Privacy Act of 1974; System of Records, 6568-6571 [2024-01984]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 89, Number 22 (Thursday, February 1, 2024)]
[Notices]
[Pages 6568-6571]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-01984]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Veterans Health Administration (VHA), Department of Veterans 
Affairs (VA).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: Pursuant to the Privacy Act of 1974, notice is hereby given 
that the Department of Veterans Affairs (VA) is modifying the system of 
records entitled, ``Caregiver Support Program--Caregiver Record 
Management Application (CARMA)-VA'' (197VA10). This system is used to 
administer, monitor and track services delivered through VA's Caregiver 
Support Program including documentation of calls to the Caregiver 
Support Line.

DATES: Comments on this modified system of records must be received no 
later than 30 days after date of publication in the Federal Register. 
If no public comment is received during the period allowed for comment 
or unless otherwise published in the Federal Register by VA, the 
modified system of records will become effective a minimum of 30 days 
after date of publication in the Federal Register. If VA receives 
public comments, VA shall review the comments to determine whether any 
changes to the notice are necessary.

ADDRESSES: Comments may be submitted through www.Regulations.gov or 
mailed to VA Privacy Service, 810 Vermont Avenue NW, (005X6F), 
Washington, DC 20420. Comments should indicate that they are submitted 
in response to ``Caregiver Support Program-Caregiver Record Management 
Application (CARMA)-VA'' (197VA10). Comments received will be available 
at www.Regulations.gov for public viewing, inspection or copies.

FOR FURTHER INFORMATION CONTACT: Stephania Griffin, Veterans Health 
Administration (VHA) Chief Privacy Officer, Department of Veterans 
Affairs, 810 Vermont Avenue NW, (105HIG) Washington, DC 20420, 
[email protected], telephone (704) 245-2492 (Note: This is not a 
toll-free number).

SUPPLEMENTARY INFORMATION: VA is modifying this system of records to 
identify changes that will more accurately describe the records 
maintained in the system. Modifications have been made to the following 
titled sections: System Manager; Purposes of the System; Categories of 
Records in the System; Record Source Categories; Routine Uses of 
Records Maintained in the System; Policies and Practices for 
Retrievability of Records; Policies and Practices for Retention and 
Disposal of Records; Physical, Procedural, and Administrative 
Safeguards; Record Access Procedure; Contesting Record Procedure; and 
Notification Procedure. VA is republishing the system notice in its 
entirety.
    The System Manager is being updated to replace Deputy Chief 
Officer, Patient Care Services Office (10P4C), with Colleen M. 
Richardson, Psy.D, Executive Director, Caregiver Support Program 
(12CSP).
    The Purpose of the System is being modified to include the 
explanation that this system may also be used for improving health care 
operations, such as producing various management and patient follow-up 
reports; program monitoring for epidemiological research and other 
health care related or program impact studies; statistical analysis, 
resource allocation, and planning and process improvement; providing 
clinical and administrative support to patient medical care and 
services; determining entitlement and eligibility benefits; processing 
and adjudicating benefit claims; and general program oversight 
activities.
    The Categories of Records in the System section has additional 
language regarding VA Form 10-305, ``Your Rights to Seek Further Review 
of Program of Comprehensive Assistance for Family Caregivers (PCAFC) 
Decisions.''
    The Record Source Categories section has been expanded to include 
the Board of Veterans' Appeals and other VA staff offices.
    The section for Routine Uses of Records Maintained in the System 
for this VA system of records notice has been amended.
    Standardized Routine Uses #16 through #18 have been added to this 
system of records notice.
    The following standard routine use is added and will be Routine Use 
#16, Equal Employment Opportunity Commission (EEOC): To the EEOC in 
connection with investigations of alleged or possible discriminatory 
practices, examination of Federal affirmative employment programs, or 
other functions of the Commission as authorized by law.
    The following standard routine use is added and will be Routine Use 
#17, Federal Labor Relations Authority (FLRA): To the FLRA in 
connection with the investigation and resolution of allegations of 
unfair labor practices, the resolution of exceptions to arbitration 
awards when a question of material fact is raised, matters before the 
Federal Service Impasses Panel, and the investigation of representation 
petitions and the conduct or supervision of representation elections.
    The following standard routine use is added and will be Routine Use 
#18, Merit Systems Protection Board (MSPB): To the MSPB in connection 
with appeals, special studies of the civil service and other merit 
systems, review of rules and regulations, investigation of alleged or 
possible prohibited personnel practices, and such other functions 
promulgated in 5 U.S.C. 1205 and 1206, or as authorized by law.
    Routine Use #19 is added to promulgate the use of information for 
VA research which states, Researchers, for Research: To epidemiological 
and other research facilities approved by the Under Secretary for 
Health for research purposes determined to be necessary and proper, 
provided that the names and addresses of Veterans, their dependents and 
caregivers will not be disclosed unless those names and addresses are 
first provided to VA by the facilities making the request.

[[Page 6569]]

    The Policies and Practices for Retrievability of Records section is 
being modified to exclude the Social Security number as an identifier 
to retrieve records on an individual.
    The Policies and Practices for Retention and Disposal of Records is 
being modified to state that CARMA records are disposed of in 
accordance with the schedule approved by the Archivist of the United 
States, VHA Records Control Schedule (RCS) 10-1, Item Number 7900, 
Temporary; Destroy 75 years after enrollment.
    Physical, Procedural, and Administrative Safeguards has been 
amended to include Amazon Web Services as a procedural safeguard for 
sensitive information.
    The Record Access Procedure, Contesting Record Procedure and 
Notification Procedure have been modified to reflect standard language 
across VA systems of records.
    The Report of Intent to Modify a System of Records Notice and an 
advance copy of the system notice have been sent to the appropriate 
Congressional committees and to the Director of the Office of 
Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy 
Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.

Signing Authority

    The Senior Agency Official for Privacy, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Kurt D. 
DelBene, Assistant Secretary for Information and Technology and Chief 
Information Officer, approved this document on December 18, 2023 for 
publication.

    Dated: January 29, 2024.
Amy L. Rose,
Government Information Specialist, VA Privacy Service, Office of 
Compliance, Risk and Remediation, Office of Information and Technology, 
Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:
    ``Caregiver Support Program--Caregiver Record Management 
Application (CARMA)-VA'' (197VA10)

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    The Caregiver Record Management Application (CARMA) system is 
hosted in the Salesforce Gov Cloud. The Salesforce's corporate address 
is 1 Market Street #300, San Francisco, CA 94105.

SYSTEM MANAGER(S):
    Official responsible for policies and procedures: Colleen M. 
Richardson, Psy.D, Executive Director, Caregiver Support Program 
(12CSP), 810 Vermont Avenue NW, Washington, DC 20420, 
[email protected], telephone number (202) 461-1635 (Note: This 
is not a toll-free number).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Caregivers and Veterans Omnibus Health Services Act of 2010, Public 
Law 111-163; 38 CFR 71.40; and 31 U.S.C. 3321.

PURPOSE(S) OF THE SYSTEM:
    Records in this system of records are used to administer, monitor 
and track the services and benefits, sought and delivered through VA's 
Caregiver Support Program, including the documentation of telephone 
calls to the Caregiver Support Line. The system and data contained 
therein is used to fully support the Program of Comprehensive 
Assistance for Family Caregivers (PCAFC) and allows for data assessment 
and comprehensive monitoring. The CARMA workflow management system is 
being used for Social Security number matching and other data field 
requirements. In addition, information in this system of records is 
used to respond to Congressional and/or internal and external 
stakeholders on the performance of the VA Caregiver Support Program. 
This system may also be used for the purpose of improving health care 
operations such as producing various management and patient follow-up 
reports; program monitoring for epidemiological research and other 
health care related or program impact studies; statistical analysis, 
resource allocation, and planning and process improvement; providing 
clinical and administrative support to patient medical care and 
services; determining entitlement and eligibility benefits; processing 
and adjudicating benefit claims; and general program oversight 
activities.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The records include Veterans and caregivers inquiring about, 
applying for, participating in and those who have previously applied 
for or participated in the PCAFC or the Program of General Caregiver 
Support Services (PGCSS) established by the Caregivers and Veterans 
Omnibus Health Services Act of 2010, Public Law 111-163, as well as 
individuals who contact or are contacted by VA's Caregiver Support 
Line, Veterans, their spouses and dependents as provided for in other 
provisions of title 38 U.S.C.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Records in this system include: the Veteran and caregiver(s) name, 
Social Security number, gender, age, date of birth, address, phone 
number, and email address; VA eligibility related information, such as 
service connection, DD 214, ``Certification of Release or Discharge 
from Active Duty'', Line of Duty documentation; PCAFC stipend payment 
information; written correspondence; VA Form 10-10CG, ``Application for 
Comprehensive Assistance for Family Caregiver Program''; requests for 
information about PCAFC Decisions (VA Form 10-305, ``Your Rights to 
Seek Further Review of Program of Comprehensive Assistance for Family 
Caregivers (PCAFC) Decisions'') and responses to such requests; 
Decision Notice Letters pertaining to eligibility for and participation 
in PCAFC and PGCSS; requests for further review and appeal of PCAFC 
decisions and related records in support of these claims and decisions, 
and correspondence with Caregiver Support Line, including referral 
information and VA staff remarks.

RECORD SOURCE CATEGORIES:
    Records in this system of records may be provided by the applicant, 
applicant's spouse or other family members or accredited 
representatives or friends; Veterans, caregivers, and other interested 
parties seeking or receiving information, benefits or services about 
VA's Caregiver Support Program, including the Caregiver Support Line; 
VA employees; and VA systems including but not limited to Veterans 
Health Information System and Technology Architecture (VistA), VA 
Master Person Index, VHA Corporate Data Warehouse, and Enrollment 
System; Veterans Benefits Administration (VBA); the Board of Veterans' 
Appeals (BVA); other VA staff offices; and State and Federal agencies.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 45 CFR parts 160 and 164, i.e., individually 
identifiable health information of VHA or any of its business 
associates, and 38 U.S.C. 7332, i.e., medical treatment information 
related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia, 
or infection with the human immunodeficiency virus, that information 
cannot be disclosed under a

[[Page 6570]]

routine use unless there is also specific disclosure authority in both 
38 U.S.C. 7332 and 45 CFR parts 160, 161, and 164.
    1. Claims Representatives: To accredited service organizations, VA-
approved claim agents, and attorneys acting under a declaration of 
representation, so that these individuals can aid claimants in the 
preparation, presentation, and prosecution of claims under the laws 
administered by VA upon the request of the claimant and provided that 
the disclosure is limited to information relevant to a claim, such as 
the name, address, the basis and nature of a claim, amount of benefit 
payment information, medical information, and military service and 
active duty separation information.
    2. Law Enforcement: To a Federal, State, local, Territorial, 
Tribal, or foreign law enforcement authority or other appropriate 
entity charged with the responsibility of investigating or prosecuting 
such violation or charged with enforcing or implementing such law, 
provided that the disclosure is limited to information that, either 
alone or in conjunction with other information, indicates a violation 
or potential violation of law, whether civil, criminal, or regulatory 
in nature. The disclosure of the names and addresses of Veterans and 
their dependents from VA records under this routine use must also 
comply with the provisions of 38 U.S.C. 5701.
    3. Guardians, Courts, for Incompetent Veterans: To a court, 
magistrate, or administrative tribunal in matters of guardianship, 
inquests, and commitments; to private attorneys representing Veterans 
rated incompetent in conjunction with the issuance of Certificates of 
Incompetency; or to probation and parole officers in connection with 
court-required duties.
    4. Guardians Ad Litem, for Representation: To a fiduciary or 
guardian ad litem in relation to his or her representation of a 
claimant in any legal proceeding as relevant and necessary to fulfill 
the duties of the fiduciary or guardian ad litem.
    5. Attorneys, Insurers, Employers: To attorneys, insurance 
companies, employers, third parties liable or potentially liable under 
health plan contracts, and courts, boards, or commissions as relevant 
and necessary to aid VA in the preparation, presentation, and 
prosecution of claims authorized by law.
    6. DoJ, Litigation, Administrative Proceeding: To the Department of 
Justice (DoJ), or in a proceeding before a court, adjudicative body, or 
other administrative body before which VA is authorized to appear, 
when:
    (a) VA or any component thereof;
    (b) Any VA employee in his or her official capacity;
    (c) Any VA employee in his or her individual capacity where DoJ has 
agreed to represent the employee; or
    (d) The United States, where VA determines that litigation is 
likely to affect the agency or any of its components is a party to such 
proceedings or has an interest in such proceedings, and VA determines 
that use of such records is relevant and necessary to the proceedings.
    7. National Archives and Records Administration (NARA): To National 
Archives and Records Administration (NARA) in records management 
inspections conducted under 44 U.S.C. 2904 and 2906, or other functions 
authorized by laws and policies governing NARA operations and VA 
records management responsibilities.
    8. Treasury, for Withholding: To the Department of the Treasury for 
the collection of title 38 benefit overpayments, overdue indebtedness, 
or costs of services provided to an individual not entitled to such 
services, by the withholding of all or a portion of the person's 
Federal income tax refund, provided that the disclosure is limited to 
information concerning an individual's indebtedness by virtue of a 
person's participation in a benefits program administered by VA.
    9. Consumer Reporting Agencies: To a consumer reporting agency for 
the purpose of locating the individual, obtaining a consumer report to 
determine the ability of the individual to repay an indebtedness to the 
United States, or assisting in the collection of such indebtedness, 
provided that the provisions of 38 U.S.C. 5701(g)(2) and (4) have been 
met, provided that the disclosure is limited to information that is 
reasonably necessary to identify such individual or concerning that 
individual's indebtedness to the United States by virtue of the 
person's participation in a benefits program administered by the 
Department.
    10. Contractors: To contractors, grantees, experts, consultants, 
students, and others performing or working on a contract, service, 
grant, cooperative agreement, or other assignment for VA, when 
reasonably necessary to accomplish an agency function related to the 
records.
    11. Congress: To a Member of Congress or staff acting upon the 
Member's behalf when the Member or staff requests the information on 
behalf of, and at the request of, the individual who is the subject of 
the record.
    12. Identity Theft Remediation, for Another Federal Agency: To 
other Federal agencies may be made to assist such agencies in 
preventing and detecting possible fraud or abuse by individuals in 
their operations and programs. This routine use permits disclosures by 
the Department to report a suspected incident of identity theft and 
provide information and/or documentation related to or in support of 
the reported incident.
    13. Data Breach Response and Remediation, for VA: To appropriate 
agencies, entities, and persons when (1) VA suspects or has confirmed 
that there has been a breach of the system of records; (2) VA has 
determined that as a result of the suspected or confirmed breach there 
is a risk of harm to individuals, VA (including its information 
systems, programs, and operations), the Federal Government or national 
security; and (3) the disclosure made to such agencies, entities, and 
persons is reasonably necessary to assist in connection with VA's 
efforts to respond to the suspected or confirmed breach or to prevent, 
minimize, or remedy such harm.
    14. Federal Agencies, for Computer Matches: To other Federal 
agencies for the purpose of conducting computer matches to obtain 
information to determine or verify eligibility of Veterans receiving VA 
benefits or medical care under title 38.
    15. Data Breach Response and Remediation, for Another Federal 
Agency: To another Federal agency or Federal entity, when VA determines 
that information from this system of records is reasonably necessary to 
assist the recipient agency or entity in (1) responding to a suspected 
or confirmed breach or (2) preventing, minimizing, or remedying the 
risk of harm to individuals, the recipient agency or entity (including 
its information systems, programs and operations), the Federal 
Government, or national security, resulting from a suspected or 
confirmed breach.
    16. Equal Employment Opportunity Commission (EEOC): To the EEOC in 
connection with investigations of alleged or possible discriminatory 
practices, examination of Federal affirmative employment programs, or 
other functions of the Commission as authorized by law.
    17. Federal Labor Relations Authority (FLRA): To the FLRA in 
connection with the investigation and resolution of allegations of 
unfair labor practices, the resolution of exceptions to arbitration 
awards when a question of material fact is raised, matters before the 
Federal Service Impasses Panel, and the

[[Page 6571]]

investigation of representation petitions and the conduct or 
supervision of representation elections.
    18. Merit Systems Protection Board (MSPB): To the MSPB in 
connection with appeals, special studies of the civil service and other 
merit systems, review of rules and regulations, investigation of 
alleged or possible prohibited personnel practices, and such other 
functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by 
law.
    19. Researchers, for Research: To epidemiological and other 
research facilities approved by the Under Secretary for Health for 
research purposes determined to be necessary and proper, provided that 
the names and addresses of Veterans, their dependents and caregivers 
will not be disclosed unless those names and addresses are first 
provided to VA by the facilities making the request.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    The CARMA system of records is hosted in the Salesforce Gov Cloud 
(GovCloud). The production environment (including application data) is 
backed up weekly to VA's Amazon Web Services (AWS) Cloud.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records in this system are retrieved by name, integration control 
number (ICN), correspondence tracking number, internal record number, 
facility number, or other assigned identifiers of the individuals on 
whom they are maintained.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records in this system are retained and disposed of in accordance 
with the schedule approved by the Archivist of the United States, VHA 
RCS 10-1, Item Number 7900, Temporary; Destroy 75 years after 
enrollment.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL, SAFEGUARDS:
    1. On an annual basis, employees are required to sign a computer 
access agreement acknowledging their understanding of confidentiality 
requirements. In addition, all employees receive annual privacy 
awareness and information security training.
    2. Access to electronic records is deactivated when no longer 
required for official duties. Recurring monitors are in place to ensure 
compliance with nationally and locally established security measures.
    3. Strict control measures are enforced to ensure that access to 
and disclosure from all records are limited to VA and the contractor's 
employees whose official duties warrant access to those files.
    4. Access to the records in CARMA is restricted and requires 
approval prior to access. Restricted access will be provided to enable 
workflow management to administer, monitor and track services delivered 
through VA's Caregiver Support Program including, but not limited to, 
documentation of calls to the Caregiver Support Line.
    5. The records in CARMA are safeguarded by the AWS GovCloud 
infrastructure that has been authorized at the high-impact level under 
the Federal Risk and Authorization Management Program. The secure site-
to-site encrypted network connection is limited to access via the VA 
trusted internet connection.

RECORD ACCESS PROCEDURE:
    Individuals seeking information on the existence and content of 
records in this system pertaining to them should contact the system 
manager in writing as indicated above or inquire in person at the 
nearest VA facility. A request for access to records must contain the 
requester's name, address, telephone number, signed by the requester, 
and describes the records sought in sufficient detail to enable VA 
personnel to locate them with a reasonable amount of effort.

CONTESTING RECORD PROCEDURES:
    Individuals seeking to contest or amend records in this system 
pertaining to them should contact the system manager in writing as 
indicated above or inquire in person at the nearest VA facility. A 
request to contest or amend records must state clearly and concisely 
what record is being contested, the reasons for contesting it, and the 
proposed amendment to the record.

NOTIFICATION PROCEDURES:
    Generalized notice is provided by the publication of this notice. 
For specific notice, see Record Access Procedure, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    86 FR 18588 (April 9, 2021).

[FR Doc. 2024-01984 Filed 1-31-24; 8:45 am]
BILLING CODE