Privacy Act of 1974; System of Records, 32296-32298 [2023-10729]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 88, Number 97 (Friday, May 19, 2023)]
[Notices]
[Pages 32296-32298]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-10729]


-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Veterans Health Administration, Department of Veterans Affairs 
(VA).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: As required by the Privacy Act of 1974, notice is hereby given 
that the Department of Veterans Affairs (VA) is modifying the system of 
records entitled, ``National Prosthetic Patient Database (NPPD)-VA'' 
(33VA113) as set forth in the Federal Register. This system is used to 
furnish administrative and clinical statistical procurement and 
prescription information, including total cost and summary of activity, 
including equipment usage, data to VA and other health care providers, 
both Federal and non-Federal, to aid in furthering the improvement of 
health care, research, and education.

DATES: Comments on this modified system of records must be received no 
later than 30 days after date of publication in the Federal Register. 
If no public comment is received during the period allowed for comment 
or unless otherwise published in the Federal Register by the VA, the 
modified system of records will become effective a minimum of 30 days 
after date of publication in the Federal Register. If VA receives 
public comments, VA shall review the comments to determine whether any 
changes to the notice are necessary.

ADDRESSES: Comments may be submitted through www.Regulations.gov or 
mailed to VA Privacy Service, 810 Vermont Avenue NW, (005R1A), 
Washington, DC 20420. Comments should indicate that they are submitted 
in response to ``National Prosthetic Patient Database (NPPD)-VA'' 
(33VA113). Comments received will be available at regulations.gov for 
public viewing, inspection or copies.

FOR FURTHER INFORMATION CONTACT: Stephania Griffin, Veterans Health 
Administration (VHA) Privacy Officer, Department of Veterans Affairs, 
810 Vermont Avenue NW, Washington, DC 20420; [email protected]; 
telephone (704) 245-2492 (Note: this is not a toll-free number).

SUPPLEMENTARY INFORMATION: VA is amending the system of records by 
revising the System Name; System Number; System Location, System 
Manager, Records Source Categories, Routine Uses of Records Maintained 
in the System, Policies and Practices for Retention and Disposal of 
Records, and Administrative, Technical and Physical Safeguards. VA is 
republishing the system notice in its entirety.
    The System Name is being updated from ``National Prosthetic Patient 
Database (NPPD)-VA'' to ``National Prosthetic Patient Records-VA''.
    The System Number is being updated from 33VA113 to 33VA10 to 
reflect the current VHA organizational routing symbol.
    The System Location and the Administrative, Technical and Physical 
Safeguards sections are being updated to replace Austin Automation 
Center (AAC) with Austin Information Technology Center (AITC).
    The System Manager is updated to replace Chief Consultant, 
Prosthetic and Sensory Aids Service Strategic Healthcare Group (113), 
with Executive Director, Prosthetic and Sensory Aids Service.
    The Records Source Categories is being updated to replace 79VA19 
with 79VA10, and 24VA19 is replaced with 24VA10A7.
    The language in Routine Use #6 is being updated. It previously 
stated that disclosure of the records to the Department of Justice 
(DoJ) is a use of the information contained in the records that is 
compatible with the purpose for which VA collected the records and that 
VA may disclose records in this system of records in legal proceedings 
before a court or administrative body after determining that the 
disclosure of the records to the court or administrative body is a use 
of the information contained in the records that is compatible with the 
purpose for which VA collected the records. This routine use will now 
state that DoJ, or in a proceeding before a court, adjudicative body, 
or other administrative body before which VA is authorized to appear, 
when:
    (a) VA or any component thereof;
    (b) Any VA employee in his or her official capacity;
    (c) Any VA employee in his or her official capacity where DoJ has 
agreed to represent the employee; or
    (d) The United States, where VA determines that litigation is 
likely to affect the agency or any of its components, is a party to 
such proceedings or has an interest in such proceedings, and VA 
determines that use of such records is relevant and necessary to the 
proceedings.
    Routine use #11 is being added to state, ``To another Federal 
agency or Federal entity, when VA determines that information from this 
system of records is reasonably necessary to assist the recipient 
agency or entity in (1) responding to a suspected or confirmed breach 
or (2) preventing, minimizing, or remedying the risk of harm to 
individuals, the recipient agency or entity (including its information 
systems, programs, and operations), the Federal Government, or national 
security, resulting from a suspected or confirmed breach.''
    Policies and Practices for Retention and Disposal of Records is 
being updated to remove ``Regardless of the

[[Page 32297]]

record medium, records will be maintained and disposed of in accordance 
with the record disposition authority approved by the Archivist of the 
United States under National Archives Job No. N1-15-01-4.'' This 
section is updated to state that NPPD records will be maintained and 
disposed of in accordance with Records Control Schedule (RCS) 10-1, 
7700.4, temporary disposition; Cutoff at the end of fiscal year in 
which prosthetic procedure was concluded. Delete 3 years after cutoff. 
(N1-15-01-4, 11/17/03, item 1)
    The Report of Intent to Amend a System of Records Notice and an 
advance copy of the system notice have been sent to the appropriate 
Congressional committees and to the Director of the Office of 
Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy 
Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.

Signing Authority

    The Senior Agency Official for Privacy, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Kurt D. 
DelBene, Assistant Secretary for Information and Technology and Chief 
Information Officer, approved this document on April 5, 2023 for 
publication.

    Dated: May 16, 2023.
Amy L. Rose,
Program Analyst, VA Privacy Service, Office of Information Security, 
Office of Information and Technology, Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:
    ``National Prosthetic Patient Records-VA'' (33VA10)

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    Records are located within Department of Veterans Affairs (VA) 
medical center databases. Extracts are maintained at the Austin 
Information Technology Center (AITC), Austin, Texas, and Hines 
Information Service Center, Hines, Illinois. VA health care facility 
address locations are listed in VA Appendix I of the Biennial Privacy 
Act Issuances publication.

SYSTEM MANAGER(S):
    Official responsible for policies and procedures: Penny Nechanicky, 
Executive Director, Prosthetic and Sensory Aids Service, VA Central 
Office, 810 Vermont Avenue NW, Washington, DC 20420. Telephone number 
202-461-4239 (this is not a toll-free number).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    38 U.S.C. 527.

PURPOSE(S) OF THE SYSTEM:
    The purpose of these records is to furnish administrative and 
clinical statistical procurement and prescription information, 
including total cost and summary of activity, including equipment 
usage, data to VA and other health care providers, both Federal and 
non-Federal, to aid in furthering the improvement of health care, 
research, and education.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The records include information concerning contracted fabricators 
of prosthetic and orthotic appliances; vendors and manufacturers of 
durable medical equipment and sensory-neural aids; medical supply 
companies; VA beneficiaries; and VA employees.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The records may include information related to: VA field facility 
ordering the orthotic device; Patient Identification Number; Health 
Care Financing Administration Common Procedure Coding System (HCPCS); 
item purchased/issued to patient; cost; quantity; type of issue 
(initial/replace/repair/spare); patient eligibility category (service-
connected, prisoner of war, aid and attendance); responsible VA 
procurement officer or representative; order creation date; order 
close/delivery date; calculated processing days; transaction/purchase 
order number; type of form used to purchase item (VAF 2421, PC2421, VAF 
2529, VAF 2914, etc.); and vendor/contractor name. All other patient 
information, i.e., name, address, telephone number, can be retrieved by 
prosthetic program officials in VA Central Office by using the unique 
Patient Identification Number assigned to the patient in NPPD.

RECORD SOURCE CATEGORIES:
    Record sources include Veterans Health Information System and 
Technology Architecture (VistA)-VA (79VA10), Patient Medical Records-VA 
(24VA10A7), and Veterans' records.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 45 CFR parts 160 and 164, i.e., individually 
identifiable health information of VHA or any of its business 
associates, and 38 U.S.C. 7332; i.e., medical treatment information 
related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia, 
or infection with the human immunodeficiency virus, that information 
cannot be disclosed under a routine use unless there is also specific 
statutory authority in both 38 U.S.C. 7332 and CFR parts 160 and 164 
permitting disclosure.
    1. Law Enforcement: To a Federal, state, local, territorial, 
tribal, or foreign law enforcement authority or other appropriate 
entity charged with the responsibility of investigating or prosecuting 
such violation or charged with enforcing or implementing such law, 
provided that the disclosure is limited to information that, either 
alone or in conjunction with other information, indicates a violation 
or potential violation of law, whether civil, criminal, or regulatory 
in nature. The disclosure of the names and addresses of Veterans and 
their dependents from VA records under this routine use must also 
comply with the provisions of 38 U.S.C. 5701.
    2. VA may disclose information to furnish administrative and 
clinical statistical procurement and prescription information, 
including total cost and summary of activity, including equipment 
usage, data to VA and other health care providers, both Federal and 
non-Federal, to aid in furthering the improvement of health care, 
research and education.
    3. VA may disclose information to provide statistical and other 
information in response to legitimate and reasonable requests as 
approved by appropriate VA authorities.
    4. Congress: To a Member of Congress or staff acting upon the 
Member's behalf when the Member or staff requests the information on 
behalf of, and at the request of, the individual who is the subject of 
the record.
    5. NARA: To the National Archives and Records Administration (NARA) 
in records management inspections conducted under 44 U.S.C. 2904 and 
2906, or other functions authorized by laws and policies governing NARA 
operations and VA records management responsibilities.
    6. DOJ, Litigation, Administrative Proceeding: To the Department of 
Justice (DoJ), or in a proceeding before a court, adjudicative body, or 
other administrative body before which VA is authorized to appear, 
when:
    (a) VA or any component thereof;
    (b) Any VA employee in his or her official capacity;

[[Page 32298]]

    (c) Any VA employee in his or her official capacity where DoJ has 
agreed to represent the employee; or
    (d) The United States, where VA determines that litigation is 
likely to affect the agency or any of its components, is a party to 
such proceedings or has an interest in such proceedings, and VA 
determines that use of such records is relevant and necessary to the 
proceedings.
    7. Contractors: To contractors, grantees, experts, consultants, 
students, and others performing or working on a contract, service, 
grant, cooperative agreement, or other assignment for VA, when 
reasonably necessary to accomplish an agency function related to the 
records.
    8. Federal Agencies, Fraud and Abuse: To other Federal agencies to 
assist such agencies in preventing and detecting possible fraud or 
abuse by individuals in their operations and programs.
    9. Data Breach Response and Remediation, for VA: To appropriate 
agencies, entities, and persons when (1) VA suspects or has confirmed 
that there has been a breach of the system of records; (2) VA has 
determined that as a result of the suspected or confirmed breach there 
is a risk to individuals, VA (including its information systems, 
programs, and operations), the Federal Government, or national 
security; and (3) the disclosure made to such agencies, entities, or 
persons is reasonably necessary to assist in connection with VA efforts 
to respond to the suspected or confirmed breach or to prevent, 
minimize, or remedy such harm.
    10. Federal Agencies, Courts, Litigants, for Litigation or 
Administrative Proceedings: To another Federal agency, court, or party 
in litigation before a court or in an administrative proceeding 
conducted by a Federal agency, when the government is a party to the 
judicial or administrative proceeding.
    11. Data Breach Response and Remediation, for Another Federal 
Agency: To another Federal agency or Federal entity, when VA determines 
that information from this system of records is reasonably necessary to 
assist the recipient agency or entity in (1) responding to a suspected 
or confirmed breach or (2) preventing, minimizing, or remedying the 
risk of harm to individuals, the recipient agency or entity (including 
its information systems, programs, and operations), the Federal 
Government, or national security, resulting from a suspected or 
confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records are maintained on compact and magnetic disk.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records in this system are retrieved and indexed by Patient 
Identification Number for VA prosthetic personnel.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    NPPD records will be maintained and disposed of in accordance with 
Records Control Schedule (RCS) 10-1, 7700.4, temporary disposition; 
Cutoff at the end of fiscal year in which prosthetic procedure was 
concluded. Delete 3 years after cutoff. (N1-15-01-4, 11/17/03, item 1)

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    1. Access to VA working and storage areas is restricted to VA 
employees on a ``need to know'' basis. Generally, VA file areas are 
locked after normal duty hours and are protected from outside access by 
the Federal Protective Service. Strict control measures are enforced to 
ensure that disclosure is limited to a ``need to know'' basis. Physical 
access to the AITC is generally restricted to AITC staff, Central 
Office employees, custodial personnel, Federal Protective Service and 
authorized operational personnel through electronic locking devices. 
All other persons gaining access to the computer rooms are escorted.
    2. Access to computer rooms at health care facilities is generally 
limited by appropriate locking devices and restricted to authorized VA 
employees and vendor personnel. Automated data processing peripheral 
devices are placed in secure areas (areas that are locked or have 
limited access) or are otherwise protected. Information in the VistA 
may be accessed by authorized VA employees. Access to file information 
is controlled at two levels; the systems recognize authorized employees 
by a series of individually-unique passwords/codes as a part of each 
data message, and the employees are limited to only that information in 
the file which is needed in the performance of their official duties. 
Access to information stored on automated storage media at other VA 
locations is controlled by individually-unique passwords/codes.

RECORD ACCESS PROCEDURES:
    Individuals seeking information on the existence and content of a 
VA prosthetic-related record in this system pertaining to them should 
contact the system manager in writing as indicated above or may write 
or visit the VA facility location where they normally receive their 
care.

CONTESTING RECORD PROCEDURES:
    Individuals seeking to contest or amend records in this system 
pertaining to them should contact the system manager in writing as 
indicated above or inquire in person at the VA health care facility 
they normally receive their care. A request to contest or amend records 
must state clearly and concisely what record is being contested, the 
reasons for contesting it, and the proposed amendment to the record.

NOTIFICATION PROCEDURES:
    Generalized notice is provided by the publication of this notice. 
For specific notice, see Record Access Procedure, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    40 FR 38095 (August 26, 1975), 66 FR 20033 (April 18, 2001) 70 FR 
3980 (January 27, 2005).

[FR Doc. 2023-10729 Filed 5-18-23; 8:45 am]
BILLING CODE P