Privacy Act of 1974; System of Records

AGENCY:

Department of Veterans Affairs (VA).

ACTION:

Notice of new system of records.

SUMMARY:

The Privacy Act of 1974 (5 U.S.C. 552a(e)(4)) requires that all agencies publish in the Federal Register a notice of the existence and character of their systems of records. Notice is hereby given that the Department of Veterans Affairs (VA) is establishing a new system of records entitled “National Patient Databases-VA” (121VA19).

DATES:

Comments on this new system of records must be received no later than May 7, 2004. If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by VA, the new system will become effective May 7, 2004.

ADDRESSES:

You may mail or hand-deliver written comments concerning the proposed amended system of records to the Director, Regulations Management (00REG1), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420; or fax comments to (202) 273-9026; or email comments to “OGCRegulations@mail.va.gov”. All relevant material received before May 7, 2004 will be considered. Comments will be available for public inspection at the above address in the Office of Regulations Management, room 1063B, between the hours of 8 a.m. and 4:30 p.m., Monday through Friday (except holidays).

FOR FURTHER INFORMATION CONTACT:

Veterans Health Administration (VHA) Privacy Act Officer, Department of Veterans Affairs, 810 Vermont Avenue NW., Washington, DC 20420, telephone (727) 320-1839.

SUPPLEMENTARY INFORMATION:

Background: VHA is the largest health care provider in the country. In order to maintain this organization, VHA collects health care information from its local facilities to evaluate quality of services, clinical resource utilization, and patient safety, as well as to distribute medical information such as alerts or recalls, track specific diseases, and monitor patients. National-level information is also needed for other activities such as, medical research, the development of National Best Clinical Practice Guidelines, and National Quality Standards. VHA gathers this information received from a wide variety of sources to include data obtained directly from a veteran as well as from information systems located at VHA medical centers, Veterans Integrated Service Networks (VISN), other VHA facilities such as the Health Eligibility Center, and Federal departments and agencies such as the U.S. Department of Defense and the Food and Drug Administration. As the data is collected, VHA stores it in several national patient databases.

I. Description of Proposed Systems of Records

The proposed system of records contains health information such as, patient assessments, diagnoses, treatments, tests, and pharmaceutical data. The records include information created or collected during the course of normal clinical operations work and is provided by patients, employees, students, volunteers, contractors, subcontractors, and consultants. Quality assurance (QA) information that is protected by 38 U.S.C. 5701 and 38 CFR 17.500-17.511 is retrieved by individual identifier and therefore not within the scope of the Privacy Act. Therefore, QA information is not included in this system of records or filed in a manner so that the information may be retrieved by reference to an individual identifier.

VHA uses data stored in national patient databases to prepare various management, tracking, and follow-up reports necessary for the effective operation of VHA as it plans for and then delivers quality health care. This includes evaluating patient eligibility, benefits and care services; monitoring the distribution and utilization of resources including provider panel management; tracking disease and patient outcomes; program review, accreditation and licensing; quality assurance audits and investigations; law enforcement investigations; and measuring VISN performance. The data may be used to validate labor policies and practices and be extracted for use by VA researchers in accordance with established protocols. The data in a de-identified form may also be used for determining best practices.

The national databases covered by this system of records are identified and listed with their physical location in Appendix 4.

II. Proposed Routine Use Disclosures of Data in the System

To the extent that records contained in the system include information protected by 38 U.S.C. 7332, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific statutory authority permitting disclosure.

VHA is proposing the following routine use disclosures of information to be maintained in the system:

1. On its own initiative, VA may disclose information, except for the names and home addresses of veterans and their dependents, to a Federal, State, local, tribal or foreign agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto. On its own initiative, the VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto.

VA must be able to comply with the requirements of agencies charged with enforcing the law and conducting investigations. VA must also be able to provide information to State or local agencies charged with protecting the public's health as set forth in state law.

2. Disclosure may be made to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose(s) of the request, and to identify the type of information requested), when necessary to obtain information relevant to an individual's eligibility, care history, or other benefits.

3. Disclosure may be made to an agency in the executive, legislative, or judicial branch, or the District of Columbia government in response to its request or at the initiation of VA, in connection with disease tracking, patient outcomes or other health information required for program accountability.

4. Disclosure may be made to National Archives and Records Administration (NARA) for it to perform its records management inspections responsibilities and its role as Archivist of the United States under authority of Title 44 United States Code (USC).

NARA is responsible for archiving old records no longer actively used but which may be appropriate for preservation; they are responsible in general for the physical maintenance of the Federal government's records. VA must be able to turn records over to these agencies in order to determine the proper disposition of such records.

5. Any information in this system of records may be disclosed to the United States Department of Justice or United States Attorneys in order to prosecute or defend litigation involving or pertaining to the United States, or in which the United States has an interest.

6. Records from this system of records may be disclosed to a Federal agency or to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity which maintains records concerning individuals' employment histories or concerning the issuance, retention or revocation of licenses, certifications, or registration necessary to practice an occupation, profession or specialty, in order for the agency to obtain information relevant to an agency decision concerning the hiring, retention or termination of an employee.

7. Records from this system of records may be disclosed to inform a Federal agency, licensing boards or the appropriate non-government entities about the health care practices of a terminated, resigned or retired health care employee whose professional health care activity so significantly failed to conform to generally accepted standards of professional medical practice as to raise reasonable concern for the health and safety of patients receiving medical care in the private sector or from another Federal agency.

8. For program review purposes and the seeking of accreditation and/or certification, disclosure may be made to survey teams of the Joint Commission on Accreditation of Healthcare Organizations (JCAHO), College of American Pathologists, American Association of Blood Banks, and similar national accreditation agencies or boards with whom VA has a contract or agreement to conduct such reviews but only to the extent that the information is necessary and relevant to the review.

VA health care facilities undergo certification and accreditation by several national accreditation agencies or boards to comply with regulations and good medical practices. VA must be able to disclose information for program review purposes and the seeking of accreditation and/or certification of health care facilities and programs.

9. Disclosure may be made to a national certifying body which has the authority to make decisions concerning the issuance, retention or revocation of licenses, certifications or registrations required to practice a health care profession, when requested in writing by an investigator or supervisory official of the national certifying body for the purpose of making a decision concerning the issuance, retention or revocation of the license, certification or registration of a named health care professional.

VA must be able to report information regarding the care a health care practitioner provides to a national certifying body charged with maintaining the health and safety of patients by making a decision about a health care professional's license, certification or registration, such as issuance, retention, revocation or other actions such as suspension.

10. Disclosure may be made to officials of labor organizations recognized under 5 U.S.C. chapter 71 when relevant and necessary to their duties of exclusive representation concerning personnel policies, practices, and matters affecting working conditions.

11. Disclosure may be made to the VA-appointed representative of an employee all notices, determinations, decisions, or other written communications issued to the employee in connection with an examination ordered by VA under medical evaluation (formerly fitness-for-duty) examination procedures or Department-filed disability retirement procedures.

12. Disclosure may be made to officials of the Merit Systems Protection Board, and the Office of the Special Counsel, or both, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions, promulgated in 5 U.S.C. or as may be authorized by law.

13. Disclosure may be made to the Equal Employment Opportunity Commission when requested in connection with investigations of alleged or possible discrimination practices, examination of Federal affirmative employment programs, compliance with the Uniform Guidelines of Employee Selection Procedures, or other functions vested in the Commission by the President's Reorganization Plan No. 1 of 1978.

14. Disclosure may be made to the Federal Labor Relations Authority (FLRA), including its General Counsel, when requested in connection with investigation and resolution of allegations of unfair labor practices, in connection with the resolution of exceptions to arbitrator awards when a question of material fact is raised and matters before the Federal Service Impasses Panel.

The release of information to FLRA from this Privacy Act system of records is necessary to comply with the statutory mandate under which FLRA operates.

15. Disclosure of medical record data, excluding name and address, unless name and address is furnished by the requester, may be made to epidemiological and other research facilities for research purposes determined to be necessary and proper when approved in accordance with VA policy.

16. Disclosure of name(s) and address(s) of present or former personnel of the Armed Services, and/or their dependents, may be made to: (a) A Federal department or agency, at the written request of the head or designee of that agency; or (b) directly to a contractor or subcontractor of a Federal department or agency, for the purpose of conducting Federal research necessary to accomplish a statutory purpose of an agency. When disclosure of this information is made directly to a contractor, VA may impose applicable conditions on the department, agency, and/or contractor to insure the appropriateness of the disclosure to the contractor.

17. Relevant information may be disclosed to individuals, organizations, private or public agencies, etc., with whom VA has a contract or agreement, including subcontractors, to perform such services as VA may deem practical for the purposes of laws administered by VA, in order for the contractor to perform the services of the contract or agreement.

VA must be able to give a contractor whatever information is necessary for the contractor to fulfill its duties. In these situations, safeguards are provided in the contract prohibiting the contractor from using or disclosing the information for any purpose other than that described in the contract.

18. Disclosure may be made to a Congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.

Individuals sometimes request the help of a member of Congress in resolving some issues relating to a matter before VA. The member of Congress then writes VA, and VA must be able to give sufficient information to be responsive to the inquiry.

III. Compatibility of the Proposed Routine Uses

The Privacy Act permits VA to disclose information about individuals without their consent for a routine use when the information will be used for a purpose that is compatible with the purpose for which VA collected the information. In all of the routine use disclosures described above, either the recipient of the information will use the information in connection with a matter relating to one of VA's programs, will use the information to provide a benefit to VA, or disclosure is required by law.

Under section 264, Subtitle F of Title II of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Public Law 104-191, 100 Stat. 1936, 2033-34 (1996), the United States Department of Health and Human Services (HHS) published a final rule, as amended, establishing Standards for Privacy of Individually-Identifiable Health Information, 45 CFR parts 160 and 164. The Veterans Health Administration (VHA) may not disclose individually-identifiable health information (as defined in HIPAA and the Privacy Rule, 42 U.S.C. 1320(d)(6) and 45 CFR 164.501) pursuant to a routine use unless either: (a) The disclosure is required by law, or (b) the disclosure is also permitted or required by the HHS Privacy Rule. The disclosures of individually-identifiable health information contemplated in the routine uses published in this amended system of records notice are permitted under the Privacy Rule or required by law. However, to also have authority to make such disclosures under the Privacy Act, VA must publish these routine uses. Consequently, VA is publishing these routine uses and is adding a preliminary paragraph to the routine uses portion of the system of records notice stating that any disclosure pursuant to the routine uses in this system of records notice must be either required by law or permitted by the Privacy Rule before VHA may disclose the covered information.

The notice of intent to publish and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.

121VA19

SYSTEM NAME:

National Patient Databases—VA.

SYSTEM LOCATION:

Records are maintained at Department of Veterans Affairs (VA) medical centers, VA Data Processing Centers, Veterans Integrated Service Networks (VISNs) and Office of Information (OI) Field Offices. Address location for each VA national patient database is listed in VA Appendix 4 at the end of this document.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The records contain information for all individuals

(1) Receiving health care from the Veterans Health Administration (VHA), and

(2) Providing the health care.

Individuals encompass veterans and their immediate family members, members of the armed services, current and former employees, trainees, contractors, sub-contractors, consultants, volunteers, and other individuals working collaboratively with VA.

CATEGORIES OF RECORDS IN THE SYSTEM:

The records may include information related to:

1. Patient medical record abstract information including information from Patient Medical Record—VA (24VA136).

2. The record may include identifying information (e.g., name, birth date, death date, admission date, discharge date, gender, social security number, taxpayer identification number); address information (e.g., home and/or mailing address, home telephone number, emergency contact information such as name, address, telephone number, and relationship); prosthetic and sensory aid serial numbers; medical record numbers; integration control numbers; information related to medical examination or treatment (e.g., location of VA medical facility providing examination or treatment, treatment dates, medical conditions treated or noted on examination); information related to military service and status;

3. Medical benefit and eligibility information;

4. Patient aggregate workload data such as admissions, discharges, and outpatient visits; resource utilization such as laboratory tests, x-rays, pharmaceuticals, prosthetics and sensory aids; employee workload and productivity data;

5. Information on services or products needed in the provision of medical care (i.e. pacemakers, prosthetics, dental implants, hearing aids, etc.); data collected may include vendor name and address, details about and/or evaluation of service or product, price/fee, dates purchased and delivered; and

6. Health care practitioner's identification number.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Title 38, United States Code, Section 501.

PURPOSE(S):

The records and information may be used for statistical analysis to produce various management, workload tracking, and follow-up reports; to track and evaluate the ordering and delivery of equipment, services and patient care; for the planning, distribution and utilization of resources; to monitor the performance of Veterans Integrated Service Networks (VISN); and to allocate clinical and administrative support to patient medical care. The data may be used for VA's extensive research programs in accord with VA policy. In addition, the data may be used to assist in workload allocation for patient treatment services including provider panel management, nursing care, clinic appointments, surgery, diagnostic and therapeutic procedures; to plan and schedule training activities for employees; for audits, reviews and investigations conducted by the Network Directors Office and VA Central Office; for quality assurance audits, reviews and investigations; for law enforcement investigations; and for personnel management, evaluation and employee ratings, and performance evaluations.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

To the extent that records contained in the system include information protected by 38 U.S.C. 7332, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific statutory authority permitting disclosure.

VA may disclose protected health information pursuant to the following routine uses where required by law, or permitted by 45 CFR parts 160 and 164.

1. On its own initiative, VA may disclose information, except for the names and home addresses of veterans and their dependents, to a Federal, state, local, tribal or foreign agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto. On its own initiative, VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto.

2. Disclosure may be made to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose(s) of the request, and to identify the type of information requested), when necessary to obtain information relevant to an individual's eligibility, care history, or other benefits.

3. Disclosure may be made to an agency in the executive, legislative, or judicial branch, or the District of Columbia government in response to its request or at the initiation of VA, in connection with disease tracking, patient outcomes or other health information required for program accountability.

4. Disclosure may be made to National Archives and Records Administration (NARA) for it to perform its records management inspections responsibilities and its role as Archivist of United States under authority of Title 44 United States Code (USC).

5. Any information in this system of records may be disclosed to the United States Department of Justice or United States Attorneys in order to prosecute or defend litigation involving or pertaining to the United States, or in which the United States has an interest.

6. Records from this system of records may be disclosed to a Federal agency or to a state or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity which maintains records concerning individuals' employment histories or concerning the issuance, retention or revocation of licenses, certifications, or registration necessary to practice an occupation, profession or specialty, in order for the agency to obtain information relevant to an agency decision concerning the hiring, retention or termination of an employee.

7. Records from this system of records may be disclosed to inform a Federal agency, licensing boards or the appropriate non-government entities about the health care practices of a terminated, resigned or retired health care employee whose professional health care activity so significantly failed to conform to generally accepted standards of professional medical practice as to raise reasonable concern for the health and safety of patients receiving medical care in the private sector or from another Federal agency.

8. For program review purposes and the seeking of accreditation and/or certification, disclosure may be made to survey teams of the Joint Commission on Accreditation of Healthcare Organizations (JCAHO), College of American Pathologists, American Association of Blood Banks, and similar national accreditation agencies or boards with whom VA has a contract or agreement to conduct such reviews but only to the extent that the information is necessary and relevant to the review.

9. Disclosure may be made to a national certifying body which has the authority to make decisions concerning the issuance, retention or revocation of licenses, certifications or registrations required to practice a health care profession, when requested in writing by an investigator or supervisory official of the national certifying body for the purpose of making a decision concerning the issuance, retention or revocation of the license, certification or registration of a named health care professional.

10. Disclosure may be made to officials of labor organizations recognized under 5 U.S.C. chapter 71 when relevant and necessary to their duties of exclusive representation concerning personnel policies, practices, and matters affecting working conditions.

11. Disclosure may be made to the representative of an employee of all notices, determinations, decisions, or other written communications issued to the employee in connection with an examination ordered by VA under medical evaluation (formerly fitness-for-duty) examination procedures or Department-filed disability retirement procedures.

12. Disclosure may be made to officials of the Merit Systems Protection Board, and the Office of the Special Counsel, or both, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions, promulgated in 5 U.S.C. or as may be authorized by law.

13. Disclosure may be made to the Equal Employment Opportunity Commission when requested in connection with investigations of alleged or possible discrimination practices, examination of Federal affirmative employment programs, compliance with the Uniform Guidelines of Employee Selection Procedures, or other functions vested in the Commission by the President's Reorganization Plan No. 1 of 1978.

14. Disclosure may be made to the Federal Labor Relations Authority (including its General Counsel) when requested in connection with investigation and resolution of allegations of unfair labor practices, in connection with the resolution of exceptions to arbitrator awards when a question of material fact is raised and matters before the Federal Service Impasses Panel.

15. Disclosure of medical record data, excluding name and address, unless name and address is furnished by the requester, may be made to epidemiological and other research facilities for research purposes determined to be necessary and proper when approved in accordance with VA policy.

16. Disclosure of name(s) and address(s) of present or former personnel of the Armed Services, and/or their dependents, may be made to: (a) A Federal department or agency, at the written request of the head or designee of that agency; or (b) directly to a contractor or subcontractor of a Federal department or agency, for the purpose of conducting Federal research necessary to accomplish a statutory purpose of an agency. When disclosure of this information is made directly to a contractor, VA may impose applicable conditions on the department, agency, and/or contractor to insure the appropriateness of the disclosure to the contractor.

17. Relevant information may be disclosed to individuals, organizations, private or public agencies, etc., with whom VA has a contract or agreement, including subcontractors, to perform such services as VA may deem practical for the purposes of laws administered by VA, in order for the contractor to perform the services of the contract or agreement.

18. Disclosure may be made to a Congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Records are maintained on electronic storage media including magnetic tape, disk, laser optical media.

RETRIEVABILITY:

Records are retrieved by name, social security number or other assigned identifiers of the individuals on whom they are maintained.

SAFEGUARDS:

1. Access to and use of national patient databases are limited to those persons whose official duties require such access, and VA has established security procedures to ensure that access is appropriately limited. Information security officers and system data stewards review and authorize data access requests. VA regulates data access with security software that authenticates users and requires individually unique codes and passwords. VA provides information security training to all staff and instructs staff on the responsibility each person has for safeguarding data confidentiality.

2. Physical access to computer rooms housing national patient databases is restricted to authorized staff and protected by a variety of security devices. Unauthorized employees, contractors, and other staff are not allowed in computer rooms. The Federal Protective Service or other security personnel provide physical security for the buildings housing computer rooms and data centers.

3. Data transmissions between operational systems and national patient databases maintained by this system of record are protected by state of the art telecommunication software and hardware. This may include firewalls, encryption, and other security measures necessary to safeguard data as it travels across the VA Wide Area Network.

4. In most cases, copies of back-up computer files are maintained at off-site locations.

RETENTION AND DISPOSAL:

Records are maintained and disposed of in accordance with records disposition authority approved by the Archivist of the United States.

SYSTEMS AND MANAGER(S) AND ADDRESS:

Official responsible for policies and procedures; Chief Information Officer (19), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420. Official maintaining this system of record; Director National Data Systems (192-3), Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772.

NOTIFICATION PROCEDURE:

Individuals who wish to determine whether this system of records contains information about them should contact the Director of National Data Systems (19F4), Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772. Inquiries should include the person's full name, social security number, location and dates of employment or location and dates of treatment, and their return address.

RECORD ACCESS PROCEDURE:

Individuals seeking information regarding access to and contesting of records in this system may write or call the Director of National Data Systems (19F4), Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772, or call the VA Austin Automation Center Help Desk and ask to speak with the VHA Director of National Data Systems at 512-326-6780.

CONTESTING RECORD PROCEDURES:

(See Record Access Procedures above.)

RECORD SOURCE CATEGORIES:

Information in this system of records is provided by veterans, VA employees, VA computer systems, Veterans Health Information Systems and Technology Architecture (VistA), VA Medical Centers, VA Health Eligibility Center, VA Program Offices, VISNs, VA Austin Automation Center, the Food and Drug Administration, the Department of Defense, and the following Systems Of Records: “Patient Medical Records—VA” (24VA136); “National Prosthetics Patient Database—VA” (33VA113); “Healthcare Eligibility Records—VA” (89VA19); and the VA Veterans Benefits Administration automated record systems (including the Veterans and Beneficiaries Identification and Records Location Subsystem—VA (38VA23)).