Privacy Act of 1974; System of Records, 4885-4889 [2023-01438]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 88, Number 16 (Wednesday, January 25, 2023)]
[Notices]
[Pages 4885-4889]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-01438]


-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Office of the Chief Human Capital Officer, Department of 
Veterans Affairs (VA).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: Pursuant to the Privacy Act of 1974, notice is hereby given 
that the Department of Veterans Affairs (VA) is modifying the system of 
records entitled, ``Employee Medical File System Records (Title 38)-
VA'' (08VA05). This system of records supports the Department by 
tracking employee health. The records are maintained for a variety of 
purposes, including: meeting the mandates of law, Executive Orders or 
regulations (e.g., Department of Labor Occupational Safety and Health 
Administration, Department of Justice, National Archives and Records 
Administration, and Office of Workers' Compensation Programs (OWCP) 
regulations.

DATES: Comments on this modified system of records must be received no 
later than 30 days after date of publication in the Federal Register. 
If no public comment is received during the period allowed for comment 
or unless otherwise published in the Federal Register by the VA, the 
modified system of records will become effective a minimum of 30 days 
after date of publication in the Federal Register. If VA receives 
public comments, VA shall review the comments to determine whether any 
changes to the notice are necessary.

ADDRESSES: Comments may be submitted through www.Regulations.gov or 
mailed to VA Privacy Service, 810 Vermont Avenue NW, (005R1A), 
Washington, DC 20420. Comments should indicate that they are submitted 
in response to ``Employee Medical File System Records (Title 38)-VA'' 
(08VA05). Comments received will be available at regulations.gov for 
public viewing, inspection or copies.

FOR FURTHER INFORMATION CONTACT: Matt Gentil, Privacy Officer, 
Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 
20420; [email protected]; telephone 202-632-4878 (Note: this is not 
a toll-free number).

SUPPLEMENTARY INFORMATION: The System has been updated to include the 
following:
     Update records located in VA National Data Centers and VA 
Information Technology (IT) systems in VA Central Office.
     Update the System Manager position title to ``The Chief 
Human Capital Officer (05).''
     Update the Authority for Maintenance of the System to add 
Executive Orders 12196 and correct the 38 U.S.C. citations.
     Update the Purpose of the System to reflect the purposes 
outlined in OPM/GOVT-10, Employee Medical File System Records for title 
5 federal employees. The Purpose of the System includes a variety of 
purposes for which the records maintained are used.
     Update Categories of Individuals Covered by the System to 
correct all of the legal citations for referenced 38 U.S.C. sections 
and add title 38 Hybrid employees.
     Update Categories of Records in the System to add ``(6) 
Other records, forms or reports containing health information for 
compliance with vaccination mandates for federal employees'' as a new 
category of records to address the collection of health information 
required to meet Executive Order 14043, ``Requiring Coronavirus Disease 
2019 Vaccination for Federal Employees.''
     Update Record Source Categories to add VA IT systems as a 
source of information.
     Update Routine Use 27-28 to align with OPM/GOVT-10.
     Update Routine Uses #27 to state, ``VA may disclose the 
results of a drug test of a Federal employee pursuant to an order of a 
court of competent jurisdiction where required by the United States 
Government to defend against any challenge against any adverse 
personnel action.''
     Update Routine Use #28 to state, ``VA may disclose 
information to evaluate and report on the effectiveness of health and 
wellness programs by agency staff or third parties under contract with 
the agency to conduct such evaluations.''
     Update The Policies and Practices for Storage of Records 
to replace the reference to information in the Decentralized Hospital 
Computer Program (DHCP) system with ``Electronic Records are maintained 
in VA IT systems.''
     Update The Policies and Practices for Retrieval of Records 
to add medical record number and, employee's VA email address.
     Update The Policies and Practices for Retention and 
Disposal of Records to indicate that ``Records in this system are 
retained and disposed of in accordance with the schedule approved by 
the Archivist of the United States, VA RCS 10-1, Item 3015, excluding 
Item 3015.9.''
     Update The Administrative, Technical, and Physical 
Safeguards section to remove all reference to DHCP and replace it with 
VA IT systems.
    Update Record Access Procedures to clarify where requests should be 
submitted and to replace the need for the Social Security Number with 
only ``last four of social security number'' to allow for adequate 
identification while protecting individual's information. Notification 
procedures is being revised to also replace the need for the Social 
Security Number with only ``last four of social security number.'' VA 
is republishing the system notice in its entirety.

Signing Authority

    The Senior Agency Official for Privacy, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Kurt D. 
DelBene, Assistant Secretary for Information and Technology and Chief 
Information Officer, approved this document on December 13, 2022 for 
publication.

    Dated: January 20, 2023.
Amy L. Rose,
Program Analyst, VA Privacy Service, Office of Information Security, 
Office of Information and Technology, Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:
    Employee Medical File System Records (Title 38)--VA, (08VA05).

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    For current employees, records are located in VA medical, 
personnel, dispensary, health, safety or other designated offices at 
Central Office and field facilities (see Appendix 1); in VA National 
Data Centers; in VA information technology (IT) systems within VA 
Central Office; with another agency providing such services for the VA; 
or with private sector contractors.

[[Page 4886]]

    For former employees, most records will be located in an Employee 
Medical Folder (EMF) stored in Federal records centers operated by the 
National Archives and Records Administration (NARA). Paper record 
abstract information is stored in automated storage media records that 
are maintained at the health care facilities.

SYSTEM MANAGER(S):
    The Chief Human Capital Officer (05), Tracey Therit, VA Central 
Office, 810 Vermont Avenue NW, Washington, DC 20420, phone: 202-461-
0235, email: [email protected].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Executive Orders 12196 and 12564; Urgent Relief for the Homeless 
Supplemental Appropriations Act of 1987, Public Law 100-71, Section 
503, 101 Stat. 468 (1987); 38 U.S.C, Chapter 3, Sec. Sec.  501(a)-(b); 
Chapter 73 and Chapter 75, Sec.  7802.

PURPOSE(S) OF THE SYSTEM:
    Records in this system of records are maintained for the following 
purposes:
    a. To ensure that records required to be retained on a long-term 
basis to meet the mandates of law, Executive Order, or regulations 
(e.g., the Department of Labor's Occupational Safety and Health 
Administration (OSHA) and Office of Workers' Compensation Program 
regulations), are so maintained.
    b. To provide data necessary for proper medical evaluations and 
diagnoses, to ensure that proper treatment is administered, and to 
maintain continuity of medical care.
    c. To provide an accurate medical history of the total health care 
and medical treatment received by the individual as well as job and/or 
hazard exposure documentation and health monitoring in relation to 
health status and claims of the individual.
    d. To enable the planning for further care of the employee/
individual.
    e. To provide a record of communications among members of the 
health care team who contribute to the employee/individual's care.
    f. To provide a legal document describing the health care 
administered and any exposure incident.
    g. To provide a method for evaluating quality of health care 
rendered and job health-protection including engineering protection 
provided, protective equipment worn, workplace monitoring, and medical 
exam monitoring required by OSHA or by good practice.
    h. To ensure that all relevant, necessary, accurate, and timely 
data are available to support any medically related employment 
decisions affecting the subject of the records (e.g., in connection 
with fitness-for-duty and disability retirement decisions).
    i. To document claims filed with and the decisions reached by the 
Office of Workers' Compensation Program and the individual's possible 
reemployment rights under statutes governing that program.
    j. To document employee's reporting of on-the-job injuries or 
unhealthy or unsafe working conditions, including the reporting of such 
conditions to the OSHA and actions taken by that agency or by the 
employing agency.
    k. To ensure proper and accurate operation of the agency's employee 
drug testing program under Executive Order 12564.
    l. To facilitate communication among members of an on-site health 
and wellness program and to the employee/individual participating in 
the program.
    m. To enable evaluation of the effectiveness of on-site health and 
wellness programs.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The following categories of individuals are covered by this system: 
current or former VA employees appointed under title 38 includes 
employees appointed to occupations identified in 38 U.S.C. 7306, 
7401(1), and 7401(3); and employees in those occupations who are 
appointed under 38 U.S.C. 7405 and 7406.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Records maintained in this system include: (1) Medical records, 
forms, and reports completed or obtained when an individual applies for 
a Federal job and is subsequently employed; (2) Medical records, forms, 
and reports completed during employment as a condition of employment, 
either by the VA or by another agency, State or local government 
entity, or a private sector entity under contract to the VA; (3) 
Records resulting from the testing of the employee for use of illegal 
drugs under Executive Order 12564. Such records may be retained by the 
VA (e.g., by the VA Medical Review Official) or by a contractor 
laboratory. This includes records of negative results, confirmed or 
unconfirmed positive test results, and lists of who has been tested, 
who failed to report for testing, and related documents. Records 
maintained by a VA dispensary are included in the system only when they 
are the result of a condition of employment or related to an on-the-job 
occurrence. (4) Files containing reports of on-the-job injuries and 
medical records, forms, and reports generated as a result of the filing 
of a claim for Workers' Compensation, whether the claim is accepted or 
not. (The official compensation claim file, maintained by the 
Department of Labor's Office of Workers' Compensation Program (OWCP) is 
part of that agency's system of records and not covered by this 
notice.) (5) All other medical records, forms, and reports created on 
an employee during his or her period of employment, including records 
retained on a short term/temporary basis (i.e., those designated to be 
retained only while the employee is with the VA) and records designated 
for long-term retention (i.e., those retained for the employee's 
duration of Federal service and for some period of time thereafter). 
(6) Records resulting from participation in agency-sponsored health 
promotion and wellness activities, including health risk appraisals, 
biometric testing, health coaching, disease management, behavioral 
management, preventive services, fitness programs, and any other 
activities that could be considered part of a comprehensive worksite 
health and wellness program.

RECORD SOURCE CATEGORIES:
    Records in this system are obtained from: the individual to whom 
the records pertain, VA employee health unit staff, Federal and private 
sector medical practitioners and treatment facilities, supervisors/
managers and other VA officials, testimony of witness, and other VA 
records and VA IT systems.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    1. To a Member of Congress or staff acting upon the Member's behalf 
when the Member or staff requests the information on behalf of, and at 
the request of, the individual who is the subject of the record.
    2. To appropriate agencies, entities, and persons when (1) VA 
suspects or has confirmed that there has been a breach of the system of 
records,[middot] (2) VA has determined that as a result of the 
suspected or confirmed breach there is a risk of harm to individuals, 
VA (including its information systems, programs, and operations), the 
Federal Government, or national security; and (3) the disclosure made 
to such agencies, entities, and persons is reasonably necessary to 
assist in connection with VA's efforts to respond to the suspected or 
confirmed breach or to prevent, minimize, or remedy such harm.
    3. To another Federal agency or Federal entity, when VA determines

[[Page 4887]]

that information from this system of records is reasonably necessary to 
assist the recipient agency or entity in (1) responding to a suspected 
or confirmed breach or (2) preventing, minimizing, or remedying the 
risk of harm to individuals, the recipient agency or entity (including 
its information systems, programs, and operations), the Federal 
Government, or national security, resulting from a suspected or 
confirmed breach.
    4. To a Federal, state, local, territorial, tribal, or foreign law 
enforcement authority or other appropriate entity charged with the 
responsibility of investigating or prosecuting such violation or 
charged with enforcing or implementing such law, provided that the 
disclosure is limited to information that, either alone or in 
conjunction with other information, indicates a violation or potential 
violation of law, whether civil, criminal, or regulatory in nature. The 
disclosure of the names and addresses of veterans and their dependents 
from VA records under this routine use must also comply with the 
provisions of 38 U.S.C. 5701.
    5. To the Department of Justice (DoJ), or in a proceeding before a 
court, adjudicative body, or other administrative body before which VA 
is authorized to appear, when:
    (a) VA or any component there of;
    (b) Any VA employee in his or her official capacity;
    (c) Any VA employee in his or her individual capacity where DoJ has 
agreed to represent the employee; or
    (d) The United States, where VA determines that litigation is 
likely to affect the agency or any of its components is a party to such 
proceedings or has an interest in such proceedings, and VA determines 
that use of such records is relevant and necessary to the proceedings.
    6. To contractors, grantees, experts, consultants, students, and 
others performing or working on a contract, service, grant, cooperative 
agreement, or other assignment for VA, when reasonably necessary to 
accomplish an agency function related to the records.
    7. To the Office of Personnel Management (OPM) in connection with 
the application or effect of civil service laws, rules, regulations, or 
OPM guidelines in particular situations.
    8. To the Equal Employment Opportunity Commission (EEOC) in 
connection with investigations of alleged or possible discriminatory 
practices, examination of Federal affirmative employment programs, or 
other functions of the Commission as authorized by law.
    9. To the Federal Labor Relations Authority (FLRA) in connection 
with the investigation and resolution of allegations of unfair labor 
practices, the resolution of exceptions to arbitration awards when a 
question of material fact is raised, matters before the Federal Service 
Impasses Panel, and the investigation of representation petitions and 
the conduct or supervision of representation elections.
    10. To the Merit Systems Protection Board (MSPB) in connection with 
appeals, special studies of the civil service and other merit systems, 
review of rules and regulations, investigation of alleged or possible 
prohibited personnel practices, and such other functions promulgated in 
5 U.S.C. 1205 and 1206, or as authorized by law.
    11. To the National Archives and Records Administration (NARA) in 
records management inspections conducted under 44 U.S.C. 2904 and 2906, 
or other functions authorized by laws and policies governing NARA 
operations and VA records management responsibilities.
    12. VA may disclose information to Office of Management and Budget 
(OMB) at any stage in the legislative coordination and clearance 
process in connection with private relief legislation as set forth in 
OMB Circular No. A-19.
    13. VA may disclose information to survey teams of the Joint 
Commission on Accreditation of Healthcare Organizations, College of 
American Pathologists, American Association of Blood Banks, and similar 
national accreditation agencies or boards with which VA has a contract 
or agreement to conduct such reviews, as relevant and necessary for the 
purpose of program review or the seeking of accreditation or 
certification.
    14. VA may disclose information to disclose to health insurance 
carriers contracting with the OPM to provide a health benefits plan 
under the Federal Employee Health Benefits Program, information 
necessary to verify eligibility for payment of a claim for health 
benefits or to carry out the coordination of audit of benefit 
provisions of such contracts.
    15. VA may disclose information to locate individuals for health 
research or survey response and in the production of summary 
descriptive statistics and analytical studies (e.g., epidemiological 
studies) in support of the function for which the records are collected 
and maintained. While published statistics and studies do not contain 
individual identifiers, in some instances the selection of elements of 
data included in the study might be structured in such a way as to make 
the data individually identifiable by inference.
    16. VA may disclose information to the Office of Federal Employees 
Group Life Insurance that is relevant and necessary to verify election, 
declination, or waiver of regular and/or optional life insurance 
coverage or eligibility for payment of a claim for life insurance.
    17. VA may disclose information when an individual to whom a record 
pertains is mentally incompetent or under other legal disability, to 
any person who is responsible for the care of the individual, to the 
extent necessary.
    18. VA may disclose information to the agency-appointed 
representative of an employee all notices, determinations, decisions, 
or other written communications issued to the employee, in connection 
with an examination ordered by the agency under: (a) Medical evaluation 
(formerly Fitness for Duty) examinations procedures, or (b) agency-
filed disability retirement procedures.
    19. VA may disclose information to a requesting agency, 
organization, or individual the home address and other information 
concerning those individuals who it is reasonably believed might have 
contracted an illness or been exposed to or suffered from a health 
hazard while employed in the Federal work force.
    20. VA may disclose information to a Federal agency, in response to 
its request or at the initiation of the VA, in connection with the 
retention of an employee, the issuance of a security clearance, the 
conducting of a suitability or security investigation of an individual, 
the letting of a contract, or the issuance of a license, grant, or 
other benefit by the other agency, or the lawful statutory, 
administrative or investigative purpose of the agency to the extent 
that the information is relevant and necessary to the other agency's 
decision on the matter.
    21. VA may disclose information to any Federal, State, or local 
government agency, in response to its request or at the initiation of 
the VA, information relevant and necessary to the lawful, statutory, 
administrative, or investigatory purpose as it relates to the conduct 
of job-related epidemiological research or the assurance of compliance 
with Federal, State, or local government laws on health and safety in 
the work environment.
    22. VA may disclose to officials of labor organizations recognized 
under 5 U.S.C. Chapter 71, analyses using exposure or medical records 
and employee exposure records, in accordance with the record access 
rules

[[Page 4888]]

of the OSHA, Department of Labor, and subject to the limitations of 29 
CFR 1910.20(e)(2)(iii)(B).
    23. VA may disclose information to a Federal Agency or to a State 
or local government licensing board and/or to the Federation of State 
Medical Boards or a similar nongovernment entity which maintains 
records concerning individuals' employment histories or concerning the 
issuance, retention or revocation of licenses, certifications, or 
registrations necessary to practice an occupation, profession or 
specialty, in order for the Agency to obtain information relevant to an 
Agency decision concerning the hiring, retention or termination of an 
employee or to inform a Federal Agency or licensing boards or the 
appropriate nongovernment entities about the health care practices of a 
terminated, resigned or retired health care employee whose professional 
health care activity so significantly failed to conform to generally 
accepted standards of professional medical practice as to raise 
reasonable concern for the health and safety of patients in the private 
sector or from another Federal Agency. These records may also be 
disclosed as part of an ongoing computer matching program to accomplish 
these purposes.
    24. VA may disclose information to a State or local government 
entity which has the legal authority to make decisions concerning the 
issuance, retention or revocation of licenses, certifications or 
registrations required to practice a health care profession, when 
requested in writing by an investigator or supervisory official of the 
licensing entity for the purpose of making a decision concerning the 
issuance, retention or revocation of the license, certification or 
registration of a named health care professional.
    25. VA may disclose information to the National Practitioner Data 
Bank at the time of hiring or clinical privileging/re-privileging of 
health care practitioners, and other times as deemed necessary by VA, 
in order for VA to obtain information relevant to a Department decision 
concerning the hiring, privileging/re-privileging, retention, or 
termination of the applicant or employee.
    26. VA may disclose information to the National Practitioner Data 
Bank or a state licensing board in the state in which a practitioner is 
licensed, in which the VA facility is located, or in which an act or 
omission occurred upon which a medical malpractice claim was based when 
VA reports information concerning: (1) Any payment for the benefit of a 
physician, dentist, or other licensed health care practitioner that was 
made as the result of a settlement or judgment of a claim of medical 
malpractice, if an appropriate determination is made in accordance with 
Department policy that payment was related to substandard care, 
professional incompetence, or professional misconduct on the part of 
the individual; (2) a final decision that relates to possible 
incompetence or improper professional conduct that adversely affects 
the clinical privileges of a physician or dentist for a period longer 
than 30 days; or (3) the acceptance of the surrender of clinical 
privileges or any restriction of such privileges by a physician or 
dentist, either while under investigation by the health care entity 
relating to possible incompetence or improper professional conduct, or 
in return for not conducting such an investigation or proceeding. These 
records may also be disclosed as part of a computer matching program to 
accomplish these purposes.
    27. VA may disclose the results of a drug test of a Federal 
employee pursuant to an order of a court of competent jurisdiction 
where required by the United States Government to defend against any 
challenge against any adverse personnel action.
    28. VA may disclose information to evaluate and report on the 
effectiveness of health and wellness programs by agency staff or third 
parties under contract with the agency to conduct such evaluations.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records are stored in paper folders, microfiche, magnetic discs, 
magnetic tape, and on file cards, X-rays, or other medical reports and 
forms. These records are stored in VA medical, personnel, dispensary, 
health, safety or other designated offices at Central Office and field 
facilities. Electronic records are maintained in VA IT systems.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records are retrieved by the employee/individual's name, date of 
birth, medical record number, employee/individual's VA email address, 
last four of the employee/individual's social security number, or any 
combination of those identifiers.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records in this system are retained and disposed of in accordance 
with the schedule approved by the Archivist of the United States, VA 
RCS 10-1, Item 3015, excluding Item 3015.9.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    Paper records are stored in locked file cabinets or locked rooms. 
Generally, file areas are locked after normal duty hours. Automated 
records are protected by restricted access procedures and audit trails. 
Access to Employee Medical File System records is strictly limited to 
VA or contractor officials with a bona fide need for access to the 
records. Strict control measures are enforced to ensure that access to 
and disclosure from these records are limited to a ``need-to-know 
basis.'' In VA Central Office these paper records are maintained in 
staffed rooms during working hours. During nonworking hours, there is 
limited access to the building with visitor control by security 
personnel. Access to VA computer rooms within VA facilities is 
generally limited by appropriate locking devices and restricted to 
authorized VA employees/individuals and vendor personnel. Automated 
data processing peripheral devices are generally placed in secure areas 
(areas that are locked or have limited access) or are otherwise 
protected. Information in VA National Data Centers and VA IT systems 
may be accessed by authorized VA employees/individuals. Access to file 
information is controlled at two levels; the system recognizes 
authorized employees/individuals by a series of individually unique 
passwords/codes as a part of each message, and the employees/
individuals are limited to only that information in the file which is 
needed in the performance of their official duties. Drug testing 
records will be maintained in accordance with the Urgent Relief for the 
Homeless Supplemental Appropriations Act of 1987, Public Law No. 100-
71, Section 503, 101 Stat. 468 (1987). Contractor laboratories are 
subject to the same restrictions as VA employees/individuals.

RECORD ACCESS PROCEDURES:
    Individuals requesting access to and contesting the contents of 
records must submit to the Human Resources Management Office at the 
facility where last employed the following information for their 
records to be located and identified: (1) Full name, (2) date of birth, 
(3) last four of social security number, (4) name and location of VA 
facility where last employed and dates of employment, and (5) 
signature.

CONTESTING RECORD PROCEDURES:
    Individuals seeking to contest or amend records in this system 
pertaining to them should contact the Human Resources Management Office 
at the

[[Page 4889]]

facility where last employed in writing as indicated above. A request 
to contest or amend records must state clearly and concisely what 
record is being contested, the reasons for contesting it, and the 
proposed amendment to the record.

NOTIFICATION PROCEDURES:
    Generalized notice is provided by the publication of this notice. 
For specific notice, see Record Access Procedure, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    Last full publication was prior to 1995.

[FR Doc. 2023-01438 Filed 1-24-23; 8:45 am]
BILLING CODE P