[Federal Register Volume 59, Number 138 (Wednesday, July 20, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-17358]


[[Page Unknown]]

[Federal Register: July 20, 1994]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 14

RIN 2900-AH01

 

Expanded Remote Access to Computerized Veterans Claims Records by 
Accredited Representatives

AGENCY: Department of Veterans Affairs.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Veterans Affairs (VA) is proposing to 
establish policy, procedures and criteria governing when, and under 
what circumstances, VA will grant authorized claimants' representatives 
read-only access to the automated claims records of claimants whom they 
represent from approved office locations away from the VA Regional 
Offices of jurisdiction for the claimants' records. Access will be 
granted only for the purpose of representing those claimants before VA 
on claims-related matters. In order to help safeguard the 
confidentiality of claimants' automated claims records, the proposed 
rules also set out responsibilities and restrictions on claimants' 
representatives in exercising their remote access to VA's automated 
claims records. These procedures and criteria will provide for better 
and more timely representation of claimants in claims matters by 
allowing their representatives to have faster, easier and more 
efficient access to the claimants' records than they currently have 
when they have to travel to the Regional Offices. The proposed 
regulations will also ensure more efficient use of VA resources in 
meeting the agency mission in that VA employees will have to spend less 
time providing access to those representatives who do not have their 
own computers in Regional Offices.

DATES: Comments must be received on or before August 19, 1994. Comments 
will be available for public inspection until August 29, 1994.

ADDRESSES: Send written comments to: Secretary of Veterans Affairs 
(271A), Department of Veterans Affairs, 810 Vermont Avenue NW., 
Washington, DC, 20420. All written comments received will be available 
for public inspection only in the Veterans Services Unit, room 119 of 
the above address between the hours of 8 a.m. to 4:30 p.m., Monday 
through Friday except holidays until August 29, 1994.

FOR FURTHER INFORMATION CONTACT: David G. Spivey, Chief, Authorization 
Procedures Staff (213B), Compensation and Pension Service, Veterans 
Benefits Administration, Department of Veterans Affairs, 810 Vermont 
Avenue, NW., Washington, DC, 20420, (202) 273-7258 or Jeffrey C. 
Corzatt, Staff Attorney (024H2), Office of General Counsel, Department 
of Veterans Affairs, 810 Vermont Avenue NW., Washington, DC, 20420, 
(202) 273-6381.

SUPPLEMENTARY INFORMATION: VA is proposing to incorporate into its 
regulations policies, criteria and procedures governing access to 
certain Veterans Benefits Administration (VBA) computerized claimants' 
records by individuals and organizations which represent those 
claimants from locations away from the Regional Offices of jurisdiction 
for those claimants' records.
    Currently, accredited representatives of veterans service 
organizations who hold a valid, current, VA power of attorney to assist 
claimants in the presentation of claims for benefits administered by VA 
may have on-line, remote access to certain information about those 
claimants contained in VA's automated claims records if the 
representatives and their computers are located in office space 
provided within VBA Regional Offices under 38 U.S.C. Sec. 5902(a)(2). 
Accredited veterans' representatives not located at a VBA Regional 
Office who do not have such remote, on-line access are expected to go 
to the Regional Office and arrange with VA employees using VA computers 
to view a veteran's automated claims records.
    VA has decided to provide the same on-line, remote access 
capability to all individuals and organizations accredited under 38 CFR 
14.626-.635 who represent claimants on VA claims for benefits and who 
request such access. Access will also be provided to attorneys of 
record for claimants before the Court of Veterans Appeals who request 
such access.
    The proposed rules concern when, and under what circumstances, VA 
will grant access, the responsibilities of those granted access, and 
the bases to revoke or suspend access. VA will grant no more than read-
only access to authorized claimants' representatives for the purpose of 
assisting claimants for whom they hold a valid power of attorney (or 
equivalent designation) in presenting their claims for VA benefits. 
Read-only access necessarily includes the ability to print or down-load 
the information.
    Qualified representatives will be granted access by the Regional 
Office of jurisdiction for the particular claimant's records. In order 
for VBA to grant access, the Regional Office must first approve the 
equipment and software the applicant will use to obtain access, as well 
as the location from which the representative will access the VBA 
computer system. Approval of the hardware and software is intended to 
ensure that access can be accomplished while maintaining the necessary 
security. Approval of the location is intended to ensure that access is 
only from the representative's customary and usual or primary place of 
representation, and not from other locations. This avoids the use of 
unapproved equipment and limits the possibility of unauthorized access 
to the data by individuals not approved for access by VA. The applicant 
must also sign a notice that contains the security requirements 
applicable to the system.
    Certain confidentiality statutes, namely, the Privacy Act, 5 U.S.C. 
Sec. 552a, and 38 U.S.C. Secs. 5701 and 7332 generally govern the VA's 
disclosure of claimants' records, whether paper or automated, to their 
representatives. Accredited representatives and agents may see the 
claims folders of those individuals whom they represent for two 
reasons: the claimant has indicated in advance in writing to the 
Department that the named individual or organization represents him or 
her on a claim for benefits, and the claimant has given prior written 
consent to VA's release of information to the claimant's 
representative. Attorneys, as officers of the court, need only file 
documentation that they represent the claimant. A routine use then 
permits the disclosure.
    These requirements also are designed to provide audit and 
accountability records for those who access the system, as well as 
ensuring the integrity and confidentiality of the system and data from 
unauthorized access.
    In order to oversee access activities properly which provide for 
the security of the data and system, VBA may, without notice, inspect 
the accessor's computer systems, review its security procedures, and 
monitor its access activities.
    VBA may revoke access privileges in two circumstances. The first is 
based on applicable confidentiality statutes, e.g., the Privacy Act, 5 
U.S.C. Sec. 552a, and 38 U.S.C. Secs. 5701 and 7332. Whenever an 
individual or organization is no longer entitled to access a particular 
claimant's records as a matter of law under the applicable 
confidentiality statutes, VA will terminate that individual's access 
privileges to that particular claimant's automated claims records. VA 
may also revoke access privileges based upon failure to comply with the 
regulations.

Regulatory Flexibility Act

    The Secretary of Veterans Affairs has certified that these proposed 
rules, if promulgated, will not have a significant economic impact on a 
substantial number of small entities as they are defined in the 
Regulatory Flexibility Act, 5 U.S.C. 601-612. Pursuant to 5 U.S.C. 
605(b), the regulations, therefore, are exempt from the initial and 
final regulatory flexibility analyses requirements of sections 603 and 
604.
    This certification can be made because the regulations facilitate 
representative access to their claimants' information while imposing 
little in the way of cost or administrative burden. Further, the rules 
affect only the small number of entities and individuals which 
represent claimants in claims before VA.
    This regulation is subject to review under Executive Order 12866.
    There are no Catalog of federal Domestic Assistance numbers for 
this program.

List of Subjects in 38 CFR Part 14

    Government employees, Lawyers, Legal services, Veterans.

    Approved: June 13, 1994.
Jesse Brown,
Secretary of Veterans Affairs.

    38 CFR part 14, Legal Services, General Counsel, is proposed to be 
amended as follows:

PART 14--LEGAL SERVICES, GENERAL COUNSEL

    1. The authority citation for part 14 continues to read as follows:

    Authority: 38 U.S.C. 5903.

    2. In part 14, Secs. 14.640 through 14.643 and an undesignated 
center heading prior to Sec. 14.640 are added to read as follows:

Expanded Remote Access to Computerized Veterans Claims Records by 
Accredited Representatives

Sec.
14.640  Purpose.
14.641  Qualifications for access.
14.642  Utilization of access.
14.643  Disqualification.

Expanded Remote Access to Computerized Veterans Claims Records by 
Accredited Representatives


Sec. 14.640  Purpose.

    (a) Sections 14.640 through 14.643 establish policy, assign 
responsibilities and prescribe procedures with respect to:
    (1) When, and under what circumstances, VA will grant authorized 
claimants' representatives read-only access to the automated Veterans 
Benefits Administration (VBA) claims records of those claimants whom 
they represent;
    (2) The exercise of authorized access by claimants' 
representatives; and
    (3) The bases and procedures for disqualification of a 
representative for violating any of the requirements for access.
    (b) VBA will grant access to its automated claimants' claims 
records from locations outside Regional Offices under the following 
conditions. Access will be provided:
    (1) Only to individuals and organizations granted access to 
automated claimants' records under Secs. 14.460 through 14.643;
    (2) Only to the claims records of VA claimants whom the 
organization or individual represents as reflected in the claims file;
    (3) Solely for the purpose of the representative assisting the 
individual claimant whose records are accessed in a claim for benefits 
administered by VA; and
    (4) On a read-only basis. Individuals authorized access to VBA 
automated claims records under Secs. 14.640 through 14.643 will not be 
permitted to modify the data.
    (c)(1) Access will be authorized only to the inquiry commands of 
the Benefits Delivery Network which provide access to the following 
categories of data:
    (i) Beneficiary identification data such as name, social security 
number, sex, date of birth, service number and related service data; 
and
    (ii) Claims history and processing data such as folder location, 
claim status, claim establishment date, claim pro-cessing history, 
award data, rating data, including service-connected medical 
conditions, income data, dependency data, deduction data, payment data, 
educational facility and program data (except chapter 32 benefits), and 
education program contribution and delimiting data (except chapter 32 
benefits).
    (2) Access to this information will currently be through the 
inquiry commands of BINQ (BIRLS (Beneficiaries Identification and 
Records Location Subsystem) Inquiry), SINQ (Status Inquiry), MINQ 
(Master Record Inquiry), PINQ (Pending Issue Inquiry) and TINQ (Payment 
History Inquiry). The identifying information received from BIRLS to 
representative inquiries will be limited to file number, veteran's 
name, date of death, folder location and transfer date of folder, 
insurance number, insurance type, insurance lapse date and insurance 
folder jurisdiction.
    (d) Sections 14.640 through 14.643 are not intended to, and do not:
    (1) Waive the sovereign immunity of the United States; or
    (2) Create, and may not be relied upon to create, any right or 
benefit, substantive or procedural, enforceable at law against the 
United States or the Department of Veterans Affairs.


Sec. 14.641  Qualifications for access.

    (a) An applicant for read-only access to VBA automated claims 
records from a location other than a VA Regional Office must be:
    (1) An organization, representative, attorney or agent approved or 
accredited by VA under 38 CFR 14.626 through 14.635; or
    (2) An attorney of record for a claimant in proceedings before the 
Court of Veterans Appeals or subsequent proceedings who requests access 
to the claimant's automated claims records as part of the 
representation of the claimant.
    (b) The hardware, modem and software utilized to obtain access, as 
well as their location, must be approved in advance by VBA.
    (c) Each individual and organization approved for access must sign 
and return a notice provided by the Regional Office Director (or the 
Regional Office Director's designee) of the Regional Office of 
jurisdiction for the claim. The notice will specify the applicable 
operational and security requirements for access and an acknowledgment 
that the breach of any of these requirements is grounds for 
disqualification from access.


Sec. 14.642  Utilization of access.

    (a) Once an individual or organization has been issued the 
necessary passwords to obtain read-only access to the automated claims 
records of individuals represented, access will be exercised in 
accordance with the following requirements:
    (1) The individual or organization will obtain access only from 
equipment and software approved in advance by the Regional Office from 
the location where the individual or organization primarily conducts 
its representation activities which also has been approved in advance;
    (2) The individual will use only his or her assigned password to 
obtain access;
    (3) The individual will not reveal his or her password to anyone 
else, or allow anyone else to use his or her password;
    (4) The individual will access only the VBA automated claims 
records of VA claimants who are represented by the person obtaining 
access or by the organization employing the person obtaining access;
    (5) The individual will access a claimant's automated claims record 
solely for the purpose of representing that claimant in a claim for 
benefits administered by VA.
    (6) Upon receipt of the password, the individual will destroy the 
hard copy; no written or printed record containing the password will be 
retained; and
    (7) The individual and organization will comply with all security 
requirements VBA deems necessary to ensure the integrity and 
confidentiality of the data and VBA's automated computer systems.
    (b) An organization granted access shall ensure that all employees 
provided access in accordance with these regulations will receive 
regular, adequate training on proper security, including the items 
listed in Sec. 14.643(a). Where an individual such as an attorney or 
registered agent is granted access, he or she will regularly review the 
security requirements for the system as set forth in these regulations 
and in any additional materials provided by VBA.
    (c) VBA may, at any time without notice:
    (1) Inspect the computer hardware and software utilized to obtain 
access and their location;
    (2) Review the security practices and training of any individual or 
organization granted access under these regulations; and
    (3) Monitor an individual's or organization's access activities. By 
applying for, and exercising, the access privileges under Secs. 14.640 
through 14.643, the applicant expressly consents to VBA monitoring the 
access activities of the applicant at any time.


Sec. 14.643  Disqualification.

    (a) The Regional Office Director or the Regional Office Director's 
designee may revoke an individual's or an organization's access 
privileges to a particular claimant's records because the individual or 
organization no longer represents the claimant, and, therefore, the 
beneficiary's consent is no longer in effect. The individual or 
organization is no longer entitled to access as a matter of law under 
the Privacy Act, 5 U.S.C. Sec. 552a, and 38 U.S.C. Secs. 5701 and 7332. 
Under these circumstances, the individual or organization is not 
entitled to any hearing or to present any evidence in opposition to the 
revocation.
    (b) An individual or organization granted access privileges to VBA 
automated claims benefits systems may have such access privileges 
revoked either to an individual claimant's records or to all claimants' 
records if the individual or organization:
    (1) Violates any of the provisions of Secs. 14.640 through 14.643;
    (2) Accesses or attempts to access data for a purpose other than 
representation of an individual veteran;
    (3) Accesses or attempts to access data other than the data 
specified in these regulations;
    (4) Accesses or attempts to access data on a VA beneficiary who is 
not represented either by the individual who obtains access or by the 
organization employing the individual who obtains access;
    (5) Utilizes unapproved computer hardware or software to obtain or 
attempt to obtain access to VBA computer systems;
    (6) Modifies or attempts to modify data in the VBA computer 
systems.
    (c) If VBA is considering revoking an individual's access, and that 
individual works for an organization, the Regional Office of 
jurisdiction will notify the organization of the pendency of the 
action.
    (d) After an individual's access privileges are revoked, if the 
conduct which resulted in revocation was such that it merits reporting 
to an appropriate governmental licensing organization such as a State 
bar, the VBA Regional Office of jurisdiction will immediately inform 
the licensing organization in writing of the fact that the individual's 
access privileges were revoked and the reasons why.
    (e) The VBA Regional Office of jurisdiction may temporarily suspend 
access privileges prior to any determination on the merits of the 
proposed revocation where the Regional Office Director or the 
Director's designee determines that such immediate suspension is 
necessary in order to protect the integrity of the system or 
confidentiality of the data in the system from a reasonably foreseeable 
compromise. However, in such case, the Regional Office shall offer the 
individual or organization an opportunity to respond to the charges 
immediately after the temporary suspension.

[FR Doc. 94-17358 Filed 7-19-94; 8:45 am]
BILLING CODE 8320-01-P