[Federal Register Volume 67, Number 188 (Friday, September 27, 2002)]
[Notices]
[Pages 61205-61209]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 02-24391]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Department of Veterans Affairs (VA).

ACTION: Notice of amendment to system of records.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974 (5 U.S.C. 552(e)(4)) requires that all 
agencies publish in the Federal Register a notice of the existence and 
character of their systems of records. Notice is hereby given that the 
Department of Veterans Affairs (VA) is amending the system of records 
entitled ``Patient Fee Basis Medical and Pharmacy Records-VA'' 
(23VA136) as set forth in the Federal Register 40 FR 38095 dated 8/26/
75 and amended in the Federal Register 58 FR 40852 dated 7/30/93. VA is 
revising the System Name and Number and amending the paragraphs for 
System Location; Purpose(s); Routine Uses of Records Maintained in the 
System; Policies and Practices for Storing, Retrieving, Accessing, 
Retaining, and Disposing of records in the System, including Storage 
and Safeguards; and System Manager. VA is republishing the system 
notice in its entirety.

DATES: Comments on the amendment of this system of records must be 
received no later than October 28, 2002. If no public comment is 
received, the new system will become effective October 28, 2002.

ADDRESSES: You may mail or hand-deliver written comments concerning the 
proposed amended system of records to the Office of Regulations 
Management (02D), Department of Veterans Affairs, 810 Vermont Avenue, 
NW., Washington, DC 20420; or fax comments to (202) 273-9289; or e-mail 
comments to ``[email protected]''. All relevant material 
received before October 28, 2002 will be considered. Comments will be 
available for public inspection at the above address in the Office of 
Regulations Management, Room 1158, between the hours of 8 a.m. and 4:30 
p.m., Monday through Friday (except holidays).

FOR FURTHER INFORMATION CONTACT: Privacy Act Officer (19), Department 
of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420, 
telephone (727) 320-1839.

SUPPLEMENTARY INFORMATION: The name and number of the system is changed 
from ``Patient Fee Basis Medical and Pharmacy Records-VA'' (23VA136) to

[[Page 61206]]

the ``Non-VA Fee Basis Records-VA'' (23VA163). The change in system 
name and number reflects organizational changes within the Department. 
The System Location; Purpose(s); Policies and Practices for Storing, 
Retrieving, Accessing, Retaining, and Disposing of records in the 
System, including Storage and Safeguards have been amended to reflect 
changes in institutional names. Specifically, VA Central Office has 
been revised to VA Headquarters, VA Boston Development Center to VA 
Allocation Resource Center, VA Data Processing Center to Austin 
Automation Center (AAC), and DHCP to VISTA.
    A new routine use is being added to allow for the disclosure of 
relevant information to individuals, organizations, private or public 
agencies, etc., with whom VA has a contract or agreement to perform 
such services as VA may deem practicable for the purposes of laws 
administered by VA, in order for the contractor or subcontractor to 
perform the services of the contract or agreement. VA occasionally 
contracts out certain of its functions when this would contribute to 
effective and efficient operations. VA must be able to give a 
contractor whatever information is necessary for the contractor to 
fulfill its duties. In these situations, safeguards are provided in the 
contract prohibiting the contractor from using or disclosing the 
information for any purpose other than that described in the contract. 
Routine use 1 is being deleted and the routine uses will be renumbered. 
The System Manager was amended to reflect the organizational changes of 
the Department. VA is republishing the system notice in its entirety.
    The notice of intent to publish and an advance copy of the system 
notice have been sent to the appropriate Congressional committees and 
to the Director of the Office of Management and Budget (OMB) as 
required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB 
(65 FR 77677), December 12, 2000.

    Approved: September 11, 2002.
Anthony J. Principi,
Secretary of Veterans Affairs.
23VA163 ,

System Name:
    Non-VA Fee Basis Records-VA.

System Location:
    Paper records are maintained at VA health care facilities and 
Federal record centers. Information is stored also in automated storage 
media records that are maintained at: The health care facilities (in 
most cases, back-up computer tape information is stored also at off-
site locations); Department of Veterans Affairs Headquarters, 810 
Vermont Ave, NW., Washington, DC; the VA Allocation Resource Center, 
Braintree, Massachusetts; the VA Office of Information Field Offices 
(OIFOs); the Veterans Benefits Administration (VBA) Regional Directors 
and Division Offices; and the Austin Automation Center (AAC) located in 
Austin, Texas. Address locations for VA facilities are listed in VA 
Appendix 1 of the biennial Privacy Act Issuances publication.

Categories of Individuals Covered by the System:
    1. Veterans who have applied for health care services under title 
38, United States Code, Chapter 17.
    2. Beneficiaries of other Federal agencies.
    3. Pensioned members of allied forces who are provided health care 
services under Title 38, United States Code, Chapter 1.
    4. Non-VA health care providers who provide fee basis services to 
veterans.

Categories of Records in the System:
    The records include information concerning patients who are 
authorized to obtain medical care and services from non-VA health care 
institutions and providers and the institutions and/or providers (e.g., 
individuals, pharmacies, clinics or group practices, hospitals, nursing 
homes, physicians, psychologists, podiatrists, optometrists, nurses, 
and others) who furnish the authorized medical treatment, services, 
medications, or supplies. The patient information may include name, 
address, social security and VA claim numbers, medical conditions 
authorized for treatment, eligibility information related to such 
treatment, the date authorization for the services was issued and the 
period of validity, the amounts paid for travel benefits, the amounts 
reimbursed for services paid for by the patient, and information that 
pertains to the medical care. Information that is maintained concerning 
the health care institutions and providers may include name, address, 
social security or employer's taxpayer identification numbers, services 
rendered, fees charged and amounts paid for services rendered, and 
earnings for performing such services.

Authority for Maintenance of the System:
    Title 38, United States Code, chapter 1, section 111 and chapter 
17, sections 1703, 1710, 1712, 1720 and 1728.

Purpose(s):
    The records or information are used for the purposes of reporting 
health care provider earnings to the Internal Revenue Service; 
producing various management and patient follow-up reports; responding 
to patient and other inquiries; statistical analysis; for resource 
allocation and planning; providing clinical and administrative support 
to patient medical care and payments for medical care; determining 
entitlement and eligibility for VA benefits; processing and 
adjudicating benefit claims by VBA Regional Office (RO) staff; audits, 
reviews and investigations conducted by staff of the health care 
facility, the VBA Regional Directors and Division Offices, VA 
Headquarters, and the VA Office of Inspector General (OIG); law 
enforcement investigations; and quality assurance audits, reviews and 
investigations.

Routine Uses of Records Maintained in the System Including Categories 
of Users and the Purposes of Such Uses:
    To the extent that records contained in the system include 
information protected by 38 U.S.C. 7332 (formerly section 4132), i.e., 
medical treatment information related to drug abuse, alcoholism or 
alcohol abuse, sickle cell anemia or infection with the human 
immunodeficiency virus, that information cannot be disclosed under a 
Routine Use unless there is also specific statutory authority 
permitting disclosure.
    1. Any information in this system, except the name and address of a 
veteran, which is relevant to a suspected violation or reasonably 
imminent violation of law, whether civil, criminal or regulatory in 
nature and whether arising by general or program statute or by 
regulation, rule or order issued pursuant thereto, may be disclosed to 
a Federal, State, local or foreign agency charged with the 
responsibility of investigating or prosecuting such violation, or 
charged with enforcing or implementing the statute, regulation, rule or 
order issued pursuant thereto. The names and addresses of veteran may 
only be disclosed:
    a. To a Federal agency charged with the responsibility of 
investigating or prosecuting such violation, or charged with enforcing 
or implementing the statute, regulation, rule or order issued pursuant 
thereto, in response to its official request.
    b. To any foreign, State or local government agency or 
instrumentality charged under applicable law with the protection of the 
public health or safety if a qualified representative of such 
organization, agency or instrumentality has made a written request that 
such name and address be provided for a purpose authorized by law.

[[Page 61207]]

    2. A record from this system of records may be disclosed as a 
``routine use'' to a Federal, State, or local government agency, or to 
a non-governmental organization maintaining civil, criminal or other 
relevant information, such as current licenses, registration or 
certification, if necessary to obtain information relevant to an agency 
decision concerning the hiring or retention of an employee, the use of 
an individual as a consultant, attending or to provide fee basis health 
care, the issuance of a security clearance, the letting of a contract, 
or the issuance of a license, grant or other health, educational or 
welfare benefits. Any information in this system also may be disclosed 
to any of the above-listed governmental organizations as part of a 
series of ongoing computer matches to determine if VA health care 
practitioners and private practitioners used by the VA hold current, 
unrestricted licenses, or are currently registered in a State, and are 
board certified in their specialty, if any. These computer matches are 
performed pursuant to the VA OIG's authority under Pub. L. 95-452, 
section 4(a), to detect and prevent fraud and abuse.
    3. A record from this system of records may be disclosed to a 
Federal agency, in response to its request, in connection with the 
hiring or retention of an employee, the issuance of a security 
clearance, the reporting of an investigation of an employee, the 
letting of a contract, or the issuance of a license, grant, or other 
benefit by the requesting agency, to the extent that the information is 
relevant and necessary to the requesting agency's decision on the 
matter.
    4. To the Treasury Department to facilitate payments to physicians, 
clinics, and pharmacies for reimbursement of services rendered.
    5. To the Treasury Department to facilitate payments to veterans 
for reimbursements of travel expenses.
    6. Disclosure may be made to a congressional office from the record 
of an individual in response to an inquiry from the congressional 
office made at the request of that individual.
    7. Disclosure may be made to National Archives and Records 
Administration (NARA), General Services Administration (GSA) in records 
management inspections conducted under authority of 44 United States 
Code.
    8. Records from this system of records may be disclosed to a 
Federal agency or to a State or local government licensing board and/or 
to the Federation of State Medical Boards or a similar non-government 
entity which maintains records concerning individuals' employment 
histories or concerning the issuance, retention or revocation of 
licenses, certifications, or registration necessary to practice an 
occupation, profession or specialty, in order for the agency to obtain 
information relevant to an agency decision concerning the hiring, 
retention or termination of an employee or to inform a Federal agency 
or licensing boards or the appropriate non-government entities about 
the health care practices of a terminated, resigned or retired health 
care employee whose professional health care activity so significantly 
failed to conform to generally accepted standards of professional 
medical practice as to raise reasonable concern for the health and 
safety of patients in the private sector or from another Federal 
agency. These records may also be disclosed as part of an ongoing 
computer matching program to accomplish these purposes.
    9. Identifying information in this system, including name, address, 
social security number and other information as is reasonably necessary 
to identify such individual, may be disclosed to the National 
Practitioner Data Bank at the time of hiring and/or clinical 
privileging/reprivileging of health care practitioners, and other times 
as deemed necessary by VA, in order for VA to obtain information 
relevant to a Department decision concerning the hiring, privileging/
reprivileging, retention or termination of the applicant or employee.
    10. Relevant information from this system of records may be 
disclosed to the National Practitioner Data Bank and/or State Licensing 
Board in the State(s) in which a practitioner is licensed, in which the 
VA facility is located, and/or in which an act or omission occurred 
upon which a medical malpractice claim was based when VA reports 
information concerning: (a) Any payment for the benefit of a physician, 
dentist, or other licensed health care practitioner which was made as 
the result of a settlement or judgment of a claim of medical 
malpractice if an appropriate determination is made in accordance with 
agency policy that payment was related to substandard care, 
professional incompetence or professional misconduct on the part of the 
individual; (b) a final decision which relates to possible incompetence 
or improper professional conduct that adversely affects the clinical 
privileges of a physician or dentist for a period longer than 30 days; 
or (c) the acceptance of the surrender of clinical privileges or any 
restriction of such privileges by a physician or dentist either while 
under investigation by the health care entity relating to possible 
incompetence or improper professional conduct, or in return for not 
conducting such an investigation or proceeding. These records may also 
be disclosed as part of a computer matching program to accomplish these 
purposes.
    11. Relevant identifying and medical treatment information 
(excluding medical treatment information related to drug or alcohol 
abuse, infection with the human immunodeficiency virus or sickle cell 
anemia) may be disclosed to a Federal agency or non-VA health care 
provider or institution when VA refers a patient for treatment or 
medical services or authorizes a patient to obtain non-VA medical 
services and the information is needed by the Federal agency or non-VA 
institution or provider to perform the services or for VA to obtain 
sufficient information in order to make payment for the services, to 
evaluate the services rendered, or to determine the need for additional 
services.
    12. Information maintained in this system concerning non-VA health 
care institutions and providers, including name, address, social 
security or employer's taxpayer identification numbers, may be 
disclosed to the Treasury Department, Internal Revenue Service, to 
report calendar year earnings of $600 or more for income tax reporting 
purposes.
    13. In order to prevent or identify duplicate payments by Medicare 
intermediaries, relevant information (excluding medical treatment 
information related to drug or alcohol abuse, infection with the human 
immunodeficiency virus or sickle cell anemia) may be disclosed to the 
Department of Health and Human Services (HHS) for the purpose of 
identifying individuals who are authorized by VA to obtain non-VA 
health care services at VA's expense and those for whom payments have 
been made. The information to be disclosed to HHS includes identifying 
information (patient and provider names, addresses, social security and 
taxpayer identification numbers, and date of birth of patient), 
treatment information (dates and diagnostic, surgical, and services 
provided codes) and payment information (payee, amounts and dates).
    14. Disclosure of relevant information may be made to individuals, 
organizations, private or public agencies, etc., with whom VA has a 
contract or agreement to perform such services as VA may deem 
practicable for the purposes of laws administered by VA, in order for 
the contractor or subcontractor to perform the services of the contract 
or agreement.

[[Page 61208]]

Policies and Practices for Storing, Retrieving, Accessing, Retaining, 
and Disposing of Records in the System:
Storage:
    Records are maintained on paper documents at the health care 
facilities. Paper payment vouchers are maintained at the health care 
facility or AAC at Austin, Texas. Information on automated storage 
media (e.g., microfilm, microfiche, magnetic tape and magnetic disks 
and laser optical media) is stored at the health care facilities 
(includes record information stored in the Integrated Hospital System 
(IHS) at selected medical facilities and at other facilities in the 
Veterans Integrated Systems and Technology Architecture (VistA) system, 
and, in most cases, copies of back-up computer files maintained at off-
site locations), VA Headquarters, the VA Allocation Resource Center 
(ARC), the Regional Directors and Division Offices, the OIFOs and the 
AAC. Reports generated from these records are maintained on paper and 
microfiche at the health care facilities, VA Headquarters, the Regional 
Directors and Division Offices, and the AAC.

Retrievability:
    Information is retrieved by the patient's name and/or social 
security number and/or the name or social security or taxpayer 
identification numbers of the non-VA health care institution or 
provider.

Safeguards:
    1. Access to working spaces and record storage areas in VA health 
care facilities is restricted to VA employees on a ``need-to-know'' 
basis. Generally, file areas are locked after normal duty hours and the 
health care facilities are protected from outside access by the Federal 
Protective Service or other security personnel. Access to the records 
is restricted to VA employees who have a need for the information in 
the performance of their official duties. Employee records or records 
of public figures or otherwise sensitive records are generally stored 
in separate locked files. Strict control measures are enforced to 
ensure that access to and disclosures from these records are limited to 
a ``need-to-know'' basis.
    2. Access to the VistA and IHS computer rooms at health care 
facilities is generally limited by appropriate locking devices and 
restricted to authorized VA employees and vendor personnel. Peripheral 
devices are generally placed in secure areas (areas that are locked or 
have limited access) or are otherwise protected. Information in the 
VistA and IHS systems may be accessed by authorized VA employees. 
Access to file information is controlled at two levels: the system 
recognizes authorized employees by a series of individually unique 
passwords/codes as a part of each data message, and the employees are 
limited to only that information in the file which is needed in the 
performance of their official duties. Information that is downloaded 
from the AAC and VistA and IHS files and maintained on personal 
computers is afforded similar storage and access protections as the 
data that is maintained in the original files. Remote access to file 
information by staff of the OIFOs, VBA Regional Offices, and access by 
OIG staff conducting an audit or investigation at the health care 
facility or an OIG office location remote from the health care facility 
is controlled in the same manner.
    3. Access to the AAC is generally restricted to Center employees, 
custodial personnel, Federal Protective Service and other security 
personnel. Access to computer rooms is restricted to authorized 
operational personnel through electronic locking devices. All other 
persons gaining access to computer rooms are escorted. Information 
stored in the computer may be accessed by authorized VA employees at 
remote locations including VA health care facilities, OIFOs, VA 
Headquarters, Regional Directors and Division Offices, and OIG 
headquarters and field staff. Access is controlled by individually 
unique passwords/codes which must be changed periodically by the 
employee.
    4. Access to records maintained at VA Headquarters, the VA ARC, the 
OIFOs and the Regional Directors and Division Offices is restricted to 
VA employees who have a need for the information in the performance of 
their official duties. Access to information stored on automated 
storage media is controlled by individually unique passwords/codes. 
Information stored on computers at the OIFOs may be accessed by 
authorized VA employees at remote locations including VA health care 
facilities and Regional Directors and Division Offices. Access is 
controlled by individually unique passwords/codes. Records are 
maintained in manned rooms during nonworking hours. The facilities are 
protected from outside access during working hours by the Federal 
Protective Service or other security personnel.
    5. Information downloaded from VistA and IHS and VA AAC files and 
maintained by the OIG Headquarters and field offices on automated 
storage media is secured in storage areas or facilities to which only 
OIG staff have access. Paper documents are similarly secured. Access to 
paper documents and information on automated storage media is limited 
to OIG employees who have a need for the information in the performance 
of their official duties. Access to information stored on automated 
storage media is controlled by individually unique passwords/codes.

Retention and Disposal:
    Paper documents at the health care facility related to authorizing 
the fee basis care and the services authorized, billed and paid for are 
maintained in the Patient Medical Records-VA (24VA136). These records 
are retained at health care facilities for a minimum of three years 
after the last episode of care. After the third year of inactivity the 
paper records are transferred to a records facility for seventy-two 
(72) more years of storage. Automated storage media and other paper 
documents that are included in this system of records and not 
maintained in the Patient Medical Records-VA (24VA136) are retained and 
disposed of in accordance with disposition authorization approved by 
the Archivist of the United States.

System Manager(s) and Address:
    Director, Health Administration Service (163), VA Headquarters, 810 
Vermont Ave., NW., Washington, DC 20420.

Notification and Procedures:
    An individual who wishes to determine whether a record is being 
maintained in this system under the individual's name or other personal 
identifier, or wants to determine the contents of such record, should 
submit a written request or apply in person to the last VA health care 
facility where care was authorized or rendered. Addresses of VA health 
care facilities may be found in VA Appendix 1 of the biennial 
publication. All inquiries must reasonably identify the portion of the 
fee basis record involved and the place and approximate date that 
medical care was provided. Inquiries should include the patient's full 
name, social security number and return address.

Record Access Procedures:
    Individuals seeking information regarding access to and contesting 
of VA fee basis records may write, call or visit the last VA facility 
where medical care was authorized or provided.

Contesting Record Procedures:
    (See Record Access Procedures above.)

[[Page 61209]]

Record Source Categories:
    The patient, family members or accredited representative, and 
friends, employers or other third parties when otherwise unobtainable 
from the patient or family; military service departments; private 
medical facilities and health care professionals; Patient Medical 
Records-VA (24VA136); other Federal agencies; VA regional offices; VA 
automated record systems including Individuals Submitting Invoices/
Vouchers for Payment-VA (13VA047), Veterans and Beneficiaries 
Identification and Records Location Subsystem-VA (38VA23) and the 
Compensation, Pension, Education and Rehabilitation Records-VA (58VA21/
22); and various automated systems providing clinical and managerial 
support at VA health care facilities.

[FR Doc. 02-24391 Filed 9-26-02; 8:45 am]
BILLING CODE 8320-01-P