Privacy Act of 1974, 27437-27441 [2015-11493]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 80, Number 92 (Wednesday, May 13, 2015)]
[Notices]
[Pages 27437-27441]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2015-11493]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974

AGENCY: Department of Veteran Affairs

ACTION: Notice of establishment of a new system of records.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974, (5 U.S.C. 552a(e)(4)) requires that 
all agencies publish in the Federal Register a notice of the existence 
and character of their systems of records. Notice is hereby given that 
the Department of Veterans Affairs (VA) is establishing a new system of 
records entitled ``Inquiry Routing & Information System (IRIS)-VA'' 
(151VA005OP6). This system was previously listed as 151VA005N and was 
published in the Federal Register/Vol. 73, No. 49/Wednesday, March 12, 
2008/Notices. The time elapsed since its original publication requires 
that a new notice be published as 151VA005OP6.

DATES: Comments on this new system of records must be received no later 
than June 12, 2015. If no public comment is received, the new system 
will become effective June 12, 2015.

ADDRESSES: Written comments concerning the proposed new system of 
records may be submitted through www.Regulations.gov; by mail or hand 
delivery to the Director, Regulations Management (00REG), Department of 
Veterans Affairs, 810 Vermont Avenue NW., Room 1063B, Washington, DC 
20420; or by fax to (202) 273-9026 (This is not a toll free number). 
Copies of comments will be available for public inspection in the 
Office of Regulation Policy and Management, Room 1063B, between the 
hours of 8:00 a.m. and 4:30 p.m., Monday through Friday (except 
holidays). Please call (202) 461-4902 (This is not a toll free number) 
for an appointment. In addition, during the comment period, comments 
may be viewed online through the Federal Docket Management System 
(FDMS) at www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT: Ms. Diane Huber, Director, Enterprise 
Web Application Support (EWAS) 005Q3, Service Delivery and Engineering 
(SDE). Office Location: 1100 1st St. NE., Rm. 513, Washington, DC 
20002-4221, telephone (202) 632-7955 (This is not a toll free number).

SUPPLEMENTARY INFORMATION:

I. Description of the Proposed System of Records

    The Department of Veterans Affairs (VA) receives and responds to 
questions, suggestions, compliments, complaints, requests for the 
status of claims and other information, collectively referred to as 
inquiries, received from veterans, their representatives and 
individuals and entities doing business with VA via a Web-based 
communications system known as the Inquiry Routing & Information System 
(IRIS). This system is also used by VA call center staff to enter 
inquiries on behalf of veterans and others doing business with the 
Department.
    The IRIS is accessed by clicking on the ``Contact Us'' link that 
appears on VA Internet Web sites. Thousands of messages are received 
each month from VA beneficiaries and other veterans, veterans' family 
members and/or their representatives, health care professionals, 
clinicians, employees and managers of small businesses, vendors, 
funeral directors, mortgage companies, realtors, home buyers, 
researchers, small business owners, veterans' service organizations, 
other Federal agencies, State and local government employees, teachers, 
and other demographic groups representing every segment of the 
population both at home and abroad. Messages are routed throughout VA 
based on type of issue and topic as selected by the inquirer and also 
on the physical location of the inquirer, if provided. Messages go to 
designated mailgroups in Veterans Benefits Administration, Veterans 
Health Administration, National Cemetery Administration, and other VA 
program offices.

[[Page 27438]]

    In November 2002, VA purchased and implemented a heavily customized 
version of a Web-based, commercial contact management product for use 
on VA's Internet Web site at www.va.gov and for use by VA call center 
personnel who enter inquiries on behalf of veterans or other callers. 
Visitors to the VA Web site and other inquirers may ask questions or 
provide VA with information by completing an approved form or having 
the form completed for them by call center staff. All personal data are 
captured and maintained within a database on a secure Web server 
running Secure Socket Layer (SSL) and Transport Layer Security (TLS). 
The Web server resides at the vendor's (Oracle) FedRamp-certified 
secure government cloud facility in Elk Grove, Illinois. The 
information that VA requests on the form is necessary for VA to 
adequately respond to the inquiries. The IRIS gives VA managers the 
ability to track inquiry traffic, to measure the quality and timeliness 
of responses, and to develop and post Frequently Asked Questions (FAQs) 
based on the analysis of messages received.
    The use of the IRIS by VA Web site visitors and callers to VA call 
centers illustrates its utility for communications with VA. VA staff 
will search the IRIS database by personal identifier to provide a 
thorough response to the inquirer. The expansion of the search 
capability in the IRIS database enables VA to provide better service, 
associate communications from a single individual and provide more 
thorough responses to their inquiries. The new system of records will 
cover anyone who chooses to submit an inquiry in person, by calling a 
VA call center, or by submitting an electronic message directly to VA.
    Information requested to process the request may include name, 
address, telephone number, email address, branch of service and service 
or claim number and Social Security number if provided by the inquirer. 
Inquirers are not required to provide personal or contact information; 
however, in some instances VA may need this information in order to 
respond to specific inquiries. The authority to maintain these records 
is title 38, United States Code, section 501.

II. Routine Uses of Records Maintained in the System, Including 
Categories of Users and the Purposes of Such Uses

    Limitation on Routine Use Disclosures: To the extent that records 
contained in the system include information protected by 45 CFR parts 
160 and 164, i.e., individually identifiable health information, and 38 
U.S.C. 7332, i.e., medical treatment information related to drug abuse, 
alcoholism or alcohol abuse, sickle cell anemia or infection with the 
human immunodeficiency virus, that information cannot be disclosed 
under a routine use unless there is also specific statutory authority 
in 38 U.S.C. 7332 and regulatory authority in 45 CFR parts 160 and 164 
permitting disclosure.
    1. Contractors: Disclosure may be made to individuals, 
organizations, private or public agencies, or other entities or 
individuals with whom VA has a contract or agreement to perform such 
services as VA may deem practicable for the purposes of laws 
administered by VA, in order for the contractor, subcontractor, public 
or private agency, or other entity or individual with whom VA has an 
agreement or contract to perform the services of the contract or 
agreement. This routine use includes disclosures by the individual or 
entity performing the service for VA to any secondary entity or 
individual to perform an activity that is necessary for individuals, 
organizations, private or public agencies, or other entities or 
individuals with whom VA has a contract or agreement to provide the 
service to VA.
    2. Equal Employment Opportunity Commission: To disclose information 
to the Equal Employment Opportunity Commission when requested in 
connection with investigations of alleged or possible discriminatory 
practices, examination of Federal affirmative employment programs, or 
for other functions of the Commission as authorized by law or 
regulation.
    3. Merit Systems Protection Board: To disclose information to 
officials of the Merit Systems Protection Board, or the Office of the 
Special Counsel, when requested in connection with appeals, special 
studies of the civil service and other merit systems, review of rules 
and regulations, investigation of alleged or possible prohibited 
personnel practices, and such other functions, promulgated in 5 U.S.C. 
1205 and 1206, or as may be authorized by law.
    4. Law enforcement: VA may disclose on its own initiative any 
information in this system, except the names and home addresses of 
veterans and their dependents, which is relevant to a suspected or 
reasonably imminent violation of law, whether civil, criminal or 
regulatory in nature and whether arising by general or program statute 
or by regulation, rule or order issued pursuant thereto, to a Federal, 
State, local, tribal, or foreign agency charged with the responsibility 
of investigating or prosecuting such violation, or charged with 
enforcing or implementing the statute, regulation, rule or order. On 
its own initiative, VA may also disclose the names and addresses of 
veterans and their dependents to a Federal agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto.
    5. Credit risk analysis and services: VA may, on its own 
initiative, disclose any information or records to appropriate 
agencies, entities, and persons when (1) VA suspects or has confirmed 
that the integrity or confidentiality of information in the system of 
records has been compromised; (2) the Department has determined that as 
a result of the suspected or confirmed compromise there is a risk of 
embarrassment or harm to the reputations of the record subjects, harm 
to economic or property interests, identity theft or fraud, or harm to 
the security, confidentiality, or integrity of this system or other 
systems or programs (whether maintained by the Department or another 
agency or entity) that rely upon the potentially compromised 
information; and (3) the disclosure is to agencies, entities, or 
persons whom VA determines are reasonably necessary to assist or carry 
out the Department's efforts to respond to the suspected or confirmed 
compromise and prevent, minimize, or remedy such harm. This routine use 
permits disclosures by the Department to respond to a suspected or 
confirmed data breach, including the conduct of any risk analysis or 
provision of credit protection services as provided in 38 U.S.C. 5724, 
as the terms are defined in 38 U.S.C. 5727.
    The Office of Management of Budget (OMB) recommended the inclusion 
of a routine use in all Privacy Act systems of records to allow for the 
appropriate mitigation of data breaches.
    6. Litigation: VA may disclose information in this system of 
records to the Department of Justice (DoJ), either on VA's initiative 
or in response to DoJ's request for the information, after either VA or 
DoJ determines that such information is relevant to DoJ's 
representation of the United States or any of its components in legal 
proceedings before a court or adjudicative body, provided that, in each 
case, the agency also determines prior to disclosure that disclosure of 
the records to the Department of Justice is a use of the information 
contained in the records that is compatible with the purpose for which 
VA collected the records. VA, on its own initiative, may disclose 
records in this system of

[[Page 27439]]

records in legal proceedings before a court or administrative body 
after determining that the disclosure of the records to the court or 
administrative body is a use of the information contained in the 
records that is compatible with the purpose for which VA collected the 
records.
    7. Congressional Offices: Disclosure may be made to a congressional 
office from the record of an individual in response to an inquiry from 
the congressional office made at the request of that individual. The 
constituent should sign a release of information statement for this 
purpose.
    Individuals sometimes request the help of a Member of Congress in 
resolving some issues relating to a matter before VA. The Member of 
Congress then writes VA, and VA must be able to give sufficient 
information to be responsive to the inquiry. That response may include 
communications to VA from an individual that was received through the 
IRIS.
    8. National Archives and Records Administration (NARA): Disclosure 
may be made to NARA in records management activities and inspections 
conducted under authority of title 44 United States Code.
    NARA is responsible for archiving records no longer actively used, 
but which may be appropriate for preservation. NARA is responsible, in 
general, for the physical maintenance of the Federal government's 
records. VA must be able to turn records over to this Agency in order 
to determine the proper disposition of such records.
    9. Other Federal Agencies: Disclosure to other Federal agencies may 
be made to assist such agencies in preventing and detecting possible 
fraud or abuse by individuals in their operations and programs.

III. Compatibility of the Routine Uses

    The Privacy Act permits disclosure of information about individuals 
without their consent for a routine use when the information will be 
used for a purpose that is compatible with the purpose for which the 
information is collected. In all of the routine use disclosures 
described above, either the recipient of the information will use the 
information in connection with a matter relating to one of VA's 
programs; to provide a benefit to VA; or because disclosure is required 
by law.
    The Report of Intent to Publish a New System of Records Notice and 
an advance copy of the system notice has been sent to the appropriate 
Congressional committees and to the Director of the Office of 
Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy 
Act), as amended, and guidelines issued by OMB (65 FR 77677), December 
12, 2000.

Signing Authority

    The Secretary of Veterans Affairs, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Jose D. 
Riojas, Chief of Staff, approved this document on April 24, 2015, for 
publication.

    Dated: April 28, 2015.
Kathleen M. Manwell,
VA Privacy Service, Office of Privacy and Records Management, 
Department of Veterans Affairs.
151VA005OP6

SYSTEM NAME:
    Inquiry Routing & Information System (IRIS)-VA

SYSTEM LOCATION:
    The system of records is located at Oracle's secure government 
cloud facility at Equnix Datacenter, 1905 Lunt Avenue, Elk Grove, 
Illinois 60007.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Individuals who contact VA via the VA Web site at www.va.gov or by 
contacting a VA call center including beneficiaries and other veterans, 
veterans' family members and/or their representatives, health care 
professionals, clinicians, employees and managers of small businesses, 
vendors, funeral directors, mortgage companies, realtors, home buyers, 
researchers, small business owners, veterans' service organizations, 
other Federal agencies, State and local government employees, teachers, 
and other demographic groups representing every segment of the 
population both at home and abroad.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The records include questions, complaints, suggestions, 
compliments, and/or requests for the status of claims and may also 
include name, address, phone number, email address, service or claim 
number, Social Security number, date of birth; branch of service; 
entered on active duty date and released from active duty date,

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Title 38, United States Code, Sections 501 and 7304.

PURPOSE:
    The purpose of this system of records is to receive and respond to 
questions, complaints, suggestions, compliments, and requests for the 
status of claims and other information by gathering sufficient 
information from the senders of inquiries to provide thorough, accurate 
and timely responses. The IRIS gives VA the ability to track inquiry 
traffic, measure the quality and timeliness of responses, and develop 
and post Frequently Asked Questions (FAQs) based on the analysis of 
messages received. VA management also uses the information to quantify 
contacts, analyze issues pertaining to veterans and VA's mission, and 
to measure staff performance regarding the quality and timeliness of 
responses.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 45 CFR parts 160 and 164, i.e., individually 
identifiable health information, and 38 U.S.C. 7332, i.e., medical 
treatment information related to drug abuse, alcoholism or alcohol 
abuse, sickle cell anemia or infection with the human immunodeficiency 
virus, that information cannot be disclosed under a routine use unless 
there is also specific statutory authority in 38 U.S.C. 7332 and 
regulatory authority in 45 CFR parts 160 and 164 permitting disclosure.
    1. Disclosure may be made to individuals, organizations, private or 
public agencies, or other entities or individuals with whom VA has a 
contract or agreement to perform such services as VA may deem 
practicable for the purposes of laws administered by VA, in order for 
the contractor, subcontractor, public or private agency, or other 
entity or individual with whom VA has an agreement or contract to 
perform the services of the contract or agreement. This routine use 
includes disclosures by the individual or entity performing the service 
for VA to any secondary entity or individual to perform an activity 
that is necessary for individuals, organizations, private or public 
agencies, or other entities or individuals with whom VA has a contract 
or agreement the to provide the service to VA.
    2. To disclose information to the Equal Employment Opportunity 
Commission when requested in connection with investigations of alleged 
or possible discriminatory practices, examination of Federal 
affirmative employment programs, or for other functions of the 
Commission as authorized by law or regulation.
    3. To disclose information to officials of the Merit Systems 
Protection Board, or the Office of the Special Counsel,

[[Page 27440]]

when requested in connection with appeals, special studies of the civil 
service and other merit systems, review of rules and regulations, 
investigation of alleged or possible prohibited personnel practices, 
and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as 
may be authorized by law.
    4. VA may disclose on its own initiative any information in this 
system, except the names and home addresses of veterans and their 
dependents, which is relevant to a suspected or reasonably imminent 
violation of law, whether civil, criminal or regulatory in nature and 
whether arising by general or program statute or by regulation, rule or 
order issued pursuant thereto, to a Federal, State, local, tribal, or 
foreign agency charged with the responsibility of investigating or 
prosecuting such violation, or charged with enforcing or implementing 
the statute, regulation, rule or order. On its own initiative, VA may 
also disclose the names and addresses of veterans and their dependents 
to a Federal agency charged with the responsibility of investigating or 
prosecuting civil, criminal or regulatory violations of law, or charged 
with enforcing or implementing the statute, regulation, rule or order 
issued pursuant thereto.
    5. VA may, on its own initiative, disclose any information or 
records to appropriate agencies, entities, and persons when (1) VA 
suspects or has confirmed that the integrity or confidentiality of 
information in the system of records has been compromised; (2) the 
Department has determined that as a result of the suspected or 
confirmed compromise there is a risk of embarrassment or harm to the 
reputations of the record subjects, harm to economic or property 
interests, identity theft or fraud, or harm to the security, 
confidentiality, or integrity of this system or other systems or 
programs (whether maintained by the Department or another agency or 
entity) that rely upon the potentially compromised information; and (3) 
the disclosure is to agencies, entities, or persons whom VA determines 
are reasonably necessary to assist or carry out the Department's 
efforts to respond to the suspected or confirmed compromise and 
prevent, minimize, or remedy such harm. This routine use permits 
disclosures by the Department to respond to a suspected or confirmed 
data breach, including the conduct of any risk analysis or provision of 
credit protection services as provided in 38 U.S.C. 5724, as the terms 
are defined in 38 U.S.C. 5727.
    6. VA may disclose information in this system of records to the 
Department of Justice (DoJ), either on VA's initiative or in response 
to DoJ's request for the information, after either VA or DoJ determines 
that such information is relevant to DoJ's representation of the United 
States or any of its components in legal proceedings before a court or 
adjudicative body, provided that, in each case, the agency also 
determines prior to disclosure that disclosure of the records to the 
Department of Justice is a use of the information contained in the 
records that is compatible with the purpose for which VA collected the 
records. VA, on its own initiative, may disclose records in this system 
of records in legal proceedings before a court or administrative body 
after determining that the disclosure of the records to the court or 
administrative body is a use of the information contained in the 
records that is compatible with the purpose for which VA collected the 
records.
    7. VA may disclose information to a member of Congress or a 
congressional staff member in response to an inquiry from the 
congressional office made at the request of that individual.
    8. Disclosure may be made to National Archives and Records 
Administration (NARA) in records management activities and inspections 
conducted under authority of title 44 United States Code.
    9. Disclosure may be made to other Federal agencies to assist such 
agencies in preventing and detecting possible fraud or abuse by 
individuals in their operations and programs.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    The IRIS stores electronic and archived messages on the secure IRIS 
server at the Oracle's FedRamp-approved hosting facility in Elk Grove, 
Illinois.

RETRIEVABILITY:
    All records in the IRIS are electronic only and are retrieved by 
system inquiry number, and/or name, and/or zip code, and/or email 
address, and/or Social Security number, and/or claim and/or service 
number.

SAFEGUARDS:
    The IRIS runs on a Secure Socket Layer (SSL) and on Transport Layer 
Security (TLS) and can only be accessed by authorized persons employed 
by and/or contracted to VA with the use of unique usernames and 
passwords, consistent with VA security policy.
    The server on which the IRIS software and database reside is 
located in a secure facility at Equnix Datacenter, 1905 Lunt Ave., Elk 
Grove, Illinois 60007. This facility is locked down at all times and 
has a security guard on duty at all times. Access to the computer room 
is restricted to specifically authorized VA staff or persons contracted 
to VA. In addition, these persons must have separate and authorized 
access to the IRIS server itself. All electronic data in this system 
are backed up nightly, with backups stored electronically and securely 
in the Elk Grove, Illinois location.

RETENTION AND DISPOSAL:
    Records are maintained and disposed of with records disposition 
authority approved by the Archivist of the United States.

SYSTEM MANAGER(S) AND ADDRESS:
    The IRIS system falls under the jurisdiction of the Director, 
Enterprise Web Applications Support (EWAS) 005Q3, Service Delivery and 
Engineering (SDE), Office of Information & Technology (OI&T) OI Field 
Office, 1100 1st St. NE., Room 513, Washington, DC 20002-4221.

NOTIFICATION PROCEDURES:
    A person who wishes to determine whether a record is being 
maintained in this system under his or her name or other personal 
identifier or wishes to determine the contents of such records should 
submit a written request or apply in person to Enterprise Web 
Applications Support (EWAS) 005Q3, Service Delivery and Engineering 
(SDE), Office of Information & Technology (OI&T),OI Field Office, 1100 
1st St. NE., Room 513, Washington, DC 20002-4221. Requests should 
contain full name, address and phone number of the person making this 
request.

RECORD ACCESS PROCEDURE:
    Individuals seeking information regarding access to and amendment 
of records in this system may write, call or visit Enterprise Web 
Applications Support (EWAS)005Q3, Service Delivery and Engineering 
(SDE), Office of Information & Technology (OI&T), OI Field Office, 1100 
1st St. NE., Room 513, Washington, DC 20002-4221. Requests should 
contain full name, address and phone number of the person making this 
request.

CONTESTING RECORD PROCEDURES:
    (See Record Access Procedure above)

RECORD SOURCE CATEGORIES:
    Individuals who contact VA via the VA Web site at www.va.gov or by 
using a VA call center include veterans, veterans' family members and/
or their

[[Page 27441]]

representatives, government employees (Federal, State and local), 
realtors and home buyers, small business owners, vendors, funeral 
directors, clinicians, teachers, researchers, employees of veterans' 
service organizations, member of the public and all other individuals 
and representatives of organizations.

RECORD SOURCE CATEGORIES:
    Information contained in this system of records is provided by 
Veterans, beneficiaries, family members, and all other persons doing 
business with VA using Contact VA on department Web sites and utilizing 
800 toll free numbers to reach VA call centers, regional offices, 
medical centers and other VA entities.

[FR Doc. 2015-11493 Filed 5-12-15; 8:45 am]
 BILLING CODE 8320-01-P