Privacy Act of 1974; System of Records, 7401-7404 [2020-02479]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 85, Number 26 (Friday, February 7, 2020)]
[Notices]
[Pages 7401-7404]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-02479]



[[Page 7401]]

-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Department of Veterans Affairs (VA).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: As required by the Privacy Act of 1974, notice is hereby given 
that the Department of Veterans Affairs (VA) is amending the system of 
records entitled, ``Spinal Cord Injury and Disorders Outcomes-
Repository (SCIDO-R)-VA'' (108VA11S) as set forth in 77 FR 22632. VA is 
amending the system of records by revising the System Name; System 
Number; System Location; Purpose of the System; Categories of 
Individuals Covered by the System; Categories of Records in the System; 
Record Source Categories; Routine Uses of Records Maintained in the 
System; Policies and Practices for Retention and Disposal of Records; 
Administrative, Technical, and Physical Safeguards; and Record Accord 
Procedure. VA is republishing the system notice in its entirety.

DATES: Comments on this amended system of records must be received no 
later than March 9, 2020. If no public comment is received during the 
period allowed for comment or unless otherwise published in the Federal 
Register by VA, the amended system will become effective March 9, 2020.

ADDRESSES: Written comments may be submitted through 
www.Regulations.gov; by mail or hand-delivery to Director, Regulation 
Policy and Management (00REG), Department of Veterans Affairs, 810 
Vermont Avenue NW, Room 1064, Washington, DC 20420; or by fax to (202) 
273-9026 (not a toll-free number). Comments should indicate that they 
are submitted in response to ``Spinal Cord Injury and Disorders 
Outcomes-Repository (SCIDO-R)-VA''. Copies of comments received will be 
available for public inspection in the Office of Regulation Policy and 
Management, Room 1063B, between the hours of 8:00 a.m. and 4:30 p.m., 
Monday through Friday (except holidays). Please call (202) 461-4902 for 
an appointment. (This is not a toll-free number.) In addition, comments 
may be viewed online at www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT: Veterans Health Administration Privacy 
Act Officer, Department of Veterans Affairs, 810 Vermont Avenue NW, 
Washington, DC 20420; telephone (704) 245-2492. (This is not a toll-
free number.)

SUPPLEMENTARY INFORMATION: The System Name is being changed from 
``Spinal Cord Injury and Disorders Outcomes-Repository (SCIDO-R)-VA'' 
to ``Spinal Cord Injuries and Disorders (SCI/D) Registry and Outcomes 
Program-VA''.
    The System Number is being changed from 108VA11S to 108VA10NC9 to 
reflect the current organizational alignment.
    The System Location has been amended to remove paper records being 
maintained at the VA Austin Information Technology Center (AITC). Being 
removed, ``Address locations for VA facilities are listed in VA 
Appendix 1 of the biennial publication of VA Privacy Act Issuances'' 
and replaced with ``Address locations for VA facilities may be found at 
https://www.va.gov/directory/guide/home.asp.'' Also, SCIDO application 
and the VA databases housed at the AITC are being replaced with data 
transmissions occurring between the local Spinal Cord Injuries (SCI) 
Centers and the VA SCI/D National Program Office.
    The Purpose of the System is being amended to replace the SCIDO 
Registry with Spinal Cord Injuries and Disorders (SCI/D) Registry and 
Outcomes Program. The Regional SCIDO Repositories are being replaced 
with the local SCI/D Centers.
    The Categories of Individuals Covered by the System and The 
Categories of Records in the System are being amended to change Spinal 
Cord Injury and Disorders Outcomes (SCIDO) Repository to Spinal Cord 
Injuries and Disorders (SCI/D) Registry and Outcomes Program.
    The Record Source Categories are being amended to replace 24VA19 
with 24VA10P2.
    The Routine Uses of Records Maintained in the System is amending 
the language in Routine Use #11 which states that disclosure of the 
records to the DoJ is a use of the information contained in the records 
that is compatible with the purpose for which VA collected the records. 
VA may disclose records in this system of records in legal proceedings 
before a court or administrative body after determining that the 
disclosure of the records to the court or administrative body is a use 
of the information contained in the records that is compatible with the 
purpose for which VA collected the records. This routine use will now 
state that release of the records to the DoJ is limited to 
circumstances where relevant and necessary to the litigation. VA may 
disclose records in this system of records in legal proceedings before 
a court or administrative body after determining that release of the 
records to the court or administrative body is limited to circumstances 
where relevant and necessary to the litigation.
    Routine Use #13 is being amended by clarifying the language to 
state, ``VA may disclose any information or records to appropriate 
agencies, entities, and persons when (1) VA suspects or has confirmed 
that there has been a breach of the system of records; (2) VA has 
determined that as a result of the suspected or confirmed breach there 
is a risk to individuals, VA (including its information systems, 
programs, and operations), the Federal Government, or national 
security; and (3) the disclosure made to such agencies, entities, or 
persons is reasonably necessary to assist in connection with VA efforts 
to respond to the suspected or confirmed breach or to prevent, 
minimize, or remedy such harm.''
    Routine use #16 is being added to state, ``VA may disclose 
information from this system to another Federal agency or Federal 
entity, when VA determines that information from this system of records 
is reasonably necessary to assist the recipient agency or entity in (1) 
responding to a suspected or confirmed breach or (2) preventing, 
minimizing, or remedying the risk of harm to individuals, the recipient 
agency or entity (including its information systems, programs, and 
operations), the Federal Government, or national security, resulting 
from a suspected or confirmed breach.'' VA needs this routine use for 
the data breach response and remedial efforts with another Federal 
agency.
    The Policies and Practices for Retention and Disposal of Records is 
being amended to remove, ``Records will be maintained and disposed of 
in accordance with record disposition authority approved by the 
Archivist of the United States. Depending on the record medium, records 
are destroyed by either shredding or degaussing. Optical disks or other 
electronic media are deleted when no longer required for official 
duties.'' VA has submitted a request for records disposition authority 
to the National Archives and Records Administration (NARA) for 
approval. Upon approval by NARA, VA will publish an amendment to this 
System of Records. In the interim, no records will be destroyed. This 
section will now state that ``Records are under the following records 
schedule; Record Control Schedule (RCS) 10-1 item 6270. Master Files 
within a centralized database; Temporary; cutoff at the last unique 
patient entry or the death of a particular patient. Delete 75 years 
after

[[Page 7402]]

cutoff. (N1-015-05-1, Item 1). Local Files (SCI centers and clinics); 
Temporary; delete when replaced by a subsequent file or 75 years after 
date of last activity for a particular patient. (N1-015-05-1, Item 2). 
Backup Files; Temporary; delete when master files have been deleted or 
replaced with a subsequent backup file. (N1-015-05-1, Item 3).
    The Administrative, Technical, and Physical Safeguards are being 
amended to 1. Add the SCI/D National Program Office protected network 
folders. Also, added the use of Computerized Patient Record System 
(CPRS) security modules. 2. AITC is being replaced with the National 
Program Office.
    The Record Access Procedure is amended to include the Program 
Office in which requests for services were made.
    The Report of Intent to Amend a System of Records Notice and an 
advance copy of the system notice have been sent to the appropriate 
Congressional committees and to the Director of Office of Management 
and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and 
guidelines issued by OMB (65 FR 77677), December 12, 2000.
    Signing Authority: The Senior Agency Official for Privacy, or 
designee, approved this document and authorized the undersigned to sign 
and submit the document to the Office of the Federal Register for 
publication electronically as an official document of the Department of 
Veterans Affairs. James P. Gfrerer, Assistant Secretary for Information 
and Technology and Chief Information Officer, Department of Veterans 
Affairs, approved this document on November 25, 2019 for publication.

    Dated: February 4, 2020.
Amy L. Rose,
Program Analyst, VA Privacy Service, Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:
    ``Spinal Cord Injuries and Disorders (SCI/D) Registry and Outcomes 
Program-VA'' (108VA10NC9)

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    All electronic records are maintained at the Austin Information 
Technology Center (AITC), Department of Veterans Affairs (VA), 1615 
Woodward Street, Austin, Texas 78772, and address locations for VA 
facilities may be found at https://www.va.gov/directory/guide/home.asp. 
Each Spinal Cord Injury Center has a Spinal Cord Injury and Disorders 
Outcome (SCIDO) application deployment. Data transmissions occur 
between the local Spinal Cord Injury (SCI) Centers and the VA Spinal 
Cord Injuries and Disorders (SCI/D) National Program Office databases 
housed in the Department's wide area network.

SYSTEM MANAGER(S):
    Official responsible for Spinal Cord Injury and Disorders 
Outcomes--Repository (SCIDO-R) design, development, and maintenance: 
SCIDO Program Specialist (128N), 1660 South Columbian Way, Seattle, 
Washington 98108.
    Official responsible for policies and procedures: Chief Consultant, 
Spinal Cord Injury and Disorders Services (128N), 1660 South Columbian 
Way, Seattle, Washington 98108.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Title 38, United States Code (U.S.C.), Section 501 and 7304.

PURPOSE(S) OF THE SYSTEM:
    The SCI/D Registry and Outcomes Program provides a registry of 
Veterans with SCI/D. This registry contains pertinent information on 
Veterans with SCI/D and enables better coordination of care among 
Veterans Health Administration (VHA) staff. The purpose of the SCI/D 
Registry and Outcomes Program is to assist clinicians, administrators, 
and researchers in identifying and tracking services for Veterans with 
spinal cord dysfunction resulting from trauma or diseases. The SCI/D 
Registry and Outcomes Program can also facilitate clinical, 
administrative, and research reports for medical center use. Local SCI/
D Centers provide data extracts to the SCI/D National Program Office 
which then uses the data to provide a VA-wide review of Veteran 
demographics and clinical aspects of injuries and disorders.

CATEGORIES OF INDIVIDUALS COVERED BY THIS SYSTEM:
    Veterans identified with SCI/D that have applied for VA healthcare 
services are included in the system. Occasionally, non-Veterans who 
have received VA healthcare or rehabilitation services under sharing 
agreements, contracted care, or humanitarian emergencies will also have 
information recorded in the SCI/D Registry and Outcomes Program.

CATEGORIES OF RECORDS IN THE SYSTEM:
    These records contain identifying information including name, 
social security number, date of birth, and registration date in the 
SCI/D Registry and Outcomes Program. Registration information may 
include information about whether individuals are receiving services 
from VA's spinal cord system of care, neurologic level of injury, 
etiology, date of onset, type of cause, completeness of injury, and 
annual evaluation dates offered and received. The SCI/D Registry and 
Outcomes Program also stores outcome measures of impairment, activity, 
social role participation, and satisfaction with life. A registrant may 
have multiple outcome entries.

RECORD SOURCE CATEGORIES:
    Various automated record systems providing clinical and managerial 
support to VA healthcare facilities, the Veteran, family members, 
accredited representatives or friends, and ``Patient Medical Records--
VA'' (24VA10P2) system of records.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 45 CFR parts 160 and 164, i.e., individually-
identifiable health information, and 38 U.S.C. 7332; i.e., medical 
treatment information related to drug abuse, alcoholism or alcohol 
abuse, sickle cell anemia or infection with the human immunodeficiency 
virus, that information cannot be disclosed under a routine use unless 
there is also specific statutory authority in 38 U.S.C. 7332 and 
regulatory authority in 45 CFR parts 160 and 164 permitting disclosure.
    1. The record of an individual who is covered by a system of 
records may be disclosed to a Member of Congress, or a staff person 
acting for the Member, when the Member or staff person requests the 
record on behalf of and at the written request of the individual.
    2. Disclosure of records covered by this system, as deemed 
necessary and proper to named individuals serving as accredited 
Veterans service organization representatives, and other individuals 
named as approved agents or attorneys for a documented purpose and 
period of time. These agents/attorneys must be aiding beneficiaries in 
the preparation/presentation of their cases during verification and/or 
due process procedures or in the presentation/prosecution of claims 
under laws administered by VA.
    3. A record containing the name(s) and address(es) of present or 
former members of the armed services and/or their dependents may be 
released from this system of records under certain circumstances:
    a. To any nonprofit organization if the release is directly 
connected with the conduct of programs and the utilization of benefits 
under Title 38, and

[[Page 7403]]

    b. To any criminal or civil law enforcement governmental agency or 
instrumentality charged under applicable law with the protection of the 
public health or safety if a qualified representative of such 
organization, agency or instrumentality has made a written request that 
such name(s) or address(es) be provided for a purpose authorized by 
law; provided, further, that the record(s) will not be used for any 
purpose other than that stated in the request and that the 
organization, agency or instrumentality is aware of the penalty 
provision of 38 U.S.C. 5701(f).
    4. Disclosure may be made to the National Archives and Records 
Administration and the General Services Administration in records 
management inspections conducted under authority of Title 44, Chapter 
29, of the United States Code.
    5. Disclosure of information, excluding name and address (unless 
name and address is furnished by the requester) for research purposes 
determined to be necessary and proper, to epidemiological and other 
research facilities approved by the Under Secretary for Health.
    6. In order to conduct Federal research necessary to accomplish a 
statutory purpose of an agency, at the written request of the head of 
the agency, or designee of the head of that agency, the name(s) and 
address(es) of present or former personnel or the armed services and/or 
their dependents may be disclosed;
    a. To a Federal department or agency; or
    b. Directly to a contractor of a Federal department or agency. When 
a disclosure of this information is to be made directly to the 
contractor, VA may impose applicable conditions on the department, 
agency, and/or contractor to ensure the appropriateness of the 
disclosure to the contractor.
    7. VA may disclose any information in this system, except the names 
and home addresses of Veterans and their dependents, that is relevant 
to a suspected or reasonably imminent violation of law, whether civil, 
criminal, or regulatory in nature and whether arising by general or 
program statute or by regulation, rule or order issued pursuant 
thereto, to a Federal, state, local, tribal, or foreign agency charged 
with the responsibility of investigating or prosecuting such violation, 
or charged with enforcing or implementing the statute, regulation, 
rule, or order. VA may also disclose the names and addresses of 
Veterans and their dependents to a Federal agency charged with the 
responsibility of investigating or prosecuting civil, criminal, or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule, or order issued pursuant thereto.
    8. For program review purposes and the seeking of accreditation 
and/or certification, disclosure may be made to survey teams of the 
Rehabilitation Accreditation Commission, The Joint Commission, College 
of American Pathologists, American Association of Blood Banks, and 
similar national accreditation agencies or boards with whom VA has a 
contract or agreement to conduct such reviews, but only to the extent 
that the information is necessary and relevant to the review.
    9. Records from this system of records may be disclosed in a 
proceeding before a court, adjudicative body, or other administrative 
body when the Department, or any Department component or employee (in 
his or her official capacity as a VA employee), is a party to 
litigation; when the Department determines that litigation is likely to 
affect the Department, any of its components or employees, or the 
United States has an interest in the litigation, and such records are 
deemed to be relevant and necessary to the legal proceedings; provided, 
however, that the disclosure is compatible with the purpose for which 
the records were collected.
    10. Disclosure may be made to individuals, organizations, private 
or public agencies, or other entities or individuals with whom VA has a 
contract or agreement to perform such services as VA may deem 
practicable for the purposes of laws administered by VA, in order for 
the contractor, subcontractor, public or private agency, or other 
entity or individual with whom VA has an agreement or contract to 
perform the services of the contract or agreement.
    11. VA may disclose information in this system of records to the 
Department of Justice (DoJ), either on VA's initiative or in response 
to DoJ's request for the information, after either VA or DoJ determines 
that such information is relevant to DoJ's representation of the United 
States or any of its components in legal proceedings before a court or 
adjudicative body, provided that, in each case, the agency also 
determines prior to disclosure that release of the records to the DoJ 
is limited to circumstances where relevant and necessary to the 
litigation. VA may disclose records in this system of records in legal 
proceedings before a court or administrative body after determining 
that release of the records to the court or administrative body is 
limited to circumstances where relevant and necessary to the 
litigation.
    12. Disclosure to other Federal agencies may be made to assist such 
agencies in preventing and detecting possible fraud or abuse by 
individuals in their operations and programs.
    13. VA may disclose any information or records to appropriate 
agencies, entities, and persons when (1) VA suspects or has confirmed 
that there has been a breach of the system of records; (2) VA has 
determined that as a result of the suspected or confirmed breach there 
is a risk to individuals, VA (including its information systems, 
programs, and operations), the Federal Government, or national 
security; and (3) the disclosure made to such agencies, entities, or 
persons is reasonably necessary to assist in connection with VA efforts 
to respond to the suspected or confirmed breach or to prevent, 
minimize, or remedy such harm.
    14. VA may disclose identifying information, including social 
security number, concerning Veterans, spouses of Veterans, and the 
beneficiaries of Veterans to other Federal agencies for the purpose of 
conducting computer matches to obtain information to determine or 
verify eligibility of Veterans receiving VA medical care under Title 
38, U.S.C.
    15. VA may disclose patient identifying information to Federal 
agencies and VA and government-wide third-party insurers responsible 
for payment of the cost of medical care for the identified patients, in 
order for VA to seek recovery of the medical care costs. These records 
may also be disclosed as part of a computer matching program to 
accomplish this purpose.
    16. VA may disclose information from this system to another Federal 
agency or Federal entity, when VA determines that information from this 
system of records is reasonably necessary to assist the recipient 
agency or entity in (1) responding to a suspected or confirmed breach 
or (2) preventing, minimizing, or remedying the risk of harm to 
individuals, the recipient agency or entity (including its information 
systems, programs, and operations), the Federal Government, or national 
security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Magnetic tapes/disks and optical discs. Electronic data are 
maintained on Direct Access Storage Devices at the AITC. The AITC 
stores registry tapes for disaster backup at a secure, off-site

[[Page 7404]]

location. Electronic backup files for the regional SCI/D applications 
are stored at the Regional Data Processing Center (RDPC1) at Denver, 
Colorado also for disaster backup at a secure, off-site location.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records are indexed by name of Veteran, social security number, 
unique patient identifiers.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records are under the following records schedule; Record Control 
Schedule (RCS) 10-1 item 6270. Master Files within a centralized 
database; Temporary; cutoff at the last unique patient entry or the 
death of a particular patient. Delete 75 years after cutoff. (N1-015-
05-1, Item 1). Local Files (SCI centers and clinics); Temporary; delete 
when replaced by a subsequent file or 75 years after date of last 
activity for a particular patient. (N1-015-05-1, Item 2). Backup Files; 
Temporary; delete when master files have been deleted or replaced with 
a subsequent backup file. (N1-015-05-1, Item 3).

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    1. Data transmissions between VA healthcare facilities and the VA 
SCI/D National Program Office protected network folders. The SCI/D-
Repository program and other programs at the respective facilities 
automatically flag records or events for transmission based upon 
functionality requirements. VA healthcare facilities control access to 
data by using VHA's VistA and Computerized Patient Record System (CPRS) 
security modules. The Department's Telecommunications Support Service 
has oversight responsibility for planning, security, and management of 
the wide area network.
    2. Access to records at VA healthcare facilities is only authorized 
to VA personnel on a ``need-to-know'' basis. Records are maintained in 
staffed rooms during working hours. During nonworking hours, there is 
limited access to the building with visitor control by security 
personnel. Access to the National Program Office staff is generally 
restricted to SCI/D staff, VA Central Office employees, custodial 
personnel, Federal Protective Service, and authorized operational 
personnel through electronic locking devices. All other persons gaining 
access to the computer rooms are escorted. Backup records stored off-
site for both the National Program Office and VA Central Office are 
safeguarded in secured storage areas.
    3. Strict control measures are enforced to ensure that access to 
and disclosure from all records including electronic files and Veteran-
specific data elements are limited to VHA employees whose official 
duties warrant access to those files. The automated record system 
recognizes authorized users by keyboard entry of unique passwords, 
access, and verify codes.

RECORD ACCESS PROCEDURE:
    An individual who seeks access to records maintained under his or 
her name may write or visit the Program Office in which requests for 
services were made, the nearest VA facility, or write to the Chief 
Consultant, Spinal Cord Injury and Disorders Services (128N), 1660 
South Columbian Way, Seattle, Washington 98108.

CONTESTING RECORD PROCEDURES:
    (See Record Access procedures above).

NOTIFICATION PROCEDURE:
    An individual who wishes to determine whether a record is being 
maintained in this system under his or her name or other personal 
identifier, or wants to determine the contents of such record, should 
submit a written request or apply in person to the last VA facility 
where medical care was provided or submit a written request to the 
Chief Consultant, Spinal Cord Injury and Disorders Services (128N), 
1660 South Columbian Way, Seattle, Washington 98108. Inquiries should 
include the Veteran's name, social security number, and return address.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    Last full publication provided in 77 FR 73 dated April 16, 2012.

[FR Doc. 2020-02479 Filed 2-6-20; 8:45 am]
BILLING CODE 8320-01-P