Privacy Act of 1974; System of Records

AGENCY:

Department of Veterans Affairs (VA).

ACTION:

Notice of amendment to system of records.

SUMMARY:

The Privacy Act of 1974 (5 U.S.C. 552(e)(4)) requires that all agencies publish in the Federal Register a notice of the existence and character of their systems of records. Notice is hereby given that the Department of Veterans Affairs (VA) is amending the system of records entitled “Patient Fee Basis Medical and Pharmacy Records-VA” (23VA136) as set forth in the Federal Register 40 FR 38095 dated 8/26/75 and amended in the Federal Register 58 FR 40852 dated 7/30/93. VA is revising the System Name and Number and amending the paragraphs for System Location; Purpose(s); Routine Uses of Records Maintained in the System; Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of records in the System, including Storage and Safeguards; and System Manager. VA is republishing the system notice in its entirety.

DATES:

Comments on the amendment of this system of records must be received no later than October 28, 2002. If no public comment is received, the new system will become effective October 28, 2002.

ADDRESSES:

You may mail or hand-deliver written comments concerning the proposed amended system of records to the Office of Regulations Management (02D), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420; or fax comments to (202) 273-9289; or e-mail comments to “OGCRegulations@mail.va.gov”. All relevant material received before October 28, 2002 will be considered. Comments will be available for public inspection at the above address in the Office of Regulations Management, Room 1158, between the hours of 8 a.m. and 4:30 p.m., Monday through Friday (except holidays).

FOR FURTHER INFORMATION CONTACT:

Privacy Act Officer (19), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420, telephone (727) 320-1839.

SUPPLEMENTARY INFORMATION:

The name and number of the system is changed from “Patient Fee Basis Medical and Pharmacy Records-VA” (23VA136) to the “Non-VA Fee Basis Records-VA” (23VA163). The change in system name and number reflects organizational changes within the Department. The System Location; Purpose(s); Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of records in the System, including Storage and Safeguards have been amended to reflect changes in institutional names. Specifically, VA Central Office has been revised to VA Headquarters, VA Boston Development Center to VA Allocation Resource Center, VA Data Processing Center to Austin Automation Center (AAC), and DHCP to VISTA.

A new routine use is being added to allow for the disclosure of relevant information to individuals, organizations, private or public agencies, etc., with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor or subcontractor to perform the services of the contract or agreement. VA occasionally contracts out certain of its functions when this would contribute to effective and efficient operations. VA must be able to give a contractor whatever information is necessary for the contractor to fulfill its duties. In these situations, safeguards are provided in the contract prohibiting the contractor from using or disclosing the information for any purpose other than that described in the contract. Routine use 1 is being deleted and the routine uses will be renumbered. The System Manager was amended to reflect the organizational changes of the Department. VA is republishing the system notice in its entirety.

The notice of intent to publish and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of the Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.

23VA163 ,

System Name:

Non-VA Fee Basis Records-VA.

System Location:

Paper records are maintained at VA health care facilities and Federal record centers. Information is stored also in automated storage media records that are maintained at: The health care facilities (in most cases, back-up computer tape information is stored also at off-site locations); Department of Veterans Affairs Headquarters, 810 Vermont Ave, NW., Washington, DC; the VA Allocation Resource Center, Braintree, Massachusetts; the VA Office of Information Field Offices (OIFOs); the Veterans Benefits Administration (VBA) Regional Directors and Division Offices; and the Austin Automation Center (AAC) located in Austin, Texas. Address locations for VA facilities are listed in VA Appendix 1 of the biennial Privacy Act Issuances publication.

Categories of Individuals Covered by the System:

1. Veterans who have applied for health care services under title 38, United States Code, Chapter 17.

2. Beneficiaries of other Federal agencies.

3. Pensioned members of allied forces who are provided health care services under Title 38, United States Code, Chapter 1.

4. Non-VA health care providers who provide fee basis services to veterans.

Categories of Records in the System:

The records include information concerning patients who are authorized to obtain medical care and services from non-VA health care institutions and providers and the institutions and/or providers (e.g., individuals, pharmacies, clinics or group practices, hospitals, nursing homes, physicians, psychologists, podiatrists, optometrists, nurses, and others) who furnish the authorized medical treatment, services, medications, or supplies. The patient information may include name, address, social security and VA claim numbers, medical conditions authorized for treatment, eligibility information related to such treatment, the date authorization for the services was issued and the period of validity, the amounts paid for travel benefits, the amounts reimbursed for services paid for by the patient, and information that pertains to the medical care. Information that is maintained concerning the health care institutions and providers may include name, address, social security or employer's taxpayer identification numbers, services rendered, fees charged and amounts paid for services rendered, and earnings for performing such services.

Authority for Maintenance of the System:

Title 38, United States Code, chapter 1, section 111 and chapter 17, sections 1703, 1710, 1712, 1720 and 1728.

Purpose(s):

The records or information are used for the purposes of reporting health care provider earnings to the Internal Revenue Service; producing various management and patient follow-up reports; responding to patient and other inquiries; statistical analysis; for resource allocation and planning; providing clinical and administrative support to patient medical care and payments for medical care; determining entitlement and eligibility for VA benefits; processing and adjudicating benefit claims by VBA Regional Office (RO) staff; audits, reviews and investigations conducted by staff of the health care facility, the VBA Regional Directors and Division Offices, VA Headquarters, and the VA Office of Inspector General (OIG); law enforcement investigations; and quality assurance audits, reviews and investigations.

Routine Uses of Records Maintained in the System Including Categories of Users and the Purposes of Such Uses:

To the extent that records contained in the system include information protected by 38 U.S.C. 7332 (formerly section 4132), i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a Routine Use unless there is also specific statutory authority permitting disclosure.

1. Any information in this system, except the name and address of a veteran, which is relevant to a suspected violation or reasonably imminent violation of law, whether civil, criminal or regulatory in nature and whether arising by general or program statute or by regulation, rule or order issued pursuant thereto, may be disclosed to a Federal, State, local or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto. The names and addresses of veteran may only be disclosed:

a. To a Federal agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto, in response to its official request.

b. To any foreign, State or local government agency or instrumentality charged under applicable law with the protection of the public health or safety if a qualified representative of such organization, agency or instrumentality has made a written request that such name and address be provided for a purpose authorized by law.

2. A record from this system of records may be disclosed as a “routine use” to a Federal, State, or local government agency, or to a non-governmental organization maintaining civil, criminal or other relevant information, such as current licenses, registration or certification, if necessary to obtain information relevant to an agency decision concerning the hiring or retention of an employee, the use of an individual as a consultant, attending or to provide fee basis health care, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other health, educational or welfare benefits. Any information in this system also may be disclosed to any of the above-listed governmental organizations as part of a series of ongoing computer matches to determine if VA health care practitioners and private practitioners used by the VA hold current, unrestricted licenses, or are currently registered in a State, and are board certified in their specialty, if any. These computer matches are performed pursuant to the VA OIG's authority under Pub. L. 95-452, section 4(a), to detect and prevent fraud and abuse.

3. A record from this system of records may be disclosed to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the information is relevant and necessary to the requesting agency's decision on the matter.

4. To the Treasury Department to facilitate payments to physicians, clinics, and pharmacies for reimbursement of services rendered.

5. To the Treasury Department to facilitate payments to veterans for reimbursements of travel expenses.

6. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.

7. Disclosure may be made to National Archives and Records Administration (NARA), General Services Administration (GSA) in records management inspections conducted under authority of 44 United States Code.

8. Records from this system of records may be disclosed to a Federal agency or to a State or local government licensing board and/or to the Federation of State Medical Boards or a similar non-government entity which maintains records concerning individuals' employment histories or concerning the issuance, retention or revocation of licenses, certifications, or registration necessary to practice an occupation, profession or specialty, in order for the agency to obtain information relevant to an agency decision concerning the hiring, retention or termination of an employee or to inform a Federal agency or licensing boards or the appropriate non-government entities about the health care practices of a terminated, resigned or retired health care employee whose professional health care activity so significantly failed to conform to generally accepted standards of professional medical practice as to raise reasonable concern for the health and safety of patients in the private sector or from another Federal agency. These records may also be disclosed as part of an ongoing computer matching program to accomplish these purposes.

9. Identifying information in this system, including name, address, social security number and other information as is reasonably necessary to identify such individual, may be disclosed to the National Practitioner Data Bank at the time of hiring and/or clinical privileging/reprivileging of health care practitioners, and other times as deemed necessary by VA, in order for VA to obtain information relevant to a Department decision concerning the hiring, privileging/reprivileging, retention or termination of the applicant or employee.

10. Relevant information from this system of records may be disclosed to the National Practitioner Data Bank and/or State Licensing Board in the State(s) in which a practitioner is licensed, in which the VA facility is located, and/or in which an act or omission occurred upon which a medical malpractice claim was based when VA reports information concerning: (a) Any payment for the benefit of a physician, dentist, or other licensed health care practitioner which was made as the result of a settlement or judgment of a claim of medical malpractice if an appropriate determination is made in accordance with agency policy that payment was related to substandard care, professional incompetence or professional misconduct on the part of the individual; (b) a final decision which relates to possible incompetence or improper professional conduct that adversely affects the clinical privileges of a physician or dentist for a period longer than 30 days; or (c) the acceptance of the surrender of clinical privileges or any restriction of such privileges by a physician or dentist either while under investigation by the health care entity relating to possible incompetence or improper professional conduct, or in return for not conducting such an investigation or proceeding. These records may also be disclosed as part of a computer matching program to accomplish these purposes.

11. Relevant identifying and medical treatment information (excluding medical treatment information related to drug or alcohol abuse, infection with the human immunodeficiency virus or sickle cell anemia) may be disclosed to a Federal agency or non-VA health care provider or institution when VA refers a patient for treatment or medical services or authorizes a patient to obtain non-VA medical services and the information is needed by the Federal agency or non-VA institution or provider to perform the services or for VA to obtain sufficient information in order to make payment for the services, to evaluate the services rendered, or to determine the need for additional services.

12. Information maintained in this system concerning non-VA health care institutions and providers, including name, address, social security or employer's taxpayer identification numbers, may be disclosed to the Treasury Department, Internal Revenue Service, to report calendar year earnings of $600 or more for income tax reporting purposes.

13. In order to prevent or identify duplicate payments by Medicare intermediaries, relevant information (excluding medical treatment information related to drug or alcohol abuse, infection with the human immunodeficiency virus or sickle cell anemia) may be disclosed to the Department of Health and Human Services (HHS) for the purpose of identifying individuals who are authorized by VA to obtain non-VA health care services at VA's expense and those for whom payments have been made. The information to be disclosed to HHS includes identifying information (patient and provider names, addresses, social security and taxpayer identification numbers, and date of birth of patient), treatment information (dates and diagnostic, surgical, and services provided codes) and payment information (payee, amounts and dates).

14. Disclosure of relevant information may be made to individuals, organizations, private or public agencies, etc., with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor or subcontractor to perform the services of the contract or agreement.

Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of Records in the System:

Storage:

Records are maintained on paper documents at the health care facilities. Paper payment vouchers are maintained at the health care facility or AAC at Austin, Texas. Information on automated storage media (e.g., microfilm, microfiche, magnetic tape and magnetic disks and laser optical media) is stored at the health care facilities (includes record information stored in the Integrated Hospital System (IHS) at selected medical facilities and at other facilities in the Veterans Integrated Systems and Technology Architecture (VistA) system, and, in most cases, copies of back-up computer files maintained at off-site locations), VA Headquarters, the VA Allocation Resource Center (ARC), the Regional Directors and Division Offices, the OIFOs and the AAC. Reports generated from these records are maintained on paper and microfiche at the health care facilities, VA Headquarters, the Regional Directors and Division Offices, and the AAC.

Retrievability:

Information is retrieved by the patient's name and/or social security number and/or the name or social security or taxpayer identification numbers of the non-VA health care institution or provider.

Safeguards:

1. Access to working spaces and record storage areas in VA health care facilities is restricted to VA employees on a “need-to-know” basis. Generally, file areas are locked after normal duty hours and the health care facilities are protected from outside access by the Federal Protective Service or other security personnel. Access to the records is restricted to VA employees who have a need for the information in the performance of their official duties. Employee records or records of public figures or otherwise sensitive records are generally stored in separate locked files. Strict control measures are enforced to ensure that access to and disclosures from these records are limited to a “need-to-know” basis.

2. Access to the VistA and IHS computer rooms at health care facilities is generally limited by appropriate locking devices and restricted to authorized VA employees and vendor personnel. Peripheral devices are generally placed in secure areas (areas that are locked or have limited access) or are otherwise protected. Information in the VistA and IHS systems may be accessed by authorized VA employees. Access to file information is controlled at two levels: the system recognizes authorized employees by a series of individually unique passwords/codes as a part of each data message, and the employees are limited to only that information in the file which is needed in the performance of their official duties. Information that is downloaded from the AAC and VistA and IHS files and maintained on personal computers is afforded similar storage and access protections as the data that is maintained in the original files. Remote access to file information by staff of the OIFOs, VBA Regional Offices, and access by OIG staff conducting an audit or investigation at the health care facility or an OIG office location remote from the health care facility is controlled in the same manner.

3. Access to the AAC is generally restricted to Center employees, custodial personnel, Federal Protective Service and other security personnel. Access to computer rooms is restricted to authorized operational personnel through electronic locking devices. All other persons gaining access to computer rooms are escorted. Information stored in the computer may be accessed by authorized VA employees at remote locations including VA health care facilities, OIFOs, VA Headquarters, Regional Directors and Division Offices, and OIG headquarters and field staff. Access is controlled by individually unique passwords/codes which must be changed periodically by the employee.

4. Access to records maintained at VA Headquarters, the VA ARC, the OIFOs and the Regional Directors and Division Offices is restricted to VA employees who have a need for the information in the performance of their official duties. Access to information stored on automated storage media is controlled by individually unique passwords/codes. Information stored on computers at the OIFOs may be accessed by authorized VA employees at remote locations including VA health care facilities and Regional Directors and Division Offices. Access is controlled by individually unique passwords/codes. Records are maintained in manned rooms during nonworking hours. The facilities are protected from outside access during working hours by the Federal Protective Service or other security personnel.

5. Information downloaded from VistA and IHS and VA AAC files and maintained by the OIG Headquarters and field offices on automated storage media is secured in storage areas or facilities to which only OIG staff have access. Paper documents are similarly secured. Access to paper documents and information on automated storage media is limited to OIG employees who have a need for the information in the performance of their official duties. Access to information stored on automated storage media is controlled by individually unique passwords/codes.

Retention and Disposal:

Paper documents at the health care facility related to authorizing the fee basis care and the services authorized, billed and paid for are maintained in the Patient Medical Records-VA (24VA136). These records are retained at health care facilities for a minimum of three years after the last episode of care. After the third year of inactivity the paper records are transferred to a records facility for seventy-two (72) more years of storage. Automated storage media and other paper documents that are included in this system of records and not maintained in the Patient Medical Records-VA (24VA136) are retained and disposed of in accordance with disposition authorization approved by the Archivist of the United States.

System Manager(s) and Address:

Director, Health Administration Service (163), VA Headquarters, 810 Vermont Ave., NW., Washington, DC 20420.

Notification and Procedures:

An individual who wishes to determine whether a record is being maintained in this system under the individual's name or other personal identifier, or wants to determine the contents of such record, should submit a written request or apply in person to the last VA health care facility where care was authorized or rendered. Addresses of VA health care facilities may be found in VA Appendix 1 of the biennial publication. All inquiries must reasonably identify the portion of the fee basis record involved and the place and approximate date that medical care was provided. Inquiries should include the patient's full name, social security number and return address.

Record Access Procedures:

Individuals seeking information regarding access to and contesting of VA fee basis records may write, call or visit the last VA facility where medical care was authorized or provided.

Contesting Record Procedures:

(See Record Access Procedures above.)

Record Source Categories:

The patient, family members or accredited representative, and friends, employers or other third parties when otherwise unobtainable from the patient or family; military service departments; private medical facilities and health care professionals; Patient Medical Records-VA (24VA136); other Federal agencies; VA regional offices; VA automated record systems including Individuals Submitting Invoices/Vouchers for Payment-VA (13VA047), Veterans and Beneficiaries Identification and Records Location Subsystem-VA (38VA23) and the Compensation, Pension, Education and Rehabilitation Records-VA (58VA21/22); and various automated systems providing clinical and managerial support at VA health care facilities.