Privacy Act of 1974; System of Records, 22112-22117 [2023-07638]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 88, Number 70 (Wednesday, April 12, 2023)]
[Notices]
[Pages 22112-22117]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-07638]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Veterans Health Administration (VHA), Department of Veterans 
Affairs (VA).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: Pursuant to the Privacy Act of 1974, notice is hereby given 
that the VA is modifying the system of records entitled, ``National 
Patient Databases-VA'' (121VA10A7). VA provides health care services to 
many of America's Veterans through the VHA. However, the care of 
America's Veterans extends beyond VHA and into community providers. 
During the course of providing health care, VHA collects medical and 
health information about Veterans under their care. Similarly, outside 
of VHA, community providers also collect medical and health information 
about Veterans under their care. This SORN requires modification to 
ensure the appropriate sharing of Veterans' medical or health 
information for disease management and population-based activities for 
improving health outcomes.

DATES: Comments on this modified system of records must be received no 
later than 30 days after date of publication in the Federal Register. 
If no public comment is received during the period allowed for comment 
or unless otherwise published in the Federal Register by VA, the 
modified system of records will become effective a minimum of 30 days 
after date of publication in the Federal Register. If VA receives 
public comments, VA shall review the comments to determine whether any 
changes to the notice are necessary.

ADDRESSES: Comments may be submitted through www.regulations.gov or 
mailed to VA Privacy Service, 810 Vermont Avenue NW, (005R1A), 
Washington, DC 20420. Comments should indicate that they are submitted 
in response to ``National Patient Databases-VA'', (121VA10A7). Comments 
received will be available at regulations.gov for public viewing, 
inspection or copies.

FOR FURTHER INFORMATION CONTACT: Stephania Griffin, VHA Chief Privacy 
Officer, Department of Veterans Affairs, 810 Vermont Avenue NW, 
Washington, DC 20420; telephone (704) 245-2492 (Note: This is not a 
toll-free number).

SUPPLEMENTARY INFORMATION: VA is modifying the system of records by 
revising the System Number; System Location; System Manager; Purpose of 
the System; Categories of Individuals Covered by this System; 
Categories of Records in the System; Records Source Categories; Routine 
Uses of Records Maintained in the System; Policies and Practices for 
Storage of Records; Policies and Practices for Retention and Disposal 
of Records; Administrative, Technical and Physical Safeguards; and 
Appendix 4.
    The System Number will be changed from 121VA10A7 to 121VA10 to 
reflect the current VHA organizational routing symbol.
    The System Location will be updated to include: information from 
these records or copies of these records may be maintained at VA 
Enterprise Cloud Data Centers/Amazon Web Services, 1915 Terry Avenue, 
Seattle, WA 98101.
    The System Manager is being updated to replace ``Assistant Deputy 
Under Secretary for Informatics and Information Governance (10P2)'', 
with, ``Chief Officer for Health Informatics (105).''
    The Purpose of the System is being modified to include: ``to 
monitor the performance outside the VA as relevant; and to study, 
monitor and report epidemiological trends and disease incidence.'' It 
is also being modified to include: ``The Public Health National Program 
Office System data will be available to VA personnel, Federal agencies 
and State/Local Health Departments for the monitoring of infections, 
emerging pathogens, and environmental issues of interest that might 
reasonably affect the health of the public.'' This section will remove: 
``National Center for Patient Safety Public Health System data will be 
available to VHA clinicians to use for the monitoring of health care-
associated infections and for the transmittal of data to state/local 
health departments for bio surveillance purposes.''
    Categories of Individuals Covered by this System is being updated, 
number (2) is being updated to reflect the following: ``Providing 
health care to individuals for VHA.'' Section (3) is also being added 
and will state: ``Whose data is provided to VA clinical registries, 
including but not limited to the VA Central Cancer Registry.''
    The Categories of Records in the System is being updated to replace 
24VA10P2 with 24VA10A7.
    The Records Source Categories is being updated to replace ``VA 
Austin Automation Center'' with ``Austin Information Technology 
Center''; 33VA113 with 33VA10; and ``Healthcare Eligibility Records-
VA'' (89VA10NB) with ``Income Verification Records-VA'' (89VA10)''. 
``Veterans and Beneficiaries Identification and Records Location 
Subsystem-VA'' (38VA23) is being removed from this section since this 
SORN was rescinded and is now encompassed in ``Compensation, Pension, 
Education, and Vocational Rehabilitation and Employment Records-VA'' 
(58VA21/22/28). This section will also include the National Cancer 
Institute (NCI) and/or their designee, and a state cancer or tumor 
registry.
    The language in Routine Use #28 is being updated. It previously 
reflected the following language, ``VA may disclose relevant health 
care information to the CDC and/or their designee in response to its 
request or at the initiation of VA, in connection with disease-
tracking, patient outcomes, bio-surveillance, or other health 
information required for program accountability.''
    Routine Use #28 will now read as follows, ``To the Centers for 
Disease Control and Prevention (CDC) and/or their designee, or other 
Federal and state public health authorities in response to its request 
or at the initiation of VA, in connection with disease-tracking, 
patient outcomes, bio-surveillance or other health information required 
for program accountability.''
    Routine Use #31 is being added to state, ``To the NCI and/or their 
designee, and/or a state cancer or tumor registry in response to its 
request or at the initiation of VA for the purpose of population-based 
activities to improve health and disease management. VA needs the 
ability to determine trends in the rates of the incidence of cancer in 
Veterans.''
    Policies and Practices for Storage of Records is being updated to 
include ``VA Enterprise Cloud.''
    Policies and Practices for Retention and Disposal of Records is 
being updated to remove General Records Schedule 20, item 4. Item 4 
provides for deletion of data files when the agency determines that the 
files are no longer needed for administrative, legal, audit or other 
operational purposes. This section will now reflect the following, 
Records in this system are retained and disposed of in accordance with 
the

[[Page 22113]]

schedule approved by the Archivist of the United States, General 
Records Schedule, 5.2, item 020.''
    Administrative, Technical and Physical Safeguards is being updated 
to include #6, ``VA Enterprise Cloud data storage conforms to security 
protocols as stipulated in VA Directives 6500 and 6517. Access control 
standards are stipulated in specific agreements with cloud vendors to 
restrict and monitor access.''
    Appendix 4 is being updated to replace ``Master Veteran Index'' 
with ``Master Person Index-VHA.'' The address for the VA Clinical 
Assessment Reporting and Tracking Program is being updated to replace 
``Denver VA Medical Center, 1055 Clermont Street, Denver, CO 80220'' 
with ``Digital Realty 350 E Cermak Road, Main Building 7th Transport 
RM, Chicago, IL 60616, and Evoque Data Centers, 11830 Webb Chapel Road, 
Suite 200, Dallas, TX 75234''.

Signing Authority

    The Senior Agency Official for Privacy, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Kurt D. 
DelBene, Assistant Secretary for Information and Technology and Chief 
Information Officer, approved this document on March 6, 2023 for 
publication.

    Dated: April 7, 2023.
Amy L. Rose,
Program Analyst, VA Privacy Service, Office of Information Security, 
Office of Information and Technology, Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:
    ``National Patient Databases-VA'' (121VA10).

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    Records are maintained at the Department of Veterans Affairs (VA) 
medical centers, VA data processing centers, Veterans Integrated 
Service Networks (VISN) and Office of Information Technology Field 
Offices. The address for each VA national patient database is listed in 
VA Appendix 4 at the end of this document. In addition, information 
from these records or copies of these records may be maintained at VA 
Enterprise Cloud Data Centers/Amazon Web Services, 1915 Terry Avenue, 
Seattle, WA 98101.

SYSTEM MANAGER(S):
    Officials responsible for policies and procedures: Chief Officer 
for Health Informatics, Department of Veterans Affairs, 810 Vermont 
Avenue NW, (105), Washington, DC 20420. Officials maintaining this 
system of records: Director, National Data Systems, Austin Information 
Technology Center, 1615 Woodward Street, Austin, Texas 78772. Telephone 
number 512-326-6780 (this is not a toll-free number).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    38 U.S.C 501.

PURPOSE(S) OF THE SYSTEM:
    The records and information may be used for statistical analysis to 
produce various management, workload tracking and follow-up reports; to 
track and evaluate the ordering and delivery of equipment, services and 
patient care; for the planning, distribution and utilization of 
resources; to monitor the performance of VISNs and/or outside the VA as 
relevant; to allocate clinical and administrative support to patient 
medical care; and to study, monitor and report epidemiological trends 
and disease incidence; for VA's extensive research programs in 
accordance with VA policy; to assist in workload allocation for patient 
treatment services including provider panel management, nursing care, 
clinic appointments, surgery, prescription processing, diagnostic and 
therapeutic procedures; to plan and schedule training activities for 
employees; for audits, reviews and investigations conducted by the 
network directors office and VA Central Office; for quality assurance 
audits, reviews and investigations; for law enforcement investigations; 
and for personnel management, evaluation and employee ratings, and 
performance evaluations. Pursuant to Executive Order 12862 and VHA 
Customer Service Standards Directive, survey data in this system will 
used to measure and monitor national, VISN and facility-level 
performance on the Veterans Health Administration (VHA) Veteran Health 
Care Service Standards (VHSS). The VHSS are designed to measure levels 
of patient satisfaction in areas that patients have defined as 
important in receiving quality, patient-centered health care. Results 
of the survey data analysis are shared throughout the VHA system. 
External Peer Review Program (EPRP) data in this system will be used to 
provide medical centers and outpatient clinics with diagnosis and 
procedure-specific quality of care information. EPRP is a contracted 
review of care, specifically designated to collect data to be used to 
improve the quality of care. The Veteran Homeless records and 
information will be used for case management in addition to statistical 
analysis to produce various management, workload tracking and follow-up 
reports; to track and evaluate the goal of ending Veteran homelessness. 
The Public Health National Program Office System data will be available 
to VA personnel, Federal agencies and State/Local Health Departments 
for the monitoring of infections, emerging pathogens, and environmental 
issues of interest that might reasonably affect the health of the 
public.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    These records include information for all individuals that are; (1) 
Receiving health care from VHA; (2) Providing health care to 
individuals for VHA; or (3) Whose data is provided to VA clinical 
registries, including but not limited to the VA Central Cancer 
Registry. Individuals encompass veterans and their immediate family 
members; members of the Armed Services; current and former employees, 
trainees, contractors, subcontractors, consultants, volunteers; and 
other individuals working collaboratively with VA.

CATEGORIES OF RECORDS IN THE SYSTEM:
    These records include information and health information related 
to; (1) Patient medical record abstract information including, but not 
limited to, information from ``Patient Medical Record-VA'' (24VA10A7); 
(2) Identifying information (e.g., name, birth date, death date, 
admission date, discharge date, gender, Social Security Number or 
taxpayer identification number); address information (e.g., home and/or 
mailing address, home telephone number, emergency contact information 
such as name, address, telephone number and relationship); prosthetic 
and sensory aid serial numbers; medical record numbers; integration 
control numbers; information related to medical examination or 
treatment (e.g., location of VA medical facility providing examination 
or treatment, treatment dates or medical conditions treated or noted on 
examination); information related to military service and status; (3) 
Medical benefit and eligibility information; (4) Patient workload data 
such as admissions, discharges and outpatient visits; resource 
utilization such as laboratory tests and x-rays; (5) Patient 
Satisfaction Survey Data which include questions and responses; (6) 
EPRP data capture; (7) Online Data

[[Page 22114]]

Collection system supported by Northeast Program Evaluation Center and 
VHA Support Service Center to include electronic information from all 
Veteran homeless programs and external sources; and (8) Clinically 
oriented information associated with My HealtheVet such as secure 
messages.

RECORD SOURCE CATEGORIES:
    Information in this system of records may be provided by veterans; 
VA employees; VA computer systems; Veterans Health Information Systems 
and Technology Architecture; VA medical centers; VA Health Eligibility 
Center; VA program offices; VISNs; Austin Information Technology 
Center; the Food and Drug Administration (FDA); Department of Defense; 
Department of Housing and Urban Development (HUD); Survey of Healthcare 
Experiences of Patients; EPRP; National Cancer Institute (NCI) and/or 
their designee; a state cancer or tumor registry; ``Patient Medical 
Records-VA'' (24VA10A7); ``National Prosthetics Patient Database-VA'' 
(33VA10); ``Income Verification Records-VA'' (89VA10); VA Veterans 
Benefits Administration automated record systems (including the 
``Compensation, Pension, Education, and Vocational Rehabilitation and 
Employment Records-VA'' (58VA21/22/28)); and subsequent iterations of 
those systems of records.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 45 CFR parts 160 and 164, i.e., individually 
identifiable health information of VHA or any of its business 
associates, and 38 U.S.C. 7332; i.e., medical treatment information 
related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia, 
or infection with the human immunodeficiency virus, that information 
cannot be disclosed under a routine use unless there is also specific 
statutory authority in both 38 U.S.C. 7332 and 45 CFR parts 160, 161, 
and 164.
    1. To a Federal, state, local, territorial, tribal or foreign law 
enforcement authority or other appropriate entity charged with the 
responsibility of investigating or prosecuting such violation or 
charged with enforcing or implementing such law, provided that the 
disclosure is limited to information that, either alone or in 
conjunction with other information, indicates a violation or potential 
violation of law, whether civil, criminal or regulatory in nature. The 
disclosure of the names and addresses of Veterans and their dependents 
from VA records under this routine use must also comply with the 
provisions of 38 U.S.C. 5701.
    2. To any source from which additional information is requested (to 
the extent necessary to identify the individual, inform the source of 
the purpose(s) of the request and identify the type of information 
requested), when necessary to obtain or provide information relevant to 
an individual's eligibility, care history or other benefits across 
different Federal, state or local, public health, health care or 
program benefit agencies that improves the quality and safety of health 
care for our Veterans.
    3. To a Federal agency in the executive, legislative or judicial 
branch, state and local Government or the District of Columbia 
Government in response to its request or at the initiation of VA, in 
connection with disease tracking, patient outcomes or other health 
information required for program accountability.
    4. To the National Archives and Records Administration (NARA) in 
records management inspections conducted under 44 U.S.C. 2904 and 2906, 
or other functions authorized by laws and policies governing NARA 
operations and VA records management responsibilities.
    5. To the Department of Justice (DoJ), or in a proceeding before a 
court, adjudicative body or other administrative body before which VA 
is authorized to appear, when:
    (a) VA or any component thereof;
    (b) Any VA employee in their official capacity;
    (c) Any VA employee in their individual capacity where DoJ has 
agreed to represent the employee; or
    (d) The United States, where VA determines that litigation is 
likely to affect the agency or any of its components,
    is a party to such proceedings or has an interest in such 
proceedings, and VA determines that the use of such records is relevant 
and necessary to the proceedings.
    6. To a Federal agency, a state or local government licensing 
board, the Federation of State Medical Boards or a similar non-
governmental entity that maintains records concerning individuals' 
employment histories or concerning the issuance, retention or 
revocation of licenses, certifications or registration necessary to 
practice an occupation, profession or specialty. This information can 
be used to inform such non-governmental entities about the health care 
practices of a terminated, resigned or retired health care employee 
whose professional health care activity so significantly failed to 
conform to generally accepted standards of professional medical 
practice as to raise reasonable concern for the health and safety of 
patients in the private sector or from another Federal Agency. These 
records may also be disclosed as part of an ongoing computer matching 
program to accomplish these purposes.
    7. To a former VA employee or contractor, as well as the authorized 
representative of a current or former employee or contractor of VA, in 
connection with or in consideration of reporting that the individual's 
professional health care activity so significantly failed to conform to 
generally accepted standards of professional medical practice as to 
raise reasonable concern for the health and safety of patients, to a 
Federal agency, a state or local government licensing board, or the 
Federation of State Medical Boards or a similar nongovernmental entity 
that maintains records concerning individuals' employment histories or 
concerning the issuance, retention or revocation of licenses, 
certifications, or registration necessary to practice an occupation, 
profession or specialty.
    8. To survey teams of The Joint Commission (TJC, College of 
American Pathologists, American Association of Blood Banks, and similar 
national accreditation agencies or boards with which VA has a contract 
or agreement to conduct such reviews, as relevant and necessary for the 
purpose of program review or the seeking of accreditation or 
certification.
    9. To a national certifying body that has the authority to make 
decisions concerning the issuance, retention or revocation of licenses, 
certifications or registrations required to practice a health care 
profession, when requested in writing by an investigator or supervisory 
official of the national certifying body for the purpose of making a 
decision concerning the issuance, retention or revocation of the 
license, certification or registration of a named health care 
professional.
    10. To officials of labor organizations recognized under 5 U.S.C. 
Chapter 71 provided that the disclosure is limited to information 
identified in 5 U.S.C. 7114(b)(4) that is relevant and necessary to 
their duties of exclusive representation concerning personnel policies, 
practices and matters affecting working conditions.
    11. To the representative of an employee of all notices, 
determinations, decisions or other written communications issued to the 
employee in connection with an examination

[[Page 22115]]

ordered by VA under medical evaluation (formerly fitness-for duty) 
examination procedures or Department-filed disability retirement 
procedures.
    12. To the Merit Systems Protection Board (MSPB) in connection with 
appeals, special studies of the civil service and other merit systems, 
review of rules and regulations, investigation of alleged or possible 
prohibited personnel practices, and such other functions promulgated in 
5 U.S.C. 1205 and 1206, or as authorized by law.
    13. To the Equal Employment Opportunity Commission (EEOC) in 
connection with investigations of alleged or possible discriminatory 
practices, examination of Federal affirmative employment programs or 
other functions of the Commission as authorized by law.
    14. To the Federal Labor Relations Authority (FLRA) in connection 
with the investigation and resolution of allegations of unfair labor 
practices, the resolution of exceptions to arbitration awards when a 
question of material fact is raised, matters before the Federal Service 
Impasses Panel, and the investigation of representation petitions and 
the conduct or supervision of representation elections.
    15. To non-Federal research facilities for research purposes 
determined to be necessary and proper when approved in accordance with 
VA policy; disclosure of medical record data, excluding name and 
address, unless name and address are furnished by the requester.
    16. To: (a) A Federal department or agency, at the written request 
of the head or designee of that agency or (b) directly to a contractor 
or subcontractor of a Federal department or agency, for the purpose of 
conducting Federal research necessary to accomplish a statutory purpose 
of an agency, provided that the disclosure is limited to the names and 
addresses of present or former members of the armed services or their 
beneficiaries, the records will not be used for any purpose other than 
that stated in the request, and the organization is aware of the 
penalty provision of 38 U.S.C. 5701(f). When disclosure of this 
information is made directly to a contractor, VA may impose applicable 
conditions on the department, agency and/or contractor to insure the 
appropriateness of the disclosure to the contractor.
    17. To contractors, grantees, experts, consultants, students and 
others performing or working on a contract, service, grant, cooperative 
agreement or other assignment for VA, when reasonably necessary to 
accomplish an agency function related to the records.
    18. To a Member of Congress or staff acting upon the Member's 
behalf when the Member or staff requests the information on behalf of, 
and at the request of, the individual who is the subject of the record.
    19. To a Federal agency for research and data analysis to perform a 
statutory purpose of that Federal agency upon the prior written request 
of that agency, provided that there is legal authority under all 
applicable confidentiality statutes and regulations to provide the data 
and the VHA Office of Informatics has determined prior to the 
disclosure that VHA data handling requirements are satisfied.
    20. To another Federal agency for the purpose of matching and 
acquiring information held by that agency for VHA for the purposes 
stated for this system of records, provided that disclosure is of 
limited individual identification information.
    21. To appropriate agencies, entities and persons when (1) VA 
suspects or has confirmed that there has been a breach of the system of 
records; (2) VA has determined that as a result of the suspected or 
confirmed breach there is a risk to individuals, VA (including its 
information systems, programs and operations), the Federal Government 
or national security; and (3) the disclosure made to such agencies, 
entities or persons reasonably necessary to assist in connection with 
VA efforts to respond to the suspected or confirmed breach or to 
prevent, minimize or remedy such harm.
    22. To the general public, on its own initiative, via an internet 
website, Primary Care Management Module information, including the 
names of its providers, provider panel sizes and reports on provider 
performance measures of quality when approved in accordance with VA 
policy.
    23. To other Federal agencies to assist such agencies in preventing 
and detecting possible fraud or abuse by individuals in their 
operations and programs.
    24. To a nonprofit organization if the release is directly 
connected with the conduct of programs and the utilization of benefits 
under title 38, provided that the disclosure is limited to the names 
and addresses of present or former members of the armed services or 
their beneficiaries, the records will not be used for any purpose other 
than that stated in the request, and the organization is aware of the 
penalty provision of 38 U.S.C. 5701(f).
    25. To HUD, including demographic information, for the purpose of 
reducing homelessness among Veterans by implementing the Federal 
strategic plan to prevent and end homelessness and by evaluating and 
monitoring the HUD-Veterans Affairs Supported Housing program.
    26. To the FDA, Department of Health and Human Services concerning 
an adverse drug reaction of a patient, for the purpose of quality of 
care management, including detection, treatment, monitoring, reporting, 
analysis and follow-up actions relating to adverse drug reactions.
    27. To an organization with whom VA has a documented partnership, 
arrangement or agreement (e.g., Health Information Exchange, Healthcare 
internet Service Provider, Direct and CommonWell Health Alliance 
Network), for the purpose of identifying and correlating patients. This 
information may include Veteran identifiers and demographic information 
(e.g., name, SSN, address, date of birth).
    28. To Center for Disease Control and Prevention (CDC) and/or their 
designee or other Federal or state public health authorities in 
response to its request or at the initiation of VA, in connection with 
disease-tracking, patient outcomes, bio-surveillance or other health 
information required for program accountability.
    29. To another Federal agency or Federal entity, when VA determines 
that information from this system of records is reasonably necessary to 
assist the recipient agency or entity in (1) responding to a suspected 
or confirmed breach or (2) preventing, minimizing or remedying the risk 
of harm to individuals, the recipient agency or entity (including its 
information systems, programs and operations), the Federal Government 
or national security, resulting from a suspected or confirmed breach.
    30. To health and welfare agencies, housing resources and community 
providers, consistent with good medical-ethical practices, for Veterans 
assessed by or engaged in VA homeless programs for purposes of 
coordinating care, expediting access to housing, providing medical and 
related services, participating in coordinated entry processes, 
reducing Veteran homelessness, identifying homeless individuals in need 
of immediate assistance and ensuring program accountability by 
assigning and tracking responsibility for urgently required care.
    31. To the NCI and/or their designee and/or a state cancer or tumor 
registry in response to its request or at the initiation of VA for the 
purpose of population-based activities to improve health and disease 
management.

[[Page 22116]]

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records are maintained on electronic storage media including 
magnetic tape, disk, laser optical media and the VA Enterprise Cloud.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records are retrieved by name, Social Security Number or other 
assigned identifiers of the individuals on whom they are maintained.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records in this system are retained and disposed of in accordance 
with the schedule approved by the Archivist of the United States, 
General Records Schedule, 5.2, item 020.

ADMINISTRATIVE, TECHNICAL AND PHYSICAL SAFEGUARDS:
    1. Access to and use of national patient databases are limited to 
those persons whose official duties require such access, and VA has 
established security procedures to ensure that access is appropriately 
limited. Information security officers and system data stewards review 
and authorize data access requests. VA regulates data access with 
security software that authenticates users and requires individually 
unique codes and passwords. VA provides information security training 
to all staff and instructs staff on the responsibility each person has 
for safeguarding data confidentiality.
    2. VA maintains Business Associate Agreements and Non-Disclosure 
Agreements with contracted resources in order to maintain the 
confidentiality of the information.
    3. Physical access to computer rooms housing national patient 
databases are restricted to authorized staff and protected by a variety 
of security devices. Unauthorized employees, contractors and other 
staff are not allowed in computer rooms. The Federal Protective Service 
or other security personnel provide physical security for the buildings 
housing computer rooms and data centers.
    4. Data transmissions between operational systems and national 
patient databases maintained by this system of record are protected by 
state-of-the-art telecommunication software and hardware. This may 
include firewalls, encryption and other security measures necessary to 
safeguard data as it travels across the VA Wide Area Network. Data may 
be transmitted via a password protected spreadsheet and placed on the 
secured SharePoint Web portal by the user that has been provided access 
to their secure file. Data can only be accessed by authorized personnel 
from each facility within the Polytrauma System of Care and the 
Physical Medicine and Rehabilitation Program Office.
    5. In most cases, copies of backup computer files are maintained at 
off-site locations.
    6. VA Enterprise Cloud data storage conforms to security protocols 
as stipulated in VA Directives 6500 and 6517. Access control standards 
are stipulated in specific agreements with cloud vendors to restrict 
and monitor access.

RECORD ACCESS PROCEDURES:
    Individuals seeking information on the existence and content of 
records in this system pertaining to them should contact the system 
manager in writing as indicated above or write or visit the VA facility 
location where they normally receive their care. A request for access 
to records must contain the requester's full name, address and 
telephone number, be signed by the requester and describe the records 
sought in sufficient detail to enable VA personnel to locate them with 
a reasonable amount of effort.

CONTESTING RECORD PROCEDURES:
    Individuals seeking to contest or amend records in this system 
pertaining to them should contact the system manager in writing as 
indicated above. A request to contest or amend records must state 
clearly and concisely what record is being contested, the reasons for 
contesting it, and the proposed amendment to the record.

NOTIFICATION PROCEDURES:
    Generalized notice is provided by the publication of this notice. 
For specific notice, see Record Access Procedure, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    69 FR 18436 (April 7, 2004); 73 FR 16103 (March 26, 2008); 75 FR 
72873 (November 26, 2010); 77 FR 27863 (May 11, 2012); 79 FR 8245 
(February 11, 2014); 83 FR 6094 (February 12, 2018).

VA Appendix 4

------------------------------------------------------------------------
             Database name                           Location
------------------------------------------------------------------------
Addiction Severity Index (ASI).........  Veterans Affairs Medical
                                          Center, 7180 Highland Drive,
                                          Pittsburgh, PA 15206.
Bidirectional Health Information         SunGard, 1500 Spring Garden
 Exchange (BHIE).                         Street, Philadelphia, PA
                                          19130.
Breast Care Registry...................  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
VA Clinical Assessment Reporting and     Digital Realty, 350 E Cermak
 Tracking (CART) Program.                 Road, Main Building 7th
                                          Transport RM, Chicago, IL
                                          60616.
                                         Evoque Data Centers, 11830 Webb
                                          Chapel Road, Suite 200,
                                          Dallas, TX 75234.
Consolidated Mail Outpatient Pharmacy    Southwest CMOP, 3675 East
 (CMOP) Centralized Database System.      Britannia Drive, Tucson, AZ
                                          85706.
Converged Registries Solution (CRS)....  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Cruetzfelet-Jakob Disease Lookback       Cincinnati Veterans Affairs
 Dataset (CJDLD).                         Medical Center, 3200 Vine
                                          Street, Cincinnati, OH 45220.
Defense and Veterans Eye Injury          Austin Information Technology
 Registry (DVEIR).                        Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Dental Encounter System (DES)..........  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Eastern Pacemaker Surveillance Center    Washington, DC Veterans Affairs
 Database.                                Medical Center, 50 Irving
                                          Street NW, Washington, DC
                                          20422.
Emerging Pathogens Initiative (EPI)....  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Federal Health Information Exchange      SunGard, 1500 Spring Garden
 (FHIE).                                  Street, Philadelphia, PA
                                          19130.

[[Page 22117]]

 
Financial Clinical Data Mart (FCDM)....  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Former Prisoner of War Statistical       Austin Information Technology
 Tracking System.                         Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Functional Status and Outcome Database   Austin Information Technology
 (FSOD).                                  Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Home Based Primary Care (HBC)..........  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Homeless Operational Management &,       Austin Information Technology
 Evaluation System (HOMES).               Center, 1615 Woodward Street,
                                          Austin, Texas 78772.
Homeless Veterans Registry.............  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Implant Tracking Registry..............  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
IPEC Legionella Case Report Module.....  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Mammography Quality Standards (MQS) VA.  Durham Veterans Affairs Medical
                                          Center, 508 Fulton Street,
                                          Durham, NC 27705.
Master Person Index--VHA...............  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Medical SAS File (MDP) (Medical          Austin Information Technology
 District Planning (MEDIPRO)).            Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Multiple Sclerosis Surveillance Request  Austin Information Technology
 (MSSR) Registry.                         Center, 1615 Woodward Street,
                                          Austin, TX 78772.
National Center for Patient Safety       Palo Alto Veterans Affairs
 Public Health System (NCPSPHS).          Medical Center, 3801 Miranda
                                          Avenue, Palo Alto, CA 94304.
National Mental Health Database System   Veterans Affairs Medical
 (NMHDS).                                 Center, 7180 Highland Drive,
                                          Pittsburgh, PA 15206.
National Medical Information System      Austin Information Technology
 (NMIS).                                  Center, 1615 Woodward Street,
                                          Austin, TX 78772.
National Survey of Veterans (NSV)......  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Patient Assessment File (PAF)..........  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Pharmacy Benefits Management (PBM).....  Edward Hines Junior Hospital
                                          Veterans Affairs Medical
                                          Center, 5000 Avenue, Hines, IL
                                          60141.
Remote Order Entry System (ROES).......  VA Denver Regional Office, 155
                                          Van Gordon Street, Lakewood,
                                          CO 80228-1709.
Resident Assessment Instrument/Minimum   Austin Information Technology
 Data Set (RAI/MDS).                      Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Traumatic Brain Injury (TBI) Registry..  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
VA National Clozapine Registry (NCCC)..  Dallas Veterans Affairs Medical
                                          Center, 4500 South Lancaster
                                          Road, Dallas, TX 75216.
Veterans Affairs Surgical Quality        VA Central Office (VACO),
 Improvement Program (VASQIP).            National Surgery Office
                                          (11SURG), 810 Vermont Avenue
                                          NW, Washington, DC 20420.
VA Vital Status File (VSF).............  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Veterans Administration Central Cancer   Washington DC Veterans Affairs
 Registry (VACCR).                        Medical Center, 50 Irving
                                          Street NW, Washington, DC
                                          20422.
Veterans Health Administration Support   Austin Information Technology
 Service Center (VSSC).                   Center, 1615 Woodward Street,
                                          Austin, TX 78772.
Veterans Integrated Registry Platform..  Austin Information Technology
                                          Center, 1615 Woodward Street,
                                          Austin, TX 78772.
War Related Illness and Injury Study     Palo Alto VA Medical Center,
 Center (WRIISC) Database.                3801 Miranda Avenue, Mail Code
                                          151Y, Palo Alto, CA 94304.
------------------------------------------------------------------------

[FR Doc. 2023-07638 Filed 4-11-23; 8:45 am]
BILLING CODE 8320-01-P