[Federal Register Volume 59, Number 177 (Wednesday, September 14, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-22669]


[[Page Unknown]]

[Federal Register: September 14, 1994]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 14

RIN 2900-AH01

 

Expanded Remote Access to Computerized Veterans Claims Records by 
Accredited Representatives

AGENCY: Department of Veterans Affairs.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Veterans Affairs (VA) is establishing 
policy, procedures and criteria governing when, and under what 
circumstances, VA will grant authorized claimants' representatives 
read-only access to the automated claims records of claimants whom they 
represent from approved office locations away from the VA Regional 
Offices of jurisdiction for the claimants' records. Access will be 
granted only for the purpose of representing those claimants before VA 
on claims-related matters. In order to help safeguard the 
confidentiality of claimants' automated claims records, the rules also 
set out responsibilities and restrictions on claimants' representatives 
in exercising their remote access to VA's automated claims records. 
These procedures and criteria will provide for better and more timely 
representation of claimants in claims matters by allowing their 
representatives to have faster, easier and more efficient access to the 
claimants' records than they currently have when they have to travel to 
the Regional Offices. The regulations will also lead to more efficient 
use of VA resources in meeting the agency mission in that VA employees 
will have to spend less time providing access to those representatives 
who do not have their own computers in Regional Offices.

EFFECTIVE DATE: October 14, 1994.

FOR FURTHER INFORMATION CONTACT: David G. Spivey, Chief, Authorization 
Procedures Staff (213B), Compensation and Pension Service, Veterans 
Benefits Administration, Department of Veterans Affairs, 810 Vermont 
Avenue, NW., Washington, DC 20420, (202) 273-7258 or Jeffrey C. 
Corzatt, Staff Attorney (024H2), Office of General Counsel, Department 
of Veterans Affairs, 810 Vermont Avenue, NW, Washington, DC, 20420, 
(202) 273-6381. Questions concerning applying for remote access should 
be addressed to the Director of the Veterans Benefits Administration 
Regional Office with jurisdiction for the claim for which remote access 
is sought.

SUPPLEMENTARY INFORMATION:

Background

    On July 20, 1994, the Department of Veterans Affairs published a 
notice of proposed rulemaking (NPRM) (59 FR 37008, July 20, 1994) to 
promulgate regulations at 38 CFR part 14 establishing policies, 
criteria and procedures governing access to certain Veterans Benefits 
Administration (VBA) computerized claimants records by individuals and 
organizations which represent those claimants from locations away from 
the Regional Offices of jurisdiction for those claimants records. As VA 
noted in its NPRM, the rules concern when, and under what 
circumstances, VA will grant access, the responsibilities of those 
granted access, and the bases to revoke or suspend access.

Discussion of Comments

    Five comments were submitted in response to the NPRM. All the 
comments endorsed the regulations. Three veterans service organizations 
had no suggested changes.
    Another commenter suggested, in essence, that the regulations be 
clarified to expressly provide that those individuals approved by the 
Department to represent veterans in claims for title 38 benefits in 
accordance with 38 CFR 14.629 are treated equally for purposes of being 
granted read-only remote access to the automated claims records of 
their clients. As was stated in the NPRM, it is the Department's 
intention to provide the same on-line, remote access capability to all 
individuals and organizations accredited under 38 CFR 14.626-14.635 who 
represent claimants on VA claims for benefits and who request such 
access. Moreover, this purpose is expressly stated in the regulations 
at Sec. 14.641(a)(1) which provides that an applicant for read-only 
access must be an organizations, representative, attorney or agent 
approved or accredited by VA under 38 CFR 14.626 through 14.635. The 
commenter's suggestion reflects what is already stated expressly in the 
regulations.
    The last commenter noted a typographical error which the Department 
has corrected. That commenter also suggested that the regulations 
should clarify that the Regional Office Director, or the Regional 
Office Director's designee, is the VA official who may revoke an 
individual's or organization's access privileges under 38 CFR 
14.643(b). Paragraphs (a) and (e) of Sec. 14.643 refer to the Regional 
Office Director or the Regional Office Director's designee as the VA 
official responsible for decisions concerning the grant, denial, 
suspension or revocation of remote access privileges. VA similarly 
intended those officials to make any revocation decisions under 
Sec. 14.643(b), and to avoid possible confusion on this issue, VA will 
clarify this point. VA accepts this suggestion, and the regulation is 
modified accordingly.
    The fifth commenter suggested also that the Department clarify that 
38 CFR 38.643(c) applies to proceedings under 38 CFR 14.643(b). VA also 
accepts this suggestion, and the regulation is changed accordingly.
    The fifth commenter also suggested that Sec. 14.643(c) should be 
modified to expressly refer only to accredited representatives of 
service organizations. However, attorneys and claims agents also 
represent veterans. These individuals may work for a law firm or some 
other organization which is not a veterans service organization. The 
proposed change would exclude some of the individuals covered by the 
regulations. Accordingly, the proposal is not adopted.
    Finally, the commenter suggested that the proposed regulations set 
forth the procedures which would be followed by the Department in any 
revocation of access proceedings under Sec. 14.643(b). The matter 
merits further consideration, and, accordingly, VA will consider 
whether to amend this rule to incorporate such procedures.
    Following consideration of the comments submitted in response to 
the NPRM, as well as further consideration of the reasoning and 
analysis in the proposed regulation published at 59 FR 37008, the 
Secretary has decided to implement the regulations as proposed, for the 
reasons contained in that Federal Register notice, with the changes 
discussed above.

Regulatory Flexibility Act

    The Secretary of Veterans Affairs has certified that these rules 
will not have a significant economic impact on a substantial number of 
small entities as they are defined in the Regulatory Flexibility Act, 5 
U.S.C. 601-612. Pursuant to 5 U.S.C. 605(b), the regulations, 
therefore, are exempt from the initial and final regulatory flexibility 
analyses requirements of sections 603 and 604.
    This certification can be made because the regulations facilitate 
representative access to their claimants' information while imposing 
little in the way of cost or administrative burden. Further, the rules 
affect only the small number of entities and individuals which 
represent claimants in claims before VA.
    This regulation is subject to review under Executive Order 12866.
    There are no Catalog of federal Domestic Assistance numbers for 
this program.

List of Subjects in 38 CFR Part 14

    Government employees, Lawyers, Legal services, Veterans.

    Approved: September 1, 1994.
Jesse Brown,
Secretary of Veterans Affairs.

    38 CFR part 14, Legal Services, General Counsel, is proposed to be 
amended as follows:

PART 14--LEGAL SERVICES, GENERAL COUNSEL

    1. The authority citation for part 14 continues to read as follows:

    Authority: 38 U.S.C. 5903.

    2. In Part 14, Secs. 14.640 through 14.646 and an undesignated 
center heading prior to Sec. 14.640 are added to read as follows:

Expanded Remote Access to Computerized Veterans Claims Records by 
Accredited Representatives

Sec.
14.640  Purpose.
14.641  Qualifications for access.
14.642  Utilization of access.
14.643  Disqualification.

Expanded Remote Access to Computerized Veterans Claims Records by 
Accredited Representatives


Sec. 14.640  Purpose.

    (a) Sections 14.640 through 14.643 establish policy, assign 
responsibilities and prescribe procedures with respect to:
    (1) When, and under what circumstances, VA will grant authorized 
claimants' representatives read-only access to the automated Veterans 
Benefits Administration (VBA) claims records of those claimants whom 
they represent;
    (2) The exercise of authorized access by claimants' 
representatives; and
    (3) The bases and procedures for disqualification of a 
representative for violating any of the requirements for access.
    (b) VBA will grant access to its automated claimants' claims 
records from locations outside Regional Offices under the following 
conditions. Access will be provided:
    (1) Only to individuals and organizations granted access to 
automated claimants' records under Secs. 14.640 through 14.643;
    (2) Only to the claims records of VA claimants whom the 
organization or individual represents as reflected in the claims file;
    (3) Solely for the purpose of the representative assisting the 
individual claimant whose records are accessed in a claim for benefits 
administered by VA; and
    (4) On a read-only basis. Individuals authorized access to VBA 
automated claims records under Secs. 14.640 through 14.643 will not be 
permitted to modify the data.
    (c)(1) Access will be authorized only to the inquiry commands of 
the Benefits Delivery Network which provide access to the following 
categories of data:
    (i) Beneficiary identification data such as name, social security 
number, sex, date of birth, service number and related service data; 
and
    (ii) Claims history and processing data such as folder location, 
claim status, claim establishment date, claim processing history, award 
data, rating data, including service-connected medical conditions, 
income data, dependency data, deduction data, payment data, educational 
facility and program data (except chapter 32 benefits), and education 
program contribution and delimiting data (except chapter 32 benefits).
    (2) Access to this information will currently be through the 
inquiry commands of BINQ (BIRLS (Beneficiaries Identification and 
Records Location Subsystem) Inquiry), SINQ (Status Inquiry), MINQ 
(Master Record Inquiry), PINQ (Pending Issue Inquiry) and TINQ (Payment 
History Inquiry). The identifying information received from BIRLS to 
representative inquiries will be limited to file number, veteran's 
name, date of death, folder location and transfer date of folder, 
insurance number, insurance type, insurance lapse date and insurance 
folder jurisdiction.
    (d) Sections 14.640 through 14.643 are not intended to, and do not:
    (1) Waive the sovereign immunity of the United States; or
    (2) Create, and may not be relied upon to create, any right or 
benefit, substantive or procedural, enforceable at law against the 
United States or the Department of Veterans Affairs.


Sec. 14.641  Qualifications for access.

    (a) An applicant for read-only access to VBA automated claims 
records from a location other than a VA Regional Office must be:
    (1) An organization, representative, attorney or agent approved or 
accredited by VA under Secs. 14.626 through 14.635; or
    (2) An attorney of record for a claimant in proceedings before the 
Court of Veterans Appeals or subsequent proceedings who requests access 
to the claimant's automated claims records as part of the 
representation of the claimant.
    (b) The hardware, modem and software utilized to obtain access, as 
well as their location, must be approved in advance by VBA.
    (c) Each individual and organization approved for access must sign 
and return a notice provided by the Regional Office Director (or the 
Regional Office Director's designee) of the Regional Office of 
jurisdiction for the claim. The notice will specify the applicable 
operational and security requirements for access and an acknowledgment 
that the breach of any of these requirements is grounds for 
disqualification from access.


Sec. 14.642  Utilization of access.

    (a) Once an individual or organization has been issued the 
necessary passwords to obtain read-only access to the automated claims 
records of individuals represented, access will be exercised in 
accordance with the following requirements:
    (1) The individual or organization will obtain access only from 
equipment and software approved in advance by the Regional Office from 
the location where the individual or organization primarily conducts 
its representation activities which also has been approved in advance;
    (2) The individual will use only his or her assigned password to 
obtain access;
    (3) The individual will not reveal his or her password to anyone 
else, or allow anyone else to use his or her password;
    (4) The individual will access only the VBA automated claims 
records of VA claimants who are represented by the person obtaining 
access or by the organization employing the person obtaining access;
    (5) The individual will access a claimant's automated claims record 
solely for the purpose of representing that claimant in a claim for 
benefits administered by VA;
    (6) Upon receipt of the password, the individual will destroy the 
hard copy; no written or printed record containing the password will be 
retained; and
    (7) The individual and organization will comply with all security 
requirements VBA deems necessary to ensure the integrity and 
confidentiality of the data and VBA's automated computer systems.
    (b) An organization granted access shall ensure that all employees 
provided access in accordance with these regulations will receive 
regular, adequate training on proper security, including the items 
listed in Sec. 14.643(a). Where an individual such as an attorney or 
registered agent is granted access, he or she will regularly review the 
security requirements for the system as set forth in these regulations 
and in any additional materials provided by VBA.
    (c) VBA may, at any time without notice:
    (1) Inspect the computer hardware and software utilized to obtain 
access and their location;
    (2) Review the security practices and training of any individual or 
organization granted access under these regulations; and
    (3) Monitor an individual's or organization's access activities. By 
applying for, and exercising, the access privileges under Secs. 14.640 
through 14.643, the applicant expressly consents to VBA monitoring the 
access activities of the applicant at any time.


Sec. 14.643  Disqualification.

    (a) The Regional Office Director or the Regional Office Director's 
designee may revoke an individual's or an organization's access 
privileges to a particular claimant's records because the individual or 
organization no longer represents the claimant, and, therefore, the 
beneficiary's consent is no longer in effect. The individual or 
organization is no longer entitled to access as a matter of law under 
the Privacy Act, 5 U.S.C. 552a, and 38 U.S.C. 5701 and 7332. Under 
these circumstances, the individual or organization is not entitled to 
any hearing or to present any evidence in opposition to the revocation.
    (b) The Regional Office Director or the Regional Office Director's 
designee may revoke an individual's or an organization's access 
privileges either to an individual claimant's records or to all 
claimants' records in the VBA automated claims benefits systems if the 
individual or organization:
    (1) Violates any of the provisions of Secs. 14.640 through 14.643;
    (2) Accesses or attempts to access data for a purpose other than 
representation of an individual veteran;
    (3) Accesses or attempts to access data other than the data 
specified in these regulations;
    (4) Accesses or attempts to access data on a VA beneficiary who is 
not represented either by the individual who obtains access or by the 
organization employing the individual who obtains access;
    (5) Utilizes unapproved computer hardware or software to obtain or 
attempt to obtain access to VBA computer systems;
    (6) Modifies or attempts to modify data in the VBA computer 
systems.
    (c) If VBA is considering revoking an individual's access under 
Sec. 14.643(b), and that individual works for an organization, the 
Regional Office of jurisdiction will notify the organization of the 
pendency of the action.
    (d) After an individual's access privileges are revoked, if the 
conduct which resulted in revocation was such that it merits reporting 
to an appropriate governmental licensing organization such as a State 
bar, the VBA Regional Office of jurisdiction will immediately inform 
the licensing organization in writing of the fact that the individual's 
access privileges were revoked and the reasons why.
    (e) The VBA Regional Office of jurisdiction may temporarily suspend 
access privileges prior to any determination on the merits of the 
proposed revocation where the Regional Office Director or the 
Director's designee determines that such immediate suspension is 
necessary in order to protect the integrity of the system or 
confidentiality of the data in the system from a reasonably foreseeable 
compromise. However, in such case, the Regional Office shall offer the 
individual or organization an opportunity to respond to the charges 
immediately after the temporary suspension.

[FR Doc. 94-22669 Filed 9-13-94; 8:45 am]
BILLING CODE 8320-01-P