Privacy Act of 1974; System of Records, 75387-75391 [2023-24193]

Download as PDF Federal Register / Vol. 88, No. 211 / Thursday, November 2, 2023 / Notices The Unified Carrier Registration Plan Finance Subcommittee (the ‘‘Subcommittee’’) will continue its work in developing and implementing the Unified Carrier Registration Plan and Agreement. The subject matter of this meeting will include: MATTERS TO BE CONSIDERED: Proposed Agenda VII. Review of 2024 Administrative Budget—UCR Depository Manager/Plan Administrator For Discussion and Possible Subcommittee Action The UCR Depository Manager/Plan Administrator will lead a discussion regarding the 2024 UCR administrative budget. The Subcommittee may take action to recommend to the Board adoption of the 2024 budget. I. Call to Order—UCR Finance Subcommittee Chair The UCR Finance Subcommittee Chair will welcome attendees, call the meeting to order, call roll for the Subcommittee, confirm whether a quorum is present, and facilitate selfintroductions. II. Verification of Publication of Meeting Notice—UCR Executive Director The UCR Executive Director will verify the publication of the meeting notice on the UCR website and distribution to the UCR contact list via email followed by the subsequent publication of the notice in the Federal Register. III. Review and Approval of Subcommittee Agenda and Setting of Ground Rules—UCR Finance Subcommittee Chair VIII. Finance Subcommittee Meetings in 2024—UCR Finance Subcommittee Chair and UCR Executive Director The UCR Finance Subcommittee Chair and UCR Executive Director will discuss upcoming Finance Subcommittee meetings in 2024. IX. Other Business—UCR Finance Subcommittee Chair The UCR Finance Subcommittee Chair will call for any other items Subcommittee members would like to discuss. X. Adjourn—UCR Finance Subcommittee Chair For Discussion and Possible Subcommittee Action The agenda will be reviewed, and the Subcommittee will consider adoption of the agenda. Ground Rules ➢ Subcommittee action only to be taken in designated areas on agenda. khammond on DSKJM1Z7X2PROD with NOTICES provide an update on UCR finances including current year 2023 budget versus expenditures and related topics. The UCR Finance Subcommittee Chair will adjourn the meeting. The agenda will be available no later than 5:00 p.m. Eastern time, October 30, 2023 at: https://plan.ucr.gov. CONTACT PERSON FOR MORE INFORMATION: Elizabeth Leaman, Chair, Unified Carrier Registration Plan Board of Directors, (617) 305–3783, eleaman@ board.ucr.gov. IV. Review and Approval of Subcommittee Minutes From the June 27, 2023, Meeting—UCR Finance Subcommittee Chair Alex B. Leath, Chief Legal Officer, Unified Carrier Registration Plan. For Discussion and Possible Subcommittee Action Draft minutes from the June 27, 2023, Subcommittee meeting in Providence, RI will be reviewed. The Subcommittee will consider action to approve. BILLING CODE 4910–YL–P V. Revenues From 2023 and 2024 Fees—UCR Depository Manager/Plan Administrator The UCR Depository Manager/Plan Administrator will review the revenues received from the 2023 and 2024 plan year fees. VI. Management Report—UCR Finance Subcommittee Chair and UCR Depository Manager The UCR Finance Subcommittee Chair and UCR Depository Manager will VerDate Sep<11>2014 16:32 Nov 01, 2023 Jkt 262001 [FR Doc. 2023–24281 Filed 10–31–23; 11:15 am] DEPARTMENT OF VETERANS AFFAIRS Privacy Act of 1974; System of Records Veterans Health Administration (VHA), Department of Veterans Affairs (VA). ACTION: Notice of a modified system of records. AGENCY: Pursuant to the Privacy Act of 1974, notice is hereby given that the VA is modifying the system of records titled, ‘‘Administrative Data Repository– VA’’ (150VA19). This system is used as the source for the information necessary SUMMARY: PO 00000 Frm 00125 Fmt 4703 Sfmt 4703 75387 to uniquely identify a person across the Veterans Health Administration (VHA), act as a record locator system for person records across the Administration, master the identity data and synchronize updates and changes to all the systems that know that person. DATES: Comments on this modified system of records must be received no later than 30 days after date of publication in the Federal Register. If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by VA, the modified system of records will become effective a minimum of 30 days after date of publication in the Federal Register. If VA receives public comments, VA shall review the comments to determine whether any changes to the notice are necessary. ADDRESSES: Comments may be submitted through www.regulations.gov or mailed to VA Privacy Service, 810 Vermont Avenue NW, (005X6F), Washington, DC 20420. Comments should indicate that they are submitted in response to ‘‘Administrative Data Repository–VA’’ (150VA19). Comments received will be available at regulations.gov for public viewing, inspection or copies. FOR FURTHER INFORMATION CONTACT: Stephania Griffin, VHA Chief Privacy Officer, Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420; Stephania.Griffin@va.gov, telephone number 704–245–2492 (Note: this is not a toll-free number). SUPPLEMENTARY INFORMATION: VA is amending the system of records by revising the System Name; System Number; System Location; System Manager; Purpose; Categories of Individuals Covered by the System; Categories of Records in the System; Record Source Categories; Routine Uses of Records Maintained in the System; Policies and Practices for Storage of Records; Policies and Practices for Retention and Disposal of Records; Record Access Procedure; Contesting Records Procedures; Notification Procedure; and Administrative, Technical and Physical Safeguards. VA is republishing the system notice in its entirety. The System Name is being updated from ‘‘Administrative Data Repository– VA’’ to ‘‘Enterprise Identity and Demographics Records–VA’’. The System Number will be changed from 150VA19 to 150VA10 to reflect the current VHA organizational routing symbol. The System Location has been updated to replace Austin Automation E:\FR\FM\02NON1.SGM 02NON1 khammond on DSKJM1Z7X2PROD with NOTICES 75388 Federal Register / Vol. 88, No. 211 / Thursday, November 2, 2023 / Notices Center with Austin Information Technology Center (AITC). The section will include that records are also hosted in a Federal Information Security Management Act (FISMA)—high VA Enterprise Cloud (VAEC). At the Enterprise Level this information is stored and maintained within the VA Master Person Index (VA MPI), which is defined as the authoritative data source for this information. The section was also amended to remove the statement, ‘‘Information from these records or copies of records may be maintained at the Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC, VA Data Processing Centers, VA CIO Field Offices, Veterans Integrated Service Network.’’ The System Manager is being updated to remove ‘‘Chief Information Officer’’ and replace ‘‘Director National Data Systems’’ with ‘‘Director Data Quality vha105highealthinfogovdqleadership@ va.gov, Enterprise Help Desk 855–673– 4357.’’ The Purpose has been amended to remove that the following: ‘‘records are used to establish person identity throughout only the VHA enterprise’’ and has been expanded to the VA enterprise. The purpose of the system of records is to provide a repository for the administrative information that is used to accomplish the purposes described within this document including determining Veteran benefits and eligibility. The records include information provided by patients, providers, employees, volunteers, trainees, contractors and others that receive IT access to our computer systems and information obtained during routine work, including VHA patient care. Quality assurance information that is protected by 38 U.S.C. 7311 and 38 CFR 17.500–17.511 is not within the scope of the Privacy Act and, therefore, is not included in this system of records or filed in a manner in which the information may be retrieved by reference to an individual identifier.’’ The Purpose section will now reflect the following language: ‘‘The purpose of these records is to serve as the source for the information necessary to uniquely identify a person across Veterans Health Administration, act as a record locator system for person records across the Administration, master the identity data and synchronize updates and changes to all the systems that know that person. The data may be used for VA’s extensive research programs in accordance with VA policy. The data is used to identify and provide benefits for all persons of interest to VA and to establish the Integration Control VerDate Sep<11>2014 16:32 Nov 01, 2023 Jkt 262001 Number (ICN) as VA’s unique enterprise identifier. The information will also be used to identify the VA MPI as authoritative for this data and defines the mastering and synchronizing of this data with integrated partners. The VA MPI also provides authoritative data for the identity of Veterans and beneficiaries; current and former patients; Veterans Health Administration (VHA), Veterans Benefits Administration (VBA) and National Cemetery Administration (NCA) beneficiaries; employees; providers; volunteers; trainees; contractors; and individuals working collaboratively with VA. These identity management services are used across the enterprise and with external sharing partners.’’ The Categories of Individuals Covered by this System is being amended to include caregivers; patients; current and former VHA, VBA, and NCA beneficiaries. Also included are individuals examined or treated under contract or resource sharing agreements; individuals who have applied for 38 U.S.C. ch. 1 benefits, but do not meet the requirements under 38 U.S.C. ch. 1 to receive such benefits; individuals who were provided medical care under emergency conditions for humanitarian reasons and pensioned members of allied forces provided healthcare services under 38 U.S.C. ch. 1. The Categories of Records in the System is being amended to replace ‘‘1. Administrative assignments or categorization of duties of certain VHA personnel’’ with ‘‘1. Information used to establish unique enterprise identifiers, VA ICNs and all associated system identifiers and related metadata. This information is used to create a unique identifier for all persons of interest to VA and all other systems that have integrated with the VA MPI.’’ The following text within Categories of Records in the System will be removed: ‘‘2. education and continuing education (e.g., name and address of schools and dates of attendance, courses attended and scheduled to attend, grades, type of degree, certificate, etc.); information related to military service and status; qualifications for employment (e.g., license, degree, registration or certification, experience); Veteran enrollment and eligibility information including financial assessments.’’ This will now be replaced with ‘‘2. Identity information such as name, date of birth, birth sex, administrative sex, self-identified gender identity, pronoun, preferred name, Social Security Number, taxpayer identification number, date of death). Other demographic information such as PO 00000 Frm 00126 Fmt 4703 Sfmt 4703 home and/or mailing address, home telephone number, emergency contact information such as name, address, telephone number and relationship; and associated audit and necessary metadata.’’ Additionally, being removed from this section is: ‘‘3. Electronic messages used for network communication between VHA systems.’’ Record Source Categories is being updated to remove: ‘‘Information in this system of records is provided by patients, employees, providers, IT users, and others that work collaboratively with VHA.’’ This section will now reflect the following language: ‘‘Information in this system of records is provided by Veterans, VA employees, VA Health Eligibility Center, VHA Program Offices, VA medical facilities, VISNs and the following Systems Of Records: Veterans Health Information Systems and Technology Architecture (VistA) Records–VA (79VA10), Veterans Affairs Profile–VA (VA Profile) (192VA30) and any associated system of records that is utilizing VA MPI identity management services.’’ The following routine uses have been added: 12. Federal Agencies, for Research: To a Federal agency to conduct research and data analysis to perform a statutory purpose of that Federal agency upon the prior written request of that agency, provided that there is legal authority under all applicable confidentiality statutes and regulations to provide the data and the VHA Office of Informatics has determined prior to the disclosure that VHA data handling requirements are satisfied. 13. Housing and Urban Development (HUD): To HUD for the purpose of reducing homelessness among Veterans by implementing the Federal strategic plan to prevent and end homelessness as well as by evaluating and monitoring the HUD Veterans Affairs Supported Housing program. 14. Federal Agencies, for Computer Matches: To other Federal agencies for the purpose of conducting computer matches to obtain information to determine or verify eligibility of veterans receiving VA benefits or medical care under title 38. 15. Non-VA Health Care Providers, for Treatment: To a non-VA healthcare provider, such as the Department Health and Human Services, for the purpose of treating any VA patient, including Veterans. 16. Governmental Agencies, Health Organizations, for Claimants’ Benefits: To Federal, State and local government agencies and national health organizations as reasonably necessary to E:\FR\FM\02NON1.SGM 02NON1 khammond on DSKJM1Z7X2PROD with NOTICES Federal Register / Vol. 88, No. 211 / Thursday, November 2, 2023 / Notices assist in the development of programs that will be beneficial to claimants, to protect their rights under law, and ensure they are receiving all benefits to which they are entitled. 17. Law Enforcement, for Locating Fugitive: To any Federal, State, local, Territorial, Tribal, or foreign law enforcement agency in order to identify, locate, or report a known fugitive felon, in compliance with 38 U.S.C. 5313B(d). 18. Business Partners, for Collaborative Efforts: To individuals or entities with whom VA has a written agreement or arrangement to perform such services as VA may deem practical for the purpose of laws administered by VA or for identifying and correlating patients. 19. Data Breach Response and Remediation, for VA: To appropriate agencies, entities and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records; (2) VA has determined that as a result of the suspected or confirmed breach there is a risk to individuals, VA (including its information systems, programs and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities or persons reasonably necessary to assist in connection with VA efforts to respond to the suspected or confirmed breach or to prevent, minimize or remedy such harm. Policies and Practices for Storage of Records is being updated to replace ‘‘Records are maintained at the Corporate Franchise Data Center which is a VA operated facility. Information is stored on disk media.’’ with ‘‘Records are stored electronically.’’ Policies and Practices for Retrieval of Records is being updated to include date of birth and ICN. Policies and Practices for Retention and Disposal of Records is being modified to include: ‘‘The records are maintained and disposed of in accordance with the schedule approved by the Archivist of the United States, General Records Schedule 4, item 2.’’ Administrative, Technical and Physical Safeguards are being updated to include: ‘‘4. The system is hosted in Amazon Web Services Government Cloud infrastructure as a service cloud computing environment that has been authorized at the high-impact level under the Federal Risk and Authorization Management Program. The secure site-to-site encrypted network connection is limited to access via the VA trusted internet connection.’’ Record Access Procedure is being updated to reflect the following language: ‘‘Individuals seeking information on the existence and VerDate Sep<11>2014 16:32 Nov 01, 2023 Jkt 262001 content of records in this system pertaining to them should contact the system manager in writing as indicated above, or write, call or visit the VA facility location where they normally receive their care. A request for access to records must contain the requester’s full name, address, telephone number, be signed by the requester, and describe the records sought in sufficient detail to enable VA personnel to locate them with a reasonable amount of effort.’’ Contesting Records Procedures is being updated to reflect the following language: ‘‘Individuals seeking to contest or amend records in this system pertaining to them should contact the system manager in writing as indicated above, or write or visit the VA facility location where they normally receive their care. A request to contest or amend records must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record.’’ Notification Procedure is being updated to state: ‘‘Generalized notice is provided by the publication of this notice. For specific notice, see Record Access Procedure, above.’’ The Report of Intent to Amend a System of Records Notice and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of the Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000. 75389 SYSTEM LOCATION: Records are hosted in a containerized environment at a federally rated Federal Information Security Management Act (FISMA)-high data center in the Department of Veterans Affairs (VA) Austin Information Technology Center (AITC) at 1615 Woodward Street, Austin, Texas 78772. Records are also hosted in a FISMA-high VA Enterprise Cloud (VAEC). At the Enterprise Level this information is stored and maintained within the VA Master Person Index (VA MPI) which is defined as the authoritative data source for this information. SYSTEM MANAGER(S): Director Data Quality, vha105highealthinfogovdqleadership@ va.gov or the Enterprise Help Desk at 855–673–4357, Corporate Franchise Center, 1615 Woodward Street, Austin, Texas 78772. AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 38 U.S.C. 501 and 7304. PURPOSE(S) OF THE SYSTEM: SYSTEM NAME AND NUMBER: The purpose of these records is to serve as the source for the information necessary to: uniquely identify a person across the Veterans Health Administration (VHA), act as a record locator system for person records across the Administration, master the identity data and synchronize updates and changes to all the systems that know that person. The data may be used for VA’s extensive research programs in accordance with VA policy. The data is used to identify and provide benefits for all persons of interest to VA and to establish the Integration Control Number (ICN) as VA’s unique enterprise identifier. The information is also used to identify the VA MPI as authoritative for this data and defines the mastering and synchronizing of this data with integrated partners. The VA MPI also provides authoritative data for the identity of Veterans and beneficiaries; current and former patients; Veterans Health Administration (VHA), Veterans Benefits Administration (VBA) and National Cemetery Administration (NCA) beneficiaries; employees; providers; volunteers; trainees; contractors; and individuals working collaboratively with VA. These identity management services are used across the enterprise and with external sharing partners. ‘‘Enterprise Identity and Demographics Records–VA’’ (150VA10). CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM: Signing Authority The Senior Agency Official for Privacy, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Kurt D. DelBene, Assistant Secretary for Information and Technology and Chief Information Officer, approved this document on September 27, 2023 for publication. Dated: October 30, 2023. Amy L. Rose, Government Information Specialist, VA Privacy Service, Office of Compliance, Risk and Remediation, Office of Information and Technology, Department of Veterans Affairs. SECURITY CLASSIFICATION: Unclassified. PO 00000 Frm 00127 Fmt 4703 Sfmt 4703 The records include information on caregivers; patients; current and former VHA, VBA, and NCA beneficiaries; E:\FR\FM\02NON1.SGM 02NON1 75390 Federal Register / Vol. 88, No. 211 / Thursday, November 2, 2023 / Notices employees; providers; volunteers; trainees; contractors; as well as individuals working collaboratively with VHA. Also included are individuals examined or treated under contract or resource sharing agreements; individuals who have applied for 38 U.S.C. ch. 1 benefits, but who do not meet the requirements under 38 U.S.C. ch. 1 to receive such benefits; individuals who were provided medical care under emergency conditions for humanitarian reasons; and pensioned members of allied forces provided healthcare services under 38 U.S.C ch. 1. CATEGORIES OF RECORDS IN THE SYSTEM: The records include information related to: 1. Information used to establish and maintain unique enterprise identifiers for VA ICNs and all associated system identifiers and related metadata. This information is used to create a unique identifier of all persons of interest to VA and all other systems that have correlated to the VA MPI. 2. Identity information such as name, date of birth, birth sex, administrative sex, self-identified gender identity, pronoun, preferred name, Social Security Number, taxpayer identification number, date of death. Other demographic information such as home and/or mailing address; home telephone number; emergency contact information such as name, address, telephone number, and relationship; and associated audit and necessary metadata. 3. Healthcare providers’ Social Security Number and National Provider Identifier. RECORD SOURCE CATEGORIES: khammond on DSKJM1Z7X2PROD with NOTICES Information in this system of records is provided by Veterans, VA employees, VA Health Eligibility Center, VHA Program Offices, VA medical facilities, VISNs, VBA, NCA and the following systems of records: Veterans Health Information Systems and Technology Architecture (VistA) Records–VA (79VA10), Veterans Affairs Profile–VA (VA Profile) (192VA30), and any associated system of record notices that is utilizing VA MPI identity management services. ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES: 1. Congress: To a Member of Congress or staff acting upon the Member’s behalf when the Member or staff requests the information on behalf of, and at the request of, the individual who is the subject of the record. VerDate Sep<11>2014 16:32 Nov 01, 2023 Jkt 262001 2. National Archives and Records Administration (NARA): To NARA in records management inspections conducted under 44 U.S.C. 2904 and 2906, or other functions authorized by laws and policies governing NARA operations and VA records management responsibilities. 3. Disclosure may be made to other Government agencies in support of data exchanges of electronic medical record information approved by the individual. 4. Law Enforcement: To a Federal, State, local, Territorial, Tribal or foreign law enforcement authority or other appropriate entity charged with the responsibility of investigating or prosecuting a violation or potential violation of law, whether civil, criminal, or regulatory in nature, or charged with enforcing or implementing such law, provided that the disclosure is limited to information that, either alone or in conjunction with other information, indicates such a violation or potential violation. The disclosure of the names and addresses of Veterans and their dependents from VA records under this routine use must also comply with the provisions of 38 U.S.C. 5701. 5. Department of Justice (DoJ), Litigation, Administrative Proceeding: To DoJ, or in a proceeding before a court, adjudicative body, or other administrative body before which VA is authorized to appear, when: (a) VA or any component thereof; (b) Any VA employee in their official capacity; (c) Any VA employee in their individual capacity where DoJ has agreed to represent the employee; or (d) The United States, where VA determines that litigation is likely to affect the agency or any of its components is a party to such proceedings or has an interest in such proceedings, and VA determines that use of such records is relevant and necessary to the proceedings. 6. Contractors: To contractors, grantees, experts, consultants, students and others performing or working on a contract, service, grant, cooperative agreement or other assignment for VA, when reasonably necessary to accomplish an agency function related to the records. 7. Federal Agencies, Fraud and Abuse: To other Federal agencies to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs. 8. Equal Employment Opportunity Commission (EEOC): To the EEOC in connection with investigations of alleged or possible discriminatory practices, examination of Federal PO 00000 Frm 00128 Fmt 4703 Sfmt 4703 affirmative employment programs or other functions of the Commission as authorized by law. 9. Federal Labor Relations Authority (FLRA): To the FLRA in connection with the investigation and resolution of allegations of unfair labor practices, the resolution of exceptions to arbitration awards when a question of material fact is raised; matters before the Federal Service Impasses Panel; and the investigation of representation petitions and the conduct or supervision of representation elections. 10. Merit Systems Protection Board (MSPB): To the MSPB in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices and such other functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by law. 11. Data Breach Response and Remediation, for Another Federal Agency: To another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach. 12. Federal Agencies, for Research: VA may disclose information to a Federal agency for the conduct of research and data analysis to perform a statutory purpose of that Federal agency upon the prior written request of that agency, provided that there is legal authority under all applicable confidentiality statutes and regulations to provide the data and the VHA Office of Informatics has determined prior to the disclosure that VHA data handling requirements are satisfied. 13. Housing and Urban Development (HUD): To HUD for the purpose of reducing homelessness among Veterans by implementing the Federal strategic plan to prevent and end homelessness as well as by evaluating and monitoring the HUD Veterans Affairs Supported Housing program. 14. Federal Agencies, for Computer Matches: To other Federal agencies for the purpose of conducting computer matches to obtain information to determine or verify eligibility of veterans receiving VA benefits or medical care under title 38. 15. Non-VA Health Care Providers, for Treatment: To a non-VA healthcare E:\FR\FM\02NON1.SGM 02NON1 Federal Register / Vol. 88, No. 211 / Thursday, November 2, 2023 / Notices provider, such as the Department Health and Human Services, for the purpose of treating any VA patient, including Veterans. 16. Governmental Agencies, Health Organizations, for Claimants’ Benefits: To Federal, State and local government agencies and national health organizations as reasonably necessary to assist in the development of programs that will be beneficial to claimants, to protect their rights under law, and ensure they are receiving all benefits to which they are entitled. 17. Law Enforcement, for Locating Fugitive: To any Federal, State, local, Territorial, Tribal, or foreign law enforcement agency in order to identify, locate, or report a known fugitive felon, in compliance with 38 U.S.C. 5313B(d). 18. Business Partners, for Collaborative Efforts: To individuals or entities with whom VA has a written agreement or arrangement to perform such services as VA may deem practical for the purpose of laws administered by VA or for identifying and correlating patients. 19. Data Breach Response and Remediation, for VA: To appropriate agencies, entities and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records; (2) VA has determined that as a result of the suspected or confirmed breach there is a risk to individuals, VA (including its information systems, programs and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities or persons reasonably necessary to assist in connection with VA efforts to respond to the suspected or confirmed breach or to prevent, minimize or remedy such harm. POLICIES AND PRACTICES FOR STORAGE OF RECORDS: Records in this system are stored electronically. POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS: khammond on DSKJM1Z7X2PROD with NOTICES Records are retrieved by identifiers such as full name, Social Security Number, date of birth, ICN and other assigned unique identifiers of the individuals on whom they are maintained. POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS: The records are maintained and disposed of in accordance with the schedule approved by the Archivist of the United States, General Records Schedule 4, item 2. VerDate Sep<11>2014 16:32 Nov 01, 2023 Jkt 262001 ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS: 1. Access to VA working and storage areas is restricted to VA employees on a ‘‘need-to-know’’ basis; strict control measures are enforced to ensure that disclosure to these individuals is also based on this same principle. Generally, VA file areas are locked after normal duty hours and the facilities are protected from outside access by the Federal Protective Service or other security personnel. 2. Access to file information is controlled at two levels: the systems recognize authorized employees by a series of individually unique passwords/codes as a part of each data message, and the employees are limited to only that information in the file which is needed in the performance of their official duties. Information that is downloaded from this system and maintained on personal computers is afforded similar storage and access protections as the data that is maintained in the original files. Access to information stored on automated storage media at other VA locations is controlled by individually unique passwords/codes. 3. Access to the AITC is generally restricted to center employees, custodial personnel, Federal Protective Service and other security personnel. Access to computer rooms is restricted to authorized operational personnel through electronic locking devices. All other persons gaining access to computer rooms are escorted. Information stored in the computer may be accessed by authorized VA employees at remote locations including VA healthcare facilities, Information Systems Centers, VA Central Office and Veteran Integrated Service Networks. Access is controlled by individually unique passwords/codes which must be changed periodically by the employee. 4. The system is hosted in Amazon Web Services Government Cloud infrastructure as a service cloud computing environment that has been authorized at the high-impact level under the Federal Risk and Authorization Management Program. The secure site-to-site encrypted network connection is limited to access via the VA trusted internet connection. RECORD ACCESS PROCEDURES: Individuals seeking information on the existence and content of records in this system pertaining to them should contact the system manager in writing as indicated above, or write, call or visit the VA facility location where they are or were employed or made contact. A request for access to records must PO 00000 Frm 00129 Fmt 4703 Sfmt 4703 75391 contain the requester’s full name, address, telephone number, be signed by the requester, and describe the records sought in sufficient detail to enable VA personnel to locate them with a reasonable amount of effort. CONTESTING RECORD PROCEDURES: Individuals seeking to contest or amend records in this system pertaining to them should contact the system manager in writing as indicated above, or write, call or visit the VA facility location where they are or were employed or made contact. A request to contest or amend records must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record. NOTIFICATION PROCEDURES: Generalized notice is provided by the publication of this notice. For specific notice, see Record Access Procedure, above. EXEMPTIONS PROMULGATED FOR THE SYSTEM: None HISTORY: 73 FR 72117 (November 26, 2008) [FR Doc. 2023–24193 Filed 11–1–23; 8:45 am] BILLING CODE P DEPARTMENT OF VETERANS AFFAIRS Privacy Act of 1974; Matching Program AGENCY: Department of Veterans Affairs (VA). Notice of a modified matching program. ACTION: This is an 18-month reestablishment computer matching agreement (CMA) with the Defense Manpower Data Center (DMDC), Department of Defense (DoD) and the Department of Veterans Affairs (VA), Veterans Benefits Administration (VBA), regarding Veterans who are in drilling status and also in receipt of compensation or pension benefits. The purpose of this CMA is to re-establish the agreement between VA, Veterans Benefits Administration (VBA) and the DoD, Defense Manpower Data Center (DMDC). DoD will disclose information about individuals who are in drill pay status. VBA will use this information as a match for recipients of Compensation and Pension benefits for adjustments of awards. DATES: Comments on this matching program must be received no later than 30 days after date of publication in the Federal Register. If no public comment SUMMARY: E:\FR\FM\02NON1.SGM 02NON1

Agencies

[Federal Register Volume 88, Number 211 (Thursday, November 2, 2023)]
[Notices]
[Pages 75387-75391]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-24193]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Veterans Health Administration (VHA), Department of Veterans 
Affairs (VA).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: Pursuant to the Privacy Act of 1974, notice is hereby given 
that the VA is modifying the system of records titled, ``Administrative 
Data Repository-VA'' (150VA19). This system is used as the source for 
the information necessary to uniquely identify a person across the 
Veterans Health Administration (VHA), act as a record locator system 
for person records across the Administration, master the identity data 
and synchronize updates and changes to all the systems that know that 
person.

DATES: Comments on this modified system of records must be received no 
later than 30 days after date of publication in the Federal Register. 
If no public comment is received during the period allowed for comment 
or unless otherwise published in the Federal Register by VA, the 
modified system of records will become effective a minimum of 30 days 
after date of publication in the Federal Register. If VA receives 
public comments, VA shall review the comments to determine whether any 
changes to the notice are necessary.

ADDRESSES: Comments may be submitted through www.regulations.gov or 
mailed to VA Privacy Service, 810 Vermont Avenue NW, (005X6F), 
Washington, DC 20420. Comments should indicate that they are submitted 
in response to ``Administrative Data Repository-VA'' (150VA19). 
Comments received will be available at regulations.gov for public 
viewing, inspection or copies.

FOR FURTHER INFORMATION CONTACT: Stephania Griffin, VHA Chief Privacy 
Officer, Department of Veterans Affairs, 810 Vermont Avenue NW, 
Washington, DC 20420; [email protected], telephone number 704-
245-2492 (Note: this is not a toll-free number).

SUPPLEMENTARY INFORMATION: VA is amending the system of records by 
revising the System Name; System Number; System Location; System 
Manager; Purpose; Categories of Individuals Covered by the System; 
Categories of Records in the System; Record Source Categories; Routine 
Uses of Records Maintained in the System; Policies and Practices for 
Storage of Records; Policies and Practices for Retention and Disposal 
of Records; Record Access Procedure; Contesting Records Procedures; 
Notification Procedure; and Administrative, Technical and Physical 
Safeguards. VA is republishing the system notice in its entirety.
    The System Name is being updated from ``Administrative Data 
Repository-VA'' to ``Enterprise Identity and Demographics Records-VA''.
    The System Number will be changed from 150VA19 to 150VA10 to 
reflect the current VHA organizational routing symbol.
    The System Location has been updated to replace Austin Automation

[[Page 75388]]

Center with Austin Information Technology Center (AITC). The section 
will include that records are also hosted in a Federal Information 
Security Management Act (FISMA)--high VA Enterprise Cloud (VAEC). At 
the Enterprise Level this information is stored and maintained within 
the VA Master Person Index (VA MPI), which is defined as the 
authoritative data source for this information. The section was also 
amended to remove the statement, ``Information from these records or 
copies of records may be maintained at the Department of Veterans 
Affairs, 810 Vermont Avenue NW, Washington, DC, VA Data Processing 
Centers, VA CIO Field Offices, Veterans Integrated Service Network.''
    The System Manager is being updated to remove ``Chief Information 
Officer'' and replace ``Director National Data Systems'' with 
``Director Data Quality [email protected], 
Enterprise Help Desk 855-673-4357.''
    The Purpose has been amended to remove that the following: 
``records are used to establish person identity throughout only the VHA 
enterprise'' and has been expanded to the VA enterprise. The purpose of 
the system of records is to provide a repository for the administrative 
information that is used to accomplish the purposes described within 
this document including determining Veteran benefits and eligibility. 
The records include information provided by patients, providers, 
employees, volunteers, trainees, contractors and others that receive IT 
access to our computer systems and information obtained during routine 
work, including VHA patient care. Quality assurance information that is 
protected by 38 U.S.C. 7311 and 38 CFR 17.500-17.511 is not within the 
scope of the Privacy Act and, therefore, is not included in this system 
of records or filed in a manner in which the information may be 
retrieved by reference to an individual identifier.''
    The Purpose section will now reflect the following language: ``The 
purpose of these records is to serve as the source for the information 
necessary to uniquely identify a person across Veterans Health 
Administration, act as a record locator system for person records 
across the Administration, master the identity data and synchronize 
updates and changes to all the systems that know that person. The data 
may be used for VA's extensive research programs in accordance with VA 
policy. The data is used to identify and provide benefits for all 
persons of interest to VA and to establish the Integration Control 
Number (ICN) as VA's unique enterprise identifier. The information will 
also be used to identify the VA MPI as authoritative for this data and 
defines the mastering and synchronizing of this data with integrated 
partners. The VA MPI also provides authoritative data for the identity 
of Veterans and beneficiaries; current and former patients; Veterans 
Health Administration (VHA), Veterans Benefits Administration (VBA) and 
National Cemetery Administration (NCA) beneficiaries; employees; 
providers; volunteers; trainees; contractors; and individuals working 
collaboratively with VA. These identity management services are used 
across the enterprise and with external sharing partners.''
    The Categories of Individuals Covered by this System is being 
amended to include caregivers; patients; current and former VHA, VBA, 
and NCA beneficiaries. Also included are individuals examined or 
treated under contract or resource sharing agreements; individuals who 
have applied for 38 U.S.C. ch. 1 benefits, but do not meet the 
requirements under 38 U.S.C. ch. 1 to receive such benefits; 
individuals who were provided medical care under emergency conditions 
for humanitarian reasons and pensioned members of allied forces 
provided healthcare services under 38 U.S.C. ch. 1.
    The Categories of Records in the System is being amended to replace 
``1. Administrative assignments or categorization of duties of certain 
VHA personnel'' with ``1. Information used to establish unique 
enterprise identifiers, VA ICNs and all associated system identifiers 
and related metadata. This information is used to create a unique 
identifier for all persons of interest to VA and all other systems that 
have integrated with the VA MPI.''
    The following text within Categories of Records in the System will 
be removed: ``2. education and continuing education (e.g., name and 
address of schools and dates of attendance, courses attended and 
scheduled to attend, grades, type of degree, certificate, etc.); 
information related to military service and status; qualifications for 
employment (e.g., license, degree, registration or certification, 
experience); Veteran enrollment and eligibility information including 
financial assessments.'' This will now be replaced with ``2. Identity 
information such as name, date of birth, birth sex, administrative sex, 
self-identified gender identity, pronoun, preferred name, Social 
Security Number, taxpayer identification number, date of death). Other 
demographic information such as home and/or mailing address, home 
telephone number, emergency contact information such as name, address, 
telephone number and relationship; and associated audit and necessary 
metadata.''
    Additionally, being removed from this section is: ``3. Electronic 
messages used for network communication between VHA systems.''
    Record Source Categories is being updated to remove: ``Information 
in this system of records is provided by patients, employees, 
providers, IT users, and others that work collaboratively with VHA.'' 
This section will now reflect the following language: ``Information in 
this system of records is provided by Veterans, VA employees, VA Health 
Eligibility Center, VHA Program Offices, VA medical facilities, VISNs 
and the following Systems Of Records: Veterans Health Information 
Systems and Technology Architecture (VistA) Records-VA (79VA10), 
Veterans Affairs Profile-VA (VA Profile) (192VA30) and any associated 
system of records that is utilizing VA MPI identity management 
services.''
    The following routine uses have been added:
    12. Federal Agencies, for Research: To a Federal agency to conduct 
research and data analysis to perform a statutory purpose of that 
Federal agency upon the prior written request of that agency, provided 
that there is legal authority under all applicable confidentiality 
statutes and regulations to provide the data and the VHA Office of 
Informatics has determined prior to the disclosure that VHA data 
handling requirements are satisfied.
    13. Housing and Urban Development (HUD): To HUD for the purpose of 
reducing homelessness among Veterans by implementing the Federal 
strategic plan to prevent and end homelessness as well as by evaluating 
and monitoring the HUD Veterans Affairs Supported Housing program.
    14. Federal Agencies, for Computer Matches: To other Federal 
agencies for the purpose of conducting computer matches to obtain 
information to determine or verify eligibility of veterans receiving VA 
benefits or medical care under title 38.
    15. Non-VA Health Care Providers, for Treatment: To a non-VA 
healthcare provider, such as the Department Health and Human Services, 
for the purpose of treating any VA patient, including Veterans.
    16. Governmental Agencies, Health Organizations, for Claimants' 
Benefits: To Federal, State and local government agencies and national 
health organizations as reasonably necessary to

[[Page 75389]]

assist in the development of programs that will be beneficial to 
claimants, to protect their rights under law, and ensure they are 
receiving all benefits to which they are entitled.
    17. Law Enforcement, for Locating Fugitive: To any Federal, State, 
local, Territorial, Tribal, or foreign law enforcement agency in order 
to identify, locate, or report a known fugitive felon, in compliance 
with 38 U.S.C. 5313B(d).
    18. Business Partners, for Collaborative Efforts: To individuals or 
entities with whom VA has a written agreement or arrangement to perform 
such services as VA may deem practical for the purpose of laws 
administered by VA or for identifying and correlating patients.
    19. Data Breach Response and Remediation, for VA: To appropriate 
agencies, entities and persons when (1) VA suspects or has confirmed 
that there has been a breach of the system of records; (2) VA has 
determined that as a result of the suspected or confirmed breach there 
is a risk to individuals, VA (including its information systems, 
programs and operations), the Federal Government, or national security; 
and (3) the disclosure made to such agencies, entities or persons 
reasonably necessary to assist in connection with VA efforts to respond 
to the suspected or confirmed breach or to prevent, minimize or remedy 
such harm.
    Policies and Practices for Storage of Records is being updated to 
replace ``Records are maintained at the Corporate Franchise Data Center 
which is a VA operated facility. Information is stored on disk media.'' 
with ``Records are stored electronically.''
    Policies and Practices for Retrieval of Records is being updated to 
include date of birth and ICN.
    Policies and Practices for Retention and Disposal of Records is 
being modified to include: ``The records are maintained and disposed of 
in accordance with the schedule approved by the Archivist of the United 
States, General Records Schedule 4, item 2.''
    Administrative, Technical and Physical Safeguards are being updated 
to include: ``4. The system is hosted in Amazon Web Services Government 
Cloud infrastructure as a service cloud computing environment that has 
been authorized at the high-impact level under the Federal Risk and 
Authorization Management Program. The secure site-to-site encrypted 
network connection is limited to access via the VA trusted internet 
connection.''
    Record Access Procedure is being updated to reflect the following 
language: ``Individuals seeking information on the existence and 
content of records in this system pertaining to them should contact the 
system manager in writing as indicated above, or write, call or visit 
the VA facility location where they normally receive their care. A 
request for access to records must contain the requester's full name, 
address, telephone number, be signed by the requester, and describe the 
records sought in sufficient detail to enable VA personnel to locate 
them with a reasonable amount of effort.''
    Contesting Records Procedures is being updated to reflect the 
following language: ``Individuals seeking to contest or amend records 
in this system pertaining to them should contact the system manager in 
writing as indicated above, or write or visit the VA facility location 
where they normally receive their care. A request to contest or amend 
records must state clearly and concisely what record is being 
contested, the reasons for contesting it, and the proposed amendment to 
the record.''
    Notification Procedure is being updated to state: ``Generalized 
notice is provided by the publication of this notice. For specific 
notice, see Record Access Procedure, above.''
    The Report of Intent to Amend a System of Records Notice and an 
advance copy of the system notice have been sent to the appropriate 
Congressional committees and to the Director of the Office of 
Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy 
Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.

Signing Authority

    The Senior Agency Official for Privacy, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Kurt D. 
DelBene, Assistant Secretary for Information and Technology and Chief 
Information Officer, approved this document on September 27, 2023 for 
publication.

    Dated: October 30, 2023.
Amy L. Rose,
Government Information Specialist, VA Privacy Service, Office of 
Compliance, Risk and Remediation, Office of Information and Technology, 
Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:
    ``Enterprise Identity and Demographics Records-VA'' (150VA10).

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    Records are hosted in a containerized environment at a federally 
rated Federal Information Security Management Act (FISMA)-high data 
center in the Department of Veterans Affairs (VA) Austin Information 
Technology Center (AITC) at 1615 Woodward Street, Austin, Texas 78772. 
Records are also hosted in a FISMA-high VA Enterprise Cloud (VAEC). At 
the Enterprise Level this information is stored and maintained within 
the VA Master Person Index (VA MPI) which is defined as the 
authoritative data source for this information.

SYSTEM MANAGER(S):
    Director Data Quality, [email protected] or 
the Enterprise Help Desk at 855-673-4357, Corporate Franchise Center, 
1615 Woodward Street, Austin, Texas 78772.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    38 U.S.C. 501 and 7304.

PURPOSE(S) OF THE SYSTEM:
    The purpose of these records is to serve as the source for the 
information necessary to: uniquely identify a person across the 
Veterans Health Administration (VHA), act as a record locator system 
for person records across the Administration, master the identity data 
and synchronize updates and changes to all the systems that know that 
person. The data may be used for VA's extensive research programs in 
accordance with VA policy. The data is used to identify and provide 
benefits for all persons of interest to VA and to establish the 
Integration Control Number (ICN) as VA's unique enterprise identifier. 
The information is also used to identify the VA MPI as authoritative 
for this data and defines the mastering and synchronizing of this data 
with integrated partners. The VA MPI also provides authoritative data 
for the identity of Veterans and beneficiaries; current and former 
patients; Veterans Health Administration (VHA), Veterans Benefits 
Administration (VBA) and National Cemetery Administration (NCA) 
beneficiaries; employees; providers; volunteers; trainees; contractors; 
and individuals working collaboratively with VA. These identity 
management services are used across the enterprise and with external 
sharing partners.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The records include information on caregivers; patients; current 
and former VHA, VBA, and NCA beneficiaries;

[[Page 75390]]

employees; providers; volunteers; trainees; contractors; as well as 
individuals working collaboratively with VHA. Also included are 
individuals examined or treated under contract or resource sharing 
agreements; individuals who have applied for 38 U.S.C. ch. 1 benefits, 
but who do not meet the requirements under 38 U.S.C. ch. 1 to receive 
such benefits; individuals who were provided medical care under 
emergency conditions for humanitarian reasons; and pensioned members of 
allied forces provided healthcare services under 38 U.S.C ch. 1.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The records include information related to:
    1. Information used to establish and maintain unique enterprise 
identifiers for VA ICNs and all associated system identifiers and 
related metadata. This information is used to create a unique 
identifier of all persons of interest to VA and all other systems that 
have correlated to the VA MPI.
    2. Identity information such as name, date of birth, birth sex, 
administrative sex, self-identified gender identity, pronoun, preferred 
name, Social Security Number, taxpayer identification number, date of 
death. Other demographic information such as home and/or mailing 
address; home telephone number; emergency contact information such as 
name, address, telephone number, and relationship; and associated audit 
and necessary metadata.
    3. Healthcare providers' Social Security Number and National 
Provider Identifier.

RECORD SOURCE CATEGORIES:
    Information in this system of records is provided by Veterans, VA 
employees, VA Health Eligibility Center, VHA Program Offices, VA 
medical facilities, VISNs, VBA, NCA and the following systems of 
records: Veterans Health Information Systems and Technology 
Architecture (VistA) Records-VA (79VA10), Veterans Affairs Profile-VA 
(VA Profile) (192VA30), and any associated system of record notices 
that is utilizing VA MPI identity management services.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    1. Congress: To a Member of Congress or staff acting upon the 
Member's behalf when the Member or staff requests the information on 
behalf of, and at the request of, the individual who is the subject of 
the record.
    2. National Archives and Records Administration (NARA): To NARA in 
records management inspections conducted under 44 U.S.C. 2904 and 2906, 
or other functions authorized by laws and policies governing NARA 
operations and VA records management responsibilities.
    3. Disclosure may be made to other Government agencies in support 
of data exchanges of electronic medical record information approved by 
the individual.
    4. Law Enforcement: To a Federal, State, local, Territorial, Tribal 
or foreign law enforcement authority or other appropriate entity 
charged with the responsibility of investigating or prosecuting a 
violation or potential violation of law, whether civil, criminal, or 
regulatory in nature, or charged with enforcing or implementing such 
law, provided that the disclosure is limited to information that, 
either alone or in conjunction with other information, indicates such a 
violation or potential violation. The disclosure of the names and 
addresses of Veterans and their dependents from VA records under this 
routine use must also comply with the provisions of 38 U.S.C. 5701.
    5. Department of Justice (DoJ), Litigation, Administrative 
Proceeding: To DoJ, or in a proceeding before a court, adjudicative 
body, or other administrative body before which VA is authorized to 
appear, when:
    (a) VA or any component thereof;
    (b) Any VA employee in their official capacity;
    (c) Any VA employee in their individual capacity where DoJ has 
agreed to represent the employee; or
    (d) The United States, where VA determines that litigation is 
likely to affect the agency or any of its components is a party to such 
proceedings or has an interest in such proceedings, and VA determines 
that use of such records is relevant and necessary to the proceedings.
    6. Contractors: To contractors, grantees, experts, consultants, 
students and others performing or working on a contract, service, 
grant, cooperative agreement or other assignment for VA, when 
reasonably necessary to accomplish an agency function related to the 
records.
    7. Federal Agencies, Fraud and Abuse: To other Federal agencies to 
assist such agencies in preventing and detecting possible fraud or 
abuse by individuals in their operations and programs.
    8. Equal Employment Opportunity Commission (EEOC): To the EEOC in 
connection with investigations of alleged or possible discriminatory 
practices, examination of Federal affirmative employment programs or 
other functions of the Commission as authorized by law.
    9. Federal Labor Relations Authority (FLRA): To the FLRA in 
connection with the investigation and resolution of allegations of 
unfair labor practices, the resolution of exceptions to arbitration 
awards when a question of material fact is raised; matters before the 
Federal Service Impasses Panel; and the investigation of representation 
petitions and the conduct or supervision of representation elections.
    10. Merit Systems Protection Board (MSPB): To the MSPB in 
connection with appeals, special studies of the civil service and other 
merit systems, review of rules and regulations, investigation of 
alleged or possible prohibited personnel practices and such other 
functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by 
law.
    11. Data Breach Response and Remediation, for Another Federal 
Agency: To another Federal agency or Federal entity, when VA determines 
that information from this system of records is reasonably necessary to 
assist the recipient agency or entity in (1) responding to a suspected 
or confirmed breach or (2) preventing, minimizing or remedying the risk 
of harm to individuals, the recipient agency or entity (including its 
information systems, programs and operations), the Federal Government, 
or national security, resulting from a suspected or confirmed breach.
    12. Federal Agencies, for Research: VA may disclose information to 
a Federal agency for the conduct of research and data analysis to 
perform a statutory purpose of that Federal agency upon the prior 
written request of that agency, provided that there is legal authority 
under all applicable confidentiality statutes and regulations to 
provide the data and the VHA Office of Informatics has determined prior 
to the disclosure that VHA data handling requirements are satisfied.
    13. Housing and Urban Development (HUD): To HUD for the purpose of 
reducing homelessness among Veterans by implementing the Federal 
strategic plan to prevent and end homelessness as well as by evaluating 
and monitoring the HUD Veterans Affairs Supported Housing program.
    14. Federal Agencies, for Computer Matches: To other Federal 
agencies for the purpose of conducting computer matches to obtain 
information to determine or verify eligibility of veterans receiving VA 
benefits or medical care under title 38.
    15. Non-VA Health Care Providers, for Treatment: To a non-VA 
healthcare

[[Page 75391]]

provider, such as the Department Health and Human Services, for the 
purpose of treating any VA patient, including Veterans.
    16. Governmental Agencies, Health Organizations, for Claimants' 
Benefits: To Federal, State and local government agencies and national 
health organizations as reasonably necessary to assist in the 
development of programs that will be beneficial to claimants, to 
protect their rights under law, and ensure they are receiving all 
benefits to which they are entitled.
    17. Law Enforcement, for Locating Fugitive: To any Federal, State, 
local, Territorial, Tribal, or foreign law enforcement agency in order 
to identify, locate, or report a known fugitive felon, in compliance 
with 38 U.S.C. 5313B(d).
    18. Business Partners, for Collaborative Efforts: To individuals or 
entities with whom VA has a written agreement or arrangement to perform 
such services as VA may deem practical for the purpose of laws 
administered by VA or for identifying and correlating patients.
    19. Data Breach Response and Remediation, for VA: To appropriate 
agencies, entities and persons when (1) VA suspects or has confirmed 
that there has been a breach of the system of records; (2) VA has 
determined that as a result of the suspected or confirmed breach there 
is a risk to individuals, VA (including its information systems, 
programs and operations), the Federal Government, or national security; 
and (3) the disclosure made to such agencies, entities or persons 
reasonably necessary to assist in connection with VA efforts to respond 
to the suspected or confirmed breach or to prevent, minimize or remedy 
such harm.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records in this system are stored electronically.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records are retrieved by identifiers such as full name, Social 
Security Number, date of birth, ICN and other assigned unique 
identifiers of the individuals on whom they are maintained.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    The records are maintained and disposed of in accordance with the 
schedule approved by the Archivist of the United States, General 
Records Schedule 4, item 2.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    1. Access to VA working and storage areas is restricted to VA 
employees on a ``need-to-know'' basis; strict control measures are 
enforced to ensure that disclosure to these individuals is also based 
on this same principle. Generally, VA file areas are locked after 
normal duty hours and the facilities are protected from outside access 
by the Federal Protective Service or other security personnel.
    2. Access to file information is controlled at two levels: the 
systems recognize authorized employees by a series of individually 
unique passwords/codes as a part of each data message, and the 
employees are limited to only that information in the file which is 
needed in the performance of their official duties. Information that is 
downloaded from this system and maintained on personal computers is 
afforded similar storage and access protections as the data that is 
maintained in the original files. Access to information stored on 
automated storage media at other VA locations is controlled by 
individually unique passwords/codes.
    3. Access to the AITC is generally restricted to center employees, 
custodial personnel, Federal Protective Service and other security 
personnel. Access to computer rooms is restricted to authorized 
operational personnel through electronic locking devices. All other 
persons gaining access to computer rooms are escorted. Information 
stored in the computer may be accessed by authorized VA employees at 
remote locations including VA healthcare facilities, Information 
Systems Centers, VA Central Office and Veteran Integrated Service 
Networks. Access is controlled by individually unique passwords/codes 
which must be changed periodically by the employee.
    4. The system is hosted in Amazon Web Services Government Cloud 
infrastructure as a service cloud computing environment that has been 
authorized at the high-impact level under the Federal Risk and 
Authorization Management Program. The secure site-to-site encrypted 
network connection is limited to access via the VA trusted internet 
connection.

RECORD ACCESS PROCEDURES:
    Individuals seeking information on the existence and content of 
records in this system pertaining to them should contact the system 
manager in writing as indicated above, or write, call or visit the VA 
facility location where they are or were employed or made contact. A 
request for access to records must contain the requester's full name, 
address, telephone number, be signed by the requester, and describe the 
records sought in sufficient detail to enable VA personnel to locate 
them with a reasonable amount of effort.

CONTESTING RECORD PROCEDURES:
    Individuals seeking to contest or amend records in this system 
pertaining to them should contact the system manager in writing as 
indicated above, or write, call or visit the VA facility location where 
they are or were employed or made contact. A request to contest or 
amend records must state clearly and concisely what record is being 
contested, the reasons for contesting it, and the proposed amendment to 
the record.

NOTIFICATION PROCEDURES:
    Generalized notice is provided by the publication of this notice. 
For specific notice, see Record Access Procedure, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None

HISTORY:
    73 FR 72117 (November 26, 2008)

[FR Doc. 2023-24193 Filed 11-1-23; 8:45 am]
BILLING CODE P


This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.