Privacy Act of 1974; System of Records, 18588-18593 [2021-07310]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 86, Number 67 (Friday, April 9, 2021)]
[Notices]
[Pages 18588-18593]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-07310]


-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Department of Veterans Affairs (VA), Veterans Health 
Administration (VHA).

ACTION: Notice of a new system of records.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974 requires that all agencies publish in 
the Federal Register a notice of the existence and character of their 
systems of records. Notice is hereby given that the Department of 
Veterans Affairs (VA) is establishing a new system of records entitled, 
``Caregiver Support Program--

[[Page 18589]]

Caregiver Record Management Application (CARMA)--VA'' (197VA10) 
formerly included and described in the ``Enrollment and Eligibility 
Records-VA'' (147VA10NF1) last amended in the Federal Register on July 
14, 2016.

DATES: Comments on this new system of records must be received no later 
than May 10, 2021. If no public comment is received during the period 
allowed for comment or unless otherwise published in the Federal 
Register by VA, the new system of records will become effective a 
minimum of 30 days after date of publication in the Federal Register. 
If VA receives public comments, VA shall review the comments to 
determine whether any changes to the notice are necessary.

ADDRESSES: Comments may be submitted through www.Regulations.gov or 
mailed to VA Privacy Service, 810 Vermont Avenue NW, (005R1A), 
Washington, DC 20420. Comments should indicate that they are submitted 
in response to ``Caregiver Support Program--Caregiver Record Management 
Application (CARMA)--VA'' (197VA10). Comments received will be 
available at regulations.gov for public viewing, inspection or copies.

FOR FURTHER INFORMATION CONTACT: Stephania Griffin, Veterans Health 
Administration (VHA) Privacy Officer, Department of Veterans Affairs, 
810 Vermont Avenue NW, Washington, DC 20420; telephone (704) 245-2492 
(Note: Not a toll-free number).

SUPPLEMENTARY INFORMATION:

I. Description of Proposed Systems of Records

    Information in this system of records is used to establish and 
maintain records of individuals applying for, participating in, and 
those who have previously applied for or participated in the Program of 
Comprehensive Assistance for Family Caregivers (PCAFC), as well as 
individuals interested in participating, those who have previously 
participated in the Program of General Caregiver Support Services 
(PGCSS), and callers to the Caregiver Support Line (CSL). Information 
is maintained in the Caregiver Record Management Application (CARMA). 
CARMA is a workflow management system that supports the administration 
and oversight of the PCAFC, PGCSS and CSL to include documentation of 
the PCAFC application workflow, tracking of initial and ongoing 
eligibility for PCAFC and PGCSS, ongoing assessment and monitoring, 
automation of the PCAFC stipend payment process, and supports needs/
record of calls to the VA's CSL. This system of records will also be 
used for data matching with other VA and external systems to support 
initial and continued eligibility determinations for services available 
through PGCSS and PCAFC. This matching includes CARMA direct or 
indirect interface with multiple systems to provide comprehensive 
matching of key data and resources to include (but not limited to) the 
Enrollment System, Identity Access Management, Incarceration data/data 
matching with state and Federal Agencies (via Veterans Benefit 
Administration), My HealtheVet, VA.Gov, Beneficiary Travel, VHA 
Corporate Data Warehouse, VBA Corporate Warehouse, and other similar 
interfaces/matches with systems to support initial and continued 
eligibility determination for services.
    Public Law 111-163, the Caregivers and Veterans Omnibus Health 
Services Act of 2010, established 38 U.S.C. 1720G, directed VA to 
establish a Program of Comprehensive Assistance for Family Caregivers 
of eligible Veterans, and a Program of General Caregiver Support 
Services for caregivers of Veterans who are enrolled in the health care 
system established under 38 U.S.C. 1705(a) (including caregivers who do 
not reside with such Veterans). These two programs are collectively 
referred to as the Caregiver Support Program (CSP). Caregivers of 
Veterans participating in these programs are eligible to receive 
certain benefits. Caregivers of eligible Veterans participating in the 
PGCSS are eligible for Education, Training and Technical Support to 
include the use of telehealth, respite care and counseling. Through 
PCAFC, Family Caregivers have access to these same services and also 
may receive enhanced respite care, mental health care, and travel, 
lodging, and subsistence (to attend required caregiver training and 
Veteran medical appointments). In addition, PCAFC provides designated 
primary family caregivers of eligible Veterans with a monthly stipend 
payment and access to health care services through the Civilian Health 
and Medical Program of the Department of Veterans Affairs (CHAMPVA) for 
those not entitled to care of services under a health plan contract. VA 
has also established a Caregiver Support Line based in Canandaigua, NY 
to provide resources and referrals to callers regarding caregiver 
supports. Callers to the CSL include caregivers of Veterans, Veterans, 
and those with an interest in supporting Veterans and caregivers.
    VA MISSION Act of 2018 amended 38 U.S.C. 1720G by expanding 
eligibility for PCAFC, establishing new benefits for designated Primary 
Family Caregivers of eligible Veterans, and making other changes 
affecting program eligibility and VA's evaluation of PCAFC 
applications. Section 162 directs VA to implement an information 
technology system that fully supports the Program and allows for data 
assessment and comprehensive monitoring. This technology system is the 
Caregiver Record Management Application, otherwise known as CARMA.

II. Proposed Routine Use Disclosures of Data in the System

    We are proposing to establish the following Routine Use disclosures 
of information maintained in the system.
    1. VA may disclose information from this system of records relevant 
to a claim of a Veteran or beneficiary, such as the name, address, the 
basis and nature of a claim, amount of benefit payment information, 
medical information, and military service and active duty separation 
information, at the request of the claimant to accredited service 
organizations, VA-approved claim agents, and attorneys acting under a 
declaration of representation, so that these individuals can aid 
claimants in the preparation, presentation, and prosecution of claims 
under the laws administered by VA. The name and address of a claimant 
will not, however, be disclosed to these individuals under this routine 
use if the claimant has not requested the assistance of an accredited 
service organization, claims agent or an attorney.
    VA must be able to disclose this information to accredited service 
organizations, VA-approved claim agents, and attorneys representing 
Veterans so they can assist Veterans by preparing, presenting, and 
prosecuting claims under the laws administered by VA.
    2. VA may disclose any information in this system, except the names 
and home addresses of Veterans and their dependents, which is relevant 
to a suspected or reasonably imminent violation of law, whether civil, 
criminal or regulatory in nature and whether arising by general or 
program statute or by regulation, rule or order issued pursuant 
thereto, to a Federal, state, local, tribal, or foreign agency charged 
with the responsibility of investigating or prosecuting such violation, 
or charged with enforcing or implementing the statute, regulation, rule 
or order. VA may also disclose the names and addresses of Veterans and 
their dependents to a Federal agency charged with the responsibility of 
investigating or prosecuting civil, criminal or regulatory violations 
of law, or charged

[[Page 18590]]

with enforcing or implementing the statute, regulation, rule or order 
issued pursuant thereto.
    VA must be able to provide information that pertains to a violation 
of laws to law enforcement authorities in order for them to investigate 
and enforce those laws. Under 38 U.S.C. 5701(a) and (f), VA may 
disclose the names and addresses of Veterans and their dependents to 
Federal entities with law enforcement responsibilities. This is 
distinct from the authority to disclose records in response to a 
qualifying request from a law enforcement entity, as authorized by 
Privacy Act subsection 5 U.S.C. 552a(b)(7).
    3. VA may disclose information from this system of records in the 
course of presenting evidence to a court, magistrate, or administrative 
tribunal; in matters of guardianship, inquests, and commitments; to 
private attorneys representing Veterans rated incompetent in 
conjunction with issuance of Certificates of Incompetency; and to 
probation and parole officers in connection with court-required duties.
    4. VA may disclose information to a fiduciary or guardian ad litem 
in relation to his or her representation of a claimant in any legal 
proceeding, but only to the extent necessary to fulfill the duties of 
the fiduciary or the guardian ad litem.
    This disclosure permits VA to provide individual information to an 
appointed VA Federal fiduciary or to the individual's guardian ad litem 
that is needed to fulfill appointed duties.
    5. VA may disclose any relevant information from this system of 
records to attorneys, insurance companies, employers, third parties 
liable or potentially liable under health plan contracts, and to 
courts, boards, or commissions, but only to the extent necessary to aid 
VA in the preparation, presentation, and prosecution of claims 
authorized under Federal, state, or local laws, and regulations 
promulgated thereunder.
    VA must be able to furnish information to attorneys, insurance 
companies, employers, and to courts, boards, or commissions where the 
disclosure is necessary to provide aid to VA in the preparation, 
presentation, and prosecution of claims of Veterans and their 
beneficiaries.
    6. VA may disclose information from this system of records to the 
Department of Justice (DoJ), either on VA's initiative or in response 
to DoJ's request for the information, after either VA or DoJ determines 
that such information is relevant to DoJ's representation of the United 
States or any of its components in legal proceedings before a court or 
adjudicative body, provided that, in each case, the agency also 
determines prior to disclosure that release of the records to the DoJ 
is limited to circumstances where relevant and necessary to the 
litigation. VA may disclose records in this system of records in legal 
proceedings before a court or administrative body after determining 
that release of the records to the DoJ is limited to circumstances 
where relevant and necessary to the litigation.
    To determine whether to disclose records under this routine use, VA 
will comply with the guidance promulgated by the Office of Management 
and Budget in a May 24, 1985, memorandum entitled ``Privacy Act 
Guidance--Update,'' currently posted at https://www.whitehouse.gove/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/guidance1985.pdf.
    VA must be able to provide information to DoJ in litigation where 
the United States or any of its components is involved or has an 
interest. A determination would be made in each instance that under the 
circumstances involved, the purpose is compatible with the purpose for 
which VA collected the information. This routine use is distinct from 
the authority to disclose records in response to a court order under 
subsection (b)(11) of the Privacy Act, 5 U.S.C. 552(b)(11), or any 
other provision of subsection (b), in accordance with the court's 
analysis in Doe v. DiGenova, 779 F.2d 74, 78-85 (D.C. Cir. 1985) and 
Doe v. Stephens, 851 F.2d 1457, 1465-67 (D.C. Cir. 1988).
    7. VA may disclose information from this system to National 
Archives and Records Administration (NARA) in records management 
inspections conducted under Title 44 U.S.C.
    8. VA may disclose the name of a Veteran or beneficiary, other 
information as is reasonably necessary to identify such individual, and 
any other information concerning the individual's indebtedness by 
virtue of a person's participation in any benefits program administered 
by VA, may be disclosed to the Department of Treasury, Internal Revenue 
Service, for the collection of Title 38 benefit overpayments, overdue 
indebtedness, and/or costs of services provided to an individual not 
entitled to such services, by the withholding of al or portion of the 
person's Federal income tax refund. The purpose of this disclosure is 
to collect a debt owed the VA by an individual by offset of his or her 
Federal income tax refund.
    9. VA may disclose the name and address of a Veteran or 
beneficiary, and other information as is reasonably necessary to 
identify such individual or concerning that individual's indebtedness 
to the United States by virtue of the person's participation in a 
benefits program administered by Department, to a consumer reporting 
agency for the purpose of locating the individual, obtaining a consumer 
report to determine the ability of the individual to repay an 
indebtedness to the United States, or assisting in the collection of 
such indebtedness, provided that the provisions of 38 U.S.C. 
57019(g)(2) and (4) have been met.
    The purpose of this information disclosure to a consumer-reporting 
agency is to assist VA in locating an individual, obtaining a consumer 
report to determine his or her ability to repay indebtedness, and to 
collect indebtedness.
    10. VA may disclose information from this system of records to 
individuals, organizations, private or public agencies, or other 
entities or individuals with whom VA has a contract or agreement to 
perform such services as VA may deem practicable for the purposes of 
laws administered by VA, in order for the contractor, subcontractor, 
public or private agency, or other entity or individual with whom VA 
has a contract or agreement to perform services under the contract or 
agreement.
    This routine use includes disclosures by the individual or entity 
performing services for VA to any secondary entity or individual to 
perform an activity that is necessary for individuals, organizations, 
private or public agencies, or other entities or individuals with whom 
VA has a contract or agreement to provide the service to VA.
    This routine use, which also applies to agreements that do not 
qualify as contracts defined by Federal procurement laws and 
regulations, is consistent with OMB guidance in OMB Circular A-130, 
App. I, paragraph 5a(1)(b) that agencies promulgate routine uses to 
address disclosure of Privacy Act-protected information to contractors 
in order to perform the services contracts for the agency.
    11. VA may disclose information from the record of an individual in 
response to an inquiry from the congressional office made at the 
request of that individual.
    VA must be able to provide information about individuals to 
adequately respond to inquiries from Members of Congress at the request 
of constituents who have sought their assistance.

[[Page 18591]]

    12. Disclosure to other Federal agencies may be made to assist such 
agencies in preventing and detecting possible fraud or abuse by 
individuals in their operations and programs.
    This routine use permits disclosures by the Department to report a 
suspected incident of identity theft and provide information and/or 
documentation related to or in support of the reported incident.
    13. VA may disclose information from this system to appropriate 
agencies, entities, and persons when (1) VA suspects or has confirmed 
that there has been a breach of the system of records; (2) VA has 
determined that as a result of the suspected or confirmed breach there 
is a risk of harm to individuals, VA (including its information 
systems, programs, and operations), the Federal Government, or national 
security; and (3) the disclosure made to such agencies, entities, and 
persons is reasonably necessary to assist in connection with VA's 
efforts to respond to the suspected or confirmed breach or to prevent, 
minimize, or remedy such harm.
    14. VA may disclose identifying information, including social 
security number, concerning Veterans, spouses of Veterans, and the 
beneficiaries of Veterans to other Federal agencies for the purpose of 
conducting computer matches to obtain information to determine or 
verify eligibility of Veterans receiving VA medical care under Title 38 
U.S.C.
    OPP may disclose limited individual identification information to 
another Federal agency for the purpose of matching and acquiring 
information held by that agency for OPP to use for the purposes stated 
for this system of records.
    15. Data breach response and remedial efforts with another Federal 
agency: VA may disclose information from this system to another Federal 
agency or Federal entity, when VA determines that information from this 
system of records is reasonably necessary to assist the recipient 
agency or entity in (1) responding to a suspected or confirmed breach 
or (2) preventing, minimizing, or remedying the risk of harm to 
individuals, the recipient agency or entity (including its information 
systems, programs, and operations), the Federal Government, or national 
security, resulting from a suspected or confirmed breach.

III. Compatibility of the Proposed Routine Uses

    The Privacy Act permits VA to disclose information about 
individuals without their consent for a routine use when the 
information will be used for a purpose that is compatible with the 
purpose for which VA collected the information. In all of the routine 
use disclosures described above, either the recipient of the 
information will use the information in connection with a matter 
relating to one of VA's programs, to provide a benefit to VA, or to 
disclose information as required by law.
    Under section 264, Subtitle F of Title II of the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA) Public Law 104-191, 
110 Stat. 1936, 2033-34 (1996), the United States Department of Health 
and Human Services (HHS) published a final rule, as amended, 
establishing Standards for Privacy of Individually-Identifiable health 
Information, 45 CFR parts 160 and 164. VHA may not disclose 
individually identifiable health information (as defined in HIPAA and 
the Privacy Rule, 42 U.S.C. 1320(d)(6) and 45 CFR 164.501) pursuant to 
a routine use unless either: (a) The disclosure is required by law, or 
(b) the disclosure is also permitted or required by HHS' Privacy Rule. 
The disclosures of individually-identifiable health information 
contemplated in the routine uses published in this new system of 
records notice are permitted under the Privacy Rule or required by law. 
However, to also have authority to make such disclosures under the 
Privacy Act, VA must publish these routine uses. Consequently, VA is 
publishing these routine uses to the routine uses portion of the system 
of records notice stating that any disclosure pursuant to the routine 
uses in this system of records notice must be either required by law or 
permitted by the Privacy Rule, before VHA may disclose the covered 
information.
    The notice of intent to publish and an advance copy of the system 
notice have been sent to the appropriate Congressional committees and 
to the Director, Office of Management and Budget, as required by 5 
U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 
77677), December 12, 2000.

Signing Authority

    The Senior Agency Official for Privacy, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Dominic A. 
Cussatt, Acting Assistant Secretary of Information and Technology and 
Chief Information Officer, approved this document on March 2, 2021 for 
publication.

     Dated: April 6, 2021.
Amy L. Rose,
Program Analyst, VA Privacy Service, Office of Information Security, 
Office of Information and Technology, Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:
    ``Caregiver Support Program--Caregiver Record Management 
Application (CARMA)--VA'' (197VA10)

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    The Caregiver Record Management Application (CARMA) system is 
hosted in the Salesforce Gov Cloud. The Salesforce's corporate address 
is 1 Market Street #300, San Francisco, CA 94105.

SYSTEM MANAGER(S):
    Official responsible for policies and procedures: Deputy Chief 
Officer Patient Care Services Officer (10P4C), 810 Vermont Avenue NW, 
Washington, DC 20420. Telephone number (202) 461-1635 (Note: This is 
not a toll-free number).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    MISSION Act of 2018 and Improper Payments Elimination and Recovery 
Act (IPERIA).

PURPOSE(S) OF THE SYSTEM:
    Information in this system of records is used to administer, 
monitor and track services delivered through VA's Caregiver Support 
Program including documentation of calls to the Caregiver Support Line. 
The CARMA workflow management system is being used for Social Security 
number matching and other data field requirements. In addition, 
information in this system of records is used to respond to 
Congressional and/or internal and external stakeholders on the 
performance of the VA Caregiver Support Program.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The records include Veterans and caregivers inquiring about, 
applying for, participating in and those who have previously applied 
for or participated in the Program of Comprehensive Assistance for 
Family Caregivers (PCAFC) or the Program of General Caregiver Support 
Services (PGCSS) established by the Caregivers and Veterans Omnibus 
Health Services Act of 2010, Public Law 111-163, as well as individuals 
who contact VA's Caregiver Support Line, Veterans, their spouses and 
dependents as provided for in other provisions of title 38 U.S.C.

[[Page 18592]]

CATEGORIES OF RECORDS IN THE SYSTEM:
    Information entered into the Caregiver Support Program web-based 
application includes, but is not limited to: The Veteran and 
caregiver(s) name, Social Security number, gender, age, date of birth, 
address, phone number, and email address; VA eligibility related 
information, such as service connection, DD 214, ``Certification of 
Release or Discharge from Active Duty'', Line of Duty documentation, 
stipend payment information; written correspondence; VA Form 10-10CG, 
``Application for Comprehensive Assistance for Family Caregiver 
Program''; and correspondence with Caregiver Support Line, including 
referral information and VA staff remarks. The Caregiver Support 
Program uses data stored in CARMA which includes, but is not limited 
to: Social Security number, eligibility, correspondence, documented and 
captured telephone calls with Veterans, Caregivers, and the general 
public.

RECORD SOURCE CATEGORIES:
    Information in the systems of records may be provided by the 
applicant; applicant's spouse or other family members or accredited 
representatives or friends; Veterans, caregivers, and other interested 
parties seeking or receiving information or services about VA's 
Caregiver Support Program, including the Caregiver Support Line, VA 
systems including but not limited to Veterans Health Information System 
and Technology Architecture (VistA), Master Person Index, VHA Corporate 
Data Warehouse, Enrollment System, VBA, and other state and Federal 
agencies.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 45 CFR parts 160 and 164, i.e., individually 
identifiable health information, and 38 U.S.C. 7332, i.e., medical 
treatment information related to drug abuse, alcoholism or alcohol 
abuse, sickle cell anemia, or infection with the Human Immunodeficiency 
Virus, that information cannot be disclosed under a routine use unless 
there is also specific statutory authority in 38 U.S.C. 7332 and 
regulatory authority in 45 CFR parts 160 and 164 permitting disclosure.
    1. VA may disclose information from this system of records relevant 
to a claim of a Veteran or beneficiary, such as the name, address, the 
basis and nature of a claim, amount of benefit payment information, 
medical information, and military service and active duty separation 
information, at the request of the claimant to accredited service 
organizations, VA-approved claim agents, and attorneys acting under a 
declaration of representation, so that these individuals can aid 
claimants in the preparation, presentation, and prosecution of claims 
under the laws administered by VA. The name and address of a claimant 
will not, however, be disclosed to these individuals under this routine 
use if the claimant has not requested the assistance of an accredited 
service organization, claims agent or an attorney.
    2. VA may disclose any information in this system, except the names 
and home addresses of Veterans and their dependents, which is relevant 
to a suspected or reasonably imminent violation of law, whether civil, 
criminal or regulatory in nature and whether arising by general or 
program statute or by regulation, rule or order issued pursuant 
thereto, to a Federal, state, local, tribal, or foreign agency charged 
with the responsibility of investigating or prosecuting such violation, 
or charged with enforcing or implementing the statute, regulation, rule 
or order. VA may also disclose the names and addresses of Veterans and 
their dependents to a Federal agency charged with the responsibility of 
investigating or prosecuting civil, criminal or regulatory violations 
of law, or charged with enforcing or implementing the statute, 
regulation, rule or order issued pursuant thereto.
    3. VA may disclose information from this system of records in the 
course of presenting evidence to a court, magistrate, or administrative 
tribunal; in matters of guardianship, inquests, and commitments; to 
private attorneys representing Veterans rated incompetent in 
conjunction with issuance of Certificates of Incompetency; and to 
probation and parole officers in connection with court-required duties.
    4. VA may disclose information to a fiduciary or guardian ad litem 
in relation to his or her representation of a claimant in any legal 
proceeding, but only to the extent necessary to fulfill the duties of 
the fiduciary or the guardian ad litem.
    5. Attorneys, Insurers, Employers: VA may disclose any relevant 
information from this system of records to attorneys, insurance 
companies, employers, third parties liable or potentially liable under 
health plan contracts, and to courts, boards, or commissions, but only 
to the extent necessary to aid VA in the preparation, presentation, and 
prosecution of claims authorized under Federal, state, or local laws, 
and regulations promulgated thereunder.
    6. VA may disclose information from this system of records to the 
Department of Justice (DoJ), either on VA's initiative or in response 
to DoJ's request for the information, after either VA or DoJ determines 
that such information is relevant to DoJ's representation of the United 
States or any of its components in legal proceedings before a court or 
adjudicative body, provided that, in each case, the agency also 
determines prior to disclosure that release of the records to the DoJ 
is limited to circumstances where relevant and necessary to the 
litigation. VA may disclose records in this system of records in legal 
proceedings before a court or administrative body after determining 
that release of the records to the DoJ is limited to circumstances 
where relevant and necessary to the litigation.
    To determine whether to disclose records under this routine use, VA 
will comply with the guidance promulgated by the Office of Management 
and Budget in a May 24, 1985, memorandum entitled ``Privacy Act 
Guidance--Update,'' currently posted at https://www.whitehouse.gove/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/guidance1985.pdf.
    7. VA may disclose information from this system to NARA in records 
management inspections conducted under Title 44 U.S.C.
    8. VA may disclose the name of a Veteran or beneficiary, other 
information as is reasonably necessary to identify such individual, and 
any other information concerning the individual's indebtedness by 
virtue of a person's participation in a benefits program administered 
by VA, may be disclosed to the Department of Treasury, Internal Revenue 
Service, for the collection of Title 38 benefit overpayments, overdue 
indebtedness, and/or costs of services provided to an individual not 
entitled to such services, by the withholding of al or portion of the 
person's Federal income tax refund.
    9. VA may disclose the name and address of a Veteran or 
beneficiary, and other information as is reasonably necessary to 
identify such individual or concerning that individual's indebtedness 
to the United States by virtue of the person's participation in a 
benefits program administered by Department, to a consumer reporting 
agency for the purpose of locating the individual, obtaining a consumer 
report to determine the ability of the individual to repay an 
indebtedness to the United States, or assisting in the collection of 
such indebtedness, provided that the provisions of 38 U.S.C. 
57019(g)(2) and (4) have been met.

[[Page 18593]]

    10. VA may disclose information from this system of records to 
individuals, organizations, private or public agencies, or other 
entities or individuals with whom VA has a contract or agreement to 
perform such services as VA may deem practicable for the purposes of 
laws administered by VA, in order for the contractor, subcontractor, 
public or private agency, or other entity or individual with whom VA 
has a contract or agreement to perform services under the contract or 
agreement.
    This routine use includes disclosures by the individual or entity 
performing services for VA to any secondary entity or individual to 
perform an activity that is necessary for individuals, organizations, 
private or public agencies, or other entities or individuals with whom 
VA has a contract or agreement to provide the service to VA.
    11. VA may disclose information from the record of an individual in 
response to an inquiry from the congressional office made at the 
request of that individual.
    12. Disclosure to other Federal agencies may be made to assist such 
agencies in preventing and detecting possible fraud or abuse by 
individuals in their operations and programs.
    13. VA may disclose information from this system to appropriate 
agencies, entities, and persons when (1) VA suspects or has confirmed 
that there has been a breach of the system of records; (2) VA has 
determined that as a result of the suspected or confirmed breach there 
is a risk of harm to individuals, VA (including its information 
systems, programs, and operations), the Federal Government, or national 
security; and (3) the disclosure made to such agencies, entities, and 
persons is reasonably necessary to assist in connection with VA's 
efforts to respond to the suspected or confirmed breach or to prevent, 
minimize, or remedy such harm.
    14. VA may disclose identifying information, including social 
security number, concerning Veterans, spouses of Veterans, and the 
beneficiaries of Veterans to other Federal agencies for the purpose of 
conducting computer matches to obtain information to determine or 
verify eligibility of Veterans receiving VA medical care under Title 38 
U.S.C.
    15. VA may disclose information from this system to another Federal 
agency or Federal entity, when VA determines that information from this 
system of records is reasonably necessary to assist the recipient 
agency or entity in (1) responding to a suspected or confirmed breach 
or (2) preventing, minimizing, or remedying the risk of harm to 
individuals, the recipient agency or entity (including its information 
systems, programs, and operations), the Federal Government, or national 
security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    The CARMA system is hosted in the Salesforce Gov Cloud. The 
production environment (including application data) is backed up weekly 
to the VA's Amazon Cloud (AWS).

POLICIES AND PRACTICES FOR RETRIEVABILITY OF RECORDS:
    Records are retrieved by name, and/or Social Security number, 
internal control number (ICN), correspondence tracking number, internal 
record number, facility number, or other assigned identifiers of the 
individuals on whom they are maintained.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    CARMA records are currently unscheduled and should not be 
destroyed.

PHYSICAL, PROCEDURAL, AND ADMINISTRATIVE SAFEGUARDS:
    1. On an annual basis, employees are required to sign a computer 
access agreement acknowledging their understanding of confidentiality 
requirements. In addition, all employees receive annual privacy 
awareness and information security training.
    2. Access to electronic records is deactivated when no longer 
required for official duties. Recurring monitors are in place to ensure 
compliance with nationally and locally established security measures.
    3. Strict control measures are enforced to ensure that access to 
and disclosure from all records are limited to VA and the contractor's 
employees whose official duties warrant access to those files.
    4. Access to CARMA is restricted and requires approval prior to 
access. Restricted access will be provided to enable workflow 
management to administer, monitor and track services delivered through 
VA's Caregiver Support Program including, but not limited to, 
documentation of calls to the Caregiver Support Line.

RECORD ACCESS PROCEDURE:
    Individuals seeking information regarding access to and contesting 
of CARMA records should submit a written request in person to the 
nearest VA facility.

CONTESTING RECORD PROCEDURES:
    (See Record Access Procedures above.)

NOTIFICATION PROCEDURE:
    Any individual who wishes to determine whether a record is being 
maintained in this system under his or her name or other personal 
identifier, or wants to determine the contents of such record, should 
submit a written request or apply in person to the nearest VA. All 
inquiries must reasonably identify the records requested. Inquiries 
should include the individual's full name, Social Security number, 
military service number, claim folder number, and return address.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    None.

[FR Doc. 2021-07310 Filed 4-8-21; 8:45 am]
BILLING CODE P