Privacy Act of 1974; System of Records, 32292-32296 [2023-10726]
Download as PDF
<![CDATA[
32292
Federal Register / Vol. 88, No. 97 / Friday, May 19, 2023 / Notices
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL
SAFEGUARDS:
personnel to locate them with a
reasonable amount of effort.
1. Access to patient-specific
information located in Call Center
databases and storage areas is restricted
to VA employees and contract personnel
on a ‘‘need-to-know’’ basis; strict control
measures are enforced to ensure that
disclosure to these individuals is also
based on this same principle. Generally,
VA Call Center areas are locked after
normal duty hours or when the Call
Center is closed, and the facilities are
protected from outside access by the
Federal Protective Service or other
security personnel.
2. Access to VA and contracted Call
Centers and computer rooms is
generally limited by appropriate locking
devices and restricted to authorized VA
employees and vendor personnel.
Information in VistA may be accessed
by authorized VA employees or
authorized contract employees. Access
to file information is controlled at two
levels; the system recognized authorized
employees or contract employees by a
series of individually unique
passwords/codes as a part of each data
message, and personnel are limited to
only that information in the file which
is needed in the performance of their
official duties. Information that is
downloaded from VistA and maintained
on VA is afforded similar storage and
access protections as the data that is
maintained in the original files access to
information stored on automated storage
media at other VA and contract
locations is controlled by individually
unique passwords/codes.
3. Remote access to VHA information
in VistA is provided to those Call Center
employees, either VA or contract staff,
that require access to information stored
in the health record. Access to this
information is protected through
hardened user access and is controlled
by individual unique passwords.
Additionally, contracted Call Centers,
either VA or private sector, are required
to have a separate computer security
plan that meets national information
security requirements.
ddrumheller on DSK120RN23PROD with NOTICES1
RECORD ACCESS PROCEDURES:
Individuals seeking information on
the existence and content of records in
this system pertaining to them should
contact the system manager in writing
as indicated above or may write or visit
the VA facility location where they
normally receive their care. A request
for access to records must contain the
requester’s full name, address,
telephone number, be signed by the
requester, and describe the records
sought in sufficient detail to enable VA
VerDate Sep<11>2014
18:30 May 18, 2023
Jkt 259001
CONTESTING RECORD PROCEDURES:
Individuals seeking to contest or
amend records in this system pertaining
to them should contact the system
manager in writing as indicated above.
A request to contest or amend records
must state clearly and concisely what
record is being contested, the reasons
for contesting it, and the proposed
amendment to the record.
NOTIFICATION PROCEDURES:
Generalized notice is provided by the
publication of this notice. For specific
notice, see Record Access Procedure,
above.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
67 FR 63497 (October 11, 2002); 74 FR
21742 (May 8, 2009).
[FR Doc. 2023–10732 Filed 5–18–23; 8:45 am]
BILLING CODE 8320–01–P
DEPARTMENT OF VETERANS
AFFAIRS
Privacy Act of 1974; System of
Records
Department of Veterans Affairs
(VA), Office of Mental Health and
Suicide Prevention (OMHSP).
ACTION: Notice of a new system of
records.
AGENCY:
The Privacy Act of 1974
requires that all agencies publish in the
Federal Register a notice of the
existence and character of their systems
of records. Notice is hereby given that
the Department of Veterans Affairs (VA)
is establishing a new system of records
entitled, ‘‘PAWS Portal-VA’’ (212VA10).
‘‘PAWS’’ is an acronym for ‘‘Puppies
Assisting Wounded Servicemembers’’.
DATES: Comments on this new system of
records must be received no later than
30 days after date of publication in the
Federal Register. If no public comment
is received during the period allowed
for comment or unless otherwise
published in the Federal Register by
VA, the new system of records will
become effective a minimum of 30 days
after date of publication in the Federal
Register. If VA receives public
comments, VA shall review the
comments to determine whether any
changes to the notice are necessary.
ADDRESSES: Comments may be
submitted through www.Regulations.gov
or mailed to VA Privacy Service, 810
Vermont Avenue NW, (005R1A),
SUMMARY:
PO 00000
Frm 00117
Fmt 4703
Sfmt 4703
Washington, DC 20420. Comments
should indicate that they are submitted
in response to ‘‘PAWS Portal-VA’’
(212VA10). Comments received will be
available at www.Regulations.gov for
public viewing, inspection or copies.
FOR FURTHER INFORMATION CONTACT:
Stephania Griffin, Veterans Health
Administration (VHA) Privacy Officer,
Department of Veterans Affairs, 810
Vermont Avenue NW, Washington, DC
20420, stephania.griffin@va.gov,
telephone number 704–245–2492 (Note:
This is not a toll-free number).
SUPPLEMENTARY INFORMATION:
I. Description of Proposed Systems of
Records
Information in this system of records
is used to establish and maintain
records of individuals participating in
the Puppies Assisting Wounded
Servicemembers for Veterans (PAWS)
program. The Puppies Assisting
Wounded Servicemembers for Veterans
Therapy Act (hereinafter referred to as
‘‘the Act’’) was signed into law by the
President on August 25, 2021 (Pub. L.
117–37, 125, Stat. 329). Section (2) of
the Act requires VA to conduct a pilot
program to provide canine training to
eligible Veterans. Section 2(h)
establishes VA’s reporting requirements
associated with the five-year pilot.
Information is maintained in the PAWS
Portal. The Portal will be the
administrative repository of information
required to support the program with
ongoing assessment and monitoring.
Designated VA staff will enter the
contact and assessment information into
the portal for each Veteran. This
information will be available to service
dog organizations (SDOs) to track
attendance. Additionally, de-identified
data generated from the PAWS Portal
will be used in reports to OMHSP, VA
Central Office and Congress on the
effectiveness of the program. The PAWS
Portal will collect Veteran patient
demographic data to evaluate the
success of the program.
II. Proposed Routine Use Disclosures of
Data in the System
We are proposing to establish the
following routine use disclosures of
information maintained in the system.
1. Congress: VA may disclose
information to a Member of Congress or
staff acting upon the Member’s behalf
when the Member or staff requests the
information on behalf of, and at the
request of, the individual who is the
subject of the record.
2. Data breach response and
remediation, for VA: VA may disclose
information to appropriate agencies,
E:\FR\FM\19MYN1.SGM
19MYN1
ddrumheller on DSK120RN23PROD with NOTICES1
Federal Register / Vol. 88, No. 97 / Friday, May 19, 2023 / Notices
entities, and persons when (1) VA
suspects or has confirmed that there has
been a breach of the system of records,·
(2) VA has determined that as a result
of the suspected or confirmed breach
there is a risk of harm to individuals,
VA (including its information systems,
programs, and operations), the Federal
Government, or national security; and
(3) the disclosure made to such
agencies, entities, and persons is
reasonably necessary to assist in
connection with VA’s efforts to respond
to the suspected or confirmed breach or
to prevent, minimize, or remedy such
harm.
3. Data breach response and
remediation, for another Federal
agency: VA may disclose information to
another Federal agency or Federal
entity, when VA determines that the
information from this system of records
is reasonably necessary to assist the
recipient agency or entity in (1)
responding to a suspected or confirmed
breach or (2) preventing, minimizing, or
remedying the risk of harm to
individuals, the recipient agency or
entity (including its information
systems, programs, and operations), the
Federal Government, or national
security, resulting from a suspected or
confirmed breach.
4. Law Enforcement: VA may disclose
information to a Federal, state, local,
territorial, tribal, or foreign law
enforcement authority or other
appropriate entity charged with the
responsibility of investigating or
prosecuting such violation or charged
with enforcing or implementing such
law, provided that the disclosure is
limited to information that, either alone
or in conjunction with other
information, indicates a violation or
potential violation of law, whether civil,
criminal, or regulatory in nature. The
disclosure of the names and addresses
of Veterans and their dependents from
VA records under this routine use must
also comply with the provisions of 38
U.S.C. 5701.
5. DoJ for Litigation or Administrative
Proceeding: VA may disclose
information to the Department of Justice
(DoJ), or in a proceeding before a court,
adjudicative body, or other
administrative body before which VA is
authorized to appear, when:
(a) VA or any component thereof;
(b) Any VA employee in his or her
official capacity;
(c) Any VA employee in his or her
individual capacity where DoJ has
agreed to represent the employee; or
(d) The United States, where VA
determines that litigation is likely to
affect the agency or any of its
components, is a party to such
VerDate Sep<11>2014
18:30 May 18, 2023
Jkt 259001
proceedings or has an interest in such
proceedings, and VA determines that
use of such records is relevant and
necessary to the proceedings.
6. Contractors: VA may disclose
information to contractors, grantees,
experts, consultants, students, and
others performing or working on a
contract, service, grant, cooperative
agreement, or other assignment for VA,
when reasonably necessary to
accomplish an agency function related
to the records.
7. OPM: VA may disclose information
to the Office of Personnel Management
(OPM) in connection with the
application or effect of civil service
laws, rules, regulations, or OPM
guidelines in particular situations.
8. EEOC: VA may disclose
information to the Equal Employment
Opportunity Commission (EEOC) in
connection with investigations of
alleged or possible discriminatory
practices, examination of Federal
affirmative employment programs, or
other functions of the Commission as
authorized by law.
9. FLRA: VA may disclose information
to the Federal Labor Relations Authority
(FLRA) in connection with: the
investigation and resolution of
allegations of unfair labor practices, the
resolution of exceptions to arbitration
awards when a question of material fact
is raised; matters before the Federal
Service Impasses Panel; and the
investigation of representation petitions
and the conduct or supervision of
representation elections.
10. MSPB: VA may disclose
information to the Merit Systems
Protection Board (MSPB) in connection
with appeals, special studies of the civil
service and other merit systems, review
of rules and regulations, investigation of
alleged or possible prohibited personnel
practices, and such other functions
promulgated in 5 U.S.C. 1205 and 1206,
or as authorized by law.
11. NARA: VA may disclose
information to the National Archives
and Records Administration (NARA) in
records management inspections
conducted under 44 U.S.C. 2904 and
2906, or other functions authorized by
laws and policies governing NARA
operations and VA records management
responsibilities.
12. Health Care Providers, for Referral
by VA: VA may disclose information to:
(1) a Federal agency or health care
provider when VA refers a patient for
medical and other health services, or
authorizes a patient to obtain such
services and the information is needed
by the Federal agency or health care
provider to perform the services; or (2)
a Federal agency or to health care
PO 00000
Frm 00118
Fmt 4703
Sfmt 4703
32293
provider under the provisions of 38
U.S.C. 513, 7409, 8111, or 8153, when
treatment is rendered by VA under the
terms of such contract or agreement or
the issuance of an authorization, and the
information is needed for purposes of
medical treatment or follow-up,
determination of eligibility for benefits,
or recovery by VA of the costs of the
treatment.
13. Health Care Providers, for Referral
to VA: VA may disclose information to
a non-VA health care provider when
that health care provider has referred
the individual to VA for medical or
other health services.
14. Covered Entities, for their Health
Care Operations: VA may disclose
information to a covered entity for their
health care operations, provided that the
entity either has or had a relationship
with the individual, and the disclosure
is for the purpose of:
(a) Conducting quality assessment and
improvement activities; patient safety
activities as defined in 42 CFR 3.20;
population-based activities relating to
improving health or reducing health
care costs, protocol development, case
management, and care coordination;
contacting of health care providers and
patients with information about
treatment alternatives; and related
functions that do not include treatment;
(b) Reviewing the competence or
qualifications of health care
professionals; evaluating practitioner
and provider performance, health plan
performance; conducting training
programs for health care practitioners,
trainees, and students; training of nonhealth care professionals; accreditation,
certification, licensing, or credentialing
activities; or
(c) Health care fraud and abuse
detection or compliance.
15. Federal Agencies, for Research:
VA may disclose information to a
Federal agency for the purpose of
conducting research and data analysis to
perform a statutory purpose of that
Federal agency upon the written request
of that agency.
16. Researchers, for Research: VA
may disclose information to
epidemiological and other research
facilities approved by the Under
Secretary for Health for research
purposes determined to be necessary
and proper, provided that the names
and addresses of Veterans and their
dependents will not be disclosed unless
those names and addresses are first
provided to VA by the facilities making
the request.
17. OMB: VA may disclose
information to the Office of
Management and Budget (OMB) for the
performance of its statutory
E:\FR\FM\19MYN1.SGM
19MYN1
32294
Federal Register / Vol. 88, No. 97 / Friday, May 19, 2023 / Notices
responsibilities for evaluating Federal
programs.
18. Nonprofits, for Release of Name
and/or Address (RONA): VA may
disclose information to a nonprofit
organization if the release is directly
connected with the conduct of programs
and the utilization of benefits under title
38, provided that the disclosure is
limited the names and addresses of
present or former members of the armed
services or their beneficiaries, the
records will not be used for any purpose
other than that stated in the request, and
the organization is aware of the penalty
provision of 38 U.S.C. 5701(f).
Signing Authority
The Senior Agency Official for
Privacy, or designee, approved this
document and authorized the
undersigned to sign and submit the
document to the Office of the Federal
Register for publication electronically as
an official document of the Department
of Veterans Affairs. Kurt D. DelBene,
Assistant Secretary for Information and
Technology and Chief Information
Officer, approved this document on
April 7, 2023 for publication.
Dated: May 16, 2023.
Amy L. Rose,
Program Analyst, VA Privacy Service, Office
of Information Security, Office of Information
and Technology, Department of Veterans
Affairs.
SYSTEM NAME AND NUMBER:
VA’’ (212VA10)
‘‘PAWS PORTAL–
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
These records are the responsibility of
the Office of Mental Health and Suicide
Prevention (OMHSP), Veterans Health
Administration, Department of Veterans
Affairs. The OMHSP is located at 810
Vermont Avenue NW, Washington, DC
20420. Records are maintained in the
Microsoft Government Cloud at the
Boydton Data Center in Boydton,
Virginia.
ddrumheller on DSK120RN23PROD with NOTICES1
SYSTEM MANAGER(S):
Stacey Pollack, Ph.D., National
Mental Health Director, Program Policy
Implementation, Office of Mental Health
and Suicide Prevention, 810 Vermont
Avenue NW, Washington, DC 20420,
telephone number 202–738–2932 (Note:
This is not a toll-free number).
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
The Puppies Assisting Wounded
Servicemembers for Veterans Therapy
Act (hereinafter referred to as ‘‘the Act’’)
was signed into law by the President on
August 25, 2021 (Pub. L. 117–37, 125,
Stat. 329).
VerDate Sep<11>2014
18:30 May 18, 2023
Jkt 259001
PURPOSE(S) OF THE SYSTEM:
The ‘‘PAWS Portal–VA’’ will be used
to store information that is shared
between the VA medical centers
(VAMCs) participating as the pilot sites,
and the service dog organizations
(SDOs) providing the training. The
Portal will be used to track Veteran
attendance in the program as well as the
management and effectiveness of the
program. The Portal may also be used to
determine the impact on Veteran care
and capture information on Veteran
satisfaction with the program.
Additionally, de-identified data
generated from the PAWS Portal will be
used in reports to OMHSP, VA Central
Office and Congress on the effectiveness
of the program.
CATEGORIES OF INDIVIDUALS COVERED BY THE
SYSTEM:
The records in the system are on
Veterans who have received VA health
care benefits under 38 U.S.C, Chapter
17, and SDO trainers participating in the
program.
CATEGORIES OF RECORDS IN THE SYSTEM:
Information entered into the PAWS
Portal includes demographic
information, such as name, address,
phone number, email address, and the
last four of the Veteran’s Social Security
number. In addition, information
regarding the Veteran’s attendance in
the program is collected, such as date of
trainings and location of trainings. SDO
trainer names and their email addresses
are collected in this system. Eligibilityrelated information may also be
collected, such as referrals, VA staff
evaluations, correspondence, and
documentation of phone calls, and any
information regarding a safety issue
around Veterans, SDO trainers, or dogs.
RECORD SOURCE CATEGORIES:
Information in this system of records
is provided by Veteran participants in
the pilot program, the PAWS Portal VA
staff, and by the SDO and their trainers.
ROUTINE USES OF RECORDS MAINTAINED IN THE
SYSTEM, INCLUDING CATEGORIES OF USERS AND
PURPOSES OF SUCH USES:
To the extent that records contained
in the system include information
protected by 45 CFR parts 160 and 164,
i.e., individually identifiable health
information of VHA or any of its
business associates, and 38 U.S.C. 7332,
i.e., medical treatment information
related to drug abuse, sickle cell anemia,
or infection with the human
immunodeficiency virus, that
information cannot be disclosed under a
routine use unless there is also specific
disclosure authority in both 38 U.S.C.
7332 and 45 CFR parts 160 and 164.
PO 00000
Frm 00119
Fmt 4703
Sfmt 4703
1. Congress: VA may disclose
information to a Member of Congress or
staff acting upon the Member’s behalf
when the Member or staff requests the
information on behalf of, and at the
request of, the individual who is the
subject of the record.
2. Data breach response and
remediation, for VA: VA may disclose
information to appropriate agencies,
entities, and persons when (1) VA
suspects or has confirmed that there has
been a breach of the system of records;
(2) VA has determined that as a result
of the suspected or confirmed breach
there is a risk of harm to individuals,
VA (including its information systems,
programs, and operations), the Federal
Government, or national security; and
(3) the disclosure made to such
agencies, entities, and persons is
reasonably necessary to assist in
connection with VA’s efforts to respond
to the suspected or confirmed breach or
to prevent, minimize, or remedy such
harm.
3. Data breach response and
remediation, for another Federal
agency: VA may disclose information to
another Federal agency or Federal
entity, when VA determines that the
information from this system of records
is reasonably necessary to assist the
recipient agency or entity in (1)
responding to a suspected or confirmed
breach or (2) preventing, minimizing, or
remedying the risk of harm to
individuals, the recipient agency or
entity (including its information
systems, programs, and operations), the
Federal Government, or national
security, resulting from a suspected or
confirmed breach.
4. Law Enforcement: VA may disclose
information to a Federal, state, local,
territorial, tribal, or foreign law
enforcement authority or other
appropriate entity charged with the
responsibility of investigating or
prosecuting such violation or charged
with enforcing or implementing such
law, provided that the disclosure is
limited to information that, either alone
or in conjunction with other
information, indicates a violation or
potential violation of law, whether civil,
criminal, or regulatory in nature. The
disclosure of the names and addresses
of Veterans and their dependents from
VA records under this routine use must
also comply with the provisions of 38
U.S.C. 5701.
5. DoJ for Litigation or Administrative
Proceeding: VA may disclose
information to the Department of Justice
(DoJ), or in a proceeding before a court,
adjudicative body, or other
administrative body before which VA is
authorized to appear, when:
E:\FR\FM\19MYN1.SGM
19MYN1
ddrumheller on DSK120RN23PROD with NOTICES1
Federal Register / Vol. 88, No. 97 / Friday, May 19, 2023 / Notices
(a) VA or any component thereof;
(b) Any VA employee in his or her
official capacity;
(c) Any VA employee in his or her
individual capacity where DoJ has
agreed to represent the employee; or
(d) The United States, where VA
determines that litigation is likely to
affect the agency or any of its
components, is a party to such
proceedings or has an interest in such
proceedings, and VA determines that
use of such records is relevant and
necessary to the proceedings.
6. Contractors: VA may disclose
information to contractors, grantees,
experts, consultants, students, and
others performing or working on a
contract, service, grant, cooperative
agreement, or other assignment for VA,
when reasonably necessary to
accomplish an agency function related
to the records.
7. OPM: VA may disclose information
to the Office of Personnel Management
(OPM) in connection with the
application or effect of civil service
laws, rules, regulations, or OPM
guidelines in particular situations.
8. EEOC: VA may disclose
information to the Equal Employment
Opportunity Commission (EEOC) in
connection with investigations of
alleged or possible discriminatory
practices, examination of Federal
affirmative employment programs, or
other functions of the Commission as
authorized by law.
9. FLRA: VA may disclose information
to the Federal Labor Relations Authority
(FLRA) in connection with: the
investigation and resolution of
allegations of unfair labor practices, the
resolution of exceptions to arbitration
awards when a question of material fact
is raised; matters before the Federal
Service Impasses Panel; and the
investigation of representation petitions
and the conduct or supervision of
representation elections.
10. MSPB: VA may disclose
information to the Merit Systems
Protection Board (MSPB) in connection
with appeals, special studies of the civil
service and other merit systems, review
of rules and regulations, investigation of
alleged or possible prohibited personnel
practices, and such other functions
promulgated in 5 U.S.C. 1205 and 1206,
or as authorized by law.
11. NARA: VA may disclose
information to the National Archives
and Records Administration (NARA) in
records management inspections
conducted under 44 U.S.C. 2904 and
2906, or other functions authorized by
laws and policies governing NARA
operations and VA records management
responsibilities.
VerDate Sep<11>2014
18:30 May 18, 2023
Jkt 259001
12. Health Care Providers, for Referral
by VA: VA may disclose information to:
(1) a Federal agency or health care
provider when VA refers a patient for
medical and other health services, or
authorizes a patient to obtain such
services and the information is needed
by the Federal agency or health care
provider to perform the services; or (2)
a Federal agency or to health care
provider under the provisions of 38
U.S.C. 513, 7409, 8111, or 8153, when
treatment is rendered by VA under the
terms of such contract or agreement or
the issuance of an authorization, and the
information is needed for purposes of
medical treatment or follow-up,
determination of eligibility for benefits,
or recovery by VA of the costs of the
treatment.
13. Health Care Providers, for Referral
to VA: VA may disclose information to
a non-VA health care provider when
that health care provider has referred
the individual to VA for medical or
other health services.
14. Covered Entities, for their Health
Care Operations: VA may disclose
information to a covered entity for their
health care operations, provided that the
entity either has or had a relationship
with the individual, and the disclosure
is for the purpose of:
(a) Conducting quality assessment and
improvement activities; patient safety
activities as defined in 42 CFR 3.20;
population-based activities relating to
improving health or reducing health
care costs, protocol development, case
management, and care coordination;
contacting of health care providers and
patients with information about
treatment alternatives; and related
functions that do not include treatment;
(b) Reviewing the competence or
qualifications of health care
professionals; evaluating practitioner
and provider performance, health plan
performance; conducting training
programs for health care practitioners,
trainees, and students; training of nonhealth care professionals; accreditation,
certification, licensing, or credentialing
activities; or
(c) Health care fraud and abuse
detection or compliance.
15. Federal Agencies, for Research:
VA may disclose information to a
Federal agency for the purpose of
conducting research and data analysis to
perform a statutory purpose of that
Federal agency upon the written request
of that agency.
16. Researchers, for Research: VA
may disclose information to
epidemiological and other research
facilities approved by the Under
Secretary for Health for research
purposes determined to be necessary
PO 00000
Frm 00120
Fmt 4703
Sfmt 4703
32295
and proper, provided that the names
and addresses of Veterans and their
dependents will not be disclosed unless
those names and addresses are first
provided to VA by the facilities making
the request.
17. OMB: VA may disclose
information to the Office of
Management and Budget (OMB) for the
performance of its statutory
responsibilities for evaluating Federal
programs.
18. Nonprofits, for Release of Name
and/or Address (RONA): VA may
disclose information to a nonprofit
organization if the release is directly
connected with the conduct of programs
and the utilization of benefits under title
38, provided that the disclosure is
limited the names and addresses of
present or former members of the armed
services or their beneficiaries, the
records will not be used for any purpose
other than that stated in the request, and
the organization is aware of the penalty
provision of 38 U.S.C. 5701(f).
POLICIES AND PRACTICES FOR STORAGE OF
RECORDS:
These records are maintained in
electronic storage media.
POLICIES AND PRACTICES FOR RETRIEVAL OF
RECORDS:
Records are retrieved by the Veteran’s
name, phone number, email address, the
last four of their Social Security
number, program attendance records or
by any combination of these identifiers.
Records are also retrieved by the name
and email address of the SDO trainers
participating in the program.
POLICIES AND PRACTICES FOR RETENTION AND
DISPOSAL OF RECORDS:
Records will be retained and
destroyed in accordance with the VA
Records Control Schedule, RCS 10–1,
6400.2: Temporary, records are to be
filed within the Veteran’s electronic
health records (DAA–0015–2015–0005–
0003) and 6400.3: Temporary, cutoff
originals and copies at the end of
calendar year. Destroy 7 years after
cutoff (DAA–0015–2015–0005–0004).
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL
SAFEGUARDS:
1. On an annual basis, employees are
required to sign a computer access
agreement acknowledging their
understanding of confidentiality
requirements. In addition, all employees
receive annual privacy awareness and
information security training. 2. Access
to electronic records is deactivated
when no longer required for official
duties. Recurring monitors are in place
to ensure compliance with nationally
and locally established security
E:\FR\FM\19MYN1.SGM
19MYN1
32296
Federal Register / Vol. 88, No. 97 / Friday, May 19, 2023 / Notices
measures. 3. Strict control measures are
enforced to ensure that access to and
disclosure from all records are limited
to VA and the SDO employees whose
official duties warrant access to those
files. 4. Access to the PAWS Portal is
restricted and requires approval prior to
access. Restricted access will be
provided to enable workflow
management to administer, monitor and
track services delivered via the PAWS
Portal.
RECORD ACCESS PROCEDURES:
Individuals seeking information
regarding access to and contesting of the
PAWS Portal records may write or visit
the VA health care facility where the
PAWS program was attended or the VA
health care facility that referred the
Veteran to participate in the PAWS
program offsite.
CONTESTING RECORD PROCEDURES:
(See Record Access Procedures
above.)
NOTIFICATION PROCEDURES:
An individual who wishes to
determine whether a record is being
maintained in this system under his or
her name or other personal identifier, or
wants to review the contents of such
record, should submit a written request,
or apply in person to the VA health care
facility where the PAWS program was
attended or to the VA health care
facility that referred the Veteran to
participate in the PAWS program offsite.
All inquiries must reasonably describe
the portion of the medical record
involved and the place and approximate
date that medical care was provided.
Inquiries should include the patient’s
full name, Social Security number, and
return address.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
None.
[FR Doc. 2023–10726 Filed 5–18–23; 8:45 am]
BILLING CODE P
DEPARTMENT OF VETERANS
AFFAIRS
ddrumheller on DSK120RN23PROD with NOTICES1
Privacy Act of 1974; System of
Records
Veterans Health
Administration, Department of Veterans
Affairs (VA).
ACTION: Notice of a modified system of
records.
AGENCY:
As required by the Privacy
Act of 1974, notice is hereby given that
SUMMARY:
VerDate Sep<11>2014
18:30 May 18, 2023
Jkt 259001
the Department of Veterans Affairs (VA)
is modifying the system of records
entitled, ‘‘National Prosthetic Patient
Database (NPPD)–VA’’ (33VA113) as set
forth in the Federal Register. This
system is used to furnish administrative
and clinical statistical procurement and
prescription information, including total
cost and summary of activity, including
equipment usage, data to VA and other
health care providers, both Federal and
non-Federal, to aid in furthering the
improvement of health care, research,
and education.
DATES: Comments on this modified
system of records must be received no
later than 30 days after date of
publication in the Federal Register. If
no public comment is received during
the period allowed for comment or
unless otherwise published in the
Federal Register by the VA, the
modified system of records will become
effective a minimum of 30 days after
date of publication in the Federal
Register. If VA receives public
comments, VA shall review the
comments to determine whether any
changes to the notice are necessary.
ADDRESSES: Comments may be
submitted through www.Regulations.gov
or mailed to VA Privacy Service, 810
Vermont Avenue NW, (005R1A),
Washington, DC 20420. Comments
should indicate that they are submitted
in response to ‘‘National Prosthetic
Patient Database (NPPD)–VA’’
(33VA113). Comments received will be
available at regulations.gov for public
viewing, inspection or copies.
FOR FURTHER INFORMATION CONTACT:
Stephania Griffin, Veterans Health
Administration (VHA) Privacy Officer,
Department of Veterans Affairs, 810
Vermont Avenue NW, Washington, DC
20420; stephania.griffin@va.gov;
telephone (704) 245–2492 (Note: this is
not a toll-free number).
SUPPLEMENTARY INFORMATION: VA is
amending the system of records by
revising the System Name; System
Number; System Location, System
Manager, Records Source Categories,
Routine Uses of Records Maintained in
the System, Policies and Practices for
Retention and Disposal of Records, and
Administrative, Technical and Physical
Safeguards. VA is republishing the
system notice in its entirety.
The System Name is being updated
from ‘‘National Prosthetic Patient
Database (NPPD)–VA’’ to ‘‘National
Prosthetic Patient Records–VA’’.
The System Number is being updated
from 33VA113 to 33VA10 to reflect the
current VHA organizational routing
symbol.
PO 00000
Frm 00121
Fmt 4703
Sfmt 4703
The System Location and the
Administrative, Technical and Physical
Safeguards sections are being updated to
replace Austin Automation Center
(AAC) with Austin Information
Technology Center (AITC).
The System Manager is updated to
replace Chief Consultant, Prosthetic and
Sensory Aids Service Strategic
Healthcare Group (113), with Executive
Director, Prosthetic and Sensory Aids
Service.
The Records Source Categories is
being updated to replace 79VA19 with
79VA10, and 24VA19 is replaced with
24VA10A7.
The language in Routine Use #6 is
being updated. It previously stated that
disclosure of the records to the
Department of Justice (DoJ) is a use of
the information contained in the records
that is compatible with the purpose for
which VA collected the records and that
VA may disclose records in this system
of records in legal proceedings before a
court or administrative body after
determining that the disclosure of the
records to the court or administrative
body is a use of the information
contained in the records that is
compatible with the purpose for which
VA collected the records. This routine
use will now state that DoJ, or in a
proceeding before a court, adjudicative
body, or other administrative body
before which VA is authorized to
appear, when:
(a) VA or any component thereof;
(b) Any VA employee in his or her
official capacity;
(c) Any VA employee in his or her
official capacity where DoJ has agreed to
represent the employee; or
(d) The United States, where VA
determines that litigation is likely to
affect the agency or any of its
components, is a party to such
proceedings or has an interest in such
proceedings, and VA determines that
use of such records is relevant and
necessary to the proceedings.
Routine use #11 is being added to
state, ‘‘To another Federal agency or
Federal entity, when VA determines
that information from this system of
records is reasonably necessary to assist
the recipient agency or entity in (1)
responding to a suspected or confirmed
breach or (2) preventing, minimizing, or
remedying the risk of harm to
individuals, the recipient agency or
entity (including its information
systems, programs, and operations), the
Federal Government, or national
security, resulting from a suspected or
confirmed breach.’’
Policies and Practices for Retention
and Disposal of Records is being
updated to remove ‘‘Regardless of the
E:\FR\FM\19MYN1.SGM
19MYN1
]]>Agencies
[Federal Register Volume 88, Number 97 (Friday, May 19, 2023)]
[Notices]
[Pages 32292-32296]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-10726]
-----------------------------------------------------------------------
DEPARTMENT OF VETERANS AFFAIRS
Privacy Act of 1974; System of Records
AGENCY: Department of Veterans Affairs (VA), Office of Mental Health
and Suicide Prevention (OMHSP).
ACTION: Notice of a new system of records.
-----------------------------------------------------------------------
SUMMARY: The Privacy Act of 1974 requires that all agencies publish in
the Federal Register a notice of the existence and character of their
systems of records. Notice is hereby given that the Department of
Veterans Affairs (VA) is establishing a new system of records entitled,
``PAWS Portal-VA'' (212VA10). ``PAWS'' is an acronym for ``Puppies
Assisting Wounded Servicemembers''.
DATES: Comments on this new system of records must be received no later
than 30 days after date of publication in the Federal Register. If no
public comment is received during the period allowed for comment or
unless otherwise published in the Federal Register by VA, the new
system of records will become effective a minimum of 30 days after date
of publication in the Federal Register. If VA receives public comments,
VA shall review the comments to determine whether any changes to the
notice are necessary.
ADDRESSES: Comments may be submitted through www.Regulations.gov or
mailed to VA Privacy Service, 810 Vermont Avenue NW, (005R1A),
Washington, DC 20420. Comments should indicate that they are submitted
in response to ``PAWS Portal-VA'' (212VA10). Comments received will be
available at www.Regulations.gov for public viewing, inspection or
copies.
FOR FURTHER INFORMATION CONTACT: Stephania Griffin, Veterans Health
Administration (VHA) Privacy Officer, Department of Veterans Affairs,
810 Vermont Avenue NW, Washington, DC 20420, [email protected],
telephone number 704-245-2492 (Note: This is not a toll-free number).
SUPPLEMENTARY INFORMATION:
I. Description of Proposed Systems of Records
Information in this system of records is used to establish and
maintain records of individuals participating in the Puppies Assisting
Wounded Servicemembers for Veterans (PAWS) program. The Puppies
Assisting Wounded Servicemembers for Veterans Therapy Act (hereinafter
referred to as ``the Act'') was signed into law by the President on
August 25, 2021 (Pub. L. 117-37, 125, Stat. 329). Section (2) of the
Act requires VA to conduct a pilot program to provide canine training
to eligible Veterans. Section 2(h) establishes VA's reporting
requirements associated with the five-year pilot. Information is
maintained in the PAWS Portal. The Portal will be the administrative
repository of information required to support the program with ongoing
assessment and monitoring. Designated VA staff will enter the contact
and assessment information into the portal for each Veteran. This
information will be available to service dog organizations (SDOs) to
track attendance. Additionally, de-identified data generated from the
PAWS Portal will be used in reports to OMHSP, VA Central Office and
Congress on the effectiveness of the program. The PAWS Portal will
collect Veteran patient demographic data to evaluate the success of the
program.
II. Proposed Routine Use Disclosures of Data in the System
We are proposing to establish the following routine use disclosures
of information maintained in the system.
1. Congress: VA may disclose information to a Member of Congress or
staff acting upon the Member's behalf when the Member or staff requests
the information on behalf of, and at the request of, the individual who
is the subject of the record.
2. Data breach response and remediation, for VA: VA may disclose
information to appropriate agencies,
[[Page 32293]]
entities, and persons when (1) VA suspects or has confirmed that there
has been a breach of the system of records,[middot] (2) VA has
determined that as a result of the suspected or confirmed breach there
is a risk of harm to individuals, VA (including its information
systems, programs, and operations), the Federal Government, or national
security; and (3) the disclosure made to such agencies, entities, and
persons is reasonably necessary to assist in connection with VA's
efforts to respond to the suspected or confirmed breach or to prevent,
minimize, or remedy such harm.
3. Data breach response and remediation, for another Federal
agency: VA may disclose information to another Federal agency or
Federal entity, when VA determines that the information from this
system of records is reasonably necessary to assist the recipient
agency or entity in (1) responding to a suspected or confirmed breach
or (2) preventing, minimizing, or remedying the risk of harm to
individuals, the recipient agency or entity (including its information
systems, programs, and operations), the Federal Government, or national
security, resulting from a suspected or confirmed breach.
4. Law Enforcement: VA may disclose information to a Federal,
state, local, territorial, tribal, or foreign law enforcement authority
or other appropriate entity charged with the responsibility of
investigating or prosecuting such violation or charged with enforcing
or implementing such law, provided that the disclosure is limited to
information that, either alone or in conjunction with other
information, indicates a violation or potential violation of law,
whether civil, criminal, or regulatory in nature. The disclosure of the
names and addresses of Veterans and their dependents from VA records
under this routine use must also comply with the provisions of 38
U.S.C. 5701.
5. DoJ for Litigation or Administrative Proceeding: VA may disclose
information to the Department of Justice (DoJ), or in a proceeding
before a court, adjudicative body, or other administrative body before
which VA is authorized to appear, when:
(a) VA or any component thereof;
(b) Any VA employee in his or her official capacity;
(c) Any VA employee in his or her individual capacity where DoJ has
agreed to represent the employee; or
(d) The United States, where VA determines that litigation is
likely to affect the agency or any of its components, is a party to
such proceedings or has an interest in such proceedings, and VA
determines that use of such records is relevant and necessary to the
proceedings.
6. Contractors: VA may disclose information to contractors,
grantees, experts, consultants, students, and others performing or
working on a contract, service, grant, cooperative agreement, or other
assignment for VA, when reasonably necessary to accomplish an agency
function related to the records.
7. OPM: VA may disclose information to the Office of Personnel
Management (OPM) in connection with the application or effect of civil
service laws, rules, regulations, or OPM guidelines in particular
situations.
8. EEOC: VA may disclose information to the Equal Employment
Opportunity Commission (EEOC) in connection with investigations of
alleged or possible discriminatory practices, examination of Federal
affirmative employment programs, or other functions of the Commission
as authorized by law.
9. FLRA: VA may disclose information to the Federal Labor Relations
Authority (FLRA) in connection with: the investigation and resolution
of allegations of unfair labor practices, the resolution of exceptions
to arbitration awards when a question of material fact is raised;
matters before the Federal Service Impasses Panel; and the
investigation of representation petitions and the conduct or
supervision of representation elections.
10. MSPB: VA may disclose information to the Merit Systems
Protection Board (MSPB) in connection with appeals, special studies of
the civil service and other merit systems, review of rules and
regulations, investigation of alleged or possible prohibited personnel
practices, and such other functions promulgated in 5 U.S.C. 1205 and
1206, or as authorized by law.
11. NARA: VA may disclose information to the National Archives and
Records Administration (NARA) in records management inspections
conducted under 44 U.S.C. 2904 and 2906, or other functions authorized
by laws and policies governing NARA operations and VA records
management responsibilities.
12. Health Care Providers, for Referral by VA: VA may disclose
information to: (1) a Federal agency or health care provider when VA
refers a patient for medical and other health services, or authorizes a
patient to obtain such services and the information is needed by the
Federal agency or health care provider to perform the services; or (2)
a Federal agency or to health care provider under the provisions of 38
U.S.C. 513, 7409, 8111, or 8153, when treatment is rendered by VA under
the terms of such contract or agreement or the issuance of an
authorization, and the information is needed for purposes of medical
treatment or follow-up, determination of eligibility for benefits, or
recovery by VA of the costs of the treatment.
13. Health Care Providers, for Referral to VA: VA may disclose
information to a non-VA health care provider when that health care
provider has referred the individual to VA for medical or other health
services.
14. Covered Entities, for their Health Care Operations: VA may
disclose information to a covered entity for their health care
operations, provided that the entity either has or had a relationship
with the individual, and the disclosure is for the purpose of:
(a) Conducting quality assessment and improvement activities;
patient safety activities as defined in 42 CFR 3.20; population-based
activities relating to improving health or reducing health care costs,
protocol development, case management, and care coordination;
contacting of health care providers and patients with information about
treatment alternatives; and related functions that do not include
treatment;
(b) Reviewing the competence or qualifications of health care
professionals; evaluating practitioner and provider performance, health
plan performance; conducting training programs for health care
practitioners, trainees, and students; training of non-health care
professionals; accreditation, certification, licensing, or
credentialing activities; or
(c) Health care fraud and abuse detection or compliance.
15. Federal Agencies, for Research: VA may disclose information to
a Federal agency for the purpose of conducting research and data
analysis to perform a statutory purpose of that Federal agency upon the
written request of that agency.
16. Researchers, for Research: VA may disclose information to
epidemiological and other research facilities approved by the Under
Secretary for Health for research purposes determined to be necessary
and proper, provided that the names and addresses of Veterans and their
dependents will not be disclosed unless those names and addresses are
first provided to VA by the facilities making the request.
17. OMB: VA may disclose information to the Office of Management
and Budget (OMB) for the performance of its statutory
[[Page 32294]]
responsibilities for evaluating Federal programs.
18. Nonprofits, for Release of Name and/or Address (RONA): VA may
disclose information to a nonprofit organization if the release is
directly connected with the conduct of programs and the utilization of
benefits under title 38, provided that the disclosure is limited the
names and addresses of present or former members of the armed services
or their beneficiaries, the records will not be used for any purpose
other than that stated in the request, and the organization is aware of
the penalty provision of 38 U.S.C. 5701(f).
Signing Authority
The Senior Agency Official for Privacy, or designee, approved this
document and authorized the undersigned to sign and submit the document
to the Office of the Federal Register for publication electronically as
an official document of the Department of Veterans Affairs. Kurt D.
DelBene, Assistant Secretary for Information and Technology and Chief
Information Officer, approved this document on April 7, 2023 for
publication.
Dated: May 16, 2023.
Amy L. Rose,
Program Analyst, VA Privacy Service, Office of Information Security,
Office of Information and Technology, Department of Veterans Affairs.
SYSTEM NAME AND NUMBER: ``PAWS PORTAL-VA'' (212VA10)
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
These records are the responsibility of the Office of Mental Health
and Suicide Prevention (OMHSP), Veterans Health Administration,
Department of Veterans Affairs. The OMHSP is located at 810 Vermont
Avenue NW, Washington, DC 20420. Records are maintained in the
Microsoft Government Cloud at the Boydton Data Center in Boydton,
Virginia.
SYSTEM MANAGER(S):
Stacey Pollack, Ph.D., National Mental Health Director, Program
Policy Implementation, Office of Mental Health and Suicide Prevention,
810 Vermont Avenue NW, Washington, DC 20420, telephone number 202-738-
2932 (Note: This is not a toll-free number).
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
The Puppies Assisting Wounded Servicemembers for Veterans Therapy
Act (hereinafter referred to as ``the Act'') was signed into law by the
President on August 25, 2021 (Pub. L. 117-37, 125, Stat. 329).
PURPOSE(S) OF THE SYSTEM:
The ``PAWS Portal-VA'' will be used to store information that is
shared between the VA medical centers (VAMCs) participating as the
pilot sites, and the service dog organizations (SDOs) providing the
training. The Portal will be used to track Veteran attendance in the
program as well as the management and effectiveness of the program. The
Portal may also be used to determine the impact on Veteran care and
capture information on Veteran satisfaction with the program.
Additionally, de-identified data generated from the PAWS Portal will be
used in reports to OMHSP, VA Central Office and Congress on the
effectiveness of the program.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
The records in the system are on Veterans who have received VA
health care benefits under 38 U.S.C, Chapter 17, and SDO trainers
participating in the program.
CATEGORIES OF RECORDS IN THE SYSTEM:
Information entered into the PAWS Portal includes demographic
information, such as name, address, phone number, email address, and
the last four of the Veteran's Social Security number. In addition,
information regarding the Veteran's attendance in the program is
collected, such as date of trainings and location of trainings. SDO
trainer names and their email addresses are collected in this system.
Eligibility-related information may also be collected, such as
referrals, VA staff evaluations, correspondence, and documentation of
phone calls, and any information regarding a safety issue around
Veterans, SDO trainers, or dogs.
RECORD SOURCE CATEGORIES:
Information in this system of records is provided by Veteran
participants in the pilot program, the PAWS Portal VA staff, and by the
SDO and their trainers.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
To the extent that records contained in the system include
information protected by 45 CFR parts 160 and 164, i.e., individually
identifiable health information of VHA or any of its business
associates, and 38 U.S.C. 7332, i.e., medical treatment information
related to drug abuse, sickle cell anemia, or infection with the human
immunodeficiency virus, that information cannot be disclosed under a
routine use unless there is also specific disclosure authority in both
38 U.S.C. 7332 and 45 CFR parts 160 and 164.
1. Congress: VA may disclose information to a Member of Congress or
staff acting upon the Member's behalf when the Member or staff requests
the information on behalf of, and at the request of, the individual who
is the subject of the record.
2. Data breach response and remediation, for VA: VA may disclose
information to appropriate agencies, entities, and persons when (1) VA
suspects or has confirmed that there has been a breach of the system of
records; (2) VA has determined that as a result of the suspected or
confirmed breach there is a risk of harm to individuals, VA (including
its information systems, programs, and operations), the Federal
Government, or national security; and (3) the disclosure made to such
agencies, entities, and persons is reasonably necessary to assist in
connection with VA's efforts to respond to the suspected or confirmed
breach or to prevent, minimize, or remedy such harm.
3. Data breach response and remediation, for another Federal
agency: VA may disclose information to another Federal agency or
Federal entity, when VA determines that the information from this
system of records is reasonably necessary to assist the recipient
agency or entity in (1) responding to a suspected or confirmed breach
or (2) preventing, minimizing, or remedying the risk of harm to
individuals, the recipient agency or entity (including its information
systems, programs, and operations), the Federal Government, or national
security, resulting from a suspected or confirmed breach.
4. Law Enforcement: VA may disclose information to a Federal,
state, local, territorial, tribal, or foreign law enforcement authority
or other appropriate entity charged with the responsibility of
investigating or prosecuting such violation or charged with enforcing
or implementing such law, provided that the disclosure is limited to
information that, either alone or in conjunction with other
information, indicates a violation or potential violation of law,
whether civil, criminal, or regulatory in nature. The disclosure of the
names and addresses of Veterans and their dependents from VA records
under this routine use must also comply with the provisions of 38
U.S.C. 5701.
5. DoJ for Litigation or Administrative Proceeding: VA may disclose
information to the Department of Justice (DoJ), or in a proceeding
before a court, adjudicative body, or other administrative body before
which VA is authorized to appear, when:
[[Page 32295]]
(a) VA or any component thereof;
(b) Any VA employee in his or her official capacity;
(c) Any VA employee in his or her individual capacity where DoJ has
agreed to represent the employee; or
(d) The United States, where VA determines that litigation is
likely to affect the agency or any of its components, is a party to
such proceedings or has an interest in such proceedings, and VA
determines that use of such records is relevant and necessary to the
proceedings.
6. Contractors: VA may disclose information to contractors,
grantees, experts, consultants, students, and others performing or
working on a contract, service, grant, cooperative agreement, or other
assignment for VA, when reasonably necessary to accomplish an agency
function related to the records.
7. OPM: VA may disclose information to the Office of Personnel
Management (OPM) in connection with the application or effect of civil
service laws, rules, regulations, or OPM guidelines in particular
situations.
8. EEOC: VA may disclose information to the Equal Employment
Opportunity Commission (EEOC) in connection with investigations of
alleged or possible discriminatory practices, examination of Federal
affirmative employment programs, or other functions of the Commission
as authorized by law.
9. FLRA: VA may disclose information to the Federal Labor Relations
Authority (FLRA) in connection with: the investigation and resolution
of allegations of unfair labor practices, the resolution of exceptions
to arbitration awards when a question of material fact is raised;
matters before the Federal Service Impasses Panel; and the
investigation of representation petitions and the conduct or
supervision of representation elections.
10. MSPB: VA may disclose information to the Merit Systems
Protection Board (MSPB) in connection with appeals, special studies of
the civil service and other merit systems, review of rules and
regulations, investigation of alleged or possible prohibited personnel
practices, and such other functions promulgated in 5 U.S.C. 1205 and
1206, or as authorized by law.
11. NARA: VA may disclose information to the National Archives and
Records Administration (NARA) in records management inspections
conducted under 44 U.S.C. 2904 and 2906, or other functions authorized
by laws and policies governing NARA operations and VA records
management responsibilities.
12. Health Care Providers, for Referral by VA: VA may disclose
information to: (1) a Federal agency or health care provider when VA
refers a patient for medical and other health services, or authorizes a
patient to obtain such services and the information is needed by the
Federal agency or health care provider to perform the services; or (2)
a Federal agency or to health care provider under the provisions of 38
U.S.C. 513, 7409, 8111, or 8153, when treatment is rendered by VA under
the terms of such contract or agreement or the issuance of an
authorization, and the information is needed for purposes of medical
treatment or follow-up, determination of eligibility for benefits, or
recovery by VA of the costs of the treatment.
13. Health Care Providers, for Referral to VA: VA may disclose
information to a non-VA health care provider when that health care
provider has referred the individual to VA for medical or other health
services.
14. Covered Entities, for their Health Care Operations: VA may
disclose information to a covered entity for their health care
operations, provided that the entity either has or had a relationship
with the individual, and the disclosure is for the purpose of:
(a) Conducting quality assessment and improvement activities;
patient safety activities as defined in 42 CFR 3.20; population-based
activities relating to improving health or reducing health care costs,
protocol development, case management, and care coordination;
contacting of health care providers and patients with information about
treatment alternatives; and related functions that do not include
treatment;
(b) Reviewing the competence or qualifications of health care
professionals; evaluating practitioner and provider performance, health
plan performance; conducting training programs for health care
practitioners, trainees, and students; training of non-health care
professionals; accreditation, certification, licensing, or
credentialing activities; or
(c) Health care fraud and abuse detection or compliance.
15. Federal Agencies, for Research: VA may disclose information to
a Federal agency for the purpose of conducting research and data
analysis to perform a statutory purpose of that Federal agency upon the
written request of that agency.
16. Researchers, for Research: VA may disclose information to
epidemiological and other research facilities approved by the Under
Secretary for Health for research purposes determined to be necessary
and proper, provided that the names and addresses of Veterans and their
dependents will not be disclosed unless those names and addresses are
first provided to VA by the facilities making the request.
17. OMB: VA may disclose information to the Office of Management
and Budget (OMB) for the performance of its statutory responsibilities
for evaluating Federal programs.
18. Nonprofits, for Release of Name and/or Address (RONA): VA may
disclose information to a nonprofit organization if the release is
directly connected with the conduct of programs and the utilization of
benefits under title 38, provided that the disclosure is limited the
names and addresses of present or former members of the armed services
or their beneficiaries, the records will not be used for any purpose
other than that stated in the request, and the organization is aware of
the penalty provision of 38 U.S.C. 5701(f).
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
These records are maintained in electronic storage media.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrieved by the Veteran's name, phone number, email
address, the last four of their Social Security number, program
attendance records or by any combination of these identifiers. Records
are also retrieved by the name and email address of the SDO trainers
participating in the program.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records will be retained and destroyed in accordance with the VA
Records Control Schedule, RCS 10-1, 6400.2: Temporary, records are to
be filed within the Veteran's electronic health records (DAA-0015-2015-
0005-0003) and 6400.3: Temporary, cutoff originals and copies at the
end of calendar year. Destroy 7 years after cutoff (DAA-0015-2015-0005-
0004).
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
1. On an annual basis, employees are required to sign a computer
access agreement acknowledging their understanding of confidentiality
requirements. In addition, all employees receive annual privacy
awareness and information security training. 2. Access to electronic
records is deactivated when no longer required for official duties.
Recurring monitors are in place to ensure compliance with nationally
and locally established security
[[Page 32296]]
measures. 3. Strict control measures are enforced to ensure that access
to and disclosure from all records are limited to VA and the SDO
employees whose official duties warrant access to those files. 4.
Access to the PAWS Portal is restricted and requires approval prior to
access. Restricted access will be provided to enable workflow
management to administer, monitor and track services delivered via the
PAWS Portal.
RECORD ACCESS PROCEDURES:
Individuals seeking information regarding access to and contesting
of the PAWS Portal records may write or visit the VA health care
facility where the PAWS program was attended or the VA health care
facility that referred the Veteran to participate in the PAWS program
offsite.
CONTESTING RECORD PROCEDURES:
(See Record Access Procedures above.)
NOTIFICATION PROCEDURES:
An individual who wishes to determine whether a record is being
maintained in this system under his or her name or other personal
identifier, or wants to review the contents of such record, should
submit a written request, or apply in person to the VA health care
facility where the PAWS program was attended or to the VA health care
facility that referred the Veteran to participate in the PAWS program
offsite. All inquiries must reasonably describe the portion of the
medical record involved and the place and approximate date that medical
care was provided. Inquiries should include the patient's full name,
Social Security number, and return address.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
None.
[FR Doc. 2023-10726 Filed 5-18-23; 8:45 am]
BILLING CODE P
