures to ensure that access is appropriately 
limited. Information security officers and system data stewards review 
and authorize data access requests. VA regulates data warehouse access 
with security software that relies on network authentication. VA 
requires information security training to all staff and instructs staff 
on the responsibility each person has for safeguarding data 
confidentiality.

[[Page 4382]]

    2. Physical access to computer rooms housing data warehouses are 
restricted to authorized staff and protected by a variety of security 
devices. Unauthorized employees, contractors, and other staff are not 
allowed in computer rooms.
    3. Data transmissions between operational systems and data 
warehouses maintained by this system of record are protected by state 
of the art telecommunication software and hardware. This may include 
firewalls, intrusion detection devices, encryption, and other security 
measures necessary to safeguard data as it travels across the VA Wide 
Area Network.
    4. In most cases, copies of back-up computer files are maintained 
at off-site locations.

RETENTION AND DISPOSAL:
    Records are maintained and disposed of in accordance with records 
disposition authority approved by the Archivist of the United States. 
The records are disposed of in accordance with General Records Schedule 
20, item 4.
    Item 4 provides for deletion of data files when the agency 
determines that the files are no longer needed for administrative, 
legal, audit, or other operational purposes.

SYSTEM MANAGER(S) AND ADDRESS:
    Officials responsible for policies and procedures; Assistant Deputy 
Under Secretary for Health for Informatics and Analytics (10P2), 
Department of Veterans Affairs, 810 Vermont Avenue NW., Washington, DC 
20420. Officials maintaining this system of records; Director, National 
Data Systems (10P2C), Austin Information Technology Center, 1615 
Woodward Street, Austin, Texas 78772.

NOTIFICATION PROCEDURE:
    Individuals who wish to determine whether this system of records 
contains information about them should contact the Director of National 
Data Systems (10P2C), Austin Information Technology Center, 1615 
Woodward Street, Austin, Texas 78772. Inquiries should include the 
person's full name, social security number, location and dates of 
employment or location and dates of treatment, and their return 
address.

RECORD ACCESS PROCEDURE:
    Individuals seeking information regarding access to and contesting 
of records in this system may write or call the Director of VHA 
National Data Systems (10P2C), located at the VA Corporate Data Center 
Operations, Austin Campus, 1615 Woodward Street, Austin, Texas 78772, 
or call the VA National Service Desk and ask to speak with the VHA 
Director of National Data Systems at (512) 326-6780.

CONTESTING RECORD PROCEDURES:
    (See Record Access Procedures above.)

RECORD SOURCE CATEGORIES:
    Information in this system of records is provided by veterans, VA 
employees, VA computer systems, Veterans Health Information Systems and 
Technology Architecture (VistA), VA Medical Centers, VA Program 
Offices, VISNs, DoD, other Federal Agencies.

VA Appendix A

------------------------------------------------------------------------
             Database name                           Location
------------------------------------------------------------------------
Corporate Data Warehouse...............  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Regional Data Warehouses (RDW).........  Region 1 Data Warehouse,
                                          Herakles Data Center, 1100
                                          North Market Blvd, Sacramento,
                                          CA 95834.
Region 2 Data Warehouse................  Little Rock VA Medical Center,
                                          IRM/Bldg 102, 2200 Ft. Roots
                                          Drive, North Little Rock, AR
                                          72114.
Region 3 Data Warehouse................  Durham VAMC, 508 Fulton Street,
                                          Durham, NC 27705.
Region 4 Data Warehouse................  Sungard Availability Services,
                                          401 N. Broad Street, Suite
                                          11.803, Philadelphia, PA
                                          19108.
Veterans Informatics, Information and    Austin Information Technology
 Computing Infrastructure (VINCI).        Center 1615 Woodward Street
                                          Austin, TX 78772.
------------------------------------------------------------------------

[FR Doc. 2014-01497 Filed 1-24-14; 8:45 am]
BILLING CODE 8320-01-P