[Federal Register Volume 66, Number 235 (Thursday, December 6, 2001)]
[Notices]
[Pages 63426-63432]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 01-30241]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Department of Veterans Affairs.

ACTION: Notice of Amendment of System of Records ``Health Care Provider 
Credentialing and Privileging Records--VA''.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974 (5 U.S.C. 552(e)(4)) requires that all 
agencies publish in the Federal Register a notice of the existence and 
character of their systems of records. The Department of Veterans 
Affairs (VA) is amending the system of records, known as ``Health Care 
Provider Credentialing and Privileging Records-VA'' (77VA11) as set 
forth in the Federal Register 55 FR 30790 dated 7/27/90. VA is changing 
the system number to 77VA10Q and amending the system notice by revising 
the paragraphs on System Location; Categories of Individuals Covered by 
the System; Categories of Records in the System; Purposes; Routine 
Uses; Storage; Retrievability; Safeguards; System Manager(s) and 
Address. VA is republishing the system notice in its entirety at this 
time.

DATES: Comments on the amendment of this system of records must be 
received no later than January 7, 2002. If no public comment is 
received, the changes will become effective January 7, 2002.

ADDRESSES: Written comments concerning the proposed amendment of the 
system of records may be submitted to the Office of Regulations 
Management (02D), Department of Veterans Affairs, 810 Vermont Avenue, 
NW., Washington, DC 20420. Comments will be available for public 
inspection at the above address in the Office of Regulations 
Management, Room 1158, between the hours of 8:00 a.m. and 4:30 p.m., 
Monday through Friday (except holidays).

FOR FURTHER INFORMATION CONTACT: Veterans Health Administration (VHA) 
Privacy Act Officer, Department of Veterans Affairs, 810 Vermont Ave., 
NW., Washington, DC 20420, (727) 320-1839.

SUPPLEMENTARY INFORMATION: VA is renumbering the system of records from 
77VA11 to 77VA10Q to reflect organizational changes in the Department. 
In addition, VA has decided, as a matter of policy, to automate and 
provide direct, on-line, remote access to data on the credentialing of 
health care practitioners appointed or otherwise utilized by the VHA. 
The automation and on-line access to credentialing data improves the 
quality, timeliness, and reliability of the credentialing process; 
promotes inter-facility sharing of health care resources; supports 
national readiness; facilitates the establishment of telemedicine 
initiatives; simplifies the process for covered health care 
practitioners; and reduces costs. An electronic credentials data file 
can cross facility and network boundaries and eliminate duplication.

[[Page 63427]]

    VHA is responsible for the medical treatment of veterans and 
promotes the provision of quality health care through credentialing the 
education, training, and qualifications of the practitioners delivering 
this care. Historically, VHA has maintained these records in a paper 
format in each medical treatment facility or Veterans Integrated 
Service Network (VISN). When a practitioner transfers between 
facilities or the practitioner's services are shared among facilities, 
either all or portions of the paper record are transferred to the 
receiving facility. Some medical treatment facilities keep 
credentialing data in non-validated electronic formats to meet local 
needs. However, the exchange of paper and/or non-validated electronic 
data means that some of the practitioner's credentials must be re-
verified with the primary source to ensure the adequate and appropriate 
education, training, and qualifications of the practitioner. This 
results in unnecessary use of resources by VA and the sources providing 
information to VA.
    VHA is supplementing the paper record through the development of a 
centralized electronic data warehouse for the storage of credentialing 
data and the images of the primary source verification. This effort is 
a joint project between the VHA and the Department of Health and Human 
Services, Health Resources and Services Administration (HHS/HRSA). The 
electronic data warehouse will not only store the electronic data and 
images, but will cross-validate data provided by the practitioner with 
data received from the primary or secondary source. Primary source 
verification is that verification received from the source that 
provided the credential, i.e., Federal Register, educational or 
training institution, certifying or licensing agency. A secondary 
information source is one that provides credentialing data that is 
derived from a primary source, i.e., National Practitioners Data Bank 
(NPDB). Secondary information sources may require additional supporting 
documentation either from a primary source or additional secondary 
sources for corroboration. Providers shall enter data into the system 
through an Internet browser. Once data has been entered into the 
system, the credentialing staff initiate the primary source 
verification of the provider's education, training, and qualifications. 
To ensure provider identification, and appropriate matching of 
information entered into an electronic system, available unique 
identifiers which may include name, social security number, national 
provider identifier, unique physician identification number, etc. will 
be used for matching data, when available. In instances where 
electronic data is available from alternate sources and meets or 
exceeds VA credentialing requirements, it will be utilized.
    Access to data in electronic files is controlled at the health care 
facility in accordance with nationally and locally established data 
security procedures. These standards include, but are not limited to, 
requiring a unique password for each user, restricting access to 
``need-to-know'' data, and deactivating screen displays after short 
periods of time. All data transmitted across the Internet is supported 
by encryption, deactivation with the server after short periods of time 
without interaction, and insulation of the Internet server by a 
firewall.
    VHA has determined that direct, real-time, remote access to the 
credentialing data of health care practitioners by authorized users 
should expedite the processing of health care practitioners for 
appointment, reappointment, rapid deployment and granting of 
privileges. VHA has also determined that the use of information 
technology and data warehousing of credentialing information should 
result in a more timely and accurate credentials file for ensuring 
practitioners' education, training, and qualifications while 
facilitating the accurate identification of providers to all interested 
parties. The availability will decrease the time it takes to address 
health care delivery needs met not only through the employment or 
appointment process, but also through contracting, sharing agreements, 
affiliations, etc. Valid electronic data will assist VA in meeting 
legislative mandates and executive orders such as Federal emergency 
responses. The availability of electronic data required for 
credentialing can also facilitate VA's requirements related to 
appointment, emergency response by the appropriate health care 
providers, telemedicine, or response to scarce medical needs.
    VHA may collect biometric information (i.e., fingerprint) for the 
verification of identity. A verification transaction involves the one-
to-one matching of sample data against a particular record of the 
person presenting the sample. This can be done automatically based 
completely on biometric minutiae. Since the credentialing process is 
for the purpose of data validation, personal validation and the 
unequivocal link of a record to the individual reinforces the 
credentialing process. The use of a biometric data adds an additional 
level of patient safety by verifying that providers are who they say 
they are throughout their professional career. Additionally, a 
biometric identifier can add an additional level of security to the 
system in the verification of individuals making transactions in the 
electronic file at log-on.
    Validated credentialing information may be shared with other 
established data systems such as Veterans Information Systems and 
Technology Architecture (VistA) and Decision Support System (DSS). The 
purpose of sharing credentialing data is to decrease the duplicative 
effort of both providers and staff in gathering the same information 
multiple times for various data bases used in VA. This data is required 
for such activities as emergency medical responses in the times of 
national disaster response, telemedicine, and medical cost care 
recovery and would be disclosed only to the extent it is reasonably 
necessary to assist in the accomplishment of legislative or executive 
order mandates.
    Amendments to the System Location include that contractors may 
maintain the records of contractors who provide care in a VA health 
care facility in accordance with this notice and VHA policy. With the 
implementation of the electronic credentials data bank, the System 
Location is also amended so all the electronic records may be 
maintained by HHS, a component thereof, a contractor or subcontractor 
of HHS in accordance with the VA Interagency Agreement. The Categories 
of Individuals Covered by the System is amended to include those health 
care providers who are not employed by VA but providing care through 
contractual or other types of agreements to VA patients. The Category 
of Records in the System is amended to reflect the inclusion of those 
health care providers who are providing care through arrangements other 
than employment. The Category of Records in the System is also amended 
to more clearly specify the data elements collected, including items 
that will bring VA into compliance with the National Standard 
disseminated by HHS.
    Routine use 1 was deleted. Former routine uses 2, 3, 5, 6, 10, 12, 
18, and 20 are amended to clarify the inclusion of all individuals 
regardless of employment, utilization, or appointment to the 
professional staff. VA utilizes the services of numerous providers 
through various appointment processes beyond the employment process. 
Former routine use 2 (now 1) was amended to allow disclosure of 
information in response to scarce or emergency needs of the Department 
or

[[Page 63428]]

other entities when specific skills are required. Former routine use 5 
(now 4) was amended to delete the section numbers. Former routine use 7 
(now 6) was amended to replace the word ``private'' with ``non-
Federal.'' Former routine use 8 (now 7) was amended to delete ``local 
Government'' and ``State.'' Routine use 12 (now 11) was amended to 
specify that the relevant information is disclosed at VA's initiative 
and that names and addresses of veterans are to be excluded from the 
relevant information that could be disclosed. Former routine use 13 
(now 16) is being modified to clarify the conditions under which data 
is disclosed to officials of labor organizations recognized under 5 
U.S.C., chapter 71. The clarification ties such disclosures to the law 
authorizing such disclosures, i.e., 5 U.S.C. 7114(b)(4). The former 
version authorized disclosures to officials of labor organizations `` 
when relevant and necessary to their duties of exclusive representation 
concerning personnel policies, practices, and matters affecting working 
conditions.'' An editorial change is being made to routine use 14 (now 
13) to clarify the terminology used for fitness for duty examinations. 
Former routine use 16 (now 15) is being changed to delete the language 
concerning disclosures to the Equal Employment Opportunity Commission 
to ensure compliance with the Uniform Guidelines on Employee Selection 
Procedures, since VA has not chosen to adopt the Uniform Guidelines for 
use in its Title 38 employment procedures. Former routine use 17 (now 
12) is amended to expand the purposes for which information may be 
disclosed to the Federal Labor Relations Authority to investigate 
representation petitions and conduct or supervise representation 
elections. Former routine use 17 (now 12) is also being clarified to 
indicate that disclosures to the Federal Labor Relations Authority and 
the Federal Service Impasses Panel may only be made after appropriate 
jurisdiction has been established. Matters arising out of (1) 
professional conduct or competence, (2) peer review, and (3) the 
establishment, determination or adjustment of compensation shall be 
decided by the Secretary of Veterans Affairs and is not itself subject 
to collective bargaining and may not be reviewed by another agency. See 
38 U.S.C. 7422. One routine use is added to this System (new 20) to 
allow for the sharing of information and data on a need-to-know basis 
for providers who move between sites and/or provide care at multiple 
sites. The routine use disclosure statements are being renumbered.
    VA is revising and updating the systems of record notice 77VA10Q, 
``Health Care Provider Credentialing and Privileging Records--VA''.
    The notice of intent to publish and an advance copy of the system 
notice have been sent to the appropriate Congressional committees and 
to the Director of the Office of Management and Budget (OMB) as 
required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB 
(65 FR 77677), December 12, 2000.

    Approved: November 19, 2001.
Anthony J. Principi,
Secretary of Veterans Affairs.
77VA10Q

System Name:
    Health Care Provider Credentialing and Privileging Records-VA.

System Location:
    Records are maintained at each VA health care facility. Address 
locations for VA facilities are listed in VA Appendix 1 of the biennial 
publication of VA system of records. In addition, information from 
these records or copies of records may be maintained at the Department 
of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420 and/
or Veterans Integrated Service Network (VISN) Offices. Records for 
those VA contracted health care providers who are credentialed by the 
contractor in accordance with VHA policy, where credentialing 
information is received by VHA facilities will be maintained in 
accordance with this notice and VHA policy. Electronic copies of 
records may be maintained by the Department of Health and Human 
Services (HHS), a component thereof, a contractor, subcontractor of 
HHS, or by another entity in accordance with the VA Interagency 
Agreement. Back-up copies of the electronic data warehouse are 
maintained at off-site locations.

Categories of Individuals Covered by the System:
    The records include information concerning health care providers 
currently or formerly employed or otherwise utilized by VA, and 
individuals who make application to VA and are considered for 
employment or appointment as health care providers. These records will 
include information concerning individuals who through a contractual or 
other type of agreement may be or are providing health care to VA 
patients. This may include, but is not limited to: audiologists; 
dentists; dietitians; expanded-function dental auxiliaries; licensed 
practical or vocational nurses; nuclear medicine technologists; nurse 
anesthetists; nurse practitioners; nurses; occupational therapists; 
optometrists; clinical pharmacists; licensed physical therapists; 
physician assistants; physicians; podiatrists; psychologists; 
registered respiratory therapists; certified respiratory therapy 
technicians; diagnostic and therapeutic radiology technologists; social 
workers; and speech pathologists.

Categories of Records in the System:
    The record consists of information related to:
    (1) The credentialing (the review and verification of an 
individual's qualifications for employment or utilization which 
includes licensure, registration or certification, professional 
education and training, employment history, experience, appraisals of 
past performance, health status, etc.) of applicants who are considered 
for employment and/or appointment, for providing health services under 
a contract or other type of agreement, and/or for appointment to the 
professional staff.
    (2) The privileging (the process of reviewing and granting or 
denying a provider's request for clinical privileges to provide medical 
or other patient care services, within well defined limits, which are 
based on an individual's professional license, registration or 
certification, experience, training, competence, health status, 
ability, and clinical judgment) health care providers who are permitted 
by law and by the medical facility to provide patient care 
independently and individuals whose duties and responsibilities are 
determined to be beyond the normal scope of activities for their 
profession;
    (3) The periodic reappraisal of health care providers' professional 
credentials and the reevaluation of the clinical competence of 
providers who have been granted clinical privileges; and/or
    (4) Accessing and reporting to the National Practitioner Data Bank 
(NPDB).
    The record may include individual identifying information (e.g., 
name, date of birth, gender, social security number, national provider 
number, and/or other personal identification number), address 
information (e.g., home and/or mailing address, home telephone number, 
e-mail address, facsimile number), biometric data and information 
related to education and training (e.g., name of medical or 
professional school attended and date of graduation, name of training 
program, type of training, dates attended, and date of completion). The 
record may also include information

[[Page 63429]]

related to: the individual's license, registration or certification by 
a State licensing board and/or national certifying body (e.g., number, 
expiration date, name and address of issuing office, status including 
any actions taken by the issuing office or any disciplinary board to 
include previous or current restrictions, suspensions, limitations, or 
revocations); citizenship; honors and awards; type of appointment or 
utilization; service/product line; professional society membership; 
professional performance, experience, and judgment (e.g., documents 
reflecting work experience, appraisals of past and current performance 
and potential); educational qualifications (e.g., name and address of 
institution, level achieved, transcript, information related to 
continuing education); Drug Enforcement Administration and or State 
controlled dangerous substance certification (e.g., current status, any 
revocations, suspensions, limitations, restrictions); information about 
mental and physical status; evaluation of clinical and/or technical 
skills; involvement in any administrative, professional or judicial 
proceedings, whether involving VA or not, in which professional 
malpractice on the individual's part is or was alleged; any actions, 
whether involving VA or not, which result in the limitation, reduction, 
revocation, or acceptance of surrender or restriction of the 
individual's clinical privileges; and, clinical performance information 
that is collected and used to support a determination of an 
individual's request for clinical privileges. Some information that is 
included in the record may be duplicated in an employee personnel 
folder.

Authority for Maintenance of the System:
    Title 38 U.S.C. 501(a) and 7304(a)(2).

Purposes(s):
    The information may be used for: Verifying the individual's 
credentials and qualifications for employment or utilization, 
appointment to the professional staff, and/or clinical privileges; 
advising prospective health care entity employers, health care 
professional licensing or monitoring bodies, the NPDB, or similar 
entities of activities of individuals covered by this system; 
accreditation of a facility by an entity such as the Joint Commission 
on Accreditation of Healthcare Organizations; audits, reviews and 
investigations conducted by staff of the health care facility, the VISN 
Directors and Division Offices, VA Central Office, VHA program offices 
who require the credentialing information, and the VA Office of 
Inspector General; law enforcement investigations; quality assurance 
audits, reviews and investigations; personnel management and 
evaluations; employee ratings and performance evaluations; and, 
employee disciplinary or other adverse action, including discharge. The 
records and information may be used for statistical analysis, to 
produce various management reports, evaluate services, collection, 
distribution and utilization of resources, and provide clinical and 
administrative support to patient medical care.

Routine Uese of Records Maintained in the System, Including Categories 
of Users and the Purposes of Such Uses:
    1. A record from this system of records may be disclosed to any 
source from which additional information is requested (to the extent 
necessary to identify the individual, inform the source of the 
purpose(s) of the request, and to identify the type of information 
requested), when necessary to obtain information relevant to a 
Department decision concerning the hiring or retention of an employee; 
the issuance or reappraisal of clinical privileges; the issuance of a 
security clearance; the conducting of a security or suitability 
investigation of an individual; the letting of a contract; the issuance 
of a license, grant, or other benefits; or in response to scarce or 
emergency needs of the Department or other entities when specific 
skills are required.
    2. A record from this system of records may be disclosed to an 
agency in the executive, legislative, or judicial branch, or the 
District of Columbia's Government in response to its request, or at the 
initiation of VA, information in connection with the hiring of an 
employee; appointment to the professional staff; the issuance of a 
security clearance; the conducting of a security or suitability 
investigation of an individual; the letting of a contract; the issuance 
of a license, grant, or other benefit by the agency; or the lawful 
statutory or administrative purpose of the agency to the extent that 
the information is relevant and necessary to the requesting agency's 
decision; or at the initiative of VA, to the extent the information is 
relevant and necessary to an investigative purpose of the agency.
    3. Disclosure may be made to a congressional office from the record 
or an individual in response to an inquiry from the congressional 
office made at the request of that individual.
    4. Disclosure may be made to National Archives and Records 
Administration in records management inspections conducted under 
authority of Title 44 United States Code.
    5. Information from this system of records may be disclosed to a 
Federal agency or to a State or local government licensing board and/or 
to the Federation of State Medical Boards or a similar non-Government 
entity, which maintains records concerning individuals' employment 
histories or concerning the issuance, retention or revocation of 
licenses, certifications, or registration necessary to practice an 
occupation, profession or specialty, in order for the Department to 
obtain information relevant to a Department decision concerning the 
hiring, utilization, appointment, retention or termination of 
individuals covered by this system or to inform a Federal agency or 
licensing boards or the appropriate non-Government entities about the 
health care practices of a currently employed, appointed, otherwise 
utilized, terminated, resigned, or retired health care employee or 
other individuals covered by this system whose professional health care 
activity so significantly failed to meet generally accepted standards 
of clinical practice as to raise reasonable concern for the safety of 
patients. These records may also be disclosed as part of an ongoing 
computer-matching program to accomplish these purposes.
    6. Information may be disclosed to non-Federal sector (i.e., State 
or local governments) agencies, organizations, boards, bureaus, or 
commissions (e.g., the Joint Commission on Accreditation of Healthcare 
Organizations). Such disclosures may be made only when: (a) The records 
are properly constituted in accordance with VA requirements; (b) the 
records are accurate, relevant, timely, and complete; and (c) the 
disclosure is in the best interest of the Government (e.g., to obtain 
accreditation or other approval rating). When cooperation with the non-
Federal sector entity, through the exchange of individual records, 
directly benefits VA's completion of its mission, enhances personnel 
management functions, or increases the public confidence in VA's or the 
Federal Government's role in the community, then the Government's best 
interests are served. Further, only such information that is clearly 
relevant and necessary for accomplishing the intended uses of the 
information as certified by the receiving entity is to be furnished.
    7. Information may be disclosed to a state or national certifying 
body, which has the authority to make decisions concerning the 
issuance, retention or revocation of licenses, certifications or 
registrations required to practice a

[[Page 63430]]

health care profession, when requested in writing by an investigator or 
supervisory official of the licensing entity or national certifying 
body, for the purpose of making a decision concerning the issuance, 
retention or revocation of the license, certification or registration 
of a named health care professional.
    8. Information may be disclosed to the Department of Justice and 
United States Attorneys in defense or prosecution of litigation 
involving the United States, and to Federal agencies upon their request 
in connection with review of administrative tort claims filed under the 
Federal Tort Claims Act, 28 U.S.C. 2672.
    9. Hiring, appointment, performance, or other personnel 
credentialing related information may be disclosed to any facility or 
agent with which there is, or there is proposed to be, an affiliation, 
sharing agreement, partnership, contract, or similar arrangement, where 
required for establishing, maintaining, or expanding any such 
relationship.
    10. Information concerning a health care provider's professional 
qualifications and clinical privileges may be disclosed to a VA 
patient, or the representative or guardian of a patient who, due to 
physical or mental incapacity, lacks sufficient understanding and/or 
legal capacity to make decisions concerning his/her medical care. This 
information may also be disclosed to a VA patient, who is receiving or 
contemplating receiving medical or other patient care services from the 
provider when the information is needed by the patient or the patient's 
representative or guardian in order to make a decision related to the 
initiation of treatment, continuation or discontinuation of treatment, 
or receiving a specific treatment that is proposed or planned by the 
provider. Disclosure will be limited to information concerning the 
health care provider's professional qualifications (professional 
education, training and current licensure/certification status), 
professional employment history, and current clinical privileges.
    11. VA may disclose on its own initiative any information in this 
system, except the names and home addresses of veterans and their 
dependents, which is relevant to a suspected or reasonably imminent 
violation of law, whether civil, criminal or regulatory in nature and 
whether arising by general or program statute or by regulation, rule or 
order issued pursuant thereto, to a Federal, State, local or foreign 
agency charged with the responsibility of investigating or prosecuting 
such violation, or charged with enforcing or implementing the statute, 
regulation, rule or order. On its own initiative, VA may also disclose 
the names and addresses of veterans and their dependents to a Federal 
agency charged with the responsibility of investigating or prosecuting 
civil, criminal or regulatory violations of law, or charged with 
enforcing or implementing the statute, regulation, rule or order issued 
pursuant thereto.
    12. VA may disclose to the Federal Labor Relations Authority 
(including its General Counsel) information related to the 
establishment of jurisdiction, the investigation and resolution of 
allegations of unfair labor practices, or information in connection 
with the resolution of exceptions to arbitration awards when a question 
of material fact is raised; to disclose information in matters properly 
before the Federal Service Impasses Panel, and to investigate 
representation petitions and conduct or supervise representation 
elections.
    13. Information may be disclosed to the VA-appointed representative 
of an employee regarding all notices, determinations, decisions, or 
other written communications issued to the employee in connection with 
an examination ordered by VA under fitness-for-duty examination 
procedures or Agency-filed disability retirement procedures.
    14. Information may be disclosed to officials of the Merit Systems 
Protection Board, including the Office of the Special Counsel, when 
requested in connection with appeals, special studies of the civil 
service and other merit systems, review of rules and regulations, 
investigation of alleged or possible prohibited personnel practices, 
and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as 
may be authorized by law.
    15. Information may be disclosed to the Equal Employment 
Opportunity Commission when requested in connection with investigations 
of alleged or possible discriminatory practices, examination of Federal 
affirmative employment programs, or the other functions of the 
Commission as authorized by law or regulation.
    16. Information listed in 5 U.S.C. 7114(b)(4) may be disclosed to 
officials of labor organizations recognized under 5 U.S.C., chapter 71 
when relevant and necessary to their duties of exclusive representation 
concerning personnel policies, practices, and matters affecting working 
conditions.
    17. Identifying information in this system, including name, 
address, social security number and other information as is reasonably 
necessary to identify such individual, may be disclosed to the NPDB at 
the time of hiring, appointment, utilization, and/or clinical 
privileging/reprivileging of physicians, dentists and other health care 
practitioners, and other times as deemed necessary by VA, in order for 
VA to obtain information relevant to a Department decision concerning 
the hiring, appointment, utilization, privileging/reprivileging, 
retention or termination of the individual.
    18. Relevant nformation from this system of records may be 
disclosed to the NPDB and/or State Licensing Board in the State(s) in 
which a practitioner is licensed, in which the VA facility is located, 
and/or in which an act or omission occurred upon which a medical 
malpractice claim was based when VA reports information concerning: (a) 
Any payment for the benefit of a physician, dentist, or other licensed 
health care practitioner which was made as the result of a settlement 
or judgment of a claim of medical malpractice if an appropriate 
determination is made in accordance with agency policy that payment was 
related to substandard care, professional incompetence or professional 
misconduct on the part of the individual; (b) a final decision which 
relates to possible incompetence or improper professional conduct that 
adversely affects the clinical privileges of a physician or dentist for 
a period longer than 30 days; or, (c) the acceptance of the surrender 
of clinical privileges or any restriction of such privileges by a 
physician or dentist either while under investigation by the health 
care entity relating to possible incompetence or improper professional 
conduct, or in return for not conducting such an investigation or 
proceeding. These records may also be disclosed as part of a computer-
matching program to accomplish these purposes.
    19. In response to a request about a specifically identified 
individual covered by this system from a prospective Federal or non-
Federal health care entity employer, the following information may be 
disclosed: (a) Relevant information concerning the individual's 
professional employment history including the clinical privileges held 
by the individual; (b) relevant information concerning a final decision 
which results in a voluntary or involuntary limitation, reduction or 
loss of clinical privileges; and (c) relevant information concerning 
any payment which is made in settlement (or partial settlement) of, or 
in satisfaction of a judgment in, a medical malpractice action or claim 
and, when through a peer review process that is undertaken

[[Page 63431]]

pursuant to VA policy, negligence, professional incompetence, 
responsibility for improper care, and/or professional misconduct has 
been assigned to the individual.
    20. Disclosure may be made to any Federal, State, local, tribal or 
private entity in response to a request concerning a specific provider 
for the purposes of credentialing providers who provide health care at 
multiple sites or move between sites. Such disclosures may be made only 
when: (a) The records are properly constituted in accordance with VA 
requirements; (b) the records are accurate, relevant, timely, and 
complete; and (c) disclosure is in the best interests of the Government 
(i.e., to meet the requirements of contracts, sharing agreements, 
partnerships, etc.). When the exchange of credentialing information 
through the exchange of individual records directly benefits VA's 
completion of its mission and enhances public confidence in VA's or the 
Federal Government's role in the delivery of health care, then the best 
interests of the Government are served.

Policies and Practices for Storing, Retrieving, Accessing, Retaining, 
and Disposing of Records in the System:
Storage:
    Records are maintained on paper documents or in electronic format. 
Information included in the record may be stored on microfilm, magnetic 
tape or disk.

Retrievability:
    Records are retrieved by the names and social security number or 
other assigned identifiers, e.g. the National Provider Identifier, of 
the individuals on whom they are maintained.

Safeguards:
    1. Access to VA working and storage areas in VA health care 
facilities is restricted to VA employees on a ``need-to-know'' basis; 
strict control measures are enforced to ensure that disclosure to these 
individuals is also based on this same principle. Generally, VA file 
areas are locked after normal duty hours and the health care facilities 
are protected from outside access by the Federal Protective Service or 
other security personnel.
    2. Access to computer rooms within the health care facilities is 
generally limited by appropriate locking devices and restricted to 
authorized VA employees and vendor personnel. Automated data processing 
peripheral devices are generally placed in secure areas (areas that are 
locked or have limited access) or are otherwise protected. Information 
in the VistA system may be accessed by authorized VA employees. Access 
to file information is controlled at two levels; the system recognizes 
authorized employees by a series of individually unique passwords/codes 
as a part of each data message, and the employees are limited to only 
that information in the file, which is needed in the performance of 
their official duties.
    3. Access to records in VA Central Office and the VISN Directors 
and Division Offices is only authorized to VA personnel on a ``need-to-
know'' basis. Records are maintained in manned rooms during working 
hours. During non-working hours, there is limited access to the 
building with visitor control by security personnel.
    4. The automated system is Internet enabled and will conform to all 
applicable Federal regulations concerning information security. The 
automated system is protected by a generalized security facility and by 
specific security techniques used within the application that accesses 
the data file and may include individually unique passwords/codes and 
may utilize Public Key Infrastructure personal certificates. Both 
physical and system security measures will meet or exceed those 
required to provide an adequate level of protection for host systems. 
Access to file information is limited to only that information in the 
file which is needed in the performance of official duties. Access to 
computer rooms is restricted generally by appropriate locking devices 
to authorized operational personnel. Information submitted to the 
automated electronic system is afforded the same protections as the 
data that is maintained in the original files. Access from remote 
locations, including remote on-line access from other agencies to the 
data storage site, is controlled in the same manner. Access to the 
electronic data is supported by encryption and the Internet server is 
insulated by a firewall.

Retention and Disposal:
    Records are maintained at the employing VA facility. If the 
individual transfers to another VA facility location, the record is 
transferred to the new location, if appropriate. Paper records are 
retired to a Federal records center 3 years after the individual 
separates from VA employment or no longer utilized by VA (in some 
cases, records may be maintained at the facility for a longer period of 
time) and are destroyed 30 years after separation. Paper records for 
applicants who are not selected for VA employment or appointment are 
destroyed 2 years after non-selection or when no longer needed for 
reference, whichever is sooner. Electronic records are transferred to 
the Director, Credentialing and Privileging Program, Office of Quality 
and Performance, VHA Central Office, when the provider leaves the 
facility. Information stored on electronic storage media is maintained 
and disposed of in accordance with records disposition authority 
approved by the Archivist of the United States.

System Manager(s) and Address:
    Official responsible for policies and procedures: Director, 
Credentialing and Privileging Program, Office of Quality and 
Performance (10Q), Veterans Health Administration, Department of 
Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420.
    Officials maintaining the system: (1) The Chief of Staff at the VA 
health care facility where the provider made application, is employed, 
or otherwise utilized; (2) the credentialing coordinator of the VA 
health care facility for individuals who made application for 
employment or other utilization, or providers currently or previously 
employed or otherwise utilized at VA Central Office or at a VISN 
location; and (3) HHS/HRSA, Parklawn Building, 5600 Fishers Lane, 
Rockville, Maryland 20852, for the electronic data warehouse. In most 
cases, the electronic data will be maintained by the Department of 
Health and Human Services, Health Resources and Services Administration 
(HHS/HRSA), a component thereof (a contractor, subcontractor of HHS/
HRSA, or by another entity) in accordance with the VA Interagency 
Agreement.

Notification Procedure:
    Individuals who wish to determine whether this system of records 
contains information about them should contact the VA facility where 
they made application for employment or appointment, or to the VA 
facility where they are or were employed. Inquiries should include the 
employee's full name, social security number, date of application for 
employment or appointment or dates of employment or appointment, and 
return address.

Record Access Procedures:
    Individuals seeking information regarding access to and contesting 
of records in this system may write, call or visit the VA facility 
where they made application for employment or appointment, or the VA 
facility where they are or were employed.

Contesting Records Procedures:
    (See Record Access Procedures above.)

[[Page 63432]]

Record Source Categories:
    Information in this system of records is provided by the applicant/
employee, or obtained from State licensing boards, Federation of State 
Medical Boards, National Council of State Boards of Nursing, National 
Practitioner Data Bank, professional societies, national certifying 
bodies, current or previous employers, other health care facilities and 
staff, references, educational institutions, medical schools, VA staff, 
patient, visitors, and VA patient medical records.

[FR Doc. 01-30241 Filed 12-5-01; 8:45 am]
BILLING CODE 8320-01-P