[Federal Register Volume 67, Number 198 (Friday, October 11, 2002)]
[Notices]
[Pages 63497-63502]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 02-25996]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Record

AGENCY: Department of Veterans Affairs (VA).

ACTION: Notice of establishment of New System of Records.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974 (5 U.S.C. 552(e)(4)) requires that all 
agencies publish in the Federal Register a notice of the existence and 
character of their systems of records. Notice is hereby given that the 
Department of Veterans Affairs (VA) is establishing a new system of 
records entitled ``Telephone Care and Service Records-VA'' (113VA112).

DATES: Comments on this new system of records must be received no later 
than November 12, 2002. If no public comment is received, the new 
system will become effective November 12, 2002.

ADDRESSES: You may mail or hand-deliver written comments concerning the 
proposed new system of records to the Office of Regulations Management 
(02D), Department of Veterans Affairs, 810 Vermont Avenue, NW., 
Washington, DC 20420; or fax comments to (202) 273-9289; or e-mail 
comments to ``[email protected]''. All relevant material 
received before

[[Page 63498]]

November 12, 2002 will be considered. Comments will be available for 
public inspection at the above address in the Office of Regulations 
Management, Room 1158, between the hours of 8 a.m. and 4:30 p.m., 
Monday through Friday (except holidays).

FOR FURTHER INFORMATION CONTACT: Veterans Health Administration (VHA) 
Privacy Act Officer, Department of Veterans Affairs, 810 Vermont 
Avenue, NW., Washington, DC 20420; telephone (727) 320-1839.

SUPPLEMENTARY INFORMATION:

I. Description of Proposed System of Records

    The primary purpose of telephone care and service function is to 
provide veterans with clinical advice and education related to symptoms 
or problems an enrolled veteran caller may be experiencing. Calls may 
be made by family members but records of the calls will be maintained 
in the enrolled veteran's record. Except in the case of emergencies, 
clinical advice and education may only be provided to enrolled 
veterans. In order to better track and retrieve information about 
previous calls, all records of calls will be maintained under the name 
of the enrolled veteran. Records will not be retrievable by the name of 
the caller. Telephone care and service provides another mode of access 
for veterans that is available 24 hours a day, seven days a week from 
any place in the country.
    The telephone care function acts as a part of the primary and 
ambulatory care delivery system and augments that system by providing 
advice to callers over the telephone. When patients or family members 
call with a concern or request, a record of the call is developed, 
whether it be a clinical or administrative issue. Clinical symptom 
calls are managed through the use of pre-approved clinical algorithms 
that ask a series of questions and based on the answers to each 
question moves to the next question, which eventually leads to the 
advice that is to be provided to the caller. The record of the call 
captures the questions asked, answers given, particularly those answers 
that reflect something abnormal, and the advice provided. Documentation 
of this type of information is consistent with standard requirements 
for medical record documentation, which captures symptoms and findings 
as they relate to how specific questions are answered and a plan of 
action established. This information is also recorded in the patient's 
medical record. At a minimum, documentation includes the complaint(s) 
and symptoms of the enrolled veteran, the algorithm and/or protocol 
used and the advice given. Information is recorded either 
electronically or in handwritten notes in the progress notes of the 
medical record and in the Call Center database.
    Acting as a part of the primary and ambulatory care delivery 
system, the telephone care function may provide private sector 
providers or facilities with relevant clinical information about 
enrolled veterans in urgent or emergent situations. Information such as 
allergies, results of recent lab tests, medications, recent health 
history or procedures may be provided.
    Telephone care and service for clinical symptom calls are provided 
in a number of ways, including contracts with private sector vendors, 
contracts with VA facilities or Networks that have developed clinical 
Call Centers, or through medical center-based Call Centers in primary 
care and other types of clinics. A number of VA facilities and Networks 
are providing access to telephone care and service through clinics or 
medical center-based Call Centers during the day and through Network or 
contracted Call Centers during non-administrative hours. Protocols or 
algorithms are used at any of these sites when advice is given by a 
registered nurse without first consulting with a clinician and all of 
these calls must be documented in the medical record and Call Center 
database.
    Keeping records of all calls to a clinical Call Center in a 
separate database is the standard of practice for clinical Call Centers 
and is a required accreditation standard of the Utilization Review 
Accreditation Commission (URAC) for clinical Call Centers. 
Accreditation by URAC or another clinical Call Center accrediting body, 
if one should become available, is required by the VHA Directive 2000-
35, Telephone Care and Service.
    This system allows a record of all previous calls made by or for a 
veteran to be accessed whenever patients or family members call, which 
improves both the quality and the timeliness of addressing callers' 
concerns. Records are generally collected and stored electronically for 
ease of retrieval by the veteran's name or other personal identifier. 
The primary purpose of the data in this system of records is for rapid 
retrieval and ease of access to a record of all calls made by or for 
veterans, including the complaints of the patient, the findings 
according to the algorithms and the advice provided. This information 
is also used for follow-up calls to some patients. Information is also 
used for aggregation of data for the purposes of monitoring and 
improving quality. Though information is retrievable by individual 
patient identifier, when reporting aggregate information for purposes, 
such as quality, patient identifiers are not provided.
    Access to such records provide Call Center staff with information 
about previous contacts and the clinical symptoms reported by veterans 
in those contacts. The protocol used, education provided, advice given 
and actions taken by the caller in previous calls are readily available 
to Call Center staff each time a veteran or family member calls, which 
improves the quality of the services.
    Access to patient-specific information located in Call Center 
databases and storage areas is restricted to VA employees and contract 
personnel on a ``need-to-know'' basis; strict control measures are 
enforced to ensure that disclosure to these individuals is also based 
on this same principle. Generally, VA Call Center file areas are locked 
after normal duty hours or when the Call Center is closed and the 
facilities are protected from outside access by the Federal Protective 
Service or other security personnel.
    VA and contracted Call Centers are held to the Department of 
Veterans Affairs Computer Security Policy and all free standing and 
contracted Call Centers are required to develop and implement a 
Computer Security Policy that is consistent with the National Policy. 
Call Centers located within a medical center are required to meet the 
requirements of that medical center's computer security policy.
    Access to VA and contracted Call Centers and computer rooms is 
generally limited by appropriate locking devices and restricted to 
authorized VA employees and vendor personnel. Information in the 
Veterans Health Information Systems and Technology Architecture (VistA) 
may be accessed by authorized VA employees or authorized contract 
employees. Access to file information is controlled at two levels; the 
systems recognize authorized employees or contract employees by a 
series of individually unique passwords/codes as a part of each data 
message, and personnel are limited to only that information in the file 
which is needed in the performance of their official duties. 
Information that is downloaded from VistA and maintained on VA or 
contract personal computers is afforded similar storage and access 
protections as the data that is maintained in the original files. 
Access to information stored on automated storage media at other VA and 
contract

[[Page 63499]]

locations is controlled by individually unique passwords/codes.
    Remote access to VHA information in VistA is provided to those Call 
Center employees, either VA or contract staff, that require access to 
information stored in the medical record. Access to this information is 
protected through hardened user access and is controlled by individual 
unique passwords. Additionally, contracted Call Centers, either VA or 
private sector, are required to have a separate computer security plan 
that meets national information security requirements.

II. Proposed Routine Use Disclosures of Data in the System

    We are proposing to establish the following Routine Use disclosures 
of information maintained in the system:
    1. Disclosure to a member of Congress or staff person acting for 
the member when the member or staff person requests the records on 
behalf of and at the request of that individual.
    Individuals sometimes request the help of a member of Congress in 
resolving some issues relating to a matter before VA. The member of 
Congress then writes VA, and VA must be able to give sufficient 
information to be responsive to the inquiry.
    2. Disclosure may be made to the Department of Justice and United 
States Attorneys in defense or prosecution of litigation involving the 
United States, and to Federal agencies upon their request in connection 
with review of administrative tort claims filed under the Federal Tort 
Claims Act, 28 U.S.C. 2672.
    3. Disclosure may be made to a Federal agency or to a State or 
local government licensing board and/or to the Federation of State 
Medical Boards or a similar nongovernment entity which maintains 
records concerning individual's employment histories or concerning the 
issuance, retention or revocation of licenses, certifications, or 
registration necessary to practice an occupation, profession or 
specialty, in order for the Department to obtain information relevant 
to a Department decision concerning the hiring, retention or 
termination of an employee or to inform a Federal agency or licensing 
boards or the appropriate nongovernment entities about the health care 
practices of a terminated, resigned or retired health care employee 
whose professional health care activity so significantly failed to 
conform to generally accepted standards of professional medical 
practice as to raise reasonable concern for the health and safety of 
patients receiving medical care in the private sector or from another 
Federal agency. These records may also be disclosed as part of an 
ongoing computer matching program to accomplish these purposes.
    VA must be able to report information regarding the care a health 
care practitioner provides to agencies and boards charged with 
maintaining the health and safety of patients.
    4. For program review purposes and the seeking of accreditation 
and/or certification, disclosure may be made to survey teams of the 
Joint Commission on Accreditation of Healthcare Organizations, College 
of American Pathologists, American Association of Blood Banks, and 
similar national accreditation agencies or boards with whom VA has a 
contract or agreement to conduct such reviews, but only to the extent 
that the information is necessary and relevant to the review.
    VA health care facilities undergo certification and accreditation 
by several national accreditation agencies or boards to comply with 
regulations and good medical practices. VA must be able to disclose 
information for program review purposes and the seeking of 
accreditation and/or certification of health care facilities and 
programs.
    5. Disclosure may be made to a State or local government entity or 
national certifying body which has the authority to make decisions 
concerning the issuance, retention or revocation of licenses, 
certifications or registrations required to practice a health care 
profession, when requested in writing by an investigator or supervisory 
official of the licensing entity or national certifying body for the 
purpose of making a decision concerning the issuance, retention or 
revocation of the license, certification or registration of a named 
health care professional.
    6. Disclosure to the National Practitioner Data Bank at the time of 
hiring and/or clinical privileging/reprivileging of health care 
practitioners, and other times as deemed necessary by VA.
    VA must be able to obtain information relevant to a Department 
decision concerning the hiring, privileging/reprivileging, retention or 
termination of the applicant or employee from the National Practitioner 
Data Bank in order to ensure VA has competent and qualified employees 
to provide patient care services.
    7. Disclosure to the National Practitioner Data Bank and/or State 
Licensing Board in the State(s) in which a practitioner is licensed, in 
which the VA facility is located, and/or in which an act or omission 
occurred upon which a medical malpractice claim was based when VA 
reports information concerning: (1) Any payment for the benefit of a 
physician, dentist, or other licensed health care practitioner which 
was made as the result of a settlement or judgment of a claim of 
medical malpractice if an appropriate determination is made in 
accordance with agency policy that payment was related to substandard 
care, professional incompetence or professional misconduct on the part 
of the individual; (2) a final decision which relates to possible 
incompetence or improper professional conduct that adversely affects 
the clinical privileges of a physician or dentist for a period longer 
than 30 days; or, (3) the acceptance of the surrender of clinical 
privileges or any restriction of such privileges by a physician or 
dentist either while under investigation by the health care entity 
relating to possible incompetence or improper professional conduct, or 
in return for not conducting such an investigation or proceeding. These 
records may also be disclosed as part of a computer matching program to 
accomplish these purposes.
    VA must be able to report information to agencies and boards 
charged with tracking the practices of health care professionals.
    8. Disclosure of information related to the performance of a health 
care student or provider may be made to a medical or nursing school or 
other health care related training institution or other facility with 
which there is an affiliation, sharing agreement, contract or similar 
arrangement when the student or provider is enrolled at or employed by 
the school or training institution or other facility and the 
information is needed for personnel management, rating and/or 
evaluation purposes.
    9. Disclosure of relevant information may be made to individuals, 
organizations, private or public agencies, etc., with whom VA has a 
contract or agreement to perform such services as VA may deem 
practicable for the purposes of laws administered by VA, in order for 
the contractor or subcontractor to perform the services of the contract 
or agreement.
    VA occasionally contracts out certain of it functions, such as 
clinical care and the provision of Call Center services, when this 
would contribute to effective and efficient operations. VA must be able 
to give a contractor whatever information is necessary for the 
contractor to fulfill its duties. In these situations, safeguards are 
provided in the contract prohibiting the contractor from using or 
disclosing the information for any purpose other than that described in 
the contract.

[[Page 63500]]

    10. Disclosure may be made to a Federal agency, in response to its 
request, in connection with the hiring or retention of an employee, the 
issuance of a security clearance, reporting of an investigation of an 
employee, the letting of a contract, or the issuance or continuance of 
a license, grant or other benefit given by that agency to the extent 
that the information is relevant and necessary to the requesting 
agency's decision on the matter.
    VA must be able to provide information to agencies conducting 
background checks on applicants for employment or licensure.
    11. Disclosure of information may be made to the next-of-kin and/or 
the person(s) with whom the patient has a meaningful relationship to 
the extent necessary and on a need-to-know basis consistent with good 
medical-ethical practices.
    12. On its own initiative, VA may disclose information, except for 
the names and home addresses of veterans and their dependents, to a 
Federal, State, local, tribal or foreign agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto. On its 
own initiative, VA may also disclose the names and addresses of 
veterans and their dependents to a Federal agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto.
    VA must be able to comply with the requirements of agencies charged 
with enforcing the law and conducting investigations. VA must also be 
able to provide information to State or local agencies charged with 
protecting the public health as set forth in State law.
    13. Disclosure of relevant information may be made to a non-VA 
physician or medical facility staff caring for a veteran for the 
purpose of providing relevant clinical information in an urgent or 
emergent situation.

III. Compatibility of the Proposed Routine Uses

    The Privacy Act permits VA to disclose information about 
individuals without their consent for a routine use when the 
information will be used for a purpose that is compatible with the 
purpose for which VA collected the information. In all of the routine 
use disclosures described above, the recipient of the information will 
use the information in connection with a matter relating to one of VA's 
programs, will use the information to provide a benefit to VA, or where 
disclosure is required by law.
    A ``Report of New System'' and an advance copy of the new system 
notice have been sent to the appropriate Congressional committees and 
the Director of the Office of Management and Budget (OMB) as required 
by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 
77677), December 12, 2000.

    Approved: September 25, 2002.
Anthony J. Principi,
Secretary of Veterans Affairs.
113VA112

SYSTEM NAME:
    Telephone Care and Service Records--VA.

SYSTEM LOCATION:
    Records are located at each Call Center, which are operated at VA 
health care facilities or at contractor locations. Address locations 
for VA facilities are listed in VA Appendix 1 of the biennial 
publication of VA Privacy Act Issuances. In addition, information from 
clinical symptom calls is maintained in the patient's medical record at 
VA health care facilities and at the Department of Veterans Affairs 
(VA), 810 Vermont Avenue, NW., Washington, DC; Veterans Integrated 
Service Network Offices (VISNs); and Employee Education Systems.

Categories of individuals covered by the system:
    The records include information concerning individual enrolled 
patients.

Categories of records in the system:
    The records may include information related to:
    1. Clinical care such as clinical symptoms, questions asked about 
symptoms, answers received, clinical protocol used and advice provided. 
It might include doctors' orders for patient care including nursing 
care, current medications, including their scheduling and delivery, 
consultations, radiology, laboratory and other diagnostic and 
therapeutic examinations and results; clinical protocol and other 
reference materials; education provided, including title of education 
material and reports of contact with individuals or groups. It includes 
information related to the patient's or family member's understanding 
of the advice given and their plan of action and, sometimes, the 
effectiveness of those actions.
    2. Record of all calls made to the Call Center, including caller 
questions about medications, their uses and side effects; requests for 
renewals of prescriptions, appointment changes, benefits information 
and the actions taken related to each call, including the notification 
of providers and other staffs about the call.
    3. Contact information from private sector medical facilities or 
clinicians contacting the VA about issues such as enrolled veterans' 
visits to an emergency department or admissions to a community medical 
center.

Authority for maintenance of the system:
    Title 38, United States Code, section 501.

PURPOSE(S):
    The purpose of these records is to provide clinical and 
administrative support to patient care and provide medical and 
administrative documentation of the care and/or services provided in 
Call Centers. The records may be used for such purposes as improving 
Call Center staff's ability to provide telephone care services to 
veterans and the quality of the service by having immediate access to 
records of calls made previously by the veteran. Records may be used 
for purposes of notifying VA providers of the patient's condition and 
status, the criteria used to judge the status of the patient and/or the 
information given to the external provider on follow-up steps that they 
must take to receive authorization for the care.
    Records may be used to assess and improve the quality of the 
services provided through telephone care services and to produce 
various management and patient follow-up reports. Records may be used 
to respond to patient, family and other inquiries, including at times 
non-VA clinicians and Joint Commission for Accreditation of Healthcare 
Organizations (JCAHO) or the Utilization Review Accreditation 
Commission (URAC) for the accreditation of a Call Center or facility. 
Records may also be used to conduct health care related studies, 
statistical analysis, and resource allocation planning using data that 
has been stripped of individual patient identifiers. The clinical 
information is integrated into the patient's overall medical record, 
into quality improvement plans, and activities of the facility, such as 
utilization review and risk management. They are also used to improve 
Call Center services, such as patient education, the improved 
integration of clinical care, the provision of telephone care services, 
and communication.

[[Page 63501]]

Routine uses of records maintained in the system, including categories 
of users and the purposes of such uses:
    Information contained in the record system may include information 
protected by 38 U.S.C. 7332, i.e., medical treatment information 
related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia 
or infection with the human immunodeficiency virus, that cannot be 
disclosed under a routine use unless there is also specific statutory 
authority permitting disclosure.
    1. Disclosure may be made to a member of Congress or staff person 
acting for the member when the member or staff person requests the 
records on behalf of and at the request of that individual.
    2. Disclosure may be made to the Department of Justice and United 
States Attorneys in defense or prosecution of litigation involving the 
United States, and to Federal agencies upon their request in connection 
with review of administrative tort claims filed under the Federal Tort 
Claims Act, 28 U.S.C. 2672.
    3. Disclosure may be made to a Federal agency or to a State or 
local government licensing board and/or to the Federation of State 
Medical Boards or a similar nongovernment entity which maintains 
records concerning individual's employment histories or concerning the 
issuance, retention or revocation of licenses, certifications, or 
registration necessary to practice an occupation, profession or 
specialty, in order for the Department to obtain information relevant 
to a Department decision concerning the hiring, retention or 
termination of an employee or to inform a Federal agency or licensing 
boards or the appropriate nongovernment entities about the health care 
practices of a terminated, resigned or retired health care employee 
whose professional health care activity so significantly failed to 
conform to generally accepted standards of professional medical 
practice as to raise reasonable concern for the health and safety of 
patients receiving medical care in the private sector or from another 
Federal agency. These records may also be disclosed as part of an 
ongoing computer matching program to accomplish these purposes.
    4. Disclosure may be made for program review purposes and the 
seeking of accreditation and/or certification, disclosure may be made 
to survey teams of the Joint Commission on Accreditation of Healthcare 
Organizations, College of American Pathologists, American Association 
of Blood Banks, and similar national accreditation agencies or boards 
with whom VA has a contract or agreement to conduct such reviews, but 
only to the extent that the information is necessary and relevant to 
the review.
    5. Disclosure may be made to a State or local government entity or 
national certifying body which has the authority to make decisions 
concerning the issuance, retention or revocation of licenses, 
certifications or registrations required to practice a health care 
profession, when requested in writing by an investigator or supervisory 
official of the licensing entity or national certifying body for the 
purpose of making a decision concerning the issuance, retention or 
revocation of the license, certification or registration of a named 
health care professional.
    6. Disclosure may be made to the National Practitioner Data Bank at 
the time of hiring and/or clinical privileging/reprivileging of health 
care practitioners, and other times as deemed necessary by VA.
    7. Disclosure may be made to the National Practitioner Data Bank 
and/or State Licensing Board in the State(s) in which a practitioner is 
licensed, in which the VA facility is located, and/or in which an act 
or omission occurred upon which a medical malpractice claim was based 
when VA reports information concerning: (1) Any payment for the benefit 
of a physician, dentist, or other licensed health care practitioner 
which was made as the result of a settlement or judgment of a claim of 
medical malpractice if an appropriate determination is made in 
accordance with agency policy that payment was related to substandard 
care, professional incompetence or professional misconduct on the part 
of the individual; (2) a final decision which relates to possible 
incompetence or improper professional conduct that adversely affects 
the clinical privileges of a physician or dentist for a period longer 
than 30 days; or, (3) the acceptance of the surrender of clinical 
privileges or any restriction of such privileges by a physician or 
dentist either while under investigation by the health care entity 
relating to possible incompetence or improper professional conduct, or 
in return for not conducting such an investigation or proceeding. These 
records may also be disclosed as part of a computer matching program to 
accomplish these purposes.
    8. Disclosure of information related to the performance of a health 
care student or provider may be made to a medical or nursing school or 
other health care related training institution or other facility with 
which there is an affiliation, sharing agreement, contract or similar 
arrangement when the student or provider is enrolled at or employed by 
the school or training institution or other facility and the 
information is needed for personnel management, rating and/or 
evaluation purposes.
    9. Disclosure of relevant information may be made to individuals, 
organizations, private or public agencies, etc., with whom VA has a 
contract or agreement to perform such services as VA may deem 
practicable for the purposes of laws administered by VA, in order for 
the contractor or subcontractor to perform the services of the contract 
or agreement.
    10. Disclosure may be made to a Federal agency, in response to its 
request, in connection with the hiring or retention of an employee, the 
issuance of a security clearance, reporting of an investigation of an 
employee, the letting of a contract, or the issuance or continuance of 
a license, grant or other benefit given by that agency to the extent 
that the information is relevant and necessary to the requesting 
agency's decision on the matter.
    11. Disclosure of information may be made to the next-of-kin and/or 
the person(s) with whom the patient has a meaningful relationship to 
the extent necessary and on a need-to-know basis consistent with good 
medical-ethical practices.
    12. On its own initiative, VA may disclose information, except for 
the names and home addresses of veterans and their dependents, to a 
Federal, State, local, tribal or foreign agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto. On its 
own initiative, VA may also disclose the names and addresses of 
veterans and their dependents to a Federal agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto.
    13. Disclosure of relevant information may be made to a non-VA 
physician or medical facility staff caring for a veteran for the 
purpose of providing relevant clinical information in an urgent or 
emergent situation.

Policies and practices for storing, retrieving, accessing, retaining, 
and disposing of records in the system:
Storage:
    Records are maintained on paper and automated storage media, such 
as

[[Page 63502]]

magnetic tape, disc or laser optical medial.

Retrievability:
    Records are retrieved by name, social security number or other 
assigned identifier of the enrolled veteran who is calling or about 
whom the call is being made.

Safeguards:
    1. Access to patient-specific information located in Call Center 
databases and storage areas is restricted to VA employees and contract 
personnel on a ``need-to-know'' basis; strict control measures are 
enforced to ensure that disclosure to these individuals is also based 
on this same principle. Generally, VA Call Center file areas are locked 
after normal duty hours or when the Call Center is closed, and the 
facilities are protected from outside access by the Federal Protective 
Service or other security personnel.
    2. Access to VA and contracted Call Centers and computer rooms is 
generally limited by appropriate locking devices and restricted to 
authorized VA employees and vendor personnel. ADP peripheral devices 
are placed in secure areas (areas that are locked or have limited 
access) or are otherwise protected. Information in the Veterans Health 
Information Systems and Technology Architecture (VistA) may be accessed 
by authorized VA employees or authorized contract employees. Access to 
file information is controlled at two levels; the systems recognize 
authorized employees or contract employees by a series of individually 
unique passwords/codes as a part of each data message, and personnel 
are limited to only that information in the file which is needed in the 
performance of their official duties. Information that is downloaded 
from VistA and maintained on VA or contract personal computers is 
afforded similar storage and access protections as the data that is 
maintained in the original files. Access to information stored on 
automated storage media at other VA and contract locations is 
controlled by individually unique passwords/codes.
    3. Remote access to VHA information in VistA is provided to those 
Call Center employees, either VA or contract staff, that require access 
to information stored in the medical record. Access to this information 
is protected through hardened user access and is controlled by 
individual unique passwords. Additionally, contracted Call Centers, 
either VA or private sector, are required to have a separate computer 
security plan that meets national information security requirements.

Retention and disposal:
    Records are to be disposed of in accordance with the Veterans 
Health Administration Records Control Schedule; 10-1. Paper records and 
information stored on electronic storage media are maintained and 
disposed of in accordance with the records disposition authority 
approved by the Archivist of the United States.

System manager(S) and address:
    Official responsible for policies and procedures: Chief Consultant 
for Primary and Ambulatory Care (112), Department of Veterans Affairs, 
810 Vermont Avenue, NW, Washington, DC 20420. Officials maintaining the 
system: Network and/or facility director at the Network and/or facility 
where the individuals are associated.

Notification procedure:
    Individuals who wish to determine whether a record is being 
maintained in this system under his or her name or other personal 
identifier, or wants to determine the contents of such record, should 
submit a written request or apply in person to the last VA health care 
facility where care was rendered. Addresses of VA health care 
facilities may be found in VA Appendix 1 at the end of this document. 
Inquiries should include the person's full name, social security 
number, dates of employment, date(s) of contact, and return address.

Record access procedure:
    Individuals seeking information regarding access to and contesting 
of records in this system may write or visit the VA facility location 
where they normally receive their care.

Contesting record procedures:
    (See Record Access Procedures above.)

Record source categories:
    Record sources include: enrolled patients, patients' families and 
friends, private medical facilities and their clinical and 
administrative staffs, health care professionals, Patient Medical 
Records-VA (24VA136), VistA (79VA19), VA health care providers, and 
Call Center nurses and administrative staff.

[FR Doc. 02-25996 Filed 10-10-02; 8:45 am]
BILLING CODE 8320-01-P